Security & Privacy

Version: 2.0.0 Last Updated: 2026-08-04

Introduction

This document describes the technical and organisational measures BodyFit by Mi7z takes to protect your personal data. Security is built into our architecture and operations.

Infrastructure Security

BodyFit runs on secure cloud infrastructure. Data in transit is encrypted using TLS (Transport Layer Security). Our hosting provider maintains industry-standard physical and network security, including ISO 27001 and SOC 2 certifications at the infrastructure level.

Access Control

• Authentication: User authentication uses secure token-based sessions. Passwords are hashed, never stored in plaintext.
• Row-level security: Each user can only access their own data. The database enforces row-level security so one user cannot read or modify another user's records.
• Admin access: Restricted to authorised admin users. Admin actions are logged in an audit trail. Admin access to user data is rare and only for support, security investigation, or legal compliance — never for casual browsing.
• Least privilege: Service accounts are scoped to the minimum permissions needed.
• Re-authentication: Sensitive operations require re-authentication or admin role.

Application Security

• Input validation: All user inputs are validated server-side.
• Output encoding: Data is encoded to prevent XSS attacks.
• OWASP Top 10: We protect against common web vulnerabilities, including injection, broken authentication, sensitive data exposure, and CSRF.
• Secure coding: We follow secure coding practices and conduct security reviews on new code.

Data Protection

• Encryption at rest: Managed by our cloud provider with infrastructure-level encryption.
• Sensitive fields: Health data, device tokens, and other sensitive information are protected with access controls.
• Data separation: Health and fitness data is stored separately from general usage data where possible.
• No data selling: We never sell user data. See our Privacy Policy.

Monitoring & Detection

• We monitor systems for security events, unusual access patterns, and potential threats.
• Alerts are triaged and investigated.
• Audit trails support forensic analysis when needed.
• See our Audit & Assurance page for details.

Vulnerability Management

• We monitor dependencies for known vulnerabilities and apply security patches promptly.
• New code undergoes security review.
• Our Responsible Disclosure programme invites external security researchers to report vulnerabilities. See our Responsible Disclosure page.

Incident Response

We maintain incident response procedures:

1. Detect & contain: Identify and isolate the incident
2. Assess: Determine scope and impact
3. Notify: Inform affected users and authorities as required by law
4. Recover: Restore services and data
5. Review: Conduct a post-incident review and improve controls

In the event of a personal data breach, we notify affected users and the ICO within 72 hours, as required by UK GDPR.

Business Continuity

We plan for service disruptions with monitoring, incident response, and recovery procedures. See our Business Continuity and Disaster Recovery pages.

Contact

For security questions or to report a vulnerability: security@bodyfit.mi7z.com. See our Responsible Disclosure page for reporting guidelines.