Security & Privacy
This page is maintained by DutyReady 365 to answer common questions about how we protect your personal information and payments. It describes enabled controls and current practices — not an independent certification.
Payments — You're PCI-Protected
Payments are processed by Stripe, a certified PCI-DSS Service Provider Level 1 — the highest tier of payment security certification, audited annually.
Card number, CVC, and expiry are entered inside a Stripe-hosted form and travel directly from your browser to Stripe. Card data never touches DutyReady 365 servers, so it cannot be stolen from our database.
Encryption
In transit: All connections use TLS 1.2+ (HTTPS).
At rest: Card data is stored by Stripe under AES-256 in isolated vault infrastructure. Account data is stored in an encrypted database hosted on SOC 2-certified infrastructure.
Webhooks from Stripe are cryptographically signed and verified with HMAC-SHA256 on every request.
Fraud & Dispute Protection
Every transaction is scored by Stripe Radar for fraud risk, with automatic 3D Secure step-up authentication where required by your bank.
Chargebacks, disputes, and eligible refunds are processed on our behalf by Stripe's managed payments program.
What Personal Data We Store
Only what's needed to run your account: email address, display name, subscription status, workout/nutrition logs you create, and non-sensitive references to your Stripe customer record.
Every user-data table is protected by Row Level Security — you can only read your own data, and administrator access is scoped to a hardcoded allowlist.
We Do Not Sell Your Data
DutyReady 365 does not sell, rent, or share your personal information with advertisers or data brokers.
Stripe (payments) and our hosting provider are the only processors that handle your data, each under their own privacy commitments and strictly for the purpose of delivering the service.
Account Security
Passwords are checked against the Have I Been Pwned database at signup and password change — passwords known from public breaches are blocked.
Sign in with Google is available so you can rely on your existing Google account security (2FA, hardware keys, etc.).
Your Rights & Deletion
You may request a copy of your data or full deletion of your account at any time by emailing support. Payment records retained by Stripe are subject to their retention policies for legal and tax compliance.
Report a Security Issue
If you believe you've found a security vulnerability, please email us and we'll respond within 1 business day. Please do not publicly disclose issues until we've had a chance to investigate.
Questions about how your data is handled?