Payments
Servestack never stores card numbers. All payments are processed by Stripe, a certified PCI DSS Level 1 service provider — the highest level of payment security certification. Card data goes directly from the guest's device to Stripe; our servers see only tokenized references.
Encryption
All traffic between guests, restaurants, and Servestack is encrypted in transit with TLS 1.2+. Data is encrypted at rest on our infrastructure providers. There is no unencrypted path to guest or order data.
Data ownership & isolation
Each restaurant's guest data belongs to that restaurant. Servestack acts as a data processor: we don't sell data, we don't share guest lists across restaurants without explicit network-program consent, and restaurants can export their data at any time. Access within Servestack follows least-privilege — production data access is limited, logged, and reviewed.
Reliability
The platform runs on redundant cloud infrastructure with automated backups and point-in-time recovery. We target 99.95% uptime on Scale plans, with service credits for verified outages per our Terms of Service. Ordering pages are designed to fail safe: if a status check ever fails, menus stay up and payment gates are enforced independently at checkout.
Subprocessors
We use a small set of vetted subprocessors to run the service: Stripe (payments), Twilio (SMS delivery), our cloud hosting and database providers, and Google Analytics on this marketing site. Each processes data only to deliver its function.
Compliance & privacy requests
We honor access, correction, and deletion requests under CCPA and similar state privacy laws — see the Privacy Policy or email privacy@servestack.ai. SMS programs follow TCPA and CTIA requirements: express opt-in, STOP/HELP handling, and quiet hours.
Responsible disclosure
Found a vulnerability? Email security@servestack.aiwith details and steps to reproduce. We acknowledge reports within two business days, and we don't pursue action against good-faith research.
Questions
Security questionnaires and diligence requests: security@servestack.ai. Servestack, Inc. — Boston, MA.