Your data and your customers' trust are our responsibility.
Security is not a feature we add — it's a constraint we design around from the start. Here's exactly how we protect Readylert, your restaurant, and your customers.
How we secure Readylert
The technical and operational controls that protect your data every day.
Encryption in transit and at rest
All data is encrypted in transit using TLS 1.3. Customer session data and vendor information is encrypted at rest in our PostgreSQL database using AES-256.
Infrastructure security
Readylert runs on enterprise-grade cloud infrastructure with automatic failover, DDoS protection, and network-level isolation between services.
Minimal data collection
We collect only what we need to operate the service. Customer sessions contain no personal data — just a unique session ID and order status. No names, no phone numbers, no emails.
Session security
Customer sessions are UUID-based, cryptographically random, and expire after 24 hours of inactivity. Vendor sessions use server-side secure, HttpOnly cookies.
Regular security audits
We conduct quarterly internal security reviews and annual third-party penetration tests. All findings are remediated within defined SLAs by severity.
Vendor authentication
Vendor passwords are hashed using bcrypt with a work factor of 12. We enforce strong password requirements and plan to add MFA in Q3 2026.
Compliance & certifications
We meet the legal and regulatory requirements for operating a data-processing service in the United Kingdom and European Union.
GDPR compliant
Full compliance with EU and UK GDPR.
UK Data Protection Act 2018
Registered with the ICO (Information Commissioner's Office).
PCI DSS (via Stripe)
Payment card data is handled exclusively by Stripe — we never store card details.
SSL/TLS everywhere
HTTPS enforced on all endpoints. HSTS enabled.
Responsible disclosure policy
We believe in working collaboratively with the security research community. If you discover a potential vulnerability in Readylert, please tell us privately so we can fix it before it can be exploited.
Report the vulnerability
Email security@readylert.com with a description of the issue, steps to reproduce, and the potential impact. Please do not disclose publicly until we have responded.
We confirm receipt
We acknowledge your report within 24 hours and assign a severity level. We'll keep you updated as we investigate.
We remediate
Critical vulnerabilities are patched within 48 hours. High severity within 7 days. We'll notify you when the fix is live.
Recognition
We publicly credit researchers (with your permission) in our changelog and security acknowledgements page. We offer a recognition programme for significant findings.
Report a security issue
Found something? We take all reports seriously and will respond within 24 hours. Please encrypt sensitive details with our PGP key.
security@readylert.com