Security
PCI restaurant security: what Appetier holds and never touches
A payment partner takes the card and gives Appetier a token. This is what that means for your restaurant.
Card data
Appetier does not store, log, or transmit a card number. A PCI DSS Level 1 certified payment partner takes the card, through hosted payment fields online and through a card reader in person, and gives Appetier a token.
That keeps Appetier's PCI scope at SAQ A, the lightest self-assessment, because the card never passes through our servers.
What Appetier stores
Appetier keeps what a restaurant needs to serve a guest: name, email, and phone number, order details, loyalty history, and payment information in tokenized form only.
We keep data only as long as needed to support restaurant operations or as the law requires. A guest or an owner can ask for access, a correction, or deletion at privacy@appetier.com.
How it is protected
- Sign-in has no password. An emailed link or a social account does it, so Appetier stores none.
- Secrets sit in a managed secret store, never in site code or the browser.
- Every change passes an automated quality gate before it ships.
- Staff accounts that reach production use multi-factor sign-in.
Audit reports
Appetier holds no SOC 2 report yet. We're working toward a SOC 2 Type 2 report and build to its trust criteria.
Need our status for a vendor review? Write to security@appetier.com. A person answers.
Report a vulnerability
If you think you found a security problem in an Appetier site, app, or console, write to security@appetier.com. Say what you saw and where, and keep the details to yourself until we have read them.
See what your site and ordering would look like
Start with your website and share a preview of your storefront.