Trust & Security

This page is maintained by AuthentiHub to answer common security and privacy questions about our ordering platform. It is not an independent certification.

Authentication & access

• Email + password sign-in with hashed credentials managed by our backend provider.
• Administrative actions require an explicit admin role checked server-side; client-side flags are never trusted.
• Restaurant partners can only see and update their own restaurant's orders, enforced by row-level security.

Payments

• All payments are processed by Stripe through their PCI-DSS compliant checkout. We never see or store card numbers.
• Tax is calculated automatically at checkout.
• Restaurant payouts are held by AuthentiHub until the restaurant accepts the order. Rejected or unaccepted orders are refunded in full.
• Webhook signatures from Stripe are verified before any database update.

Data handling

• Customer data is stored in our backend provider's encrypted Postgres database.
• File uploads (food images) live in a private bucket; download links are short-lived signed URLs.
• Transactional emails respect a suppression list so unsubscribed recipients are not contacted again.

Operational practices

• Production secrets are stored in a managed secrets vault, never in source code.
• Server-side functions verify caller identity and role before privileged actions.
• Security findings are reviewed and remediated on a rolling basis.

Report a vulnerability

Please email security@authentihub.com. We acknowledge reports within two business days.

See also our Privacy Policy and Terms of Service.