Security & Data Protection

MØDUS holds some of the most personal information a coaching relationship produces — body metrics, progress photos, private messages and payment records. We treat it that way: private by default, encrypted everywhere, and visible only to the people it belongs to.

MØDUS runs on enterprise cloud infrastructure that is independently audited and certified to SOC 2 Type II and ISO 27001. These certifications belong to our hosting providers and cover the physical and operational security of the platform MØDUS is built on.

• Data is stored in tier-1 data centres with restricted physical access.
• Infrastructure is monitored 24/7.
• Automated backups protect against data loss.

• At rest: stored data, including files and photos, is encrypted with AES-256.
• In transit: every connection to modus.fitness uses HTTPS with TLS 1.3.
• Calendar connections: Google and Apple Calendar credentials are stored encrypted on our servers and are never shown to other users.

• Every record is access-controlled at the data layer: athletes only see their own data, and coaches only see athletes on their roster.
• Body metrics, session photos and videos, and chats are private between athlete and coach — never public.
• Media is served through short-lived private links instead of public addresses.
• Account roles are stored separately and cannot be changed by users themselves.
• We never sell your data. See our Privacy Policy.

• Passwords are never stored in plain text; they are securely hashed.
• Sign-in sessions use expiring tokens, and password resets are verified by email.
• Signing out ends your session on that device.

If you believe you've found a security issue in MØDUS, please email contact@modus.fitness with the details and steps to reproduce. Please give us reasonable time to fix it before sharing publicly, and don't access or modify other users' data. We'll acknowledge your report and keep you updated.

Privacy Policy · Terms of Service