Security
Trust, enforced structurally.
Role-based access control, JWT sessions with per-session revocation, bcrypt password hashing, and strict cross-agency data isolation — verified by a dedicated security test suite.
- JWT authentication with unique per-session IDs (JTI)
- Access-token blacklisting on logout — a revoked token stops working immediately
- Concurrent sessions supported and independently revocable
- Bcrypt password hashing
- Role-based access control across four roles: admin, agency, trainer, client
- Cross-agency data isolation enforced from JWT context at the service layer
- Input validation and error responses that do not leak data
- TLS-terminated gRPC in production
- Account deletion available to clients and trainers from within the app
Cross-agency isolation is structural, not UI filtering.
Enforced from the JWT context at the service boundary — one agency cannot read another agency's trainers, clients, plans, or sessions. Covered by a dedicated security test suite.