Security & compliance

Every restaurant's data is isolated at the application layer — queries that don't carry a restaurantId filter are blocked by a custom ESLint rule before they reach production. Every mutation writes an audit log row attributed to the actor who made the change.

Customer data is encrypted in transit (TLS 1.3) and at rest (Postgres + provider keys). Sentry breadcrumbs are passed through a PII scrubber before they leave our servers — phone numbers and email addresses are redacted by default.

We never store card numbers. Card data is handled by Stripe (PCI-DSS Level 1) or — for phone payments — by Twilio's PCI-scope Pay connector. We hold token references only.

Every restaurant can sign in and self-serve both a full data export and a permanent account deletion from Settings → Danger Zone. The delete is irreversible and cascades through every row tagged to your restaurant. Operators can also run deletion requests received via support email — the operator path requires the same verbatim confirmation.

We retain confirmed orders for 7 years (tax records) but anonymise them after the SOC2-recommended window: caller name, phone, and item-level details are stripped while we keep aggregate revenue totals. Call recordings (when you enable them) are dropped after 12 months. Opt- out records are kept for 5 years per TCPA.

Every outbound SMS leads with the restaurant's name, ends with a Reply STOP to opt out clause, and is sent only after a caller initiates contact (transactional, not marketing). Our STOP handler responds in English and Spanish today; more languages roll out in Phase 3.

Recording is off by default. Owners in two-party-consent states (CA, FL, IL, MA, MD, MT, NV, NH, PA, WA, DC) can opt in via Settings → Call Recording — the moment recording is on, every call begins with “This call may be recorded for quality and order accuracy.” We are not your lawyers; jurisdiction-specific compliance is your responsibility.

Live operational signal at /status. If something breaks, you'll know before your callers do.

Every privileged operation — admin suspends, profile edits, plan changes, data deletions — writes an immutable audit row. We can produce a per-tenant chronological access log on request for SOC2 / due-diligence reviews.