Security at TrainerSuite

Trainers and clients can sign in using email and password, a one-time code sent by email or text, Google, or Apple. Requests to the trainer and client areas of the app are validated against the signed-in session on the server before account data is loaded.

TrainerSuite uses database row-level access rules keyed to workspace membership to separate the clients, sessions, and payments that belong to unrelated trainer accounts.

Sensitive information like private notes about a client, session notes, and a client's injuries and emergency contact are encrypted before they're stored.

When you connect a client to the client app, they see their own sessions, packages and payments, plus the details they need from you, like your business name and where to train. They never see other clients, and they can't see your private notes about them or your notes on their sessions.

These limits are enforced by access rules inside the database, not just by what the app's screens show. Row-level security is switched on for every table that holds your data. Clients read through restricted views that leave out your internal details, such as notes, calendar event titles, gym payout terms and your internal business settings.

If you turn off a client's access, they lose access to your sessions, packages and payment history in the client app. Payment links you've already sent keep working until they expire or you cancel them. If a client trains with more than one trainer on TrainerSuite, each trainer's records stay separate.

We test these rules against our live database using simulated trainer and client accounts.

For Zelle, Venmo, cash, and check, payment happens outside TrainerSuite. TrainerSuite can show the trainer's payment instructions and, for supported digital methods, link to or open the payment app. TrainerSuite does not receive or hold those funds. The trainer confirms the payment record in TrainerSuite.

For card payments, Stripe hosts checkout and processes the charge on the trainer's connected Stripe account. Stripe handles the card payment and payout, including applicable processing and TrainerSuite platform fees. TrainerSuite does not receive or store card numbers.

Trainers paying for a TrainerSuite plan also enter their card on Stripe's hosted checkout page.

TrainerSuite keeps payment records such as the amount, date, purpose, status, and Stripe reference numbers, so those business records stay available. Read more on Stripe's security page.

When a trainer connects Google Calendar or Apple Calendar, TrainerSuite encrypts the stored credential that keeps the connection working with AES-256-GCM before writing it. Disconnecting the calendar clears the stored credentials for that connection.

Google Analytics runs on the public marketing site only, not inside the signed-in app. Inside the app, TrainerSuite uses Vercel Web Analytics. Before a page view is sent, TrainerSuite removes client and session identifiers, invite and payment tokens, the query string, and the URL fragment. If a URL cannot be cleaned, the event is not sent.

TrainerSuite uses Vercel for application hosting and Supabase Postgres for application data.

Vercel redirects HTTP requests to HTTPS and documents support for TLS 1.2 and TLS 1.3 for encrypted traffic to the application (Vercel encryption docs).

Supabase states that customer data on its platform is encrypted at rest using AES-256 and in transit using TLS (Supabase security). TrainerSuite's production Supabase project is on a paid plan that includes daily database backups. These are controls provided by Supabase, not TrainerSuite certifications.

• We don't sell your data or your clients' data.
• We don't give your business or client data to advertisers or data brokers.
• We share information only with the services that run TrainerSuite (hosting, database, analytics, email, notifications, sign-in and payments), and only what they need. Beyond that, we share it only when the law requires it, to protect someone's safety, or when you ask us to.
• Your financial records (payments, packages and what you charge) are used only to run your account. They're never shared beyond the services above.
• We only access account data to run, support or secure the service.
• You can start deleting your account from Settings, and you can email us to ask for a copy of your data or to correct it. Our Privacy Policy has the details.