We take the security of your catering business's data seriously. This page summarizes the safeguards built into Savrsoft.
Encryption in transit
All traffic to and from Savrsoft is served exclusively over HTTPS (TLS). Data moving between your browser or app and our servers is encrypted.
Credential protection
- Passwords are never stored in plain text. They are hashed with PBKDF2-HMAC-SHA256 using a unique per-user salt and many iterations.
- Sign-in with Google & Apple uses industry-standard OAuth/OpenID Connect, so we never handle your provider password.
- API keys are shown once at creation and stored only as a SHA-256 hash. Revoking a key takes effect immediately.
- Webhook payloads are signed with HMAC-SHA256 so your systems can verify they genuinely came from Savrsoft.
Data isolation
Every organization's data is scoped to its own account. Requests are authorized on every call, so one customer can never read or write another customer's records.
Infrastructure
Savrsoft runs on Cloudflare's global network, which provides managed, access-controlled compute and storage, automatic TLS, and network-level DDoS protection. Uploaded documents (such as non-profit certificates) are kept in access-controlled object storage.
Payments
Card payments are handled entirely by Stripe, a PCI-DSS Level 1 certified provider. Savrsoft never sees or stores full card numbers.
Least data by design
We collect only what's needed to run the service and don't sell your data or use it for advertising. See our Privacy Policy.
Responsible disclosure
If you believe you've found a security vulnerability, please email security@savrsoft.com with details. We appreciate responsible disclosure and will work with you to resolve valid issues promptly. Please don't publicly disclose an issue until we've had a chance to address it.