Every academy's data, encrypted and isolated
Academies trust us with their students' records and payments. Here is exactly how we protect them — in plain language, without buzzwords.
Encrypted in transit, secrets encrypted at rest
Data is protected on its way to our servers, and sensitive credentials are never stored in readable form.
HTTPS/TLS everywhere
Every connection to the app, the parent app, public pages and our APIs is encrypted with TLS — including custom academy domains.
AES-256-GCM for secrets
Integration credentials, such as WhatsApp Business access tokens, are encrypted with AES-256-GCM before they are saved, and are never shown back in full.
Passwords we cannot read
Passwords are stored only as salted bcrypt hashes with a high work factor. Not even our team can see them.
Your academy is a vault — only your people hold the key
Every record belongs to one academy, and every request is checked against who is asking.
Strict tenant isolation
Every record is tied to one academy. Queries are scoped to your academy on the server, and automated tests check that one academy can never read another's data.
Role-based access
Owners, admins, branch managers, coaches and parents each see only the screens and records their role needs. Parents see only their own children.
Audit logs
Changes to fees, grading results and student records are logged with who made them and when, so every sensitive change is traceable.
Hardened sign-in
One-time passwords by email and WhatsApp verify accounts, sign-in attempts are rate-limited, sessions expire automatically, and secure HTTP headers protect the app.
Platform staff kept out of student data
Our own platform administrators manage plans and billing, but are blocked from viewing academies' student personal data.
Cloud hosted
Kreeda runs on managed cloud infrastructure with the app, database and files kept separate, and access restricted to authorised systems.
A smart assistant that respects your boundaries
Kreeda's assistant helps owners and coaches find answers in their own academy data — quickly and safely.
Answers come only from your own academy's data — never another academy's. The assistant follows the same role permissions as the person asking. Every assistant request is recorded in an audit log. Your data is never sold or used to train public AI models.
Payment security
Checkout is hosted by our RBI-authorised payment partner — we never see card numbers, CVVs or UPI PINs. Every payment confirmation is verified with an HMAC-SHA256 signature before an invoice is marked as paid. Each transaction is processed exactly once, so duplicate notifications can never be double-counted. Academy fees are settled directly to the academy's own bank account.
Privacy by default for children
Children's profiles are created by academies with parental consent. Digital sports passports stay private until the academy or a parent shares them. No advertising, no tracking cookies and no selling of personal data. Built to align with India's Digital Personal Data Protection Act, 2023.
Found a security issue?
We welcome responsible disclosure. Email support[AT]kreedasportsacademy[dot]com with the subject "Security report" and the steps to reproduce it. Please do not access other users' data or disrupt the service while testing. We will acknowledge your report and keep you updated.
Run your academy on a platform built for trust
Set up in minutes on the free plan — no card required. Invite coaches and parents whenever you are ready.