Security

Security is built into Mesa, not bolted on. This page summarises how we protect your workspace and your data as you run your business on the platform. It should be read together with our Privacy policy.

Encryption in transit

Traffic between your browser and Mesa is served over HTTPS, so your data is encrypted as it travels across the network.

Encryption at rest

Sensitive data is encrypted where it is stored. Statutory documents you upload to the business documents vault are held outside the public web root and encrypted with AES-256-GCM, and are decrypted only inside your authenticated, tenant-scoped view. Customer mobile numbers are encrypted and only the last four digits are ever displayed.

Passwords and sign-in

Account passwords are never stored in plain text — they are hashed with Argon2id, a modern memory-hard algorithm designed to resist brute-force and GPU attacks. You can also sign in through established identity providers, and email verification confirms ownership of your address.

Tenant isolation

Every business's data is walled off from every other business on the platform. The data layer automatically scopes queries to your workspace, and a write guard prevents data from ever being saved against the wrong workspace, so one restaurant can never see or affect another's information.

Access control

Access inside your workspace is governed by roles — waiter, cashier, manager, owner — enforced on the server, not just hidden in the interface. Sensitive actions such as large discounts, voids and comps require a manager PIN, and reporting visibility can be granted per staff member.

Safe error handling

When something goes wrong, users see a calm, branded message rather than technical internals. The detailed diagnostic report travels only in encrypted form and can be opened by the platform operator alone, so error details cannot leak sensitive information.

Content and abuse protection

Mesa screens catalog and business names against a content policy, flags suspicious activity for review, and gives the operator the ability to suspend an abusive account quickly — protecting the platform and its legitimate users.

Your part

Security is shared. Please use a strong, unique password, keep point-of-sale PINs confidential, give each staff member their own sign-in with the least access they need, and sign out on shared devices. Tell us promptly if you suspect any unauthorised access.

Responsible disclosure

If you believe you have found a security vulnerability, please report it responsibly to info@sanjivanimt.com and give us a reasonable chance to investigate and fix it before any public disclosure. We appreciate the security community's help.

Changes

We may update this page as our practices evolve; the date above reflects the latest revision.