Security & Compliance at AIA Cater

Encryption in Transit & at Rest

All customer and order data moves through TLS 1.3–protected channels and is stored with AES-256 server-side encryption. While this is not end-to-end encryption (our servers must read the data to power your dashboard), it means the information is unreadable to prying eyes both on the wire and on disk.

Payment Protection via Stripe & Square

We never touch raw card numbers. Every charge is tokenised and processed by Stripe or Square—both certified PCI-DSS Level 1 Service Providers, the highest standard in the payments industry. That off-loads card risk to partners whose entire business is payment security.

Documentation: Square

Granular “3-Step Verification” for Critical Changes

Regular log-ins use email + password or your SSO of choice. Any sensitive account change—transferring ownership, downloading a full data export, deleting records, altering payout details—triggers an extra triple check:

  • Password re-entry (hashed with bcrypt)
  • One-time code sent to the verified phone on file
  • Master Key—a 256-bit secret generated with hardware-grade entropy, then split-key–encrypted so even our engineers can’t read it. Lose it and you’ll need to re-key the workspace via a documented recovery flow.

Right to Erasure

A single click in Settings → Privacy schedules your workspace—including backups—for cryptographic erasure after a short grace period. Perfect for GDPR, CCPA, or franchise off-boarding.

Tenant Isolation (“Pocket Universes”)

Each restaurant instance runs in its own isolated database cluster, message queue, and encryption-key scope. No cross-tenant tables, no accidental data bleed—your data lives in its own pocket universe.

Hardened Cloud & Continuous Audits

  • Hosted on SOC 2-compliant infrastructure with 24/7 monitoring
  • Quarterly third-party penetration tests and automated dependency scanning
  • Immutable audit logs and role-based access control for every action

From encrypted storage to PCI-certified payments and zero-trust admin flows, AIA Cater is engineered so you can sleep at night—and so your compliance officer can, too.