Your members’ data is the most sensitive thing you hold.
Names, phone numbers, payment records, health details and, if you use facial check-in, biometric data. Here is specifically how MuscleX handles it, and what we do not claim.
isolation
One gym must never see another gym’s data.
MuscleX is multi-tenant: many studios run on one platform. Keeping those studios separate is treated as the system's most important property, not as a configuration setting.
Per-studio data separation
Each gym is a tenant with its own data. Tenant records live in per-studio database schemas rather than pooled into one shared table space.
Gym scoping on every request
The identity of the studio comes from the signed token on the request, and the platform applies that scope to data access. It is not something a page can forget to pass.
Branch-level scoping
Within a studio, branch managers are scoped to their branch. The restriction is applied server-side, not by hiding buttons in the interface.
access
Who gets in, and what they can reach.
Staff accounts are the realistic attack surface in gym software: shared, high-turnover and used on shared machines at a front desk.
Authenticated by default
Every API route requires a signed bearer token. Only sign-in and the health check are reachable without one.
Two-factor authentication
Staff accounts can require a second factor at sign-in, with a supported recovery path for lost devices.
Login lockout
Five failed attempts lock the account for fifteen minutes. The lock is stored, not held in memory, so restarting a server does not reset an attacker’s counter.
Sessions and devices
Active sessions and signed-in devices are visible and revocable, with a login history for every account.
Roles and permissions
Build the roles your organisation actually uses and grant only the permissions each one needs. Available from the Pro plan.
Audit logs
A record of who changed what, available from the Starter plan upward.
data handling
What the system refuses to hand out.
The safest way to avoid leaking a sensitive field is to make it structurally impossible for a route to return it.
Sensitive fields never leave the server
Face descriptors, stored payment tokens, password hashes, two-factor secrets and salary fields are stripped from API responses centrally, so no individual endpoint can leak them by accident.
Private file storage
Member documents and uploads are held in private buckets and reached through signed URLs rather than public links. Uploads are validated server-side for type, size and extension.
Verified payment webhooks
Inbound payment webhooks are signature-checked with a timing-safe comparison before anything is processed. Card details are handled by the payment gateway and never stored by MuscleX.
Validated inputs
Every endpoint validates its payload against a declared schema and rejects unrecognised fields outright, rather than trusting whatever arrives.
Facial check-in is optional, and treated as biometric data.
Face recognition is a convenience feature, not a requirement. If you choose not to enable it, no face data is ever collected.
- Facial check-in is off unless you turn it on, per studio.
- Face descriptors are stripped from every API response, so they are never returned to a client.
- Members who prefer not to enrol can use QR, a device or the front desk instead, with no loss of access.
- Biometric data is regulated differently across jurisdictions. Check your local obligations before enabling it, and tell your members what you are collecting.
honesty
What we do not claim.
Plenty of software in this category advertises certifications it has not earned. We would rather be specific about what exists today.
MuscleX does not currently hold a SOC 2, ISO 27001 or equivalent third-party audit, and this page should not be read as a compliance certification of any kind. The controls described above are the controls that are actually implemented in the product.
Security work is continuous. If you have found something, or your organisation needs a specific control before it can adopt MuscleX, we would genuinely rather hear from you than not.
Run your studio on a system that takes this seriously.
Start on the free plan and see how MuscleX handles your data before you move anything important onto it.
- Free plan
- No card required
- Cancel anytime