Security
Not by application code remembering to filter — by row-level security the database enforces whether or not the code asks nicely.
Row-level security is forced on every org-scoped table. Isolation across all 36 tables is verified by an automated suite on every single change — the tests deliberately query without a filter and must still come back correctly scoped. A bug that leaked another gym's data would fail the build.
Payments run on Stripe end to end — subscriptions, checkout, the customer portal, webhooks. Raw card data never reaches a Superaxe server, so it cannot leak from one.
Operational events are written to an append-only activity ledger with no update path and no delete path. Database triggers capture them, so nobody can forget to log something inconvenient.
Actions are attributed to the staff member who took them, with timestamps. That is the same mechanism that makes tour-to-signup rate by staff a real number — the audit trail and the reporting are the same records.
Evidence
None of this proves the software is perfect. It does mean the claims on this page are things you could check rather than things you have to believe.
Honest limits
Superaxe is not SOC 2, HIPAA or PCI Level 1 certified, and we will not imply otherwise to win a deal. Stripe holds PCI certification for the payment path; that is Stripe's, not ours.
A human penetration test has not been performed. When one has, this page will say so and name who did it.
We aim high and will tell you about incidents, but there is no SLA unless it is written into your contract.
Download your complete member database, payment history and attendance records at any time, in CSV. No support ticket, no retention call, no fee. Some gym software makes leaving hard on purpose — that is a business model we would rather not have.
Send them our way. We'd rather answer a hard technical question honestly than have you find the gap after you've migrated.