Tailored Sports Software and Analytics Solutions

Tailored software and analytics solutions for the global sports ecosystem, to improve performance, fan engagement and operations. This page names the systems a club, a venue or a league actually runs, where the data comes from and where it goes, the rules that reach a ticket, a fan account and a payment, what moves the cost, and what to ask any firm bidding for the work, including us.

On this page

• What we build for sports organisations
• Sports analytics, from player metrics to customer analytics software
• The rules a ticket, a fan account and a payment answer to
• How a sports software build runs
• Custom platform or a packaged product, compared
• What drives the cost of sports software
• What to ask before you hire a sports software vendor
• What you receive
• Frequently asked questions
• Related pages

What we build for sports organisations

The service lines above, each in one line, from the store and the turnstile to the transport between venues.

Sports analytics, from player metrics to customer analytics software

The sports analytics card says our analytics platforms capture, process and visualize key data from matches, player metrics and fan engagement. Read against the other cards, that covers two different jobs: performance data for the sporting side, and the fan and buyer data that makes it customer analytics software for the commercial side.

Three of those outputs go by other names outside sport. Conversion optimization and sales analytics on the merchandising line is retail analytics software for a club store. Predictive route and demand analytics on the event transport line is one of the predictive analytics solutions on this page. And the fan engagement data, loyalty and rewards included, is consumer analytics software in everything but the label, which is why the rules below about fan accounts matter to the analytics design as much as to the app.

The rules a ticket, a fan account and a payment answer to

PCI DSS, for tickets, merchandise and concierge payments

Who issues it, and whom it binds. The PCI Security Standards Council, whose stated audience is “Entities that store, process, or transmit cardholder data (CHD) and/or sensitive authentication data (SAD)”, together with entities that could affect the security of the cardholder data environment. Whether a given merchant has to validate, and how, is decided by the acquirer or payment brand rather than by the council.

Where it touches this page. Three cards take payments: ticket sales and secure transactions on the ticketing line, the store on the merchandising line, and the payment systems the concierge line integrates. Where the card form comes from decides which Self-Assessment Questionnaire a design implies; our ecommerce page sets out the three questionnaires side by side.

ADA Title III and WCAG, for ticketing that everyone can use

Who issues it, and whom it binds. The US Department of Justice, whose web guidance says Title III “prohibits discrimination against people with disabilities by businesses open to the public”. The same guidance says businesses must make the programs, services and goods they provide to the public accessible, including those provided online, and it points to technical standards such as WCAG rather than naming one.

Where it touches this page. Online event booking, ticket purchase and venue navigation are the buying path, and the path is what gets tested, not only the marketing pages. WCAG 2.2, a W3C Recommendation published on 12 December 2024 with three conformance levels, A, AA and AAA, is set out on our ecommerce page.

COPPA, if a fan app is directed to children

Who issues it, and whom it binds. The Federal Trade Commission, at 16 CFR part 312. The rule makes it unlawful “for any operator of a website or online service directed to children, or any operator that has actual knowledge that it is collecting or maintaining personal information from a child,” to collect that information in a way that violates the rule, and it defines the age plainly: “Child means an individual under the age of 13.”

Where it touches this page. Loyalty and rewards programs, social engagement tools and targeted advertising all collect personal information. If a fan app or a youth program is aimed at under 13s, or the operator knows it is collecting from them, the rule reaches the design of every one of those features.

GDPR, for fans in the EU

Who issues it, and whom it binds. The European Parliament and Council, in Regulation (EU) 2016/679. Article 3(2) applies it to a controller or processor not established in the Union where the processing relates to “(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or” to “(b) the monitoring of their behaviour as far as their behaviour takes place within the Union.”

Where it touches this page. Ticketing for events from local tournaments to global championships, as the ticketing card puts it, and fan engagement platforms that personalize content, are both inside that sentence the moment they serve someone in the EU.

How a sports software build runs

The four steps below condense the stages published on our custom software development page. We work in two week sprints, so working software arrives every two weeks and a first production release typically lands in three to six months, as published on our about page.

1. DiscoveryThe problem, the constraints and the success criteria are mapped before a line of code. It ends with a written scope and a costed roadmap, which is the point at which a fixed price becomes possible.
2. Architecture and designThe data model, where state lives, how the system fails, how it scales, and how a reviewer will later verify its security posture.
3. Build and releaseTwo week sprints that end in something reviewable, then hardening, testing and a controlled release with the rollback path decided before the deployment.
4. Handover and supportThe repository and the cloud accounts in your name, then monitoring, maintenance and a roadmap tied to business outcomes.

Custom platform or a packaged product, compared

Requests that arrive as a need for custom software have three honest answers, and only one of them is a build. Our custom software development page sets out all three; these are the two ends.

The test that settles most of these is not technical: write down the process you are automating and ask whether a competitor could copy it and be at parity with you. If yes, buy or configure. If no, that process is the reason to build.

What drives the cost of sports software

Our rates are $150 to $250 per hour, depending on the seniority and mix of the team, and a typical project runs $50,000 to $200,000. Where the scope is clear we quote a fixed price for a defined outcome, with a costed roadmap before any build starts.

• How many systems it has to talk to. The cards above name ERP integration for stadiums and arenas, SMS gateways and payment systems. Every integration adds a counterparty whose availability, data quality and release calendar you do not control.
• Where the data comes from. Wearable and embedded data collection and RFID-based access management each bring devices into the scope alongside the software.
• The control framework the contract names. A PCI DSS scope or a WCAG conformance target carries evidence, review and documentation the same build would not otherwise need.
• How settled the scope is. A settled scope can be quoted as a fixed price; an unsettled one priced as though it were settled is where the buffer comes from.
• The seniority and mix of the team. This is the stated reason our own rate band has a range at all.
• What happens after launch. A quote that stops at go-live is not cheaper, it is shorter.

What to ask before you hire a sports software vendor

Every one of these is already published on this site, so you can put all of them to us as easily as to anybody else.

• Ask what they have integrated with, by name and version. Experience with a platform and a completed integration against it are different claims.
• Ask which certifications are audited and which are self declared, then ask for the report date.
• Ask which PCI DSS questionnaire the ticketing and store checkouts imply, and who decided it.
• Ask for named engineers on the contract, and a notice clause if they change.
• Ask what happens when the estimate is wrong.
• Ask what they would not build.

What you receive

• The repository and the cloud accounts, in your name from the first commit, with no licence back to us.
• A written scope and a costed roadmap, before any build starts.
• Working software every two weeks, not a status report about software.
• Architecture and a security posture you can put in front of a reviewer.
• Infrastructure your own engineers can run once we hand it over.
• Monitoring, maintenance and a roadmap after launch, priced up front.

Case study, delivered by NeoSOFT. The customized e-commerce platform built for a trend-focused clothing and accessories brand, in the carousel above, enhancing visual appeal, inventory accuracy and payment flexibility through deep platform customization. It is the merchandising and commerce side of this page, told in full on its own page.

Frequently asked questions

What is customer analytics software in a sports business?

On this page it is the fan side of sports analytics: fan engagement, loyalty and merchandise data captured, processed and visualized, next to the conversion optimization and sales analytics the merchandising line names. The performance side, from wearables, matches and player metrics, is the same capture, process and visualize work pointed at the team.

Does PCI DSS apply to ticketing and merchandise?

It applies to entities that store, process or transmit cardholder data or sensitive authentication data, and to those that could affect the security of the cardholder data environment. Whether you have to validate, and how, is decided by your acquirer or payment brand.

Does the ADA reach online ticketing?

The Department of Justice says Title III prohibits discrimination against people with disabilities by businesses open to the public, and that the programs, services and goods they provide to the public, including those provided online, must be accessible to people with disabilities.

Does COPPA apply to a fan app?

It applies to an operator of a website or online service directed to children, and to any operator that has actual knowledge it is collecting or maintaining personal information from a child. The rule defines a child as an individual under the age of 13.

What does sports software cost?

Our rates are $150 to $250 per hour, depending on the seniority and mix of the team, and a typical project runs $50,000 to $200,000. Where the scope is clear we quote a fixed price for a defined outcome, with a costed roadmap before any build starts.

Does Sthenos hold a PCI DSS attestation?

No. Sthenos holds no PCI DSS attestation, SOC 2 report or ISO 27001 certificate of its own, and does not describe itself as certified against any of them. Formal certifications and audits are the institution's to hold.

Related pages

• Ecommerce and retail, where PCI DSS, its questionnaires, WCAG 2.2 and the ADA are set out in full.
• Data analytics services and big data and analytics, for the platform behind the dashboards.
• Internet of things, for wearable and embedded data collection.
• Mobile app development, for fan and venue apps.
• Travel and hospitality, for booking, accommodation and payments.

Talk to an engineer. We are happy to answer any questions you may have and help you determine which of our services best fit your needs. Talk to our engineers.