Security

• Encryption: TLS for all traffic; provider access/refresh tokens encrypted at rest (Fernet / AES-128-CBC + HMAC).
• Least privilege: production data accessible only to named staff with MFA; access logged.
• Tokens: personal access tokens are stored as SHA-256 hashes and can be revoked in Settings.
• OAuth: authorization code flow with PKCE and signed, short-lived state; redirect URIs fixed per provider.
• Data minimisation: only the data types listed in the Data Use policy are stored.
• Backups: encrypted, rotated, purged within [35] days.
• Incidents: users, affected providers and authorities notified as required (target: within 72 hours).

Reporting a vulnerability

Email security@vo2max.health. Please do not access other users' data; we will acknowledge within 3 business days.