Security
The practices behind the product, in plain terms.
No passwords, anywhere
Signing in is Google or an email magic link — there is no password field on the account, and nothing password-shaped to leak or reuse.
Every change is logged
Every mutation — who did it, what it touched, when, from where — is written to an audit log in the same transaction as the change itself, not as an afterthought.
One organisation can't see another's data
Every request is scoped to the organisation, brand or branch the signed-in user actually holds a role in. A cross-tenant read returns nothing, not an error that leaks whether the record exists.
A card's code is never proof of ownership
The shortcode printed on a card is public — anyone in the shop can read it — so it only routes a tap. Cards reach your account already linked to your branch, and invite links are hashed and single-use.
Google review content is never stored
Ratings, review text and reviewer details from Google are shown live and never written to our database. What we chart over time is first-party data we collected ourselves.