Security is a
foundation, not a feature.
Fitbinary handles sensitive business and member data. We treat security as a fundamental requirement — not an afterthought — built into every layer of the platform.
Six pillars of
platform security.
Every layer of Fitbinary — from infrastructure to application logic — is built with security as a constraint, not a control.
Data encryption
All data is encrypted at rest using AES-256 and in transit using TLS 1.2+. Member records, payment data, and business information are encrypted at every layer.
Infrastructure security
Fitbinary runs on hardened cloud infrastructure with network isolation, automatic security patching, and continuous vulnerability scanning.
Access control
Role-based access control (RBAC) is enforced at every level — from product UI to API endpoints. Every request is authenticated and tenant-scoped.
Audit logging
Every significant action across Fitbinary products is logged with user identity, timestamp, and context. Logs are immutable and retained for compliance purposes.
Availability & redundancy
Fitbinary infrastructure is designed for high availability with automatic failover, regular backups, and a 99.9% uptime SLA.
Incident response
We maintain a documented incident response process. Security incidents are assessed, contained, and disclosed to affected customers promptly.
What we do
in practice.
Authentication
- Passwords hashed using bcrypt with a high work factor
- Session tokens rotated on authentication events
- API keys are scoped to tenant and never logged in plaintext
- Multi-factor authentication (MFA) available for all accounts
Data handling
- Member personal data is stored with field-level encryption where applicable
- Payment card data is never stored — processed through PCI-compliant providers
- Data is logically isolated per tenant with no cross-tenant data access
- Data deletion requests are honored within 30 days
Application security
- Code reviewed before every production deployment
- Dependencies audited for known vulnerabilities on a regular schedule
- API rate limiting enforced to prevent abuse
- Input validation and output encoding against injection attacks
Operational security
- Principle of least privilege applied across all internal systems
- Production access restricted to authorized personnel only
- All internal access is logged and monitored
- Security training required for all team members
Found a security issue?
We take vulnerability reports seriously. If you discover a security issue in any Fitbinary product, please contact us responsibly before public disclosure.
security@fitbinary.comWe aim to acknowledge all reports within 48 hours.