Security

Raceo Run handles registration data for skaters, clubs, and event organizers. Keeping that data safe is a baseline requirement, not a feature. This page describes how the platform is built and operated.

Infrastructure

• The platform runs on managed cloud infrastructure, with data hosted mainly in Taiwan.
• The application and database run on managed services maintained by the cloud provider.
• All traffic passes through a global edge network, which provides DDoS mitigation and caching.
• Infrastructure is managed as code, so every environment change is reviewed and versioned.

Encryption

• All connections are encrypted in transit with TLS; plain HTTP is not served.
• Data is encrypted at rest, covering the database and file storage.

Access Control

• Organizer tools live in a separate management console with role-based permissions; skater-facing pages never expose management capabilities.
• Authentication uses token-based sessions over HTTPS.
• Deployments and infrastructure changes use dedicated least-privilege service accounts — no shared credentials, no long-lived keys in code.

Environment Isolation

• Testing and production are fully separated: independent databases, independent file storage buckets, and independently scoped access keys.

Secrets Management

• Application secrets are stored in a managed secret store and injected at runtime — they are never baked into source code or container images.

Backups and Availability

• The managed database has automated backups.
• The platform scales automatically with load, including registration-day traffic spikes.

Payments

The platform does not store payment card data. Registration fees are collected according to each competition's regulations.

Responsible Disclosure

If you believe you have found a security issue, please report it to contact@ori.vision. We appreciate responsible disclosure and will respond as quickly as we can.