Security
How we protect your data, and how to report a vulnerability.
Last updated: 2 June 2026
Reporting a vulnerability
Email security@openalacarte.com with details of the issue. We acknowledge inside 24 hours and aim to triage inside 72 hours. Encrypt exploit details with our PGP key (linked from the same address). Please don't open public GitHub issues for security reports.
Safe harbor
We will not pursue legal action against researchers who follow these guidelines: report in good faith, don't access more data than necessary to demonstrate the issue, don't degrade service, don't exfiltrate or retain customer data, and give us a reasonable window to fix before public disclosure (default: 90 days).
Scope
In scope: openalacarte.com and *.openalacarte.com, our public API at /api/v1/*, the embeddable booking widget, our mobile apps if released. Out of scope: customer-owned restaurant pages, third-party services (Stripe, etc.), denial-of-service attacks, social engineering against staff, physical attacks.
What we want to hear about
Authentication and session bypass, privilege escalation, exposed secrets, SQL injection, XSS that survives our existing protections, IDOR allowing access to another tenant's data, broken access control, server-side request forgery, remote code execution, broken cryptography, supply-chain issues affecting our dependencies.
What we'd rather not hear about (low signal)
Missing security headers without an exploit chain, theoretical clickjacking on pages with no sensitive actions, lack of rate-limiting on public endpoints (we rate-limit at the edge), self-XSS, software version disclosure, missing best-practice cookie flags without an exploit, content spoofing without injection.
Our security practices
TLS 1.2+ in transit, AES-256-GCM at rest for sensitive fields (POS tokens, SSO secrets, sensor secrets). Secrets live only in the hosting platform's secret store — never in source. Append-only audit log for every privileged action. Daily encrypted DB backups with point-in-time recovery and regular restore drills. Sentry telemetry on all server errors. CSP, HSTS, X-Frame-Options, Referrer-Policy headers on every response.
Compliance
Stripe handles all card data — we never store full card numbers. We offer a Data Processing Agreement to all business customers. ICO registration, a UK GDPR Article 30 register and SOC 2 Type 1 are planned before commercial launch; we will list them here once they are in place, not before.
Acknowledgments
We publicly thank researchers who responsibly disclose. With your permission, your name (or handle) appears on this page after the issue is fixed and disclosed. No researchers acknowledged yet — be the first.
Questions about this document? Email legal@openalacarte.com