Security

Platform Availability

Baseline is built for reliability. Our infrastructure is deployed across a global edge network with automatic failover and redundancy. We target 99.9% uptime and actively monitor all services around the clock. Status updates and incident reports are communicated promptly to affected customers.

Infrastructure Security

Baseline is hosted on Vercel, which provides enterprise-grade infrastructure with automatic scaling, edge network distribution, and DDoS protection. All traffic is encrypted with TLS 1.2+ in transit. Data at rest is encrypted using AES-256. Our DNS and CDN are managed through Cloudflare, providing additional security layers including WAF (Web Application Firewall) and bot mitigation.

Key Infrastructure Controls

• Automatic TLS certificate provisioning and renewal
• Global edge network with built-in DDoS mitigation
• Isolated build environments with no shared state
• Immutable deployments with instant rollback capability
• Cloudflare WAF and rate limiting at the network edge

Application Security

We follow industry best practices to ensure application-level security across every layer of the platform.

Security Controls

• Content Security Policy (CSP) headers on all pages
• CSRF protection on all form submissions and API endpoints
• Input validation and sanitization on all API endpoints
• Rate limiting to prevent abuse and brute-force attempts
• Strict HTTP security headers (HSTS, X-Frame-Options, X-Content-Type-Options)
• Regular dependency audits and automated vulnerability scanning
• Server-side rendering with no sensitive data exposed to the client

Payment Security

Payment processing is handled by our PCI DSS Level 1 compliant payment partner. Baseline never stores credit card numbers, CVVs, or other sensitive payment data on our servers. All payment transactions are processed through encrypted, tokenized connections.

Payment Controls

• PCI DSS Level 1 certified payment processing
• Tokenized card storage — no raw card data touches our servers
• Encrypted payment transmission via TLS
• Automated failed payment recovery with retry logic
• Real-time transaction monitoring and fraud detection

Access Control & Authentication

Baseline uses role-based access controls to ensure team members only access what they need. Facility owners can configure granular permissions for staff, trainers, and administrators.

Authentication Controls

• Role-based access control (RBAC) for staff and administrators
• Multi-factor authentication (MFA) for internal systems
• Session management with automatic timeout
• Secure password hashing with modern algorithms
• Audit logging for sensitive operations

Data Privacy & Ownership

We collect only the data necessary to provide our services. We do not sell your data to third parties. You retain full ownership of all data you upload to the platform and can request a complete export at any time.

Privacy Commitments

• You own your data — we never sell or share it with third parties
• Full data export available on request
• Data retention policies aligned with your account lifecycle
• Minimal data collection principle — we only store what's necessary
• Transparent data processing as outlined in our Privacy Policy

Monitoring & Incident Response

We use real-time monitoring and alerting across all production systems to detect and respond to issues before they affect your experience.

Monitoring Stack

• Real-time error tracking and alerting via Sentry
• Automated performance monitoring and anomaly detection
• Structured incident response process with defined severity levels
• Post-incident reviews and root cause analysis

Responsible Disclosure

If you discover a security vulnerability, we encourage responsible disclosure. Please report any security concerns to security@baselinepro.com. We will acknowledge your report within 48 hours and work to resolve confirmed vulnerabilities promptly.