Six-level role hierarchy
Owner, general manager, manager, coach, analyst, player. Fine-grained permissions plus wildcard scopes mean every screen only renders what the role is cleared to see.
Field-level encryption, role-based access, and audit logging — the primitives behind every screen in Enkelt.ai.
Phone numbers, passport details, salary terms, and payout accounts are encrypted with AES-256-GCM and a per-record IV. Plaintext never lives at rest — not in backups, not in logs, not in support tools.
256-bit key · authenticated encryption · unique IV per record
Every action a coach, manager, or player can take passes through the same auth, audit, and rate-limit layer.
Owner, general manager, manager, coach, analyst, player. Fine-grained permissions plus wildcard scopes mean every screen only renders what the role is cleared to see.
Contract edits, salary changes, role grants, and exports are appended to an immutable audit trail with timestamp and actor identity.
Public and authenticated API routes are guarded by per-key and per-IP limits to absorb abuse without degrading the rest of the platform.
Third-party API keys (Riot, FaceIT, Steam, PandaScore) are encrypted at rest with a separate envelope key, never returned in API responses.
Inbound webhooks from Clerk (Svix) and Stripe are signature-verified on every request, with replay-protection tracking so retried events run exactly once.
Platform admins can step into an organization to investigate issues, but every mutation is blocked while impersonating. Audit log captures who, when, and why.
Enkelt.ai is built in Norway. Your team's data is yours — export it, retain it, or remove it, on your schedule.
We sign a Data Processing Agreement with every organization and process player data under documented lawful bases. The DPA is published — no NDA required.
Export everything your organization stores — rosters, contracts, scrim history, finance ledger — as structured files on demand.
Each data class has a documented retention window with scheduled cleanup. Cancel your subscription and your data is removed on the published schedule.
Players under the age of legal consent require a verified guardian record before profile data, contracts, or contact details are accepted.
Everything that governs how we handle your data lives at a stable URL.
Email our team for the specifics — DPA, sub-processors, encryption design, incident response.