Security

Yours, and safe.

Your members trust you with their phone numbers, measurements and photos. You trust us with your gym. Here is how that trust is built.

Your gym

One tenant, one wall.

LumiFit runs many gyms on one platform. Every one of them is a separate tenant, and the wall between them is enforced in code, not in a setting.

  1. Another gym's identifier simply doesn't exist here.

    Every query is scoped to the gym that is signed in. A request that names another gym's member, class or photo gets "not found", never "forbidden".

  2. Your showcase is never anyone's benchmark.

    City Benchmark and City League compare a gym only against gyms that opted in, anonymised on both sides. The demo gym is compared only with other demo gyms.

  3. Credentials your gym enters are encrypted at rest.

    Any key or token a gym configures is stored encrypted and never shown back in full. Logs redact it.

  4. Your data belongs to your gym.

    Members' records are yours to run the gym with, and for nothing else. We do not sell them. If you leave, we return your data and delete it.

Your members

Their phone, their password, their photos.

A member signs in to your app the way they sign in to their bank, and keeps the parts of their progress that are theirs alone.

  1. Phone number and their own password.

    A one-time setup code at the desk, a password, and she is in. Passwords are hashed with a memory-hard algorithm; sign-in attempts are rate-limited. No OTP fees, no SIM dependency.

  2. Phone numbers are encrypted at rest.

    Sign-in looks a number up through a keyed index, not the number itself. A copy of the database alone does not reveal who your members are.

  3. Sessions last ninety days and can be ended from the console.

    "Sign out of all devices" ends every session at once, the right tool for a lost phone. Staff sign out everywhere the moment their password changes.

  4. Progress photos never reach the owner.

    Stored for the member, shown to the member. A trainer sees a photo only when the member shares it, and the share can be withdrawn.

  5. Form Coach runs on the phone.

    The camera's frames are processed on the device by a pose model loaded once from our own servers. Not one frame is uploaded; an automated test fails the build if anyone adds a network call to that screen.

  6. AI answers are processed in Mumbai.

    The in-app coach, the workout generator and the meal-photo estimate run on managed cloud models in the Mumbai region. Nothing sent for an answer is kept beyond it.

The platform

Tested, deployed, backed up. Every time.

A gym's software should be boring in exactly one way: it should always be there in the morning.

  1. Over 6,000 automated tests, before every release.

    Every change runs the full suite, including the tests that prove one gym cannot read another's data. If a release fails its health check, the previous one comes back automatically.

  2. Nightly backups, a weekly restore test.

    Backed up every night to separate storage; once a week a backup is restored and checked, because a backup never restored is a hope. Kept ninety days; the server that writes them cannot delete them.

  3. Hosted in Mumbai, encrypted in transit.

    The AWS Mumbai region, every connection over HTTPS. The servers accept web traffic and nothing else; no remote shell is open to the internet.

  4. Fast on the phones your members actually own.

    The first screen must open in under 1.8 seconds on slow 4G, or the release does not ship. An app that stalls is an app people stop opening.

Questions a technical partner would ask? Answered in writing, before you sign anything.

Ask a security question →