Security & Trust
How we keep your data safe
We build and run websites, client portals and marketing for restaurants and small businesses. Here’s, in plain language, how we protect your business and your guests’ information.
Where everything runs
Our websites and client portal run on Cloudflare’s global network. Our infrastructure provider, Cloudflare, maintains SOC 2 Type II and ISO 27001 certifications. Those certifications belong to Cloudflare and cover the hosting platform; they are not certifications held by Loaded Nacho itself.
Encryption
- Every site and the client portal use HTTPS, so information is encrypted in transit between visitors and our servers.
- Data stored on our hosting platform is encrypted at rest.
- Files like job-application resumes and support attachments are kept in private storage. They’re never public links and can only be opened by signed-in users with access.
Client portal sign-in
- Passwords are stored only as strong one-way hashes, never in plain text.
- Optional two-factor authentication with an authenticator app or an emailed code, plus one-time recovery codes.
- Passkey sign-in (Face ID, fingerprint or device PIN).
- Automatic lockout and rate limiting after repeated failed sign-in attempts.
- Secure, HTTP-only sessions that expire.
Your data stays yours
- Each client’s data is isolated. Users only see their own business’s menus, reservations, applications and requests.
- We practice least access: people and systems get only the access they need.
- We never sell your data or your customers’ data.
Backups
- Databases are backed up automatically every night, and those backups are kept for 30 days.
- We can restore a database to any point within the past 30 days.
- We also keep an encrypted off-site copy.
Monitoring
Automated security scans check our sites, portal, file storage, backups and DNS on a regular schedule, and anything they find is reviewed and fixed.
Payments
Online ordering and card payments are handled by your point-of-sale and ordering provider (such as SpotOn). Loaded Nacho does not process or store card numbers.
- Marketing email, like newsletters and loyalty lists, is sent through Brevo.
- System email, like sign-in codes, password resets and form notifications, is sent through Cloudflare.
Report a security concern
If you think you’ve found a security issue, email hello@loadednacho.com. Please include as much detail as you can. We’ll look into it promptly.
See also our Privacy Policy.