---
title: "Security and data protection | GymSetora"
description: "How GymSetora protects gym data: argon2 passwords, staff two-factor login, AES-256-GCM encryption, Aadhaar last-4 only, owner data export under the DPDP Act."
url: https://www.gymsetora.com/security
updated: 2026-10-22
---

[Home](https://www.gymsetora.com/) › Security

Security

# Security and data protection

GymSetora stores staff passwords only as argon2 hashes, offers two-factor login for staff, encrypts payment keys, WhatsApp tokens and bank account numbers with AES-256-GCM, and keeps only the last 4 digits of Aadhaar. Owners can export all their gym's data and anonymise members on request, in line with the DPDP Act 2023.

## Staff accounts and sign-in

- All plans

  Staff passwords are stored only as argon2 hashes, never in readable form
- All plans

  Two-factor login for staff with an authenticator app
- All plans

  Sign-in sessions use HTTP-only cookies, with CSRF protection, rate limits and security headers on every request
- All plans

  Audit log of logins and staff actions

## Sensitive data

- All plans

  WhatsApp access tokens, payment gateway keys and staff bank account numbers are encrypted with AES-256-GCM; only the last 4 digits of a bank account are shown
- All plans

  For Aadhaar, only the last 4 digits and a one-way hash are kept — never the full number
- All plans

  Personal data inside payment-gateway notifications is purged after 90 days

## Your gym's data

- All plans

  Owner-only full data export and member anonymisation on request (DPDP Act 2023)

## Member money

- All plans

  Dynamic UPI QR that pays straight to your own UPI ID, 0% commission
- Pro+ or add-on

  Members can set up autopay by card or UPI AutoPay through your own Razorpay account, so the money settles straight to you

## Gates and biometrics

- Pro+ or add-on

  The gateway keeps only member codes, first names, card numbers and pass dates — no phone numbers, photos or fingerprint templates
- All plans

  The member's QR pass keeps changing and only works at your gym, so screenshots and forwarded passes are refused

## Found a problem?

If you think you have found a security issue, email [[email protected]](https://www.gymsetora.com/cdn-cgi/l/email-protection#becddbddcbccd7cac7fed9c7d3cddbcad1ccdf90ddd1d3) privately (or message us on [WhatsApp](https://wa.me/919328819265?text=Hi%2C%20I%27d%20like%20to%20know%20more%20about%20GymSetora)) with the steps to reproduce it. Please don’t share it publicly, access other gyms’ data or disrupt the service while testing; we will acknowledge your report and keep you updated until it is fixed. Our contact details are also published in [security.txt](https://www.gymsetora.com/.well-known/security.txt). How we handle personal data is set out in the [privacy policy](https://www.gymsetora.com/privacy).

## Security questions

**Is my gym members' data safe with GymSetora?**

GymSetora stores staff passwords only as argon2 hashes, supports two-factor login for staff, keeps an audit log of logins and staff actions, and encrypts sensitive keys and bank account numbers with AES-256-GCM. Only the owner can export the gym's full data.

All plans

**Does GymSetora store members' Aadhaar numbers?**

No. GymSetora keeps only the last 4 digits of an Aadhaar number and a one-way hash of it, never the full number.

All plans

**Can I take all my gym's data out of GymSetora?**

Yes. The owner can export the gym's full data at any time and anonymise an individual member on request, in line with the Digital Personal Data Protection Act 2023.

All plans

**Does GymSetora store fingerprints?**

No. Fingerprint and face templates stay on the biometric terminal. The GymSetora gateway at your gym keeps only member codes, first names, card numbers and pass dates.

Pro+ or add-on

Start today

## Bridge every gym to growth.

Bring your member list from Excel, collect fees by UPI to your own account and let members check in with a QR. Try every self-serve plan free for 14 days.

[Start 14-day free trial](https://app.gymsetora.com/signup)

[Staff sign in](https://app.gymsetora.com/login)

No card required · Prices include GST

[Chat with us on WhatsApp](https://wa.me/919328819265?text=Hi%2C%20I%27d%20like%20to%20know%20more%20about%20GymSetora)