Security at MenuSpy

MenuSpy treats restaurant operator data as sensitive operational data. We run on Google Firebase with managed infrastructure for authentication, database, and serverless compute. User passwords are not stored by MenuSpy; authentication is handled by Firebase Auth with industry-standard hashing and Google Sign-In for SSO. Database access is gated by Firestore security rules that enforce per-restaurant ownership at the row level. Stripe handles all payment information and MenuSpy never sees a credit card number. API endpoints are rate-limited and authenticated. We do not sell or share aggregated restaurant data with third parties. We do not scan or share menu data outside the workspace of the restaurant operator who configured the comparison. Email contact@menuspy.ai if you are a restaurant group or franchisee who needs additional documentation for a procurement review.