mamalSecurity & trust
What we protect, and what we don’t claim.
How your data is held, who can reach it, and how you get all of it back.
Card data
Card numbers never reach our servers.
Cards are tokenized in the customer’s browser before anything reaches us. We hold a token, never a number, never a CVV.
Sensitive data never lands somewhere it could be stolen from us, and your PCI paperwork stays in the lightest category a merchant can be in.1
Access
Who can do what, and who did it.
- Roles and permissions enforced down to individual actions, not broad tiers
- Every restaurant’s data is scoped by tenant and location and enforced on each request, rather than merely hidden by the interface
- Comps, voids, reopened checks and refunds each write an audit entry with a name and a timestamp attached
- Register devices are paired, and their credentials sit in storage the page’s own scripts are not able to read
- Manager approval required for the operations that move money after a check is closed
Your data
Leaving is a feature, not a penalty.
- Everything you can see in a report exports to CSV in one click
- A full extract of menus, sales history and customers, in standard formats, free, and we do not ask why you want it
- Your database is backed up nightly to durable off-site storage
- We do not sell your data or your customers’ data, and there is no version of this business where that becomes tempting
- Nothing on your counter stops working because you stopped paying us, since none of it came from us
The privacy policy has the formal version. Switching covers what leaving actually looks like in practice.
The honest limits
What we are not claiming.
Worth knowing before you sign rather than after.
- SOC 2 audit is not complete. If your franchisor requires a report today, we cannot satisfy that yet.
- No PCI certification of our own — see above for what we do instead, which is to stay out of card data entirely.
- No published uptime SLA. Ask what our actual availability has been and we will tell you.
- Replicated database is in progress. Nightly off-site backups run today.
Found something? Write to security@mamal.shop. Good-faith reports get answered quickly, and never lawyered.
Have a security question
we haven’t answered here?
- This describes how Mamal is architected: card data is tokenized by the payment gateway and never reaches our servers. It is not a claim that Mamal holds a PCI certification of its own.