Trust & security
Security at Meuze
Meuze processes operational data for multi-location restaurant groups: sales, inventory, invoices, and labor. Protecting that data is a core product requirement, not an afterthought. This page describes the controls we run today.
Encryption
All traffic between your browser, our application, and our APIs is encrypted in transit with TLS 1.2 or higher. Customer data is encrypted at rest across our databases, object storage, and backups using AES-256 managed by our cloud providers.
SOC 2 Type II program
Meuze operates a SOC 2 Type II compliance program covering the Security trust services criteria. Our Type II observation period completed in 2026 and the independent auditor's report is forthcoming. Prospective customers can request our current compliance documentation under NDA via support@meuze.ai.
Infrastructure
Our backend runs on Amazon Web Services. Threat detection is handled by Amazon GuardDuty, and all control-plane activity is recorded with AWS CloudTrail. Audit logs are retained for 365 days. Infrastructure access follows least-privilege IAM roles, and production changes ship through reviewed, automated deployment pipelines.
Tenant isolation
Meuze is multi-tenant by design. Every customer-facing database table enforces row-level security (RLS), scoping reads and writes to the authenticated organization. Application-layer checks are backed by database-layer policies, so a missing filter in code cannot expose another tenant's data.
Monitoring
Application errors are captured with production-only error monitoring configured to scrub personally identifiable information before events leave our infrastructure. Alerts route to the engineering team for triage against defined severity levels.
Subprocessors
We use a small set of vetted subprocessors to deliver the service:
| Subprocessor | Purpose |
|---|---|
| Amazon Web Services | Cloud infrastructure and compute |
| Supabase | Managed Postgres database |
| Clerk | Authentication and identity |
| Stripe | Payments and billing |
| Nango | Third-party integration credentials (POS, accounting, email) |
| OpenRouter | LLM inference routing |
| Twilio | Messaging delivery |
| Sentry | Error monitoring (PII scrubbed) |
| Vercel | Web application hosting |
Responsible disclosure
If you believe you have found a security vulnerability in a Meuze product or service, we want to hear from you. Report it to support@meuze.ai with enough detail to reproduce the issue. Machine-readable contact details are published at /.well-known/security.txt. We ask that you avoid accessing other customers' data, give us reasonable time to remediate before public disclosure, and act in good faith. We will acknowledge valid reports and keep you informed through resolution. We do not pursue legal action against good-faith security research.