Security & privacy
Security & privacy, described honestly
We describe only practices that are actually in place. Where something is still an owner decision or a work in progress, we say so.
Architectural practices in place
Tenant isolation, fail-closed
Every gym is a separate tenant. Data access is scoped to the current tenant, and a request with no tenant context returns nothing rather than leaking — isolation fails closed by design.
Role-based permissions
Staff roles grant only the access they need, enforced at both the page and action layers so a read-only role cannot write, even via a crafted request.
Append-only audit logging
Sensitive create, update and delete actions are recorded in an audit trail that cannot be edited after the fact.
Controlled feature rollout
Capabilities are turned on deliberately. Critical modules such as billing, payments, payroll and accounting are held off and are not activated automatically.
Database-only pilot workflows
Pilot onboarding and import rehearsals are staged in the database with no external delivery, so a gym can rehearse safely before anything is committed.
Data minimisation
Public inquiries collect only what's needed to follow up. Raw IP and user-agent are never stored — only a one-way salted hash for spam correlation.
Backups with a verified restore
Nightly database backups are taken and a restore has been rehearsed and verified. Off-server backup storage is an owner decision that is still open (see below).
Encrypted in transit
Traffic is served over HTTPS with HSTS. The marketing site loads no third-party scripts, fonts, analytics or ad pixels.
Multi-factor admin access
Staff and owner access to the admin panel requires multi-factor authentication.
Privacy on this website
This marketing site uses only strictly-necessary cookies (a session cookie and a CSRF-protection token). There are no analytics, advertising, or third-party tracking cookies, no session-replay, and no external fonts or embeds. See the privacy policy for details.
What we don't claim
We do not claim any formal certification that Gymciety does not hold. We are not PCI, SOC 2, or HIPAA certified, we make no enterprise-certification claims, and we don't promise uninterrupted uptime or guaranteed outcomes.