Security Overview

Scope

This describes controls that are implemented in the Bounce Hype application today. We do not list planned or aspirational controls, and we do not claim any certification.

Access control

• Staff and school users must sign in; there are no shared public admin links.
• Access is role-based: owner, school administrator, and event staff each see a different scope.
• Database row-level security enforces access at the data layer, not only in the interface.
• The event-day check-in roster is served by a restricted database function that returns only the fields staff need. Parent contact details and safety or allergy notes are not included in staff roster views.

Payments

• Card details are entered in Stripe-hosted checkout. Bounce Hype does not store full card numbers.
• Payment webhooks are signature-verified before any record is written.
• Financial settlements are locked after they are finalized and cannot be silently edited.

Data handling

• Traffic is encrypted in transit.
• Important administrative actions are written to an audit trail with the acting user.
• Accepted policy versions are stored immutably with a content hash.

Reporting a concern

If you believe you have found a security issue, email info@millersjumptime.com with the details and how to reproduce it. Please do not access or modify other people's data while testing. We will acknowledge reports and respond as quickly as we can.

What we do not claim

We do not claim PCI certification, SOC 2, ISO certification, penetration-test attestation, or a guarantee that the service cannot be breached.