Security & trust
Built so the safe path is the only path.
Hospitality systems handle money, personal data and physical kitchen tickets every minute. Gustara is designed so the careful behaviour is enforced by the platform itself, not left to good habits.
Payments
Money is treated as the serious thing it is.
The order flow is built around one rule: nothing becomes real until payment is confirmed, and nothing is ever done twice.
- Payment before preparation. A failed, abandoned or timed-out payment never creates a kitchen or bar docket.
- No duplicates. Duplicate payment confirmations never print twice, and a failed payment followed by a successful retry yields exactly one set of dockets.
- Card details stay with Stripe. Guests pay through Stripe's own payment form. Gustara never sees or stores a card number.
- Confirmation you can trust. Payment outcomes come from Stripe's signed server-to-server messages, with the amount and currency checked, never from what a browser claims.
- Refunds that cannot overshoot. Refunds are reserved atomically against the amount actually paid, so simultaneous requests cannot refund more than was taken.
- Unclear outcomes are held, not guessed. If a provider's answer is ambiguous, the refund waits for a person to confirm what really happened.
- Your money, your account. You connect your own Stripe account. Gustara does not sit in the flow of funds.
Guests & privacy
Collect less. Protect what you collect.
- Unguessable QR links. Each code carries a long random token rather than a table number anyone could enumerate. Lost a sticker? Rotate the code and the old one stops working.
- Order pages stay private. A guest's email and order details are not exposed to someone who merely holds an order link.
- Email is optional. Receipts by email are a setting you control, and guests are not asked for an address if neither receipt feature is enabled.
- Consent kept separate. Marketing opt-in is its own versioned choice, stored with the exact wording the guest saw, and is never a condition of ordering or receiving a receipt.
- Abuse protection. Ordering and requests are rate-limited per spot, so scripted flooding is stopped without punishing the other guests on the same Wi-Fi.
Access control
The right people, and nobody else.
- Personal PINs. Every employee has their own PIN, stored only as a salted hash. Two active employees can never share one.
- Instant revocation. Deactivate someone, remove their management access or reset their PIN, and their open sessions end on their very next action.
- Locks that work. Staff and management terminals lock when idle, with timeouts you set. A lock is not a logout, so work resumes where it stopped.
- Sign-in protection. Repeated failed sign-ins are rate-limited, and forms and actions are protected against cross-site request forgery.
- Management is a grant. Staff can serve fast without being able to refund, reconfigure or export. Sensitive actions need the matching permission.
Records & audit
Everything leaves a trail.
- Nothing is overwritten. A cancellation, void or refund sits beside the original record. History is never quietly edited.
- Who, what, when. Staff, management and security actions are written to the audit log, attributed to a person wherever one is involved.
- Long memory where it matters. Financial and security events are retained for at least five years, whatever the shorter operational retention you choose.
- Locked after preparation. Once an order is being prepared it cannot be silently changed. A correction is a refund.
- Trading days that make sense. Every sale, refund and void carries its own business date, using your cut-off, so reports reconcile.
Data & hosting
A database of your own.
- Dedicated per property. Each property runs on its own database and its own web address. There are no shared tables where one venue's data could leak into another's.
- Secrets encrypted at rest. Stripe keys and email passwords you enter are encrypted with a key held outside the database, and are never displayed again.
- Strict start-up checks. In production the platform refuses to start with weak or placeholder secrets, a short manager PIN, or a non-HTTPS public address.
- You choose retention. Set when old orders are archived or purged and how long audit history is kept, with the long floor above for financial and security records.
- Printer safety. Text from guests and staff is stripped of printer control characters, so a note can never inject commands into a docket printer.
Who does what
A clear split of responsibility.
Good security is shared. Here is where each party's job begins and ends.
| Area | Handled by | What that means |
|---|---|---|
| Card data, authentication, wallets | Stripe | Guests pay on Stripe's form. Card numbers never reach Gustara or your network. |
| Order flow, routing, records, audit | Gustara | Payment-first ordering, correct routing, one docket per paid order, and a complete trail. |
| Menu, allergen and dietary accuracy | Your venue | Gustara shows exactly what you have recorded. Keeping it correct is your team's responsibility. |
| PIN hygiene and who has access | Your venue | Gustara enforces uniqueness and revocation. Deciding who is employed and trusted is yours. |
| Printers and local network | Your venue, with our guidance | We help you specify and connect printers. The hardware lives on your network. |
Proven, not just promised
The rules are tested, including under pressure.
More than 1,300 automated tests cover payments, printing, refunds and access rules. The guarantees against double printing and double refunds are also proven under genuinely simultaneous database connections, where the real race conditions live.
Straight talk. We would rather tell you precisely what has been verified for your payment setup and printer hardware than promise it in general terms. Ask us for the current verification status in your walkthrough.
Have a security question?
Send us your checklist or questionnaire and we will answer it plainly, in writing.