Security

Last updated 22 September 2026 · Effective 22 September 2026

How data is protected

In transit: all traffic is encrypted with TLS.
At rest: databases and file storage are encrypted.
Authentication: sign-in is handled by Firebase (Google and Apple), or by a one-time code sent to your email. We never store a plaintext password.
Coach isolation: a coach can only reach clients assigned to them, enforced on the server, not in the interface.
Certification documents: coach credentials are stored privately and served only through short-lived signed links.
Least privilege: staff access to production is limited and logged.

Reporting a vulnerability

Write to security@elsara.ai. Please include enough detail to reproduce it. We will acknowledge within 2 business days.

We ask that you give us reasonable time to fix an issue before disclosing it publicly, that you do not access, modify or delete data belonging to anyone else, and that you do not degrade the service. We will not pursue legal action against researchers who follow this.

Incident notification

If a breach affects your personal data we will notify you and the relevant supervisory authority without undue delay, and within any statutory deadline that applies.