Infrastructure
FitBoard runs on modern cloud infrastructure with encrypted connections (TLS/HTTPS) for all traffic. Database connections use SSL. Our hosting provider maintains SOC 2 compliance and regular security audits.
Authentication
Passwords are hashed using bcrypt with a strong work factor — we never store plaintext passwords. Sessions use secure, HTTP-only cookies. Google OAuth is supported as an alternative sign-in method with industry-standard OAuth 2.0 flows.
Access Control
Role-based access ensures trainers and clients only see data they are authorized to view. Trainer–client relationships require mutual consent before coaching data is shared. API routes and server actions verify authentication on every request.
Data Protection
Coaching data (plans, logs, messages, progress photos) is stored in isolated database records tied to your account. We do not sell or share your data with advertisers. See our Privacy Policy for full details on data handling.
Payments
Subscription billing is handled by PayPal. FitBoard does not store credit card numbers. PayPal maintains PCI DSS compliance for payment processing.
Rate Limiting & Abuse Prevention
Login, registration, and contact form submissions are rate-limited to protect against brute-force attacks and spam. We monitor for suspicious activity and may temporarily block abusive IP addresses.
Reporting Security Issues
If you discover a security vulnerability, please report it responsibly to support@fitboard.space. We will investigate and respond promptly.