Security & Trust

Secure by design for restaurants that run on us

Ecom Smartify POS protects your business data with modern encryption, layered access controls, and hardened infrastructure. We follow industry standards for web application security and cardholder data handling.

OWASP ASVS-driven controlsStrict TLS + HSTSCSP + security headersRole-based accessBackups & DR
Application Security

We align our control objectives with the OWASP Application Security Verification Standard (ASVS). That means systematic input validation, auth/session hardening, and secure defaults across the stack.

  • Central auth with role-based access and least privilege
  • Strong password hashing (Argon2/Bcrypt)
  • Rate limiting and abuse prevention on sensitive routes
  • Code reviews and dependency monitoring
Encryption
  • TLS in transit with modern ciphers and HSTS
  • At-rest encryption at the database and volume levels
  • Key and secret isolation in server-side environments
Infrastructure & Reliability
  • Hardened network edges and WAF/CDN shielding
  • Daily backups, point-in-time restore, and disaster recovery drills
  • Separate environments for dev, staging, and production
Authentication & Session
  • Passwords stored using modern password hashing
  • Sessions scoped and rotated; short-lived tokens for APIs
  • Optional device/session revocation via admin panel

We follow NIST guidance for memorized secrets and do not require arbitrary composition rules that reduce usability.

Secure Development
  • Static checks and dependency audits during CI
  • Security headers by default: CSP, HSTS, X-Frame-Options, X-Content-Type-Options
  • Content Security Policy tuned to block inline and cross-site script execution
Payments & Compliance

For card payments processed via integrated providers, card data is sent directly to the payment gateway over TLS. We do not store raw primary account numbers on our servers.

  • Scope reduction patterns to align with PCI DSS responsibilities
  • Audit logs around payment events and admin actions
  • Data export and deletion available for account owners
Monitoring & Incident Response
  • Centralized logs and alerts for auth, privilege, and data access anomalies
  • Runbooks for detection, triage, containment, and customer comms
  • Post-incident reviews and hardening
Responsible Disclosure

We welcome reports from the security community. If you believe you have found a vulnerability, contact contact@pos.ecomsmartify.com.

You can also find our /.well-known/security.txt file with contact and policy details.

No data exfiltration in testingGive us reasonable time to remediateGood-faith research appreciated
Ready to try a secure POS

Start with Starter or scale with Growth—same security everywhere

Bring modern security, fast order entry, and KDS to your floor today.