Raceo Run

Security

Last updated: August 1, 2026

Raceo Run handles registration data for skaters, clubs, and event organizers. Keeping that data safe is a baseline requirement, not a feature. This page describes how the platform is built and operated.

Infrastructure

  • The platform runs on Google Cloud Platform in the asia-east1 (Taiwan) region — data is hosted in Taiwan, close to our users.
  • The API runs on serverless containers (Cloud Run); the database is a managed relational database (Cloud SQL).
  • All traffic passes through Cloudflare's global edge network, which provides DDoS mitigation and caching.
  • Infrastructure is managed as code (Terraform), so every environment change is reviewed and versioned.

Encryption

  • All connections are encrypted in transit with TLS; plain HTTP is not served.
  • Data is encrypted at rest by default on Google Cloud, covering the database and file storage.

Access Control

  • Organizer tools live in a separate management console with role-based permissions; skater-facing pages never expose management capabilities.
  • Authentication uses token-based sessions over HTTPS.
  • Deployments and infrastructure changes use dedicated least-privilege service accounts — no shared credentials, no long-lived keys in code.

Environment Isolation

  • Testing and production are fully separated: independent databases, independent file storage buckets, and independently scoped access keys.

Secrets Management

  • Application secrets are stored in a managed secret store and injected at runtime — they are never baked into source code or container images.

Backups and Availability

  • The managed database has automated backups.
  • The serverless architecture scales automatically with load, including registration-day traffic spikes.

Payments

The platform does not store payment card data. Registration fees are collected according to each competition's regulations.

Responsible Disclosure

If you believe you have found a security issue, please report it to contact@ori.vision. We appreciate responsible disclosure and will respond as quickly as we can.