Security

1. Each restaurant's data stays separate

Every restaurant on Preppify has its own database. When you sign in, Preppify checks which restaurants you belong to and connects you only to theirs. One restaurant's records are never stored alongside another's.

2. Encryption

• All traffic to and from Preppify is encrypted with HTTPS.
• The keys that connect Preppify to your other services, such as QuickBooks and your bank, are encrypted with AES-256-GCM before they're stored. So are the details Preppify uses to reach each restaurant's database.
• Our database and file storage providers encrypt data on disk.

3. Signing in

• Passwords are stored only as bcrypt hashes; nobody at Preppify can read them.
• Before sensitive actions, such as connecting a bank, Preppify asks for a 6-digit code sent to your email. Each code expires after 10 minutes and allows only a few tries.
• Your session is kept in a cookie that scripts on the page can't read.
• Sign-in and upload requests are rate-limited to slow down guessing and abuse.

4. Access by role

The account owner decides who can see what. Each person is an owner, partner, manager or member of staff, and sees only what that role needs. An accountant can be given read-only access, which lets them see the books without changing anything.

5. Connected services

• Bank, through Plaid. You sign in to your bank in Plaid's own window. Preppify never sees your bank login, and you can disconnect at any time.
• QuickBooks Online. Connected with Intuit's own sign-in, checked against tampering. You can remove Preppify's access from your Intuit account whenever you like.
• Toast. Sales and timecards arrive through Toast's nightly data export, over an encrypted SFTP connection.

6. AI providers

When Preppify reads a bill, the document goes to an AI provider only to be read, and the result comes back to your account. We don't use your data to train AI models. The providers we use are listed in our Privacy policy.

7. Browser protections

Preppify sends strict security headers, including a Content Security Policy that only lets the page load code from Preppify itself and from Plaid, for bank connections.

8. How we build it

• Every change is reviewed and approved before it is released.
• Each change is scanned automatically for security problems and risky dependencies before it can be merged.

We don't hold a SOC 2 report or similar certification yet. If you need a security questionnaire answered, write to us and we'll go through it with you.

9. Reporting a security problem

If you think you've found a vulnerability, email security@preppify.app with what you found and how to reproduce it. Please give us a chance to fix it before telling others, and don't access or change data that isn't yours.

We aim to reply within two business days and will keep you posted until it's fixed.