Security

Last updated: 27 September 2026

This page describes what Sened's security rests on: where restaurant data is kept, the limits of what the application asks from a Google account, how this site is built, and how to tell us if you find a vulnerability.

Where the data lives and who controls it

Restaurant data — orders, items, inventory, expenses, settings and staff accounts — is stored in a database on the restaurant's own device. No intermediary server of ours carries this data, and the application does not send restaurant operations data to any third party.

• Full control of the device and of who uses it stays with the owner.
• Each employee has an account with defined permissions and cannot reach what their job does not require.
• Waiter and kitchen devices connect over the local network the owner configures, not over the internet.

Least privilege in Google Drive

Cloud backup is optional. When it is enabled, Sened requests the https://www.googleapis.com/auth/drive.file scope only — the narrowest scope that does the job:

• It grants access only to files Sened itself created — not to the rest of your Drive.
• It is used to upload a database backup, list previous backups, and download a selected one to restore.
• Google user data is never used for advertising, never sold, never shared with advertisers and never used to train models.

The connection token is kept on the restaurant's device in protected storage provided by the operating system; it never appears on this site and is never sent to us. The owner can disconnect from the app's settings at any time, or revoke access from the Google account permissions page.

This site's security

This site is a set of static pages for information and policies only, built so that its attack surface is as small as possible:

• HTTPS enforced: every http:// request is redirected to https://, and the certificate is managed and renewed automatically.
• No JavaScript: there is not a single script on the site, so there is nothing to execute in your browser.
• Strict Content Security Policy: the default source is 'none'; only our own stylesheet and images, plus Google Fonts, are allowed.
• No tracking, no forms: no analytics and no cookies of ours, and no fields that collect your data. Contact is by email only.
• Limited referrer: strict-origin-when-cross-origin, so page paths are not leaked to other sites.

These pages are hosted on GitHub Pages, which may process visit data under its own policy. Fonts are loaded from Google Fonts — the only external connection the page makes. Because the hosting is static, some protections are applied through service headers we do not control; this is also why the site contains no functionality that handles user data at all.

Support email and impersonation

The only official support address is support@sened.group, a receiving address forwarded to the team's mailbox.

• We never ask you for your account password, a verification code, or a backup file by email or phone.
• We do not send password-reset links unless you requested one, and we never ask you to install software from other sources.
• If you receive a message impersonating Sened, do not respond to it and report it to us with the full message headers.

The owner's responsibilities

In a system that runs on your own device, a large part of security depends on you:

• A password-protected operating-system account on the restaurant's device, and a locked screen when unattended.
• A separate account for each employee with the least privilege that suffices, and immediate removal when someone leaves.
• A local network closed with a strong password, and the restaurant's device kept off the guest network.
• Regular backups and tested restores — an untested backup is not a backup.
• Keeping the operating system and the application updated, and keeping a copy off the device (external disk or Drive).

Reporting a vulnerability

If you find a vulnerability in the application or in this site, write to support@sened.group with "security" in the subject. Helpful details: a description of the issue, steps to reproduce it, the expected impact, and the version or URL concerned.

• We acknowledge your message and work on fixing what is confirmed.
• We ask that you not publish details before a fix, and that you not access, modify or delete real restaurant data while testing.
• Please do not test in ways that disrupt the service, and do not use social engineering against Sened's users.

Machine-readable contact details: /.well-known/security.txt.