01Every gym is walled off
Gyms Cloud is multi-tenant: many gyms share the platform, but never each other’s data. Every gym-owned record carries the gym it belongs to, and every query the application runs is filtered by the signed-in user’s gym. A record that belongs to another gym simply does not exist from your point of view — asking for it by number returns “not found”. Our automated tests check this isolation on every change.
02Access control inside your gym
- Roles and permissions. Owner, manager, front desk, trainer and accountant roles come ready-made, and you can create your own. The server checks permissions on every request — hiding a button is never the only protection.
- Trainers see their own members. Trainers only see the members assigned to them and their personal-training clients.
- Sensitive actions are separate permissions — giving discounts, voiding invoices, exporting reports and managing staff.
- Audit trail. Sign-ins, sales, voids, refunds and settings changes are recorded with who did them and when.
03Sign-in and sessions
- Passwords are stored only as strong one-way hashes (bcrypt via PHP’s
password_hash) and are never visible to anyone — including us. - Repeated failed sign-ins are locked out for 15 minutes to stop password guessing.
- Web sessions use secure, HTTP-only cookies, are renewed at sign-in and expire after 12 hours of inactivity. Every change made from the browser carries an anti-forgery (CSRF) token, and requests from other websites are refused.
- Mobile apps use revocable tokens. Staff can see their signed-in devices and sign any of them out; changing a password signs out every other device.
04Encryption
- In transit: all traffic uses HTTPS with modern TLS and HSTS; plain HTTP is redirected.
- Secrets at rest: payment gateway secrets (such as a gym’s Razorpay key secret and webhook secret) are encrypted with AES-256-GCM using a key that is kept outside the database and the code repository. They are never returned by the API.
- Payments: card and UPI details are entered on Razorpay’s checkout and never touch our servers. Online payments are verified by signature before a membership is extended.
05Biometric devices
Fingerprint and face templates are stored on the gym’s own devices. Gyms Cloud stores only enrollment flags and device PINs, and uses them to switch a member’s access on or off as their membership changes. Devices authenticate to Gyms Cloud with a per-gym key.
06How we build and run Gyms Cloud
- Database queries use prepared statements only, and every page escapes output, to prevent SQL injection and cross-site scripting.
- Prices, taxes and totals are always calculated on the server from your own plan settings — never trusted from the browser.
- Money changes that touch several records happen in a single database transaction, so they are all saved or none are.
- An automated test suite runs against an isolated test database — never against live data.
- Uploaded files (such as logos and member photos) are stored where they cannot be executed as code.
- Production access is limited to a small number of authorised Cybex Innovation engineers. Platform support actions, including any support session opened inside a gym’s account, are recorded in that gym’s audit log.
- Data is backed up regularly, and backups are encrypted and kept separately from the live servers.
07What you can do
- Give every staff member their own login and the smallest role that lets them do their job. Disable accounts as soon as someone leaves.
- Use a long, unique password, and never share logins.
- Review your activity log and signed-in devices from time to time.
- Only issue API tokens to apps you trust, and revoke tokens you no longer use.
08Reporting a vulnerability
If you believe you have found a security problem in Gyms Cloud, please email info@cybexinnovation.com with the subject “Security” and enough detail for us to reproduce it. Please do not access other customers’ data, degrade the service or publish the issue before we have had a reasonable chance to fix it. We will acknowledge your report within two business days, keep you updated, and credit you if you wish.
09If something goes wrong
If we discover a security incident that affects personal data, we will contain it, investigate, notify affected gyms without undue delay with what we know and what they should do, and notify regulators where the law requires — including the Data Protection Board of India and CERT-In within the timelines they set.