Security Practices

Every statement on this page is a representation to our users and to device partners and their reviewers.

ENCRYPTION

Physiological records are encrypted at rest under a key scoped to the individual account, so a record is unreadable in storage without that account's key. An automated check runs every hour and alerts if any physiological record is found stored in plaintext. All traffic between the app, our services, and device partners is TLS-encrypted in transit. Access tokens for connected services are stored sealed, separately from the health data they unlock.

ACCESS CONTROL

Isolation between accounts is enforced at the database layer with row-level security on every table holding user data, not only in application code. Anonymous access to write operations on user tables is revoked. Staff access is least-privilege and limited to the operator's engineering role; there is no support tooling that exposes decrypted physiological data.

PROVENANCE

Every wearable and health record carries a non-null source label identifying the service it came from, written at ingestion. That label governs how the record may be used, including exclusion from AI training where a partner requires it and removal when you disconnect that source.

INCIDENT RESPONSE

We maintain a written incident-response plan covering detection, triage, a named owner, a notification clock, and a post-incident record. Where a device partner's agreement sets a notification deadline, we notify that partner within it; our shortest current obligation is 24 hours from discovery of an incident affecting that partner's data. Affected users are notified as applicable law requires.

RESPONSIBLE DISCLOSURE

If you believe you have found a vulnerability, write to zac.s@fittso.app with "Security" in the subject. Tell us what you found and how to reproduce it. Please do not access, modify, or retain another person's data while testing. We will acknowledge, investigate, and keep you updated, and we will not pursue action against good-faith research conducted within those limits.

INFRASTRUCTURE

FITTSO runs on managed cloud infrastructure in the United States (Supabase for database and authentication, Fly.io for the THEIA service, Cloudflare R2 for image storage). Database backups are taken daily, encrypted, access-controlled, and overwritten on a rolling cycle; they are not restored to production after a deletion request.

WHAT WE DO NOT CLAIM

No security measure is absolute, and we will not say otherwise. We do not hold a third-party security certification today. This page is reviewed whenever the underlying controls change. Last reviewed September 12, 2026.