VenueChef is designed for hospitality venues that handle real customer orders and payments. Security is built into the architecture from authentication down to the device.
Authentication and access control
VenueChef uses Supabase Auth for identity. Passwords are hashed with modern algorithms. We support optional two-factor authentication (TOTP) for owner and manager accounts. Every API request is authenticated and authorised through row-level security policies that enforce organisation boundaries.
Row-level security and multi-tenancy
Every database row belongs to an organisation. Staff can only read and write data for venues they are members of, and only if they hold the right capability. The public guest menu is reached only through a unique, revocable token tied to a specific service point.
Encryption
Data is encrypted in transit using TLS. Data at rest is protected by the hosting provider. PIN hashes and credentials on the Flutter POS app are stored in the device's secure storage.
Offline operation and device data
The Flutter POS app maintains a local projection of venue data so it can keep working without a connection. Local data is stored in the app sandbox and is removed when the app is uninstalled or its storage is cleared by the device owner.
Payments and billing
VenueChef does not store card details. Subscription billing is handled by Stripe. Guest payments are recorded as cash or as handled by the venue's own terminal; VenueChef does not process card-present guest payments.
Monitoring and incident response
We log security-relevant events, review access patterns and keep dependencies up to date. If you discover a vulnerability or incident, please contact legal@venuechef.com.
Responsible disclosure
We welcome responsible disclosure of security issues. Please do not test against live venues or customer data. We will respond promptly and credit researchers who report valid issues with our permission.