Security & privacy

Security & privacy, described honestly

We describe only practices that are actually in place. Where something is still an owner decision or a work in progress, we say so.

Architectural practices in place

Tenant isolation, fail-closed

Every gym is a separate tenant. Data access is scoped to the current tenant, and a request with no tenant context returns nothing rather than leaking — isolation fails closed by design.

Role-based permissions

Staff roles grant only the access they need, enforced at both the page and action layers so a read-only role cannot write, even via a crafted request.

Append-only audit logging

Sensitive create, update and delete actions are recorded in an audit trail that cannot be edited after the fact.

Controlled feature rollout

Capabilities are turned on deliberately. Critical modules such as billing, payments, payroll and accounting are held off and are not activated automatically.

Database-only pilot workflows

Pilot onboarding and import rehearsals are staged in the database with no external delivery, so a gym can rehearse safely before anything is committed.

Data minimisation

Public inquiries collect only what's needed to follow up. Raw IP and user-agent are never stored — only a one-way salted hash for spam correlation.

Backups with a verified restore

Nightly database backups are taken and a restore has been rehearsed and verified. Off-server backup storage is an owner decision that is still open (see below).

Encrypted in transit

Traffic is served over HTTPS with HSTS. The marketing site loads no third-party scripts, fonts, analytics or ad pixels.

Multi-factor admin access

Staff and owner access to the admin panel requires multi-factor authentication.

Privacy on this website

This marketing site uses only strictly-necessary cookies (a session cookie and a CSRF-protection token). There are no analytics, advertising, or third-party tracking cookies, no session-replay, and no external fonts or embeds. See the privacy policy for details.

What we don't claim

We do not claim any formal certification that Gymciety does not hold. We are not PCI, SOC 2, or HIPAA certified, we make no enterprise-certification claims, and we don't promise uninterrupted uptime or guaranteed outcomes.

Honest about readiness

Production pilot readiness is not automatic. It requires completed onboarding gates and explicit owner approval before any real gym's data is imported or any account is activated. A couple of operational items remain open owner decisions — notably off-server backup storage and a source-code backup remote — and we disclose these rather than imply they're done.

How the pilot works