Legal
Security
An overview of how Restiqo protects restaurant data, and how to report a security issue.
Draft: This page describes how the product is built. It does not claim any certification or audit. Compliance certifications, audit reports, data-centre locations, retention commitments and a security contact address still need to be confirmed by the business owner before they are published here.
Accounts and access
Every user signs in with their own account. Access inside a restaurant is controlled by roles, so a waiter, a kitchen user and an owner see only the screens their role allows.
Separation between restaurants
Data is scoped to the restaurant that owns it. Database access rules are applied per record so one account cannot read or change another restaurant's orders, menu, customers or invoices.
Data in transit
The website and application are served over HTTPS, and requests between the application and its backend use encrypted connections.
Data on the device
The point of sale stores a working copy of your operational data on the billing device so it keeps working without internet. That local copy syncs to the cloud when connectivity returns. Devices used for billing should be locked with a device passcode.
Payments
Card and UPI payments are processed by the payment gateway. Restiqo does not store card numbers or UPI credentials.
WhatsApp and invoice links
Each restaurant sends from its own verified WhatsApp sender; sender identifiers are chosen on the server from the signed-in restaurant, never from the browser. Invoice links use an unguessable token and expose no customer details in the URL. Operational logs store phone numbers in masked form and never contain access tokens, invoice contents or full invoice links. Sending is rate limited per restaurant and per recipient.
Reporting a vulnerability
If you believe you have found a security issue, report it through the contact form with enough detail to reproduce it, and please do not disclose it publicly until it has been addressed. We will confirm receipt and keep you updated.
Your responsibilities
Keep passwords private, remove staff accounts when people leave, and give each user the lowest role that lets them do their job.