Overview
MenuOnScan is a hosted SaaS platform for digital menus and venue operations. We apply defense-in-depth controls across authentication, authorization, infrastructure, and monitoring. This page summarizes our practices; it does not disclose internal architecture secrets.
Data in transit and at rest
All customer-facing traffic is served over HTTPS (TLS 1.2+). Session cookies are httpOnly and scoped appropriately. Database connections use TLS. Uploaded menu images are stored in private object storage with CDN delivery for public guest assets only.
Authentication and access
Dashboard and admin access use Better Auth with email OTP (and optional Google OAuth). Venue mutations require server-side RBAC checks — UI hiding alone is never sufficient. Super-admin access is restricted, audited, and supports optional MFA for production admin routes.
Application security
Public APIs validate input with Zod schemas, apply IP rate limits, and use honeypot fields on contact and feedback forms. Cron routes require a shared secret. Stripe webhooks verify signatures. File uploads validate MIME type, size, and magic bytes.
Monitoring and incident response
Production errors are reported to Sentry when configured. Structured API logs include correlation IDs. See our status page for dependency health and our incident response runbook (internal) for on-call procedures.
Responsible disclosure
Report suspected vulnerabilities to hello@menuonscan.app. Please do not test against production customer venues without written approval. We acknowledge good-faith reports within 5 business days.