Last Updated: February 2, 2026

1. Our Security Commitment

Security is a fundamental part of the beIN90 platform.

beIN90 provides cloud-based software for football clubs, academies and sports organizations that may process sensitive operational, personal, financial, player, employee, performance, video and organizational information.

We design our Services with the objective of protecting Customer Data against unauthorized access, unauthorized disclosure, alteration, loss and destruction.

Security is treated as an ongoing process rather than a single product, certification or technical control.

2. Customer Data Isolation

beIN90 operates as a multi-organization SaaS platform.

Customer organizations are logically separated within the application.

Authorization decisions are associated with the authenticated user, organization membership, role, permissions and requested resource.

A user authorized for Organization A is not authorized to access Customer Data belonging to Organization B.

Organization boundaries are treated as a core security requirement across application functionality.

This principle applies, as applicable, to:

1. player records;
2. staff records;
3. teams;
4. attendance;
5. training information;
6. documents;
7. financial records;
8. inventory;
9. facilities;
10. videos;
11. images;
12. reports;
13. analytics;
14. AI functionality;
15. exports;
16. notifications;
17. integrations.

3. Authentication

beIN90 uses authentication controls designed to ensure that users can access only accounts and organizations for which they are authorized.

Security controls may include:

1. password-based authentication;
2. protected credential storage;
3. session management;
4. account verification;
5. authentication controls;
6. password reset controls;
7. session expiration;
8. administrative access controls.

Where available, additional authentication mechanisms may be enabled according to the customer's subscription and configuration.

4. Authorization and Role-Based Access

Authentication alone does not grant access to Customer Data.

beIN90 uses authorization mechanisms to determine what an authenticated user is permitted to access or perform.

Permissions may be based on:

1. organization;
2. role;
3. module;
4. resource;
5. action;
6. administrative privileges.

Examples of permissions may include:

1. viewing;
2. creating;
3. editing;
4. deleting;
5. exporting;
6. approving;
7. managing users;
8. managing financial information;
9. managing documents.

Authorization is intended to follow the principle of least privilege.

5. Administrative Access

Administrative access to production systems is restricted to authorized personnel who require such access for legitimate business or technical purposes.

Administrative access may be subject to:

1. authentication controls;
2. access approval;
3. least-privilege principles;
4. logging;
5. monitoring;
6. periodic review.

beIN90 does not provide employees with unrestricted access to all customer information merely because they are employees.

Where operational access is required, it should be limited to the minimum scope reasonably necessary to perform the relevant task.

6. Encryption

beIN90 uses encryption and secure communication mechanisms appropriate to the systems and data involved.

Data transmitted between users and beIN90 services should be protected using encrypted communication protocols such as HTTPS/TLS.

Where supported by the underlying infrastructure, sensitive information stored in databases, storage systems and backups may be protected through encryption at rest.

Specific cryptographic technologies may change as the platform evolves.

7. Infrastructure Security

beIN90 uses cloud and infrastructure services to operate its platform.

Infrastructure security may include:

1. network access controls;
2. firewall controls;
3. restricted administrative access;
4. operating-system security;
5. secure configuration;
6. patch management;
7. monitoring;
8. backups;
9. infrastructure logging;
10. controlled deployment processes.

Third-party infrastructure providers are selected based on business, technical and security requirements appropriate to the services they provide.

8. Application Security

beIN90 follows secure software development principles intended to reduce application security risks.

Security considerations may include:

1. server-side authorization;
2. input validation;
3. authentication controls;
4. session security;
5. access control;
6. secure API design;
7. dependency management;
8. secrets management;
9. logging;
10. error handling;
11. secure deployment practices.

Security requirements are considered during feature development and system changes.

9. API Security

beIN90 APIs are designed to enforce authentication and authorization controls before protected resources are returned or modified.

API security controls may include:

1. authenticated requests;
2. authorization checks;
3. organization-level access checks;
4. input validation;
5. rate limiting where appropriate;
6. request logging;
7. protection of sensitive endpoints.

A successful authentication event does not by itself authorize access to resources belonging to another organization.

10. Data Access Controls

Access to Customer Data is controlled according to authorization requirements.

beIN90 seeks to prevent unauthorized access through:

1. organization boundaries;
2. role-based permissions;
3. administrative access restrictions;
4. authentication;
5. audit logging;
6. operational controls.

Access rights should be removed or modified when personnel no longer require them.

11. Logging and Auditability

beIN90 maintains logs and security events appropriate to the operation and security of the Services.

Depending on the system, logs may include:

1. authentication events;
2. authorization events;
3. administrative actions;
4. security events;
5. system errors;
6. service activity;
7. changes to important resources.

Logs are used for troubleshooting, security monitoring, incident investigation and operational accountability.

Security logs may be retained for a period determined by operational, legal and security requirements.

12. Monitoring

beIN90 monitors its infrastructure and Services to identify:

1. service failures;
2. abnormal behavior;
3. security events;
4. infrastructure problems;
5. availability issues.

Monitoring and alerting are continuously improved as the platform evolves.

13. Vulnerability Management

beIN90 seeks to identify and address vulnerabilities affecting its application, dependencies and infrastructure.

Security activities may include:

1. dependency updates;
2. vulnerability scanning;
3. security reviews;
4. patch management;
5. code review;
6. infrastructure updates;
7. penetration testing where appropriate.

The severity and remediation priority of a vulnerability may depend on its potential impact, exploitability and affected systems.

14. Secrets and Credentials

Production credentials, API keys, access tokens and other secrets should not be stored in source-code repositories.

Secrets are managed using controlled mechanisms appropriate to the environment.

Access to secrets is restricted according to operational requirements.

15. Backups and Recovery

beIN90 maintains backup and recovery mechanisms designed to support restoration of Services and Customer Data following technical or operational incidents.

Backup procedures may include:

1. automated backups;
2. backup retention;
3. restricted backup access;
4. monitoring;
5. restoration procedures;
6. disaster-recovery procedures.

Backups may remain for a limited period after Customer Data is removed from production systems.

16. Availability and Resilience

beIN90 seeks to maintain the availability and resilience of its Services through:

1. infrastructure monitoring;
2. backups;
3. fault recovery;
4. controlled deployments;
5. incident response;
6. operational monitoring.

Specific uptime commitments, recovery time objectives and recovery point objectives may be defined in applicable customer agreements or Service Level Agreements.

17. Secure Development Lifecycle

Security is incorporated into software development processes where appropriate.

Development controls may include:

1. source-code access control;
2. code review;
3. dependency management;
4. environment separation;
5. controlled deployments;
6. testing;
7. security review of material changes.

Development and production environments should be appropriately separated.

18. Third-Party Providers

beIN90 may rely on specialized providers for:

1. cloud infrastructure;
2. storage;
3. email;
4. payments;
5. monitoring;
6. analytics;
7. security;
8. AI;
9. customer support.

Third-party providers that process Customer Data on behalf of beIN90 are evaluated and governed according to applicable contractual and security requirements.

19. AI Security and Customer Data

AI functionality may process Customer Data when necessary to provide a feature requested by a customer.

beIN90's security and privacy principles apply to AI-related processing.

Customer Data is not intentionally exposed to another customer through AI features.

beIN90 does not intentionally use one customer's confidential information to generate customer-specific information for another customer.

Where third-party AI providers are used, appropriate technical and contractual controls should be applied.

20. Video and Sports Analytics Security

Video and sports-analysis systems may process large files and derived information.

Security controls may include:

1. authenticated upload;
2. organization-level access control;
3. protected storage;
4. restricted download;
5. access logging;
6. controlled processing;
7. deletion according to applicable retention rules.

Video-derived information is treated as Customer Data when submitted or generated on behalf of a customer organization.

21. Incident Response

beIN90 maintains procedures for responding to security incidents.

Incident response may include:

1. detection;
2. initial assessment;
3. containment;
4. investigation;
5. remediation;
6. recovery;
7. notification where required;
8. post-incident review.

Where a security incident involving Customer Data triggers a contractual or legal notification requirement, beIN90 will provide notification in accordance with applicable law and the applicable customer agreement.

22. Security Breach Notification

If beIN90 determines that a confirmed security incident has affected Customer Data and notification is legally or contractually required, beIN90 will notify the appropriate customer contact without undue delay in accordance with the applicable requirements.

Notifications may include available information regarding:

1. the nature of the incident;
2. affected systems;
3. affected data;
4. known or expected impact;
5. containment actions;
6. remediation actions;
7. recommended customer actions.

23. Employee Security

Personnel with access to systems or Customer Data are expected to follow applicable security and confidentiality requirements.

Security practices may include:

1. confidentiality obligations;
2. access controls;
3. onboarding and offboarding procedures;
4. security awareness;
5. least-privilege access;
6. access reviews.

24. Confidentiality

beIN90 treats Customer Data as confidential information.

beIN90 does not sell Customer Data to other football clubs, academies or organizations.

Customer Data is not intentionally provided to another customer for that customer's independent commercial use.

25. Security Testing

beIN90 intends to continuously improve its security program through appropriate testing and assessment.

Testing may include:

1. vulnerability assessments;
2. dependency scanning;
3. security reviews;
4. penetration testing;
5. access reviews;
6. configuration reviews;
7. backup restoration tests.

The frequency and scope of testing may depend on risk and the maturity of the applicable system.

26. Security Certifications

beIN90 will publish applicable independent certifications or audit reports when they have been formally obtained.

Examples may include:

1. ISO/IEC 27001;
2. SOC 2;
3. ISO/IEC 27701;
4. other applicable certifications or independent assessments.

Until such certifications are formally obtained, beIN90 does not represent itself as certified.

27. Customer Security Responsibilities

Security is a shared responsibility.

Customers are responsible for:

1. protecting account credentials;
2. assigning appropriate user roles;
3. removing users who no longer require access;
4. configuring permissions appropriately;
5. protecting administrator accounts;
6. uploading information only when legally permitted;
7. obtaining required permissions for player, parent, employee, image and video data;
8. promptly reporting suspected security incidents.

28. Responsible Disclosure

Security researchers who believe they have identified a vulnerability in beIN90 are encouraged to report it responsibly.

Reports should include:

1. affected service;
2. description of the issue;
3. steps required to reproduce it;
4. potential impact;
5. relevant evidence.

Security reports should be sent to: [email protected]

Please do not access, modify, delete or disclose another customer's information while investigating a suspected vulnerability.

29. Continuous Improvement

Security is continuously reviewed as the beIN90 platform, infrastructure, customer requirements and threat landscape evolve.

Controls described in this Security Policy may be updated as beIN90 improves its security program.

30. Contact

For security-related questions or vulnerability reports:

beIN90 Security Team

Email: [email protected]

Security Policy Version: 1.0

Last Updated: February 2, 2026