Security
How we protect your data, and how to report a vulnerability.
Last updated: 2 June 2026
Reporting a vulnerability
Email security@openalacarte.com with details of the issue. We acknowledge inside 24 hours and aim to triage inside 72 hours. Encrypt exploit details with our PGP key (linked from the same address). Please don't open public GitHub issues for security reports.
Safe harbor
We will not pursue legal action against researchers who follow these guidelines: report in good faith, don't access more data than necessary to demonstrate the issue, don't degrade service, don't exfiltrate or retain customer data, and give us a reasonable window to fix before public disclosure (default: 90 days).
Scope
In scope: openalacarte.com and *.openalacarte.com, our public API at /api/v1/*, the embeddable booking widget, our mobile apps if released. Out of scope: customer-owned restaurant pages, third-party services (Stripe, etc.), denial-of-service attacks, social engineering against staff, physical attacks.
What we want to hear about
Authentication and session bypass, privilege escalation, exposed secrets, SQL injection, XSS that survives our existing protections, IDOR allowing access to another tenant's data, broken access control, server-side request forgery, remote code execution, broken cryptography, supply-chain issues affecting our dependencies.
What we'd rather not hear about (low signal)
Missing security headers without an exploit chain, theoretical clickjacking on pages with no sensitive actions, lack of rate-limiting on public endpoints (we rate-limit at the edge), self-XSS, software version disclosure, missing best-practice cookie flags without an exploit, content spoofing without injection.
Our security practices
TLS 1.2+ in transit, AES-256-GCM at rest for sensitive fields (POS tokens, SSO secrets, sensor secrets). Secrets live only in the hosting platform's secret store — never in source. Append-only audit log for every privileged action. Nightly encrypted database and upload backups to off-site object storage, retained 14 days, with an alert raised if a backup is missed. There is no point-in-time recovery, and our first restore drill has not been carried out yet. Error telemetry is wired but not yet switched on. CSP, HSTS, X-Frame-Options, Referrer-Policy headers on every response.
Compliance
Stripe handles all card data — we never store full card numbers. We offer a Data Processing Agreement to all business customers. We are registered with the ICO (fee paid; the registration number will be listed here once the confirmation arrives) and maintain a UK GDPR Article 30 record of processing. SOC 2 and ISO 27001 are planned; neither is held today and no audit engagement has started.
Acknowledgments
We publicly thank researchers who responsibly disclose. With your permission, your name (or handle) appears on this page after the issue is fixed and disclosed. No researchers acknowledged yet — be the first.
Questions about this document? Email legal@openalacarte.com