Security
How we protect your data
At Fit Collective, we handle sensitive data on behalf of our brand customers — including shopper reviews, product catalogues, and order history. We take this responsibility seriously, and this page explains how we protect that data.
If you have a security question not answered here, email us at security@fitcollective.io.
Infrastructure
Fit Collective runs on Amazon Web Services (AWS), hosted in the EU (Stockholm region, eu-north-1). All network traffic is encrypted using TLS 1.2 or higher. Data at rest is encrypted using AES-256 encryption across all production databases and storage.
Our analytics warehouse runs on Snowflake, which enforces encryption at rest and in transit by default.
We perform automated backups of production data, retained for 14 days.
Data isolation
Fit Collective is a multi-tenant platform. Every query against our analytics layer is scoped to your brand's data using a strict tenant isolation model — it is not possible for one brand's data to be visible to another. This is enforced at the infrastructure level on every request, not just at the application level.
Authentication and access control
End-user authentication is handled by Auth0, an industry-standard identity platform hosted in the EU. Passwords are never stored by Fit Collective.
Internally, we follow a least-privilege access model — team members are granted only the access they need to do their jobs. Access to production systems is restricted and reviewed regularly. All AWS API activity is logged via CloudTrail for audit purposes.
Secrets management
Application secrets and credentials are stored in AWS Systems Manager Parameter Store as encrypted SecureString parameters. Secrets are never stored in source code or unencrypted configuration files.
Dependency management
We use automated vulnerability scanning (GitHub Dependabot) across all production repositories to detect and remediate known vulnerabilities in third-party dependencies.
Incident response
We maintain a documented incident response plan. In the event of a security incident affecting customer data, we will notify affected customers within 72 hours in accordance with GDPR requirements.
Privacy and GDPR
Fit Collective operates in compliance with the UK GDPR and EU GDPR. Our brand customers are data controllers; Fit Collective acts as a data processor.
All infrastructure and data processing takes place within the EU. We do not transfer personal data outside the European Economic Area.
We will never sell or share your data with third parties without your explicit consent.
Shoppers whose data is processed via Fit Collective integrations can request access to or deletion of their data by contacting the brand directly, or by emailing privacy@fitcollective.io.
Our full privacy policy is available at fitcollective.io/privacy-policy.
We are happy to sign a Data Processing Agreement (DPA) with any brand customer upon request.
Vulnerability disclosure
If you discover a security vulnerability, please report it to security@fitcollective.io. We will acknowledge your report within 48 hours and keep you updated on our investigation.
Please do not publicly disclose vulnerabilities before we have had the opportunity to investigate and remediate.