Security at Kasratbook.

Kasratbook stores operational data that gyms rely on every day: member profiles, payments, dues, attendance, biometric device events, staff permissions, and communication history. We design security around one simple idea: the right person should get the right access at the right time, and every sensitive action should leave a trace.

Kasratbook is currently operated by its platform operator and founding team. We will update this page with formal company and certification details as those controls mature. This page describes our current security posture; it is not a compliance certificate, audit report, or warranty.

Kasratbook uses HTTPS, secure session cookies, strict production secrets, request rate limits, security headers, origin checks for browser requests, input validation, and server-side authorization checks across protected APIs.

Backend APIs verify JWT token type, token revocation status, account status, gym status, role permissions, and tenant scope before returning protected gym data.

Owner and staff passwords are hashed with bcrypt. Login attempts are rate-limited and repeated failures can temporarily lock the account. Password resets use time-limited tokens and successful password changes invalidate older sessions.

Kasratbook supports email/password login, Google sign-in where enabled, phone-based flows for member portal access, and extra verification for super-admin access.

Every gym workspace is scoped by gym ID. Staff permissions determine which modules a user can view or change, including members, billing, attendance, classes, settings, biometric devices, reports, and staff management. Backend services are expected to enforce tenant scope even when the frontend hides an action.

Super-admin routes require normal authentication plus a dedicated admin verification step. The admin area supports authenticator-app TOTP, a separate admin PIN, short-lived admin sessions, stricter admin rate limits, token-age checks, audit logging, and optional IP allowlisting.

Online payments are processed by payment providers such as Razorpay. Kasratbook stores payment status, invoice references, gateway IDs, refund records, and accounting metadata, but it does not store full card numbers, CVV values, UPI PINs, or banking passwords.

WhatsApp and email integrations are scoped to the gym that configures them. Message sending is permission-gated, logged, and subject to provider limits and anti-abuse controls. When QR based WhatsApp is used, the gym is responsible for keeping the linked WhatsApp account and phone device secure.

Kasratbook stores biometric device records, device serial numbers, biometric user IDs, enrollment metadata, access logs, attendance events, and device command history where a gym enables biometric attendance.

Device APIs are gym-scoped, and ADMS-style device communication is designed to use device identity and authentication tokens. Device network security also depends on the gym’s local network, firmware configuration, and physical device access.

Kasratbook uses managed database, object storage, and infrastructure providers. Backups, uploaded files, logs, and operational data are protected using provider security controls and access restrictions. Access to production data is limited to people and systems that need it to operate, support, or secure the service.

We use third-party infrastructure, payment, messaging, email, analytics, and support providers to operate Kasratbook. We aim to choose providers with appropriate security controls, restrict access to production systems, and avoid sharing more customer data than is needed for the provider’s role.

Kasratbook records important activity such as logins, staff actions, member changes, billing events, refunds, payment actions, WhatsApp activity, biometric assignments, and admin operations. Audit logs help gyms investigate changes and help us diagnose incidents.

We use environment-based secret requirements, webhook signature checks where supported, request body redaction for sensitive fields, rate limiting, monitoring, and health checks for core dependencies such as database, Redis, queues, and external providers.

Security is shared. Gym owners should use strong passwords, limit owner/admin access, assign staff roles carefully, remove staff who leave, review WhatsApp templates and recipient lists, secure biometric devices, and keep local network equipment protected.

If you export data from Kasratbook or connect third-party tools, you are responsible for protecting that exported or connected data outside Kasratbook.

Gyms are also responsible for giving proper privacy notices, collecting consent where required, keeping WhatsApp and payment-provider accounts in good standing, and securing local biometric devices, routers, workstations, and staff phones used to access Kasratbook.

If you believe you found a security issue, email [email protected] with enough detail for us to reproduce the problem. Please do not access, modify, delete, or disclose data that does not belong to you.

We do not currently operate a public bug bounty program. We still appreciate responsible, good-faith reports and will work with researchers to investigate valid issues.

If we identify a security incident that affects customer data, we will investigate, contain, and notify affected customers as required by applicable law and the facts of the incident. We aim to communicate clearly, quickly, and with practical remediation steps.

Where a breach creates legal notification duties for a gym, we will provide reasonably available information to help the gym evaluate and meet those obligations.

No system can be guaranteed completely secure. This page describes the controls and posture we use today; it is not a warranty, certification, or promise that a particular attack or outage can never happen.