1. Multi-Tenant Isolation via PostgreSQL RLS
Traditional SaaS applications often rely on application-level filtering (e.g. appending WHERE tenant_id = ? to queries). This is notoriously error-prone. In sports science, where contracts, physiological data, and biometric markers carry immense confidentiality risks, application-level checks are insufficient.
In Valdris, data isolation is enforced at the database kernel level using PostgreSQL Row-Level Security (RLS). JWT tokens issued to authenticated users contain signed claims in app_metadata specifying tenant_id and role. Every database transaction sets session variables corresponding to these claims, causing PostgreSQL to automatically filter rows before any result sets can be read or modified.
2. GDPR Article 9 Health Data Masking & Age Gating
Athlete biometric data constitutes special category health data under GDPR Article 9. Different organizational roles have strictly distinct access rights: a medical doctor requires granular heart rate variability (HRV) and recovery telemetry, whereas a tactical head coach should only receive high-level availability status.
I engineered dynamic server-side masking filters that evaluate the requester's role, athlete consent state, and data category before serializing JSON responses. If a non-medical role queries squad records, sensitive biometric markers are stripped from the payload upstream. Furthermore, UTC-anchored age verification triggers and adults-only attestation gates prevent processing and storage of athletic data for individuals under 18 years old.
3. Deterministic Analytics Engine & 28-Day z-Score Baselines
Athletic readiness cannot be computed using arbitrary fixed thresholds because an elite athlete's baseline differs dramatically across training cycles. The Valdris computation engine calculates an individualized 28-day rolling z-score baseline for each athlete across GPS metrics (Catapult format) and daily wellness entries.
The Composite Load Score (CLS) combines normalized acute-to-chronic workload ratios with physiological decision rules. If acute jump-load spikes or acute sleep deficits cross critical standard deviation boundaries, the engine fires deterministic override rules that programmatically cap the overall readiness band—preventing coaches from overtraining compromised athletes.
4. Legal AI Regex Firewall
To assist coaches in reviewing complex squad logs, we integrated Anthropic's Claude SDK to generate natural language squad summaries. However, generating medical advice without medical licensing presents substantial legal risk.
I designed a two-stage pipeline: first, an anonymized fact-extraction layer strips all Personally Identifiable Information (PII). Second, a post-generation regex firewall validates the narrative output. If the model outputs clinical inferences (such as injury diagnoses, prognosis estimations, or definitive return-to-play verdicts), the response is rejected and regenerated under deterministic factual constraints.
5. Automated Testing & Verification Harness
To guarantee zero data bleed between competing sports organizations, I authored extensive test suites using Vitest and Playwright. A specialized automated cross-tenant verification script creates concurrent sessions across distinct tenant accounts, executes simultaneous read and write mutations, and asserts that no record from Tenant A is ever visible to Tenant B under any circumstance.