1. Overview
This page describes the security controls actually built into Restzo today, in plain language — not a marketing checklist. We'd rather tell you exactly what's in place than imply more than is true. Restzo is built for Indian MSMEs and is designed around the Digital Personal Data Protection Act, 2023 (DPDP Act) — see our Privacy Policy for the full legal detail.
2. Authentication & Access
• Passwords are hashed with bcrypt — never stored in plain text. • Role-based access control: staff accounts (Owner, Manager, Staff, Kitchen) are scoped to only the permissions their role needs. • Every account can review and end all of its active sessions at once ("log out of all devices"), and a password change automatically invalidates any other signed-in session.
3. Data Protection
• All traffic to and from Restzo is encrypted in transit (TLS), enforced automatically at the network edge. • Business data is stored in a managed Postgres database (Supabase) with encryption at rest handled at the infrastructure level. • Security headers (Content-Security-Policy, HSTS, and others) and explicit request-origin checks are applied across authentication and dashboard traffic. • Public-facing endpoints (login, bookings, storefront APIs) are rate-limited to slow down automated abuse. • File uploads are validated for type and size before they're accepted.
4. Your Data, Your Control
Every business owner can, without waiting on support: • Export a full copy of everything stored for their business (menu, orders, bookings, team, and more) as a downloadable JSON file — Settings → Security → "Export my data." • Deactivate their business at any time and reactivate it themselves within 30 days — Settings → Security → "Delete my business." Deleting a business takes it offline immediately and starts a 30-day self-service reactivation window before any files are permanently removed. Records that other parties have a legitimate interest in (e.g. order and payment history) are retained per standard financial record-keeping practice, consistent with the DPDP Act's own exceptions.
5. Operational Readiness
• Sensitive actions (logins, role changes, account exports/deletions) are recorded in an audit trail. • We maintain a documented incident-response process and a repeatable database backup-restore procedure. We're a small, focused team — we don't yet have a formal SOC 2, ISO 27001, or similar third-party security certification, and we're not going to claim one we don't have. If a specific certification becomes something you need for your business, talk to us — it's on our roadmap once there's a concrete reason to pursue it, not before.
Security question we haven't answered here?
Reach out at privacy@restzo.com