Security at PrepIQ

Your kitchen data is the backbone of your operations, and we treat it with the same care you put into every dish that leaves your kitchen — protected at every layer, monitored continuously, and never sold to anyone.

Infrastructure

PrepIQ runs on reputable, industry-standard cloud infrastructure with encrypted storage, redundant systems, and automated backups. Our hosting providers maintain recognized security certifications and follow industry best practices for physical and network security.

Authentication & Access Control

• Passwords are never stored in plain text — they are hashed using industry-standard cryptography.
• We use JSON Web Tokens (JWT) for secure, short-lived authentication sessions, with automatic refresh and expiration.
• Role-based access control (RBAC) ensures each team member only sees the data and features relevant to their role.
• Inactive sessions expire automatically.
• Multi-factor authentication (MFA) is on our roadmap for all accounts.

Data Protection

• All data in transit is encrypted using TLS.
• Sensitive data at rest is encrypted.
• Database connections use SSL/TLS.
• API secrets and credentials are stored using dedicated secrets-management tooling — never hardcoded or committed to source code.

Connector Security

The PIQ Connector deserves its own explanation, because it's the piece of software closest to your POS and kitchen systems:

• It accesses only the specific databases and tables you configure it to access — nothing more.
• All communication between the Connector and PrepIQ is encrypted over HTTPS.
• It authenticates using a unique, revocable API key issued to your organization.
• It updates automatically to patch security issues and stay compatible with your systems, and every release is digitally signed so you can trust its authenticity.
• It has no ability to remotely control, modify, or delete data in your source systems — it is strictly read-only.

AI & Forecasting Security

• Your operational data is isolated at the database level — other organizations cannot access, view, or influence your forecasts.
• Cross-tenant access is architecturally impossible, not just a policy — our data model enforces separation between organizations.
• Our machine learning models are trained and applied within the boundaries of your own organization's data; they do not leak or expose one customer's information to another.

Monitoring, Logging & Alerting

We continuously monitor our systems for unusual activity, log access events for auditing, and alert our team automatically when something looks wrong, so we can investigate and respond quickly.

Disaster Recovery

• Backups run automatically and regularly.
• Backup and recovery procedures are tested periodically to confirm they actually work.
• Data is stored redundantly to reduce the risk of loss from a single point of failure.

Incident Response

We maintain an incident response process with defined escalation paths, so that if something does go wrong, we can act quickly and communicate clearly. In the unlikely event of a security incident affecting your data, we will notify affected customers within 72 hours in accordance with applicable regulations, and we conduct a post-incident review afterward to prevent recurrence.

Compliance & Best Practices

We build PrepIQ with data protection regulations such as the GDPR and CCPA in mind, and we align our practices with recognized industry security frameworks. Our infrastructure partners maintain independently audited certifications, such as SOC 2 Type II, that we rely on as part of our overall security posture.

Vendor Security

Every third-party service we rely on — including our payment processor, notification provider, and file storage provider — goes through a security review before we integrate it, and we keep the number of vendors with access to customer data as small as possible. We periodically review vendor access permissions and data sharing agreements.

Secure Development Lifecycle

Every code change goes through automated security scanning, peer review, and staging validation before it reaches production. We periodically review our systems for vulnerabilities and prioritize fixes based on risk.

Responsible Disclosure

If you discover a security vulnerability in PrepIQ, we want to know about it. Please report it to security@prepiq.net with as much detail as you can provide. We will acknowledge your report within 24 hours, investigate promptly, and keep you updated on our progress. We will not pursue legal action against security researchers who act in good faith, report responsibly, and avoid accessing or modifying data that isn't theirs.