Legal

Security & Data Protection Measures

Last updated: 24 August 2026

A summary of how Cravd protects the data restaurants and their guests trust us with. This describes verified measures we actually have in place, not aspirational or generic claims.

In transit

All traffic to our applications is encrypted (HTTPS) end to end.

Tenant isolation

Cravd is multi-tenant software: every restaurant's menus, orders, and staff accounts are isolated from every other restaurant's at the database level, using row-level security policies that scope every query to the correct restaurant automatically — never based on a value a client device sends us.

Access control

Staff accounts are role-based (restaurant admin, kitchen, or Cravd operator), enforced on our servers rather than trusted from the browser. Our own infrastructure credentials follow least-privilege — for example, the elevated database key that can bypass tenant isolation is used only by our backend, never shipped to a browser or app.

Authentication

Staff sign in via our authentication provider (Supabase Auth), which handles password hashing and session management. Guests never create an account or a password — there is nothing to compromise on the guest side beyond a table-bound session.

Secrets

API keys and credentials are held as environment configuration on our hosting platform, never committed to our source code.

Network access

Our origin restricts which web addresses may call our API (CORS), rather than accepting requests from anywhere.

Backups

Our database provider maintains backups as part of its own managed service.

What we don't claim

Cravd does not currently hold a formal third-party security certification (such as SOC 2 or ISO 27001). If that changes, this page will be updated to say so.

Reporting a concern

If you believe you've found a security issue, tell us: info@cravdstudio.com.

More information

See our Website Privacy Notice and Subprocessors page.

---

← Back to Legal & Trust