SECURITY & PRIVACY
Security at Chefnomics is a set of specific controls: every query is account-scoped, production access is restricted and logged, and owners keep control of their data.
SEE THE CONTROLS01 · ACCOUNT ISOLATION
Recipes, costs, suppliers, and pricing live inside a restaurant's own account and brand. The account boundary is applied on every database query—not checked once and assumed after that.
Cross-restaurant access is explicitly tested for and blocked. If one owner wants to share between their own brands, they opt in deliberately; nothing crosses automatically.
02 · SEATS & PERMISSIONS
Owners invite staff as separate logins scoped to one restaurant. Each Seat starts with access to specific areas of Chefnomics—not the whole account by default.
Invitations expire and work once. Owners can review permissions and revoke a staff member's access whenever they need to.
03 · SIGN-IN & ACCOUNT SECURITY
Passwords are hashed with a modern password-hashing algorithm—never stored or logged in plain text—and a real-time strength check is required at sign-up. Two-factor authentication with backup recovery codes is available to every owner.
Login and password-reset attempts are rate-limited. A password or 2FA change immediately signs out every other device and sends a confirmation email.
04 · SESSIONS
Sessions are cryptographically signed, expire automatically, and can be revoked one at a time. Every active signed-in device is visible to the account holder.
Owners can remotely sign out a device they no longer recognize or use. Chefnomics does not add IP-based geolocation tracking to login activity.
05 · INTERNAL ACCESS & AUDIT TRAIL
Chefnomics engineers and support staff do not have standing access to customer data. Development and testing use separate synthetic data, never real restaurant accounts.
If a named, authorized team member genuinely needs production access—for example, to fix a reported bug—the access is logged automatically: who accessed what, and when.
Every change to a recipe, ingredient, price, supplier, user, or permission is recorded with the actor and time. Audit records are kept separately so they cannot be quietly edited away.
06 · INFRASTRUCTURE
Chefnomics is hosted on Supabase, which encrypts data at rest with AES-256 and in transit with TLS by default. Encrypted automatic backups are regularly tested by restoring them.
The database requires authentication and is not publicly exposed. The app connects through a least-privilege account—not a superuser—and security-relevant secrets stay in backend infrastructure, never in the browser or source code.
07 · DATA USE & OWNERSHIP
Customer data is never sold. Recipe and pricing data is never used to train AI models. Chef AYA only sees data from the account currently asking her a question.
Owners can export and download all of their data at any time. If an account is cancelled, a documented policy applies a defined retention period, then deletes that account's data.
08 · ONGOING PRACTICE
Chefnomics follows engineering practices guided by the OWASP Top 10, the industry-standard list of critical web application risks. It guides priorities; it is not a certification or an audit result.
Vulnerability scanning and dependency monitoring continue after launch. A written incident response plan supports immediately disabling a compromised account, revoking its sessions, and blocking further malicious activity.
SECURITY YOU CAN QUESTION
Separate accounts. Restricted access. Durable records. Data you can take with you.
CREATE ACCOUNT