Hudl enables thousands of teams and millions of athletes to get the most out of every moment. One crucial aspect of that mission is keeping those moments—and any personal information—secure.
Hudl’s security program is aligned with the NIST 800-53 and SOC frameworks, which includes a set of policies and procedures that are reviewed and approved annually. Our Security Council, made up of company leaders, meets on a quarterly basis to discuss organizational and technical risks, as well as any changes to laws and regulations that affect business operations.
A key part of our security program is ensuring customer data remains secure and private. We’ve implemented several employee-specific processes to help protect customer data stored within our services.
Hudl services are GDPR-compliant and the following documents can be made available upon request:
Hudl follows a role-based access control (RBAC) scheme, supplemented by the principles of least privilege and need to know. User and group management is centralized using single sign-on where possible. Access to Hudl networks and systems is restricted to Hudl personnel through the use of unique user IDs, strong passwords, and multi-factor authentication.
Hudl requires authentication for access to all Hudl resources, except for those intended to be public. By default, customers are required to utilize a unique email address and strong password. Upon request, Hudl can provide additional security options—such as multi-factor authentication or federated single sign-on—for customers that wish to enhance the security around their accounts. Authentication credentials for Hudl services are encrypted in transit, and passwords are salted and hashed using industry standard techniques.
Hudl’s infrastructure is designed to minimize service interruption due to hardware failure, natural disasters or other catastrophes. Hudl maintains business continuity processes including, but not limited to:
These processes are designed to minimize the impact of potential threats to business operations. If an outage occurs, Hudl customers can view updates at https://status.hudl.com.
Due to the nature of a SaaS product and supporting environment, Hudl treats all customer data as sensitive information. Therefore, all data that is processed by, transmitted to or from, and stored within Hudl services is encrypted using the latest industry standards.
Data stored within Hudl services is only accessible by authorized users, unless it has been made public by a customer. Hudl retains customer data for the length of the service agreement with Hudl, as defined in the customer’s contract. Upon request, Hudl will securely erase or destroy all media that contains customer data using industry-standard procedures, such as NIST SP 800-88.
Hudl employs a defense-in-depth strategy for endpoint security that’s designed to block access to known malicious sites and applications, as well as monitor for indicators of compromise. All endpoints are:
Hudl has implemented formal processes for monitoring the security and availability of its services. All systems generate security and operational logs, which are forwarded to a centralized logging system and monitored for anomalous activity. Alerts are configured to notify appropriate teams to take action according to standard procedures.
In the event of a suspected incident and reasonably suspected breach, Hudl will use commercially reasonable efforts to contain, mitigate and resolve the incident, then put in place additional controls to prevent further incidents of a similar type. Hudl will notify customers without undue delay (typically within 72 hours or sooner), once an incident has been confirmed.
Hudl employs a defense-in-depth, zero-trust aligned strategy for network security that includes:
Hudl’s follows an Agile Scrum software development lifecycle (SDLC), which enables continuous monitoring and improvements for Hudl services using applicable OWASP standards. Our SDLC includes the following activities intended to foster security:
Hudl follows a risk-based methodology leveraging relevant industry standards, such as CVSS, to prioritize vulnerabilities based on their impact severity and likelihood of exploitation. Hudl aims to release patches or remediate an issue in a reasonable period of time commensurate with the results of the associated risk assessment. Generally, higher impact issues will be prioritized and fixed sooner than lower impact issues. However, the exact amount of time required to fix a vulnerability is unique to each finding and depends on a set of factors, including: the complexity of the issue, the number of components impacted, and any third party dependencies.
Hudl subscribes to notification channels for its vendors, as well as industry feeds for vulnerabilities. Hudl also regularly engages qualified third parties to perform independent assessments of source code, products and infrastructure.
