SECURITY
Security overview
TrainDesk is built with workspace isolation, role-based access, and secure transport as platform defaults for gym operators and their members.
Transport
Administrator dashboards, APIs, and member app traffic are served over TLS. Use HTTPS endpoints only in production environments.
Authentication and roles
Staff and administrator accounts authenticate through secured sessions. Permissions are scoped by gym workspace and role so front desk, trainers, and owners only access what they need.
Workspace isolation
Membership records, billing settings, attendance logs, and staff data are scoped to your gym workspace. Cross-gym access is not part of the product model.
Member and billing data
Subscription status, renewal dates, attendance history, and communications are processed to operate the service. We do not sell gym member lists. See the Privacy Policy for retention details.
Operational monitoring
We monitor platform reliability and security signals to detect abuse, protect availability, and support incident response.
Responsible disclosure
If you believe you have found a vulnerability, email contact@traindesk.com.np with steps to reproduce. Please avoid accessing other gyms' data or disrupting production systems.