Start free trial
Security

Security at ChopOps

Your invoices, recipes, sales and payroll numbers are your business. Here's how we look after them, and how to tell us if you find a problem.

How we protect your data

  • Encrypted everywhere. All traffic uses HTTPS. Data and files are encrypted at rest by our database provider.
  • Each restaurant is walled off. Database-level access rules mean one restaurant's data can't be read by another, even if the app had a bug.
  • Roles. Owners decide who's on the team and what they can do. Only owners and managers see wages and labour cost.
  • A protected account holder. Each restaurant has one account holder who can't be removed, and only they can add or remove Owners. They get an email when someone else removes a team member or a new Owner joins.
  • Passwords are never stored in plain text. Card details are handled by Stripe; we never see full card numbers.
  • AI assistants you connect only get what your role allows, for the one restaurant you pick, and can be disconnected any time. See AI assistants.
  • Trusted providers. Hosting (Vercel), database and sign-in (Supabase) and AI invoice reading (Anthropic) each hold SOC 2 Type II reports. Data is stored in the United States.
  • Deleted when you leave. If you cancel, your restaurant's data is deleted within 90 days. See our Privacy Policy.

Report a security problem

If you think you've found a vulnerability in ChopOps, please email support@getchopops.com with "Security report" in the subject. Include what you found, the steps to reproduce it and the page or address involved.

  • We'll reply within 2 business days and keep you updated until it's fixed.
  • Please don't access, change or delete other people's data, slow the service down, or use automated scanners that send large amounts of traffic. Use your own account, or ask us for a test account.
  • Give us a reasonable time to fix the problem before telling anyone else.
  • If you act in good faith and follow these rules, we won't pursue legal action against you for your research.

Our security.txt has the same contact details.

If something goes wrong

If a security incident affects your information, we'll contain it, tell you without delay, and report it to the Office of the Privacy Commissioner of Canada and any other regulator as the law requires.