Security
Security commitment and data protection
Last updated: June 22, 2026
Our Commitment
At KVTemplate, security is a fundamental pillar of our platform. We implement a defense-in-depth security approach to protect restaurant and customer data, complying with the highest industry standards and Ecuadorian regulations.
This page details the technical, organizational, and legal security measures we apply to ensure the confidentiality, integrity, and availability of information.
1. Data Encryption
All traffic between your browser and our servers is protected using TLS 1.3 (Transport Layer Security), the most current standard for in-transit encryption. This applies to the public website, the administration panel, our APIs, and third-party integrations.
Sensitive data at rest (passwords, authentication tokens) is stored using robust hashing algorithms (bcrypt/argon2) and never in plain text.
2. Database Security (Row Level Security)
We use Row Level Security (RLS) at the database level in Supabase/PostgreSQL. Every database query is automatically filtered by the owning restaurant's identifier, preventing any user from accessing data that does not belong to them.
This protection operates at the database engine level and cannot be bypassed from the application layer, ensuring total data isolation between restaurants.
3. Payment Protection (PCI DSS)
KVTemplate does not store, process, or transmit credit or debit card data. All payments are processed exclusively through PayPal, a PCI DSS Level 1 certified provider (the highest standard in the payments industry).
By using PayPal as the sole payment processor, KVTemplate reduces its PCI DSS scope to the minimum (SAQ A), eliminating the risk of financial data exposure for our users.
4. Authentication and Access Control
We support two-factor authentication (2FA) for all accounts. Access to data and administrative functions is restricted through granular roles and permissions.
User sessions are managed with short-lived JWT tokens and automatic rotation. Access credentials are always transmitted encrypted and never stored in client-side cache.
5. Continuous Monitoring and Incident Response
We maintain continuous 24-hour security monitoring to detect and respond to suspicious activities, unauthorized access attempts, and potential vulnerabilities.
In the event of a security breach affecting personal data, KVTemplate will notify the Ecuadorian Personal Data Protection Authority within 72 hours, in accordance with Article 42 of the LOPD, and will communicate to affected data subjects without undue delay.
6. Backups and Disaster Recovery
We perform automatic daily backups of all information stored on the platform. Backups are stored in geographically separate locations and are encrypted at rest.
Our Recovery Time Objective (RTO) is under 1 hour and our Recovery Point Objective (RPO) is under 24 hours, ensuring business continuity for our users.
7. Physical and Infrastructure Security
Our infrastructure is hosted on Vercel (serverless deployment platform), proprietary VPS servers (for complementary services), and Supabase (database), providers that maintain SOC 2 Type II and ISO 27001 certifications and comply with international physical and logical security standards in their data centers.
Access to production infrastructure is restricted exclusively to authorized technical personnel via multi-factor authentication and audit logs.
8. Ecuador Regulatory Compliance
KVTemplate operates in compliance with Ecuador's Organic Law on Personal Data Protection (LOPD), implementing the principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality.
For electronic invoicing, we comply with the requirements of Ecuador's Internal Revenue Service (SRI), generating invoices in PDF and XML format valid for tax filing.
9. Privacy by Design and by Default
We apply the principles of Privacy by Design and Privacy by Default in the development of all our features. This means that data protection is integrated into the platform's architecture from its conception and not as a layer added afterward.
By default, only the minimum data necessary to provide the service is collected. We do not sell, share, or monetize personal data from our users or their customers.
10. How to Report a Vulnerability?
If you discover a security vulnerability in our platform, we appreciate responsible disclosure. Please send an email to: [email protected] with technical details and steps to reproduce the finding.
We will maintain direct communication with you during the investigation and remediation process. We request not to publicly disclose the vulnerability until we have had the opportunity to fix it (responsible disclosure policy). We appreciate and will eventually recognize researchers who follow this process.