This is what's actually built, not what we hope to get to. Where something is a goal rather than a fact, it's written as a goal.
Every login, permission change and row change in the staff view is written to a chained log – each row hashes in the previous row's hash, so a changed or deleted row shows up immediately on inspection.
The log can only be appended to, never overwritten. Export to CSV for your own review.
Staff accounts can be protected with a second factor (MFA), built on Supabase Auth's assurance level AAL2 – a verified factor is required before sensitive views are reached, not just at login.
Automatic backups of the database, at least daily, stored separately from the running database by the same provider that runs it (Supabase, Frankfurt).
Continuous point-in-time recovery (PITR) is the goal we're working towards, not today's standard level.
A read API (/api/v1) with its own documentation (OpenAPI) for anyone who wants to connect their own reporting tools or integrations. Its own key per organisation, no shared access.
The guest's ordering flow has been reviewed against WCAG 2.1 AA: contrast issues fixed, keyboard navigation and focus order through every step, automated tests that catch regressions.
The seating map's visual seat picker currently has no keyboard path – a list view with the same function is built and will be connected shortly.
A balanced bookkeeping file every day, reconciled against Stripe's payments to the öre, plus an accrual report in the same format – Xledger's own import format, not one of our own.
All data within the EU (Frankfurt), under GDPR. A data processing agreement is signed at the start. No sensitive data is stored locally with us – everything runs through the shared, access-controlled database.
Stripe (PCI-certified) handles every card detail. No card information ever reaches our servers.
If your procurement asks for something not covered here – audit routines, operating agreements, specific RTO/RPO levels – ask us directly. We answer with what's true, not what sounds best.
Write to us, we reply the same day.
hej@entreakt.com