← Back to home
Trust
Security at POSavoir
The point-of-sale runs your most sensitive data , sales, staff, and your patrons. We take that seriously. This page summarises how we secure the platform.
Compliance & attestations
- SOC 2 Type II , annual audit of security, availability, and confidentiality controls.
- PCI DSS , card data is processed by PCI-validated providers; POSavoir's environment is reviewed annually.
- GDPR / UK GDPR / CCPA , privacy program aligned to leading data-protection regimes.
Encryption
- TLS 1.2+ in transit, AES-256 at rest.
- Secrets stored in a managed key-management service with hardware security module backing.
Access control
- Single sign-on (SAML/OIDC) and enforced multi-factor authentication for employees.
- Least-privilege access reviewed quarterly. Production access is gated by approval, audit-logged, and time-bound.
Application security
- Code review and automated static analysis on every change.
- Dependency scanning and patch management on a defined SLA.
- Annual third-party penetration test; report available under NDA.
Infrastructure
- Hosted in tier-1 cloud regions with 24/7 monitoring and on-call rotation.
- Encrypted, geographically isolated backups; recovery objectives documented in our DR plan.
Incident response
We maintain a documented incident response plan with a 24/7 on-call rotation. We will notify affected operators without undue delay if we determine that personal data has been compromised, in line with applicable law and contractual commitments.
Responsible disclosure
If you believe you've found a security vulnerability, please email security@POSavoir.com. We will acknowledge within 2 business days and work in good faith to investigate and resolve. We do not pursue legal action against good-faith researchers.
Documents available on request
- SOC 2 Type II report (under NDA)
- Penetration test summary
- Sub-processor list
- Business continuity / disaster recovery summary
Email security@POSavoir.com.