Security

Sign-in and two-step verification

Every request is checked against a signed-in session. Coaches can add an authenticator app; once they have, payouts, billing, data export, account deletion and team changes also need the six-digit code.

Tenant isolation

Signing in proves who you are. A second check on every request proves the record is yours to see: your own, a client you actively coach, or your studio’s. Another coach’s clients, another client’s records and another studio’s settings are refused.

automated isolation cases

526

API routes they cover

111

On every change, the test suite signs in as a coach of another studio, as another client and as a studio member without the admin role, tries to read and change records that are not theirs, and checks that each attempt is refused. The numbers above are produced by that suite, not written by hand.

Counted November 9, 2026.

Encryption

Traffic is encrypted in transit with TLS. The database and file storage are encrypted at rest, chat messages are encrypted by the app before they are stored, and private files such as progress photos are only served through short-lived signed links.

A second line of defence in the database

Row-level security is enabled on the database tables, so the database cannot be read around the app: a direct query only ever reaches the caller’s own rows. The checks in the app are the first line; the database is the second.

Report a vulnerability

Found a security problem? Email support@netfit.coach with the details. Please do not publish it until we have had the chance to fix it.