What protects your restaurant, in the order you would ask.
Written for the person who has to decide whether to run a dining room on this. Outcomes rather than configuration: what happens to your account, your money and your data — not the settings behind it, which would help an attacker and tell you nothing.
What we never do
The shortest answer on this page, and the one you can hold us to. These are not policies we adopted; they are things the product cannot do.
- We never touch your money. It goes from the diner to you, on your own payment method.
- We never ask for, store, or transmit a UPI PIN, OTP, card number, or bank credential. No screen in the product has a field for one.
- We will never ask you for your password or a one-time code — not by email, not by phone, not inside the product. Anyone who does is not us.
- Nobody here can sign in as you, or let someone else in. Not support, not the founder.
- We never take a commission, and we never charge per order, per diner, or per scan.
Can you take my money?
No, and not because we promise not to — because there is no point at which we hold it.
- Diners pay you directly. No money passes through us at any stage, so there is nothing for us to hold, delay, or settle.
- We take no commission and no share of any order. The subscription is the whole price.
- You keep your existing payment method and your existing rates — your own payment QR, or cash and card at the counter.
- We never ask for, store, or transmit a UPI PIN, OTP, card number, or bank credential.
Can someone get into my dashboard?
Not with your password alone — and this is the one claim on this page you can test yourself in about thirty seconds, rather than take our word for.
- A correct password on a browser we have never seen does not sign you in. It asks you to confirm, by tapping the number shown on the screen that is signing in, on a device you already use — never a bare “Approve?” you could answer by reflex.
- Each browser that signs in holds a key it cannot hand over, and proves it every time.
- A trusted browser does not stay trusted forever; it re-confirms.
- Every outcome — allowed, refused or expired — reaches you by email. Saying “no, this wasn’t me” signs out every other device and forgets every other trusted browser.
- Nobody here can approve a device on your behalf. There is no support path that does it, so there is no one for a stranger to phone — and you recover your own account yourself.
- Passwords are hashed with Argon2 and never stored in a readable form. Two-factor authentication is available with any authenticator app, along with ten single-use recovery codes.
- Repeated failed logins are throttled and temporarily locked. You can see every device signed into your account, and sign any of them out.
Can someone spam my restaurant with fake orders?
A real fear on a busy night, and one most security pages never get to because they are written about servers rather than about your evening.
- Repeated ordering from one device is throttled.
- Any order can be rejected in one tap, and rejecting it is the end of it.
Will I lose my menu and my orders?
The honest test of a backup is not whether it ran, but whether anyone has restored it. We restore ours on a schedule.
- Everything is backed up every night, and again before any change to the system.
- Every backup is integrity-checked as it is written. One that fails the check is refused rather than quietly kept.
- Restores are rehearsed on a schedule — we prove the backups work rather than assuming they would.
- Your uploaded images are backed up too, on rolling daily, weekly and monthly copies.
- A corrupted or mismatched backup is refused at restore, never silently applied over your data.
Who at Tabemi can see my data?
Fewer people than you would assume, and every administrative action leaves a record.
- The databases are not reachable from the internet.
- Administrative actions are recorded — who, what, and when.
- Destructive actions inside our own platform tools need a second confirmation by email, bound to that exact target.
- Your staff get only the permissions you grant, and a staff member can never promote themselves to owner of your restaurant.
- Suspend a staff member and their access ends immediately. Remove someone and they are out on their next tap, rather than whenever their session happens to expire. Every payment confirmation is recorded against the staff member who made it.
What about my diners?
They are your customers, not ours. The product is built so that ordering never requires them to hand anything over.
- Diners can order as guests — no account, no phone number.
- A guest’s history stays on their own phone unless they choose to link an account.
- Analytics identifiers are hashed with a per-deployment salt, and no raw addresses are kept.
- Measurement is consent-gated where the law requires it, Global Privacy Control is honoured, and withdrawing consent takes effect immediately — the unsent buffer is discarded rather than flushed.
- Operational logs are deleted after 30 days. And we are not a marketplace: we never market to your diners.
How do changes reach my restaurant?
The riskiest moment for any live system is the moment someone changes it. This is what happens around that.
- Updates roll out one instance at a time, and roll back automatically if anything comes up unhealthy.
- Changes are rehearsed on a production-copy environment before they reach you.
- Every release proves the backup is restorable before it migrates your data.
- Every release is scanned for known vulnerabilities.
- Uploaded images are re-encoded, so a file cannot carry anything through. Automated probes are blocked before they reach the application, and everything travels over HTTPS.
What if someone finds a problem?
We would rather hear it from the person who found it than read about it later, so the route to us is published and the promise is in writing.
- A security contact and policy are published at /.well-known/security.txt, and security@ reaches a person directly.
- Good-faith researchers have safe harbour, set out in our vulnerability disclosure policy.
- We will never ask you for your password, your PIN, or a one-time code. If a message claiming to be us does, it is not us — forward it to security@ and we will look at it.
What you will not find on this page
No uptime percentage, no penetration-test badge, and no lockout thresholds, retention counts or timings. The first two we have not earned and will not imply; the last are configuration, and publishing them would tell an attacker where to push while telling you nothing you could act on. If you are evaluating us formally and need more than this, write to security@ and ask.