Transport and sessions
Production must use HTTPS and secure cookies, with trusted hosts and session settings appropriate to the domain model.
Only verifiable controls
Security and restaurant data protection
A clear description of implemented controls: HTTPS, sessions, permissions and tenant-aware data access.
Roles and permissions
Owner access is separated from staff, and administration areas are restricted by role and subscription.
No fake certifications
We do not claim certifications or legal compliance that have not been formally obtained.