RestroMatrix holds your purchase records, cash movements, staff details and salary figures. This page describes what we actually do to protect them. Everything below is a statement about how the software is built, not an aspiration.
Every record — every bill, cash entry, stock movement, staff member and salary row — carries the identity of the restaurant it belongs to, and every query the server runs is filtered by it. There is no screen and no API route that returns another restaurant's data, because the restaurant is taken from your login token and never from anything the app asks for.
A cashier, a store manager and an owner see different screens — but the difference is not that some buttons are hidden. Each route on the server declares the roles allowed to call it and refuses everyone else, so a request made outside the app is refused the same way a tap inside it would be.
| Control | What it does |
|---|---|
| PIN storage | PINs are stored as bcrypt hashes. They are never stored in a readable form, and nobody at Erpixo can look one up. |
| Failed attempts | Five wrong PINs lock that phone number for 15 minutes. |
| Request limits | The API rate-limits every caller, with tighter limits on sign-in, sign-up and PIN reset. |
| Changing a PIN | Signs out every other device immediately, so a PIN someone else knew stops working everywhere at once. |
| One-time codes | Sign-up and PIN reset codes expire, allow a limited number of attempts, and are single use. |
| Admin access | Our own support console requires a one-time code emailed to an approved address on every sign-in, and is a separate login from any restaurant's. |
The app and the website talk to the server over HTTPS only. Nothing your staff enters travels unencrypted.
Each bill, cash-out, stock movement and count records who created it and when, and that name is shown in the app rather than kept hidden. This is deliberate: most of what the product is for — knowing where money went — depends on it being obvious who recorded what.
The database is backed up nightly to Cloudflare R2 object storage, and backups are kept for a rolling fourteen days. Backups are stored in a private bucket that is not reachable from the web.
Application data is held on servers in India. Photos you attach — bills, payment proofs, wastage — are held with the record they belong to. Payments are handled by Razorpay and card details never reach our servers. Push notifications go through Expo. We do not collect Aadhaar numbers or images. The full list of who processes what, and why, is in the Privacy Policy.
Access to production systems is limited to the people who operate them, and each has their own credentials. We do not browse a customer's records as a matter of course; when support requires it, we ask first.
If you believe you have found a security issue, write to admin@erpixo.com with enough detail to reproduce it. We will confirm receipt and tell you what we find. Please do not test against another restaurant's data.