Security at Restaurant Velocity

How we protect operator data and Google Business Profile credentials. Plain language. Updated April 27, 2026.

Encryption

All data in transit is encrypted with TLS 1.3. All data at rest is encrypted with AES-256. OAuth refresh tokens are encrypted with AES-256-GCM using a per-Customer key derived from a master key managed in a Hardware Security Module. Plaintext tokens never enter our application logs. Logging filters are tested in CI to catch accidental token exposure.

Tenant isolation

Every Customer is one tenant. Tenants are isolated using Postgres Row Level Security policies. Cross-tenant reads are prevented at the database layer, not just at the application layer. We have unit tests that attempt to read across tenants and assert they fail.

Access controls

Internal access to production data is limited to authorized engineers acting under a support ticket. Every production data access event is logged with timestamp, engineer ID, ticket reference, and tenant. We do not browse Customer data without a ticketed reason.

Compliance roadmap

  • Active: OWASP application security guidance. GDPR and CCPA data subject access workflow. Documented incident response plan.
  • In flight: SOC 2 Type 1 (target 6 months post-launch).
  • Year 1: Annual third-party penetration test. Public bug bounty.

Incident response

If we discover a confirmed personal-data incident, we notify affected Customers within 4 hours and publish a post-mortem within 14 days. Our incident contacts are security@restaurantvelocity.com for security issues and privacy@restaurantvelocity.com for privacy issues.

Bug bounty (preview)

We have a vulnerability disclosure program at security@restaurantvelocity.com. We commit to a 90-day fix SLA on validated vulnerabilities and we do not threaten or pursue legal action against good-faith researchers acting within scope.

Third parties we rely on

We use a small number of subprocessors to operate the Service. Categories are listed in our Privacy Policy section 5. A current named list is available to all paying Customers from their account settings, and to anyone on written request to privacy@restaurantvelocity.com.

Operator controls

Default mode for every new account is Manual. Every change requires explicit per-item approval. Auto-publish modes are opt-in and individually confirmed. Every operator can disconnect at any time, which immediately revokes our access to Google Business Profile and triggers data purge per the Privacy Policy.

Questions? security@restaurantvelocity.com. Privacy questions: privacy@restaurantvelocity.com.

Scroll to Top