Perch IS & T Procurement Q&A

Frequently asked questions from customer IT, Information Security, and Compliance teams during the procurement process.

See also sub-tabs of this document for more specific information:

• P2 Install & Wiring
• Perch Cast Installations

System Architecture & Data Processing

Q: Where does data processing happen — on the device or in the cloud?

All exercise computation happens locally on the Perch camera hardware. The camera calculates metrics like displacement, velocity, acceleration, and power output on-device, then transmits only the computed results to the paired tablet over Bluetooth or USB. No cloud processing is involved in real-time exercise tracking. The cloud is used only for storing data after the fact so that coaches and users can review it longitudinally.

Q: What role does the cloud play in the system?

The cloud (AWS) serves three purposes:

• IoT device management — software updates, device health monitoring, and camera configuration are distributed through our cloud platform. Both the camera and tablet authenticate to access these services.
• Data storage — workout metrics and user profiles are persisted so coaches and users can access historical data via the web application or mobile app.
• Video storage — the P2 model captures color video of activities, which is uploaded and stored for playback. This can be disabled.

All connections between devices and our cloud are authenticated and encrypted via HTTPS/TLS 1.2.

Data Collection & Privacy

Q: What data does Perch collect?

Data falls into four categories:

Catapult never transmits customer data to third parties without the customer's explicit consent. Third-party data sharing occurs only when the customer chooses to integrate Perch with external systems (e.g., Athlete Management Systems).

Q: What personally identifiable information (PII) is required?

The only required PII is a name to create a user profile. Email is optional (required only if the user wants web access). Height, weight, gender, and photo are all optional and used to enhance reporting. The core workout metrics (velocity, displacement, power, etc.) are not inherently identifiable on their own.

 Q: Does the P2 model's color video raise additional privacy considerations?

Yes. The P2 camera captures color video of exercises, which is identifiable footage — it is not anonymized. This video is uploaded to the cloud for playback features. Video recording can be disabled on a per-customer basis. Disabling video removes the playback features and limits Catapult's ability to provide remote support.

Q: How does Perch use customer data internally?

Catapult staff only utilize customer data in accordance with our Terms of Service and Privacy Policy. See those documents for the full details.

Compliance, Data Hosting, & Residency

Q: Where is customer data hosted?

All data is hosted on AWS in the United States. Catapult is headquartered in Melbourne, Australia. Perch cloud infrastructure is hosted within the contiguous United States.

Q: Can data be hosted in our region (e.g., EU, APAC, UAE)?

No. Catapult does not currently offer regional hosting options for Perch. All customer data is stored in the US regardless of the customer's location.

Q: Our facility operates under strict data residency regulations. How should we evaluate this?

We recommend reviewing the specific data Perch collects (see above) against your regulatory framework to determine whether it falls within scope. Your legal and compliance teams are best positioned to make that determination.

If your assessment determines the data is in-scope for additional compliance requirements, reach out to your Catapult representative.

Encryption & Security

Q: Is data encrypted in transit?

Yes. All communication between Perch devices and the cloud uses HTTPS with at least TLS 1.2. All connections require authentication (user or device credentials).

Q: Is data encrypted at rest?

Yes. All databases and file storage are encrypted at rest using at least AES-256.

Q: What access controls does the system support?

Perch has three roles: Admin, Coach, and Athlete. Admins have full edit access across the organization. Coaches can manage athletes and view data. Athletes have limited self-service access. Password requirements follow industry standards.

Q: Does Perch support multi-factor authentication (MFA)?

Yes. Perch supports email-based multi-factor authentication for user accounts accessing the web and mobile applications. After entering valid credentials, the user is sent a one-time verification code to their registered email address, which must be entered to complete sign-in. This applies to remote access to the Perch platform.

Q: Does Perch log security-relevant events?

Yes. Perch maintains audit logging for security-critical events and generates user login notifications so account holders are alerted to access of their accounts. Contact your Catapult representative for details on what specific events are captured and on log access or export for your own monitoring workflows.
 

Q: Does Perch support SSO or integration with enterprise identity providers (e.g., SAML, Azure AD)?

Perch does not currently support SSO or federated identity. User accounts are managed within the Perch platform. Given the typical scale of Perch deployments (a small number of coach/admin accounts per organization), account management overhead is minimal.

Data Export & Backup

Q: Can we export data from Perch into our own backup and storage systems?

Yes, through two mechanisms:

• API — Catapult provides a documented JSON API that allows you to programmatically pull all data associated with your users, including workout metrics and user profiles. This can be integrated with third party services or backup workflows.
• CSV Export — manual CSV export is available as a simpler alternative for lower-volume deployments.

Q: What is Perch's own backup and retention policy?

Catapult performs regular backups of all Perch databases. Contact your Catapult representative for details on data retention after contract termination and backup export options.

Offline Mode

Q: Can the system operate without internet connectivity?

Yes, but with significant limitations. In offline mode:

• Real-time exercise tracking and feedback works normally — all computation is local.
• No user profiles — the system cannot authenticate users or maintain individual records.
• No longitudinal data — workout history is not saved or retrievable.
• No software updates — devices cannot receive firmware or app updates.

Offline mode is suitable only for live, real-time feedback use cases where historical tracking is not needed.

Network Requirements

Q: What WiFi standards and authentication methods does Perch support?

• WPA2 — supported on all models
• WPA3 — supported on the P2 model
• WPA Enterprise (802.1X) — supported on all models

For enterprise deployments, our preferred configuration is a dedicated, MAC-authenticated SSID. This avoids credential sharing and simplifies device onboarding.

Live video playback — used by both tablets and Perch Cast devices — requires LAN connectivity between the playback device and its paired Perch Camera. See the video playback question below for required ports. Perch Cast deployments additionally require a small number of bridge ports between the Cast device and the Camera; see the Perch Cast question below.

Q: Does Perch support wired connections?

The P2 camera model supports Ethernet connectivity – with the use of a USB-C dongle – in addition to WiFi. Tablets connect via WiFi.

Q: What outbound network access does Perch require?

Perch devices require outbound internet access only. No inbound ports need to be opened or forwarded. Perch does not need access to your internal/corporate network.

If your firewall filters outbound traffic by domain or category, the following endpoints must be reachable:
 

Perch Services

OS & System Services (Camera Devices)

TLS Certificate Validation

Standard OCSP and CRL endpoints used by your network's TLS stack for certificate verification. These are the same endpoints any HTTPS-capable device on your network would need. Common examples include ocsp.pki.goog, o.lencr.org, and Amazon Trust Services endpoints. If you see TLS handshake failures, blocked OCSP traffic is a likely cause.

Tablet App (Android / iOS)

This list covers known requirements. If your environment uses strict URL-based filtering, we recommend monitoring firewall logs during initial setup to identify any additional endpoints and working with your Catapult representative to resolve them.

Q: What local network access is required for live video playback?

Live video playback from a Perch Camera — used by both tablets and Perch Cast devices — requires LAN connectivity between the playback device and the Camera. Within the LAN segment shared by the playback device and the Camera, the following must be permitted:

Playback devices and Cameras must either reside on the same subnet or VLAN, or be placed on separate VLANs with routing rules that permit bidirectional traffic on the ports above. Perch devices locate one another by IP address through Perch Cloud, so mDNS is not required.

The Camera presents a TLS certificate that the playback device pins by fingerprint, so TLS-inspecting middleboxes between the playback device and the Camera will prevent video playback and should be avoided.

Q: What additional local network access does Perch Cast require?

Perch Cast deployments add a TV-mounted Cast device at each rack that displays live video and other content from the paired Perch Camera. Please see the additional guide on Perch Cast installations.

In addition to the video playback ports above, the Cast uses a small number of bridge ports for control and telemetry traffic with the Camera:
 

All traffic between Perch Cast and Perch Camera is encrypted and authenticated. Each device has its own cryptographic keypair, and a Camera only accepts connections from Cast devices it has been authorized to talk to. Every session is additionally gated by a short-lived JWT access token issued by Perch Cloud.
 

No inbound rules from the public internet are required for either video playback or Perch Cast — all LAN ports listed above are between the playback device (or Cast) and the Camera only.
 

For additional technical documentation, contact your Catapult representative.