restaurant_menu
DineWaves shield Ask a security question
Security & data protection

Straight talk about how your data is handled.

We’re not going to hand-wave with "military-grade encryption" or "SOC 2 Type II" if we don’t have it. Here is exactly what protects your restaurant and your guests today, and what we’re working toward.

lock
In transit
HTTPS · TLS 1.2+
shield
Payments
PCI-DSS partners
public
Data residency
India + EU regions

1. Infrastructure

DineWaves runs on Google Cloud Firebase & Firestore. Data is stored in Google’s multi-region datacenters (defaulting to Mumbai / asia-south1 for restaurants that request India data residency, and EU regions for European customers). Google Cloud maintains ISO 27001, ISO 27017, ISO 27018, SOC 1/2/3, and PCI-DSS certifications, which we inherit at the infrastructure layer.

2. Encryption

  • In transit: HTTPS everywhere (TLS 1.2 minimum, HSTS enforced). No plaintext HTTP is served, even on marketing pages.
  • At rest: All Firestore data is AES-256 encrypted at rest by default. Media assets in Cloud Storage are encrypted with Google-managed keys.
  • Passwords: Restaurant admin passwords are hashed with bcrypt (cost factor 12). We do not store, log, or transmit plaintext passwords at any point.

3. Payments

Card and UPI details never touch DineWaves servers. When guest payments are enabled, the transaction is handled entirely by our processor partners:

  • India: Razorpay (PCI-DSS Level 1 certified).
  • International: Stripe (PCI-DSS Level 1 certified).

DineWaves receives only a transaction reference and status. Payouts settle directly from the processor to your restaurant’s bank on the processor’s standard cycle. We do not act as a payment aggregator and never hold your funds.

4. Access control

  • Role-based access (Owner, Manager, Kitchen, Staff) inside each restaurant workspace.
  • Session cookies are HttpOnly, SameSite-guarded, and marked Secure in production. Sessions expire after 7 days of inactivity.
  • Server-side rate limiting on authentication endpoints (20 attempts / 15 min) and write endpoints (120 requests / min).
  • Content Security Policy is enforced at the HTTP layer; the site is not vulnerable to arbitrary third-party script injection.

5. Backups & disaster recovery

Firestore data is continuously replicated across multiple availability zones within the chosen region. We take daily point-in-time backups. Recovery is measured in minutes, not hours. In the unlikely event of a regional outage, we can restore into an alternate region within the same jurisdiction.

6. India DPDP 2023 alignment

We treat restaurant owners as our Data Principals and process guest data as Data Fiduciaries on behalf of the restaurant. In practice:

  • We collect only the minimum guest data needed for the ordering flow (name and phone number if the guest chooses to share them; nothing more).
  • Guests can request deletion by asking the restaurant, or by writing to us on WhatsApp; we honour requests within 30 days.
  • We do not sell guest data to third parties. Ever.
  • Restaurants can export or delete their entire workspace at any time from the owner portal.

7. GDPR alignment (for EU customers)

We honour Data Subject Access Requests (DSAR), Right to Erasure, and Data Portability under Articles 15, 17, and 20 of GDPR. EU customer data can be pinned to EU regions on request. Our sub-processors (Google Cloud, Razorpay/Stripe) are GDPR-compliant and appear in our processor register (send a request on WhatsApp for the current list).

8. What we do not have — yet

In the spirit of not over-promising:

  • We are not SOC 2 Type II certified. We plan to pursue it once the customer base warrants the audit cost.
  • We do not currently run a formal public bug-bounty programme, but we honour responsible disclosure via WhatsApp or security@dinewaves.com and will credit reporters publicly on request.
  • We do not support SSO/SAML for restaurant portals yet.

9. Report a vulnerability

If you find a security issue, please tell us privately first. WhatsApp +91 74407 00785 or email security@dinewaves.com. We’ll acknowledge within 24 hours and keep you updated on the fix timeline. We commit to public credit and, once we start our bounty programme, retroactive rewards for prior responsible disclosures.

10. Sub-processor list

  • Google Cloud (Firebase, Firestore, Cloud Storage) — hosting, database, media storage
  • Razorpay — Indian payments (guest checkout + DineWaves’ own SaaS billing)
  • Stripe — international payments (guest checkout, when enabled)
  • Google Analytics — anonymised website traffic (opt-in via cookie banner)
  • Nodemailer / SMTP — transactional email (subscription receipts, password resets)

Last updated: this month. We’ll bump this date whenever a sub-processor changes.