Trust & Security

BluePlate runs on managed cloud infrastructure. Platform providers (listed under Subprocessors) are responsible for their physical data centers, network security, and platform-level certifications. BluePlate is responsible for the application code, access controls, and how customer data is stored and used. Restaurant partners are responsible for keeping their account credentials safe and for the accuracy of the content they publish.

All traffic to blueplate.world and its API endpoints is served over HTTPS with TLS terminated at our hosting edge. The application database and file storage (special images) are encrypted at rest by the underlying managed platform using AES-256. Secrets (API keys, webhook signing keys) are stored in a managed secret vault and are only exposed as environment variables to server-side code — never shipped to the browser.

Restaurant accounts sign in with email/password or Google OAuth. Passwords are hashed by the managed auth provider (bcrypt-family) — BluePlate never sees or stores plaintext passwords. Sessions use short-lived JWT access tokens with refresh-token rotation. Diners browsing the public feed do not need an account and are not tracked with personal identifiers.

Every database table containing restaurant-owned data has Row-Level Security enabled in Postgres. Policies restrict reads and writes to auth.uid() — a restaurant can only see and modify its own profile, specials, and subscription records. Administrative role checks use a separate user_roles table and a security-definer function so roles cannot be escalated from the client. Public data (the diner feed) is served from a projection table with a narrow, read-only anonymous policy that exposes only fields safe for public display.

Subscription payments are processed by Stripe. BluePlate does not store card numbers, CVCs, or full bank details on our servers — Stripe's hosted checkout handles the sensitive fields directly. We store only the Stripe customer and subscription identifiers needed to manage billing. Stripe is PCI DSS Level 1 certified.

BluePlate uses the following subprocessors to operate the service:

• Supabase — application database (Postgres), authentication, and file storage. SOC 2 Type 2 and HIPAA-ready.
• Cloudflare — hosting, CDN, TLS termination, and DDoS protection. SOC 2 Type 2, ISO 27001, and PCI DSS certified.
• Stripe — subscription billing and payment processing. PCI DSS Level 1.
• Resend — transactional and authentication email delivery.
• OpenStreetMap / Nominatim — geocoding of restaurant addresses and diner-typed locations. Only address text is sent; no account identifiers.

We will update this list before adding a new subprocessor that processes customer data.

Restaurant account data is retained while the account is active. If you delete your account, we remove your profile, specials, and uploaded images within 30 days, except where retention is required for tax, fraud, or legal reasons (for example, Stripe payment records). Diners can request removal of any personal information they've submitted by emailing us.

We log server errors and abnormal activity to help diagnose issues and detect abuse. Logs do not contain plaintext passwords or full payment card data. Access to production systems is limited to BluePlate operators and requires authentication with the underlying platform.

If we become aware of a security incident affecting restaurant partner or diner data, we will investigate promptly and notify affected users by email without undue delay, along with guidance on any recommended steps. Report suspected vulnerabilities to security@blueplate.world.

BluePlate itself does not currently hold SOC 2, ISO 27001, HIPAA, or PCI DSS certifications — those apply to the underlying platform providers listed under Subprocessors, not to BluePlate as a company. We follow the security practices described on this page and inherit the platform-level controls of Supabase, Cloudflare, and Stripe. If your organization requires a Data Processing Agreement (DPA), a copy of a subprocessor's SOC 2 report, or a security questionnaire completed, email security@blueplate.world and we will respond within 10 business days.

Security questions and disclosures: security@blueplate.world
General support: support@blueplate.world