Legal
Security.
What protects your restaurant’s data in delEat, stated precisely enough to check. Two-step sign-in, the audit trail screen and a full export of your data are live. This page claims no certification and no service level.
Signing in
Passwords and PINs are stored as scrypt hashes, never in plain text.
After five failed sign-ins the account locks for a while, and repeated attempts from the same address are slowed down.
A session lasts 12 hours, held in a cookie the page’s own scripts cannot read. Signing out ends it. A new password or PIN, or a change to someone’s role or outlets, ends every other session they have.
A password reset is a link that works once and expires after 30 minutes. Using it signs the account out everywhere else.
Two-step sign-in adds a code from an authenticator app to the password. For owners and admins, once enrolled, the code is required at every sign-in. Recovery codes cover a lost phone, and a password reset cannot bypass the second step.
Who can do what
Access is denied until it is granted. delEat has 81 separate permissions, and every role is built from them.
Nobody can hand out a permission they do not hold, so a manager cannot make anyone more powerful than the manager. Staff see only the outlets they belong to.
A record of every change
Every change to money, the menu, stock, staff, settings and payments is recorded: who made it, when, and what it changed.
The audit trail screen shows that record. It can be filtered, and what it shows can be exported.
Card numbers
Card numbers never reach delEat. Online and pay-at-table payments go through the payment provider’s own hosted page, from Stripe, Telr or Network International (N-Genius), and the provider handles the card.
That keeps delEat’s own billing in PCI DSS SAQ-A scope, the self-assessment for businesses that leave card handling entirely to the provider. SAQ-A is a self-assessment, not a certification.
The payment-provider keys an outlet enters are encrypted at rest with AES-256-GCM, and delEat only ever shows their last four characters.
Where it runs
delEat runs on Amazon Web Services in Mumbai (ap-south-1).
The server accepts no inbound connections. Traffic reaches it only through an encrypted Cloudflare tunnel, so it has no ports open to the internet.
Every page is served over HTTPS, with HSTS, which tells browsers never to connect without encryption, and a strict Content-Security-Policy, which limits what a page is allowed to load.
Backups
The data is backed up every night and copied off-site to Cloudflare R2 in the European Union, which encrypts what it stores.
Each backup sits under a 30-day lock. For those 30 days nobody can alter or delete it, delEat included.
Your data
When an account closes, there are 30 days in which everything can be exported. After that it is purged.
Export all my data downloads what the account holds. Passwords, keys and tokens are left out of the export.
A guest’s personal data can be erased on request.
delEat follows the UAE Personal Data Protection Law, Federal Decree-Law No. 45 of 2021. The privacy policy sets out what is collected and who else is involved.
Questions