What should performance analysts expect from professional sports software?

Modern tools have made it easier than ever to build and launch sports apps. As a result, apps can reach performance analysts even when the people behind them lack experience building software for professional environments. An app can be up and running while its builders have skipped key decisions about security, reliability and data integrity.

At VectorPitch, we take those foundations seriously. Our founders have spent 15–20 years working in sport and sports software, and even longer in design and engineering. They know how to build robust software for professional use.

That experience shapes what analysts should expect from professional sports software: dependable match-week performance, verifiable security and usable control over club data.

Questions to ask about your software

Before you trust a sports platform, ask questions that expose the experience behind it, the controls protecting your club and the evidence supporting the provider’s claims.

Who built it and how it is checked

• Who is accountable for the product’s architecture, security and reliability?
• What have the people building and operating it previously designed and supported in professional sport or at comparable scale?
• How are important engineering decisions reviewed, tested and revisited as the product changes?

Who can see your data

• How is club data kept separate from other clubs, and protected while moving between systems and while stored?
• Can access be limited by role, strengthened with multi-factor authentication and audited? Can the club revoke access immediately when staff leave?
• How does the provider find, prioritise and fix security weaknesses, and how quickly will the club be told about an incident affecting its data?

What happens to your video and tags

• What checks prevent video, tags and reports from being lost, duplicated or silently changed during upload, processing, editing or export?
• Can the club trace changes to analysis records and verify that exported data is complete and usable elsewhere?
• How often are backups tested by restoring them? How much recent data could be lost, and how quickly would service be restored?
• At contract end, can the club export its video, tags and associated metadata, then have data deleted from active systems and backups? What evidence is provided?

Ask for evidence: a walkthrough using a full match file, results of security and recovery testing, and clear documentation on how data is handled.

What VectorPitch can show today

Engineering

VectorPitch is led by its founders, who bring 15–20 years of experience working in sport and sports software, and longer experience in design and engineering. They are accountable for the product and engineering work.

The product brings together a browser-based analysis app, an API and dedicated GPU workers for video processing. Code changes are checked through backend unit, integration and security tests, frontend tests, and an automated scan that blocks critical vulnerability findings. Some long-running video jobs can resume from checkpoints, while AWS monitoring raises alerts about service and worker failures.

These controls show how changes are tested and services monitored. We have not yet published who formally reviews architecture decisions or how often they are revisited, and there is no set customer-support response time.

Security and access

Organisations and teams have separate access boundaries. Each request checks the user’s organisation membership and, where relevant, team membership. Roles include viewer, analyst, coach and admin. Users can enable time-based two-factor authentication; access to the VectorPitch admin console requires it.

App traffic is redirected to HTTPS. The database runs in private subnets and is encrypted with a managed KMS key. Video files are held in a non-public S3 bucket with server-side encryption. Organisation administrators can remove a member; membership checks then deny that user access to the organisation, and share links they created for its resources are deactivated.

The platform records user and administrator actions. VectorPitch platform administrators can search and export audit logs, but organisation administrators do not have a searchable audit-log page. Security controls also include automated security tests, a scan that blocks critical vulnerability findings, AWS WAF, GuardDuty, CloudTrail and CloudWatch alerts.

We do not yet have an independent penetration-test schedule, a security certification or a contracted deadline for notifying customers about an incident affecting their data.

Data integrity and control

Analysts can export event and lineup records as CSV or JSONL, and report tables as CSV or Excel. Event exports are organisation-scoped and include confirmed tags linked to matches. Some video-processing jobs can resume from checkpoints. These controls support continuity and defined exports, but no end-to-end checks are documented to detect every lost, duplicated or silently changed video or analysis record.

The organisation data archive includes video metadata and records for matches, players, annotations, clips, comments, event tags and playlists; it excludes source video files and audit logs. An administrator can request the archive through the available endpoint. Its download link lasts one hour, and the archive expires after seven days; a self-service organisation export screen is not currently available.

The database has seven days of automated backups, and noncurrent video objects are retained for 30 days. No restore-test results are documented, so we cannot yet say how much data could be lost or how quickly service could be restored.

Users can export their profile, organisation memberships and up to 1,000 recent login events. An organisation administrator can export a member’s activity or anonymise that member’s data in the organisation; anonymisation also deactivates share links and revokes organisation API keys. A user can request account deletion after leaving all organisations, with a 30-day grace period. A contract-end export and deletion process, and a schedule for deleting backups, are not yet defined.

Before relying on any of these controls, ask the provider to demonstrate a full-match workflow and show exactly what can be exported, restored, audited and deleted.