Security and trust
Your data, protected like it matters. Because it does.
Restaurants trust Ordrova with their sales, their customers and their cash. Here is how we protect them.
Built under ISO/IEC 27001:2022
Ordrova is developed, maintained and supported by Cyber Nest, whose information security management system is certified to ISO/IEC 27001:2022, the international standard for managing information security: risk assessment, access control, secure development, supplier management, incident response and continual improvement.
- Certificate holder
- Cyber Nest
- Scope
- Development, Maintenance and Support Services of Software
- Certificate copy
- Available on request to customers and prospects: [email protected]
How we protect your restaurant
Every restaurant isolated
Each restaurant's menus, orders, customers and staff are kept apart. Every lookup is checked against the restaurant it belongs to, and automated tests try to read across restaurants on every change.
Default-deny access
No operation runs without an explicit permission rule. Roles limit what each person can do and which branches they can see.
Encryption
Traffic is encrypted with HTTPS. Payment gateway, tax-authority and SMS credentials are encrypted with AES-256-GCM and never shown again after they are saved.
Verified payments
An order is only paid after the gateway confirms it, with the signature and the amount checked. Card details are entered with the payment gateway, never stored by Ordrova.
Audit trails
Order status changes, voids, refunds, discounts and cash movements record who did them and which manager approved them. Approvals are checked by the server whenever the till is online, and those made offline are flagged for the owner.
Strong sign-in
Passwords are hashed, accounts lock after repeated wrong passwords, and signing out ends every session. Customers sign in with one-time codes sent only to their own email, or to their phone through the restaurant's own WhatsApp or SMS account. Till staff use personal PINs with lockout.
Bots kept out
Sign-in, sign-up, guest checkout and contact forms are protected by Cloudflare Turnstile and rate limits, so fake orders and code spam are stopped before they reach a restaurant.
Built to keep running
The POS keeps selling when the internet drops, and every sale syncs exactly once when it is back.
Tested on every change
Hundreds of automated tests, including permission, cross-restaurant and attack scenarios from our security review, run before any change is released.
Compliance
Built for Pakistan's rules from the start.
Tax invoicing
Sales reported to FBR with the invoice number and QR code on receipts; voids reported as credit notes. PRA and SRB being added.
Payments
Payments run through licensed local gateways into your own merchant account.
Data processing agreement
Available for Enterprise customers.
Responsible disclosure
Report vulnerabilities to [email protected].
Who owns the data?
You do. You can download your orders and customers to Excel at any time, and on Growth and Enterprise your full sales report. We process customer data on your behalf to run your restaurant's ordering and do not sell it.
Do you store card numbers?
No. Customers enter card and wallet details with the payment gateway (JazzCash, Easypaisa, PayFast, Safepay, Bank Alfalah, XPay, Stripe or PayPal). Ordrova only receives the verified result.
Can my staff see other branches?
Only if you allow it. Branch roles are limited to the branches they are assigned to.
How do I report a security issue?
Email [email protected]. We acknowledge reports within two business days and ask that you give us time to fix an issue before disclosing it.
Need a security review?
Enterprise customers get a security review, our certificate and a data processing agreement. Talk to us.