Skip to content
FitFocus
Log inBook a demo

Security

Your data, and your clients' data, kept safe

When you move your coaching business to FitFocus, you are trusting us with sensitive client information. We take that seriously. This page lays out the controls we have in place today, and the ones we are still working towards, in plain language.

Book a demoRead the Privacy Policy

How we protect your data

Six layers of protection behind every workspace

Encryption

The FitFocus platform is hosted on Microsoft Azure in Australia. Data is encrypted in transit and at rest. Some services we use, such as Stripe for payments and our email and push notification providers, process data overseas, mostly in the United States. Every one is listed on the subprocessors page.

  • TLS 1.2+ enforced across every public endpoint, with HSTS on the marketing site and applications.
  • Databases run on Azure SQL Database with Transparent Data Encryption (AES-256).
  • Uploaded files are stored in Azure Blob Storage, which encrypts data at rest with AES-256.
  • Passwords are hashed with bcrypt, never stored in plain text.

Access controls

Each business on FitFocus has its own workspace, and no workspace can see another's data. Inside a workspace, coaches share clients: that's how a team covers for each other, and it's worth knowing before you add a coach.

  • Every organisation-owned record carries its organisation, and database queries are filtered to the signed-in user's organisation automatically. We keep automated tests that try to reach one workspace's data from another.
  • Role-based access controls separate organisation administrators, coaches, clients, and FitFocus platform staff.
  • Payment and other service credentials are held on the server and never shipped to the web or mobile apps.
  • Administrative access to production requires separate credentials and is audited.

Backups and durability

Your clients' history is safe. Managed backups and point-in-time recovery mean a bad day stays a bad day, not a catastrophe.

  • Automated backups of the production databases by Azure SQL Database.
  • Point-in-time recovery available within the retention window offered by our database provider.
  • File storage backed by redundant Azure Blob Storage.

Incident response

If something goes wrong, you hear it from us early, not from someone else later.

  • A documented runbook covers triage, containment, customer communication, and post-incident review.
  • Affected workspace owners are notified without undue delay after we confirm a material incident.
  • Post-incident write-ups are shared for significant events that impact availability or data integrity.

People and process

Only the people who need access to production systems have it, and that access is monitored.

  • Least-privilege access to production for engineering staff; administrative access requires additional controls.
  • All team accounts protected by single sign-on and hardware-backed second factors.
  • Code changes land through peer review and CI checks before reaching production.

Application security

Secure-by-default patterns are baked into how we build.

  • Requests are validated on the server before anything is written.
  • The web app at app.fitfocus.io sends a Content Security Policy. This marketing site does not.
  • Every change runs automated build, test, and lint checks in CI before it can merge.
  • No secrets in client bundles, checked in code review.

Compliance

An honest view of where we stand

We publish the truth about our compliance posture, not badges we have not earned. We keep this table current whenever a new attestation is issued or a framework status materially changes, so what you see here is what you get.

FrameworkStatusNotes
Australian Privacy Act 1988 (APPs)AlignedOur handling of personal information is designed around the thirteen Australian Privacy Principles.
GDPR (EU) 2016/679AlignedGDPR-aligned rights and processor obligations are reflected in the Privacy Policy and DPA.
PCI DSSNoticeCardholder data is never handled by FitFocus. Card payments are processed by Stripe (PCI DSS Level 1) and direct debits by Ezidebit, on their hosted pages.
SOC 2 Type IIWorking towardsNo report has been issued yet. We are working towards SOC 2 readiness and will publish attestations once they are available.
ISO/IEC 27001Working towardsNot currently certified. Listed here so prospective enterprise customers can plan accordingly.

Responsible disclosure

Found a vulnerability? Tell us.

We welcome reports from security researchers and users. Please share the issue privately, give us a reasonable window to remediate before publishing, and act in good faith: no data exfiltration, no service disruption, and no accessing accounts other than ones you own or have explicit permission to test.

We acknowledge valid reports and credit researchers where appropriate.

security@fitfocus.ioAcceptable Use Policy

What to expect

  • Acknowledgement from our security team.
  • Triage and confirmation of the issue, with regular updates through to remediation.
  • Coordinated disclosure once a fix is in place, with credit if you would like it.

Subprocessors

The vendors behind the platform

Each company that processes personal data for us is on the subprocessors page, with what it does, the data it handles and where it's based. We give at least 30 days' notice before a new one starts.

View subprocessorsTrust centreData Processing Addendum

Questions your team needs answered?

Bring them to a demo and we'll go through them with you.

Book a demoContact us