Security & your data
Last updated 9 September 2026
You are handing us your sales, your payroll and your bank matching. This page says in plain words what we do to protect them, and where we are still on the road. It lists only what is built and running today: no certification we do not hold, no audit we have not had. We would rather tell you now than on the install day.
Who can talk to the engine
Every request from a till to the engine carries a key. Today one engine key is shared within a group. Per-branch keys — so that one branch's key is never another's — are built and waiting on the rollout; when they are in place this page will say so, with the date. [to confirm]
The factory key that shipped with the early installs was retired on 1 September 2026, and strict key checking is on: a request without a valid key is refused, not tolerated.
What the till does not hold
A till is the most exposed machine in a restaurant. It stands on the floor, staff share it, and it can walk out of the door. So we keep it thin.
The till holds no salaries and no IBANs. A PIN is never stored anywhere as a PIN: it is kept only as a salted hash (PBKDF2, 60,000 rounds), so a stolen till yields hashes, not PINs. The two things that move money — a refund, and a void of a bill already paid — are checked again by the engine before they are booked, whatever the till thinks. The tokens that connect your Instagram and TikTok accounts are redacted from anything a till can read; the till never sees them.
The permanent journal
Sales, voids, refunds and wage changes are written to a permanent journal that only accepts additions. A correction is a new line that points at the old one. Nothing is edited, and nothing is edited away.
If a number was wrong on Tuesday, on Friday you can still see what it said on Tuesday, and the line that corrected it.
Backups and restores
The database is backed up every day. A backup that has never been restored is a hope, not a backup, so we test the restore as well: a copy is brought back and checked that it works.
How we prove a fix is a fix
When we fix a defect we do not only fix it. We write a test, then put the defect back on purpose to prove the test catches it, then take it out again. Only then does the fix ship.
Today 297 of these gates stand between any change and your till. A change that fails one of them does not go out.
When the line drops
The till keeps selling with no connection. What matters is what it believes when the answer from the engine comes back empty: nothing. An empty answer is never treated as truth, not as a zero and not as "there is nothing". Unknown is never zero. The till waits for a real answer and carries on with what it knew.
Devices: one code each, revoked in a tap
Waiter tablets, chef displays, hostess desks and staff phones each join by scanning a QR code that works once and is then dead. The Owner app is different: it connects with a company code and the Owner's own PIN, and every Owner session can be ended at once from Head Office. If a tablet is lost, or a phone leaves with a member of staff, its access is revoked in a tap and the device is out.
What this page does not claim
We hold no ISO or SOC certification, and this page claims none. We make no claim of an independent penetration test. When either of those changes, this page will say so, with the date. [to confirm]
Questions
Write to hello@mim-smart.com. If you find a weakness, we want to hear about it there first.