Security

Encryption

• In transit: every site and app is served over HTTPS, and browsers are told to use HTTPS only.
• At rest: our database, file storage and backups are encrypted at rest by our providers.
• Access tokens for services a coach connects, such as calendars and Instagram, are kept in an encrypted vault and never shown again.

Each business walled off

Every business on Ceiling has its own data, and row level security in the database keeps it separate. Every query is checked against the business the request belongs to, so one business can never read another's data, even through a mistake in our code.

Inside a business, the same rules decide what each person can see: clients see their own data, and coaches and their team see what their role allows.

Sign in

There are no passwords to steal or reuse. You sign in with a one-time code or link sent to your email. Codes expire, links work once, and sign in attempts are rate limited.

Sessions belong to one business's address, so signing in to one coach's app never signs you in to another.

Activity log

Coaches can see what happened in their business in Settings, then Activity: payments, refunds, subscription changes, enrollments, coupons, applications and AI approvals, each with its time.

Backups

The production database is backed up every day, and copies in backups are removed as the backups expire.

Payments

Payments are handled by Stripe. Card numbers are entered on Stripe's own checkout and go straight to Stripe, so they never touch our servers. We only receive details such as the card brand, last four digits and payment status.

Report a vulnerability

If you think you have found a security problem, email security@ceiling.app with the steps to reproduce it. Please give us a reasonable time to fix it before telling anyone else, do not access or change other people's data, and do not run tests that slow down or disrupt the service. We will confirm we received your report and keep you updated.