Security
Names, phone numbers, sometimes a CNIC, sometimes a medical note. Six things we do about that, each one a rule the system enforces rather than a habit somebody has to remember.
Separation is enforced at the database layer, on every collection, by a rule the query has to pass through, not by a filter each screen remembers to add. Each collection has an automated test that fails the build if it could ever return another gym’s rows.
Payment records are append-only. Correcting one creates a reversal entry beside it rather than changing what was there, so the history of what was taken and when survives intact, including for the person who took it.
The invoice, the payment and the audit entry are written in a single database transaction. Either all three land or none do. There is no state where a member has paid but the invoice disagrees.
Neither is returned by any list endpoint. They are fetched only when somebody deliberately opens that member’s record, and that access is recorded.
They are held in a private bucket with non-guessable keys and served through links that expire in fifteen minutes. There is no public URL to guess at or share by accident.
Your gym’s check-in secret never leaves the server and appears in no API response. One-time passcodes, session tokens and payment references are kept out of logs and error reports, so they cannot leak through a screenshot of a crash.
What we do not claim
Every security page on the internet says the same four words. These are the ones we have not earned, and saying so is more useful than a badge.
Your members’ rights
Your gym is the one that decides what is collected; we hold it on your behalf. A member wanting a copy, a correction, or deletion goes through you, and we do the work behind it.
If you think you have found a security problem, tell us before you tell anyone else and we will fix it. Message the same number that answers everything else.
