Security
Most of the security story here is subtraction: the data RetainLens never asks for cannot leak, and access it never requests cannot be abused.
RetainLens is not live yet. This page describes how the product is being built and what is true when the first account opens. It does not describe a system that holds customer data today, and it will be dated again when one does.
Read-only, at the token level
Integrations with TeamUp and Pike13 request read scopes only. RetainLens cannot cancel a membership, charge a card, book a class or edit a record. Not because a check in our code says no, but because the access token was never issued for it. The CSV path has the same property by nature: a file you export and hand over.
What is never stored
No health data, no injury notes, no body metrics, no payment card details, and no member contact details beyond an email address where you choose to include one. The importer maps the columns the scoring needs (name, join date, membership type, status, check-in timestamps) and drops the rest instead of keeping it in case it turns out useful.
Card data goes from your browser to Stripe and never touches our servers.
Isolation
Every row carries the account it belongs to, and isolation is enforced in the database with row-level security rather than only in application code, so a missing filter in a query cannot expose another studio's members.
Encryption
Everything is served over TLS; plain HTTP is redirected and HSTS is set. Data at rest is encrypted by the database and backup providers. Passwords are stored as salted hashes by the authentication provider, never as recoverable strings.
Hosting and region
The application and its database are provisioned in an EU region at launch. Sub-processors that are US companies are covered by Standard Contractual Clauses; the current list is in the Data Processing Agreement.
Access
Production access is limited to the people who need it to run the service, today one person, with multi-factor authentication on every provider account. Support access to a customer account happens only with the customer's request and is logged.
Backups
The database is backed up daily with point-in-time recovery, and backups age out within 35 days. Restores are tested rather than assumed. Backups are encrypted and live in the same region as the primary.
What we do not have
No SOC 2 report and no ISO 27001 certificate. RetainLens is a one-person product and pretending otherwise would be the least trustworthy thing on this page. What we do offer instead is a short data list, read-only access, a signed DPA and a straight answer to any security question you send.
Reporting a vulnerability
Write to hello@retainlens.com with what you found and how to reproduce it. We will confirm within three business days and keep you posted until it is fixed. We do not pay bounties yet, and we will not send lawyers after anyone acting in good faith: do not access other people's data, do not degrade the service, and give us reasonable time before publishing.