Built like infrastructure.

Tenant isolation, enforced twice

A static-analysis rule fails the build on any unscoped query against tenant data; a runtime check verifies every request was authorized and every index was policy-scoped.

Authorization on every request

Pundit on every action, with a pinned, tested list of the only public endpoints — a cop forbids skipping authorization for a whole controller.

Audited impersonation

Support can act as an organizer to help — every action records both the true and acted-as user.

Secure auth & session hygiene

Bcrypt passwords, password reset, and a background job that purges idle sessions.

Privacy-safe logs

Structured event logs carry ids, never emails or tokens; tokens in URLs are masked before they reach a log.

Security scanning & dependency audits on every change

A security scan and a gem/JS dependency audit run in the same gate as the tests — a known vulnerability fails the build, not a monthly report.

Encryption for sensitive fields

Medical notes and emergency-contact data encrypted at the field level, not just at rest.

Two-factor authentication for organizer accounts

Optional, then required, 2FA for the accounts that can move money and message a whole race field.

Periodic third-party penetration testing

An outside team probing for what internal review misses, on a recurring cadence.

Capacity enforced at the database

A distance sells exactly its capacity — the database itself refuses the spot past the last one, so hundreds of simultaneous checkouts can never oversell.

Idempotent payments

Every charge carries an idempotency key — a retried request or a dropped connection never charges a runner twice.

Retries with backoff

Background work retries on failure with backoff instead of failing silently or hammering a provider that is already struggling.

Queued work off the request path

Confirmation emails, receipts and webhooks run on Solid Queue, so a runner's checkout returns the moment payment is confirmed.

Real-time without polling

Turbo Streams over WebSockets push updates to every open screen instead of every client polling for them.

Horizontal scaling

Stateless application servers scale out behind a load balancer ahead of a big opening, and back in afterward.

Load testing before big openings

Registration-open traffic rehearsed against production-sized infrastructure before it happens for real.

Zero-downtime deploys

A release rolls out without dropping a checkout or a live race-day session mid-request.

Failover

A standby database and application capacity take over if the primary fails, with a target measured in minutes.

Error tracking with alerts

Every exception reaches Sentry with context, not a silent 500.

Structured logs

Every request and background job logs in a consistent, queryable shape.

Browser tests of the full race-season walkthrough

System tests drive a real browser through registration, lottery, race day and results, not just unit tests of the pieces.

Performance monitoring

Response times and slow queries tracked continuously, not discovered from a complaint.

Alerting on symptoms, not noise

Alerts fire on what runners feel — failed checkouts, slow pages, a growing queue — and page a person, not an inbox.

One container-deployed application

Jobs, cache and real-time all run alongside the database — no separate systems to patch, monitor and keep compatible.

Schema & theme drift checks

The gate fails if the database schema or the design tokens drift from what's checked in.

Dependency upgrades as routine

Audited on every change, so upgrading is a small, frequent decision instead of a once-a-year project.

Automated backups with point-in-time recovery

Continuous backups that can restore to any recent moment, not just last night.

Restore drills

Recovery tested on a schedule, so the first real restore isn't also the first attempt.

Multi-region failover

Once scale calls for it — resilience beyond a single region.

Stripe Connect, one account per organization

Each organization's revenue lands in its own connected Stripe account, not a shared pool.

Card data never touches Trailmark

Stripe-hosted checkout keeps PCI scope minimal — Trailmark never sees or stores a card number.

Destination charges with application fees

The platform fee is taken automatically at the moment of charge, not reconciled after the fact.

Refunds, partial refunds, coupons and credits as a ledger

Every adjustment to what a runner paid is a ledger entry, auditable after the season is over.

Payouts

Real money landing in an organizer's own bank account, on a schedule they can see.

Disputes & chargebacks handled

A structured process for the moment a cardholder disputes a charge, not an email nobody sees.

Native iOS & Android, from the same screens

Hotwire Native wraps the existing server-rendered screens — nothing to rebuild twice.

Push notifications

A race-day alert reaches a phone's lock screen, not just an open tab.

Offline-tolerant race-day views

Built to keep working through the weak signal at an aid station, not just a strong wifi bar.

Automated customer support

Athlete and organizer tickets auto-categorised, answered from each race's own guide, and escalated with SLA timers when a person is needed.

Status page & incident communication

One public page for every component, updated during an incident, with a postmortem afterward.

On-call rotation

A primary, a secondary and an escalation path once real races depend on this running.

Audit logs

Impersonation and actor columns record who really acted and on whose behalf; a full audit trail of sensitive actions follows in Phase 2.

Role-based access, least privilege

Organization roles and a policy on every request mean each person sees only what their job needs; a medical-only role follows with race day.

Data retention & deletion requests

Clear retention periods, and a runner's request to export or delete their data handled end to end.

Fraud & chargeback handling

Suspicious payments flagged before payout, and disputes answered with the evidence already attached.

Abuse & rate limiting on registration

Bots and scripted checkouts throttled, so real runners get the spots on opening day.

Patching cadence

Dependencies and security advisories audited on every change and upgraded on a routine, not an emergency.

Observability dashboards

Uptime, latency, error rate and queue depth on one screen, with history to compare openings year over year.

Releases behind feature flags

New work ships dark, turns on for one organization first, and turns off in seconds if it misbehaves.

Disaster-recovery drills

Restores and failovers rehearsed on a schedule, so the first real one isn't the first attempt.

Automated WCAG AA contrast gate

Every colour pair in the design system is checked for contrast on every change, in both themes.

Light and dark themes

A full theme pair, not a dark mode bolted on afterward.

Tablet-first operator screens

The design system's layouts are built tablet-first for race day, where a laptop doesn't fit on the table.

Locale-aware formatting, translation-ready

Dates, numbers and currency follow the runner's language; this prototype already switches between English, Spanish, French and German.