Security & Data Protection Measures
Last updated: 24 August 2026
A summary of how Cravd protects the data restaurants and their guests trust us with. This describes verified measures we actually have in place, not aspirational or generic claims.
In transit
All traffic to our applications is encrypted (HTTPS) end to end.
Tenant isolation
Cravd is multi-tenant software: every restaurant's menus, orders, and staff accounts are isolated from every other restaurant's at the database level, using row-level security policies that scope every query to the correct restaurant automatically, never based on a value a client device sends us.
Access control
Staff accounts are role-based (restaurant admin, kitchen, or Cravd operator), enforced on our servers rather than trusted from the browser. Our own infrastructure credentials follow least-privilege, for example, the elevated database key that can bypass tenant isolation is used only by our backend, never shipped to a browser or app.
Authentication
Staff sign in via our authentication provider (Supabase Auth), which handles password hashing and session management. Guests never create an account or a password: there is nothing to compromise on the guest side beyond a table-bound session.
Secrets
API keys and credentials are held as environment configuration on our hosting platform, never committed to our source code.
Network access
Our origin restricts which web addresses may call our API (CORS), rather than accepting requests from anywhere.
Backups
Our database provider maintains backups as part of its own managed service.
What we don't claim
Cravd does not currently hold a formal third-party security certification (such as SOC 2 or ISO 27001). If that changes, this page will be updated to say so.
Reporting a concern
If you believe you've found a security issue, tell us: info@cravdstudio.com.
More information
See our Website Privacy Notice and Subprocessors page.
← Back to Legal & Trust