Your restaurant's data, treated like it's ours.
Schedules, pay rates, recipes, inspection records — the stuff in RestaurantFlow is the stuff that runs your business. Here's exactly how we protect it.
Your restaurant's data is isolated at the database layer
Every table is scoped to your organization and enforced with Postgres row-level security — isolation lives in the database itself, not just in application code. One restaurant can never read another's data.
Privileged actions leave a trail
Role changes, invitations, API tokens, billing changes, and every successful change made in the app are recorded in your organization's audit log — who did what, and when. Message contents and note bodies are never stored in activity records.
Our own staff are held to the same standard
When our support team assists inside your account — including concierge onboarding, where our implementers load your data for you — every action is logged under their identity, in a trail you can see. Platform-level actions are additionally recorded in a separate log our staff can't erase by deleting records.
Encrypted in transit and at rest
All traffic runs over TLS; data is encrypted at rest by our infrastructure providers. Payment cards never touch our servers — checkout and card storage are handled entirely by Stripe.
AI features read, they don't hoard
Receipt photos and setup uploads are processed to extract your data and are not used to train models. Every AI call is attributed and metered per organization.
No lock-in — your data exports
Owners can export their organization's data, and every module offers CSV or PDF exports. We keep customers with value, not with hostages.
Subprocessors
The services that help us run RestaurantFlow, and what each one touches.
| Supabase (AWS) | Database, authentication, file storage |
| Vercel | Application hosting and delivery |
| Stripe | Payments, subscriptions, invoices |
| Anthropic | AI features (Coach, receipt reading, drafting) |
| Vapi | Voice AI telephony and speech |
| Resend | Transactional email |
| Twilio | SMS delivery |
Found something?
If you believe you've found a security issue, tell us directly and we'll take it seriously: support@restaurantflow.app. We'll acknowledge quickly, keep you posted, and never take legal action against good-faith research.