Skip to content
FitFocus
Sign inBook a demo

Security

Your data, and your clients' data, kept safe

When you move your coaching business to FitFocus, you are trusting us with sensitive client information. We take that seriously. This page lays out the controls we have in place today, and the ones we are still working towards, in plain language.

Book a demoRead the Privacy Policy

How we protect your data

Six layers of protection behind every workspace

Encryption

All data is encrypted in transit and at rest on Microsoft Azure, hosted in Australia.

  • TLS 1.2+ enforced across every public endpoint, with HSTS on the marketing site and applications.
  • Databases run on Azure SQL Database with Transparent Data Encryption (AES-256).
  • Uploaded files are stored in Azure Blob Storage, which encrypts data at rest with AES-256.
  • Passwords are hashed with bcrypt, never stored in plain text.

Access controls

One coach's data is never visible to another. Isolation is enforced in the data layer for every query, not left to individual screens.

  • Every organisation-owned record carries its organisation, and database queries are filtered to the signed-in user's organisation automatically.
  • Role-based access controls separate organisation administrators, coaches, clients, and FitFocus platform staff.
  • Payment and other service credentials are held on the server and never shipped to the web or mobile apps.
  • Administrative access to production requires separate credentials and is audited.

Backups and durability

Your clients' history is safe. Managed backups and point-in-time recovery mean a bad day stays a bad day, not a catastrophe.

  • Automated backups of the production databases by Azure SQL Database.
  • Point-in-time recovery available within the retention window offered by our database provider.
  • File storage backed by redundant Azure Blob Storage.

Incident response

If something goes wrong, you hear it from us early, not from someone else later.

  • A documented runbook covers triage, containment, customer communication, and post-incident review.
  • Affected workspace owners are notified without undue delay after we confirm a material incident.
  • Post-incident write-ups are shared for significant events that impact availability or data integrity.

People and process

Only the people who need access to production systems have it, and that access is monitored.

  • Least-privilege access to production for engineering staff; administrative access requires additional controls.
  • All team accounts protected by single sign-on and hardware-backed second factors.
  • Code changes land through peer review and CI checks before reaching production.

Application security

Secure-by-default patterns are baked into how we build.

  • Requests are validated on the server before anything is written.
  • Content Security Policy and modern security headers on marketing and application surfaces.
  • Every change runs automated build, test, and lint checks in CI before it can merge.
  • No secrets in client bundles, checked in code review.

Compliance

An honest view of where we stand

We publish the truth about our compliance posture, not badges we have not earned. We keep this table current whenever a new attestation is issued or a framework status materially changes, so what you see here is what you get.

FrameworkStatusNotes
Australian Privacy Act 1988 (APPs)AlignedOur handling of personal information is designed around the thirteen Australian Privacy Principles.
GDPR (EU) 2016/679AlignedGDPR-aligned rights and processor obligations are reflected in the Privacy Policy and DPA.
PCI DSSNoticeCardholder data is never handled by FitFocus. Card payments are processed by Stripe (PCI DSS Level 1) and direct debits by Ezidebit, on their hosted pages.
SOC 2 Type IIWorking towardsNo report has been issued yet. We are working towards SOC 2 readiness and will publish attestations once they are available.
ISO/IEC 27001Working towardsNot currently certified. Listed here so prospective enterprise customers can plan accordingly.

Responsible disclosure

Found a vulnerability? Tell us.

We welcome reports from security researchers and users. Please share the issue privately, give us a reasonable window to remediate before publishing, and act in good faith: no data exfiltration, no service disruption, and no accessing accounts other than ones you own or have explicit permission to test.

We acknowledge valid reports and credit researchers where appropriate.

security@fitfocus.ioAcceptable Use Policy

What to expect

  • Acknowledgement from our security team.
  • Triage and confirmation of the issue, with regular updates through to remediation.
  • Coordinated disclosure once a fix is in place, with credit if you would like it.

Subprocessors

The vendors behind the platform

A small, carefully chosen set of vendors help us run the platform, and you can see every one of them. No third-party analytics or advertising tools are used on the marketing website in v1.

View subprocessorsTrust centreData Processing Addendum

Talk to a coaching specialist

Questions about fit? Chat with someone who coaches on FitFocus every day.

Contact salesBook a demo