Authentication & sessions

Staff access uses secure authentication with JWT access tokens and hashed refresh tokens stored server-side. Web sessions use httpOnly cookies where appropriate.

Role-based access control

Permissions are enforced on the server for every sensitive operation. Owners, managers, front-desk staff, trainers, and members each receive appropriate access — never more than their role requires.

Tenant & branch isolation

Each gym (tenant) operates in an isolated data context. Branch-level scoping further limits what staff can see and modify. Cross-tenant data access is blocked at the application layer with automated tests.

File storage

Member photos and files are stored securely. Production deployments can use cloud object storage; development environments may use local fallback storage.

What we don't claim

We do not advertise compliance certifications (such as GDPR or SOC 2) unless formally audited and verified. Contact us for security questionnaires during enterprise evaluation.