How we protect your data
Your sales and costs are sensitive. Here is what is in place today, and what isn't yet.
How we protect your data
Each company kept apart
Every record belongs to one company, and the database itself stops a company from reading another's data (PostgreSQL row-level security). Automated tests check it.
We don't look without your permission
Our team can't browse your data. If you need support, you grant access for a number of hours you choose. It is logged, and you can revoke it.
Account protection
Two-step verification with single-use codes, and you can make it mandatory for owners and admins. After repeated failed sign-ins the account is locked for a while.
Roles per branch
Owner, branch manager and kitchen team each have a role, given for one branch or for all of them. People see only what their role allows.
Audit log
Approvals, setting changes and automated actions are recorded with who did them and when.
Encryption
Connections use TLS. Integration credentials and two-step verification secrets are stored encrypted.
Safe connections
Addresses for your POS connection are checked before we call them, so they can't be pointed at internal networks.
Your data stays yours
Export all your data whenever you want. If you close your account, it is deleted after a grace period.
Hosting in Saudi Arabia
Your data is not hosted in the Kingdom yet. We plan to move to a Saudi cloud region at launch, in line with the Personal Data Protection Law. If in-Kingdom hosting is a requirement for you, ask us for the date and where your data sits today.
A security questionnaire from your IT team
Send it over and we'll answer it, or we can set up a call to walk your team through how the system is built.