Security
What we actually do with your data.
Written for whoever has to sign off on a new vendor. Every claim below is something you can check in the product or in our subprocessor list, and the things we have not done yet are listed too.
How the product is built
Every query is scoped to one workspace
Workspace isolation is enforced in the data layer rather than the interface. A request carries the organisation it belongs to and the query cannot return rows outside it, so a bug in a screen cannot expose another restaurant's stock.
Encrypted in transit and at rest
All traffic is HTTPS. The database and file storage are managed by Supabase, which encrypts data at rest on disk and in backups. We do not operate our own database servers.
Six roles, enforced server-side
Owner, Admin, Manager, Viewer, Server and Chef each see a different product. Access is checked on the server for every route, not by hiding menu items — typing a URL you should not have does not work.
Two-factor authentication
TOTP, compatible with any authenticator app. When it is pending, every authenticated route redirects to the challenge until it is cleared, so a half-finished login reaches nothing.
Audit trail
Workspace actions are recorded with the user, the action, a timestamp, the IP address and the user agent. Stock itself is an append-only event log: entries are never quietly overwritten, which is why a variance can always be traced back to what caused it.
Uploads are checked, not trusted
Image uploads are size-capped, restricted to an allowlist of types, and verified by reading the file's magic bytes — a file that claims to be a JPEG but is not gets rejected before it is stored. Files live in a private bucket and are served only through short-lived signed URLs.
We never see your card
Payments run through Stripe's hosted checkout. Card numbers are entered on Stripe's own form and never reach our servers or our database.
Deletion means deletion
Closing an account anonymises the personal data immediately and marks the workspace for removal. A nightly job permanently purges workspaces past their grace period. You can also transfer ownership instead of deleting, so a departing owner does not take the restaurant's history with them.
Where your data lives
The database and file storage are in the European Union. This table is generated from the same subprocessor list our DPA references, so it cannot drift from what that page says.
| Provider | Purpose | Region |
|---|---|---|
| Supabase | Database and authentication | European Union |
| Vercel | Application hosting | United States |
| Stripe | Payment processing | United States |
| Sentry | Cloud monitoring | European Union |
What we do not have yet
Yumpit is early, and a security page that lists only strengths is not worth reading. These are the things a thorough review will ask about and the honest answers.
- No SOC 2 or ISO 27001 certification. We are not audited against either standard, and you will not find a badge for one anywhere on this site. If your procurement process requires a certified vendor, we are not one yet.
- No third-party penetration test has been commissioned. The controls above are how the product is built, not findings confirmed by an external assessor.
- No contractual uptime SLA except on the Custom plan. We do not publish an availability figure we have not measured over a meaningful period.
Reporting a vulnerability
If you have found a security issue, email us with enough detail to reproduce it and we will confirm receipt. We will not pursue anyone who reports a genuine issue in good faith and gives us reasonable time to fix it before disclosing it.
Reviewing us as a vendor?
Ask for whatever your process needs. If we do not have it, we will tell you rather than send you something that sounds close.