Security and Trust

At Kitchen Stocker, the security of our customers' data is a priority. This page describes the technical and organisational measures we implement to protect your information and the ways you can help keep your account secure.

Kitchen Stocker is hosted with cloud infrastructure providers holding recognised security certifications. Data is stored in data centres located in the European Union or in jurisdictions with an equivalent level of protection recognised by the European Commission.

• Encryption of data in transit using TLS 1.2 or higher on all connections
• Encryption of data at rest in the database
• Multi-tenant architecture with strict per-customer isolation by means of a restaurant identifier
• Automatic daily backups with integrity verification
• 30-day backup retention policy

Access to the platform is protected by a secure authentication system and role-based access control:

• Passwords stored using modern hashing algorithms (bcrypt); never in plain text
• Multi-factor authentication (MFA) available, and mandatory for owner and administrator roles
• Granular role system: owner, manager and staff, with differentiated permissions
• Sessions with automatic expiry and the ability to log out on all devices
• Rate limiting of failed login attempts to prevent brute-force attacks

Kitchen Stocker applies secure development practices, including:

• Protection against SQL injection through parameterised queries
• Protection against Cross-Site Scripting (XSS) with input sanitisation
• CSRF tokens on forms and sensitive endpoints
• HTTP security headers: X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy
• Regular dependency review and updating of packages with known vulnerabilities

We operate continuous monitoring systems to detect anomalies and respond to security incidents:

• Real-time capture and analysis of server and client errors
• Automatic alerts on anomalous access patterns
• Service health endpoint with availability monitoring
• Documented incident response procedure with defined owners
• Notification of affected customers within a maximum of 72 hours in the event of a confirmed security breach, in accordance with Article 33 of the General Data Protection Regulation (GDPR, "RGPD")

The Kitchen Stocker team follows security principles in its day-to-day operations:

• Production access restricted to strictly necessary personnel (principle of least privilege)
• Use of VPN and multi-factor authentication for access to internal systems
• Regular team training in security best practices
• Confidentiality agreements with all employees and contractors

We maintain a business continuity plan that includes documented disaster recovery procedures, with defined recovery time objectives (RTO) and recovery point objectives (RPO) to minimise the impact of any serious incident on service availability.

• Enable multi-factor authentication (MFA) on your account
• Use a unique, strong password for Kitchen Stocker
• Do not share your credentials: add each user with their own access and role
• Deactivate or remove the accounts of users who no longer work at your establishment
• Regularly review the active users on your account from the administration panel

If you discover a security vulnerability in Kitchen Stocker, we ask that you report it to us responsibly before making it public, so that we can fix it and protect our customers.

Contact our security team at: security@kitchenstocker.com. Include a detailed description of the vulnerability and the steps to reproduce it. We commit to responding within a maximum of 5 business days and to taking no legal action against good-faith researchers.