Gyms trust Oxyye with their members' information and their revenue. Protecting that data is core to the product. This page summarises the safeguards we have in place.
Authentication & access
- Sign-in is handled by a dedicated identity provider with support for email, one-time codes, and Google sign-in.
- Access is invite-only — accounts are provisioned deliberately, not through open self-signup.
- Every user has a role (owner, trainer, member, admin), and the backend enforces role-based permissions on every request.
- Registration invite links are single-use and expire, so a leaked link can't be redeemed later.
Data protection
- All traffic is encrypted in transit with TLS (HTTPS).
- Data is stored on managed, access-controlled cloud infrastructure with encryption at rest.
- Each gym's data is logically isolated, and the API scopes every query to the caller's own gym.
- We never store full payment-card numbers; card data is handled directly by our PCI-compliant payment partner.
Platform hardening
- Sensitive endpoints are rate-limited per IP to protect against brute-force and abuse.
- Server-side validation guards every write, independent of the client.
- Secrets and credentials are stored in environment configuration, never in source control.
- Production and development environments are fully isolated, with separate databases and keys.
Reliability
Oxyye runs on managed hosting with automated builds and deploys. Database migrations are applied in a controlled pipeline so schema changes are predictable and reversible.
Reporting a vulnerability
If you believe you have found a security issue, please email hello@oxyye.com with the details. We take every report seriously, will acknowledge it promptly, and ask that you give us a reasonable opportunity to address the issue before disclosing it publicly. We will not pursue action against good-faith researchers who follow responsible-disclosure practices.