Security
Your numbers are yours.
Data privacy is the top barrier to AI adoption in this industry, ahead of accuracy and cost. That's a reasonable place to be cautious. Here is the whole posture, in plain language, so you can judge it rather than trust it.
Isolation enforced by the database
Every table carrying business data is protected by row-level security keyed to your organization. A query from another tenant returns nothing — not because the application filtered it, but because the database refused. Application bugs cannot leak across tenants.
Platform staff cannot read your financials
Our own support and engineering staff have no policy granting them read access to tenant financial tables. Internal dashboards are built on aggregate and billing views. Impersonating an account for support requires a stated reason and writes a record you can see in your audit log.
Invoice files encrypted, never public
Uploaded invoices and receipts are encrypted at rest and served only through short-lived signed links generated for an authenticated member of your organization. There is no public bucket URL, and no guessable path.
Accounts and sessions
Multi-factor authentication is available on every plan. Passwords are checked against a minimum-strength policy and against known breached credentials. Owners can see every active session with device and last-seen, and revoke any of them immediately.
An audit log you can read
Membership changes, role changes, partner access grants and revocations, exports, and support impersonation are all written to a per-tenant audit log that the owner reads directly in the app. Not on request, not through support.
No lock-in
Settings → Your data exports every table as CSV plus your original invoice images as a ZIP, immediately, with no support ticket. A QuickBooks-compatible journal entry export is included. If you leave, you leave with everything.
Benchmarks: what actually leaves your account
Normalized ratios only — food cost as a percentage of your own sales, labour as a percentage of your own sales, prime cost percentage. No dollar amounts, no vendor names, no prices, no recipes, no identity. A peer figure is only ever shown once at least ten distinct locations sit behind it, and values are winsorized at the 5th and 95th percentile before aggregation so no single restaurant can be identified or can skew the cohort. Contribution is a single toggle you control, and switching it off costs you nothing else.
Compliance
SOC 2 Type I is in progress; groups of five locations and up ask for it, and they should. We'd rather say "in progress, here is the control set" than imply a certificate we don't hold yet. Ask us for the current control documentation and we'll send it the same day.
Reporting a vulnerability
Email security@nochef.app with details and, if you have one, a proof of concept. We acknowledge within one business day, and we don't threaten researchers.
Already a customer? The Privacy Center in your account shows your live settings and generates a printable summary for your accountant or franchisor.