Security built
in from day one
Encryption in transit and at rest, isolated data for every restaurant, clear permissions and a log of sensitive actions. Your data is hosted in Frankfurt (EU).
How we protect your data
Encryption in transit & at rest
All traffic over HTTPS (TLS) with HSTS, and data encrypted at rest by our database provider. Passwords are bcrypt-hashed.
Tenant isolation
Each business has its own ID, and isolation is enforced twice: by the application on every query, and by Row-Level Security policies inside the database itself.
Roles & permissions
8 built-in roles. Price overrides and cancelling partly-paid orders require a manager PIN; manual discounts are always logged.
Optional 2FA
Turn on TOTP two-factor authentication for dashboard accounts via Google Authenticator or Authy, with backup codes.
Audit log
Sensitive actions (void, discount, refund, permission change) are recorded with who did it and when.
Secure sessions
Short-lived access tokens with refresh tokens rotated on every use and revoked on logout.
Abuse protection
Rate limiting on sensitive endpoints, and bot protection on forms via Cloudflare Turnstile.
Error monitoring
We monitor system errors in real time to catch and fix them fast, with personal data scrubbed before sending.
Compliance & hosting
Hosting and data-transfer details are in our privacy policy.
Found a security issue? Email security@alifood.co
We welcome responsible disclosure and appreciate every report — we will respond and fix issues promptly.