Your numbers are your numbers

The straightforward way to run a platform like this is one big database with a column marking which venue each row belongs to, and a filter on every screen. It works perfectly until somebody misconfigures a filter.

We do not do it that way. Each venue gets its own separate data store and its own separate reporting dashboard, created from the same template but never sharing a table, a query or a connection.

The difference matters when something goes wrong. With filters, a mistake shows you another client’s margins. With separate stores, a mistake shows you an empty report. One of those is a bad afternoon; the other is a breach.

And we prove it rather than assert it

Before handover, we run a documented isolation test. An operator signed into one sandbox venue attempts to reach another’s records, dashboards and documents — by direct link, by substituting identifiers, and through the reporting layer. Every attempt is recorded with its result, and the report is handed over as a deliverable.

If you ask us how we know the separation holds, the answer is a document, not a reassurance.

Invoices arrive at a dedicated address that exists only for that purpose. It is not a mailbox anyone uses for correspondence.

Every incoming message is checked against a list of specifically named staff email addresses that you choose. Not a domain — individual addresses, added one at a time.

An address that is not on the list is refused. The message is not opened, not read and not processed; an alert goes to our operations desk telling us an unrecognised sender tried. If a member of staff leaves, removing their address from the list removes their access that moment.

Only BOH changes that list, and only at your request. Our automation reads it through a separate read-only connection, so the system that checks permissions cannot alter its own permissions.

Every document is read into structured line items, and every field carries a confidence score — the supplier’s name, each product, each quantity, each unit price.

Anything below our threshold stops. It goes into a review queue for a person to look at, and it does not enter your ledger until someone has.

This is deliberate, and it occasionally means a blurred photograph waits for attention instead of processing instantly. We think that is the right trade. A misread unit price is not a display bug you notice and correct — it becomes a price baseline, and three months later it is a margin decision made on a wrong number.

A system that admits it is unsure is worth more than one that is confidently wrong.

Staff forward things. They re-send, they copy the address on a thread, they photograph the same delivery note twice.

Every document is fingerprinted on arrival. A duplicate is recognised and discarded — it does not create a second entry and it does not move a price baseline. Without this, a system eventually compares an invoice against itself and reports a price change that never happened.

Guest reviews are collected automatically, assessed, and answered with a drafted reply written in your venue’s register.

The draft waits for you. Nothing is published to a guest until a person has read it and approved it. Drafting is automated; publishing is not, and will not be.

An unsupervised system replying on its own to an upset guest on a public listing is a risk with no matching upside.

Your store keeps an append-only audit trail. Every write the system makes is recorded — what changed, when, and what triggered it. Entries are added, never edited or removed.

If a figure on your dashboard looks wrong, it can be traced back to the document it came from and the moment it was written.

Our domain is authenticated with SPF, DKIM and DMARC, verified against an independent external checker. That means mail claiming to come from us can be verified as ours — which matters most when the message concerns your invoices.

Your data is yours. It is held in structured, ordinary formats — not a proprietary one — so it can be exported in full whenever you ask.

We keep supplier invoices for 7 years (for corporate tax compliance), staff rotas for 3 years and guest reviews for 2 years, as set out in our Privacy Notice.

This page describes how the platform handles your information. Our Privacy Notice covers our legal obligations — what we collect, on what basis, how long we keep it, and your rights.

If you have a security question this page does not answer, ask. We would rather answer it directly than have you assume.

[email protected]