Security & reliability

Protected by design.

Understand how payments, staff access and venue records are handled. Read the published service and privacy terms, and request current security information for your own supplier checks.

Where card data actually goes

Guest pays

Pay by supported card or wallet through the configured payment flow. Availability depends on the device and payment setup.

Stripe

Stripe collects card details for integrated payments; Servio records payment references and status.

Your bank

Stripe manages settlement, subject to account verification, payout status and the applicable schedule.

Read the published service and privacy terms and request current security information where your venue needs it. Live status · Refund policy · Companies House

How Servio protects your data

Payments via Stripe

Stripe collects card details for integrated payments. Servio keeps order-related payment identifiers and status. Your venue still needs to protect accounts and devices and follow the PCI requirements applicable to its payment setup.

Connections and stored data

Public Servio connections use HTTPS. The Data Processing Addendum sets out the encryption and access-control commitments for venue data; request current technical documentation if your procurement process needs implementation details.

Cloud services and data handling

Servio is a UK company using cloud services for the website and product. Request current hosting, data-location and backup information for your supplier checks, and read the privacy and Data Processing Addendum terms for personal-data handling.

Role-based access

Use individual staff access and the permissions available on your plan. Growth and Enterprise include role controls; check access to orders, reports, refunds and settings before service.

Uptime we target

The published SLA targets 99.9% monthly uptime for core ordering and payments, excluding announced maintenance. This is a service target, rather than a claim of measured historical availability. See app.servio.uk/status for current checks and incidents.

Offline resilience

A previously loaded POS can queue cash or external-card orders on that device and sync after reconnecting. Integrated Stripe Terminal payments cannot be queued offline. QR ordering, live kitchen updates and cloud reporting need connectivity. Keep a backup connection available and preserve browser data until pending orders sync.

Reporting a vulnerability

If you think you have found a security problem in Servio, tell us before you tell anyone else and we will work with you. Email support@servio.uk, or read the machine-readable version at /.well-known/security.txt.

We acknowledge reports within one working day and keep you updated until the issue is closed. We will not take legal action against anyone who reports a genuine issue in good faith, keeps the details private until we have fixed it, and stays inside two limits while testing: do not run automated scans heavy enough to degrade service for a live venue mid-shift, and never access, change or keep another venue’s data. If you need test data, ask us and we will set you up rather than have you poke at a real restaurant.

Who else touches your data

Integrated card payments use Stripe. Servio also uses cloud hosting and transactional email providers to operate the website, account flows and product. Provider certifications do not establish a separate Servio certification or remove a venue’s own payment-security responsibilities.

Request the current sub-processor list, roles and processing locations from enquiries@servio.uk. The Data Processing Addendum sets out the contractual obligations and safeguards for processing and international transfers.

Who can see what, inside your venue

Individual staff access, appropriate permissions and device security help protect venue information. Check who can use a device and what that account can access, especially on shared tills.

Roles rather than shared logins

Create individual staff access and use the role controls available on your plan. Check permissions against the tasks each person performs, including orders, refunds, reports and staff administration.

An owner can see who did what

Review the available order and staff activity records when investigating a correction, void or refund. Individual accounts make recorded activity more useful; avoid assuming that every possible device action appears in the same audit view.

Cloud records and local pending work

Synchronised records are stored in the platform, while pending offline orders remain on the original device. A replacement device does not recover unsynchronised work automatically. Protect device access and preserve pending data while arranging recovery with support.

Availability, outages and published terms

The SLA sets a 99.9% monthly uptime target for core ordering and payments, excluding announced maintenance. Check app.servio.uk/status for service checks and incidents. Request current backup and recovery documentation when assessing continuity for your venue.

A previously loaded POS can queue cash or external-card orders on that device and sync after reconnecting. Integrated Stripe Terminal payments cannot be queued offline. QR ordering, live kitchen updates and cloud reporting need connectivity. Keep a backup connection available and preserve browser data until pending orders sync. Under the published refund policy, more than 24 consecutive hours of unavailability of core ordering and payments due to an issue on our side qualifies for a pro-rata refund.

If something does go wrong

Report a suspected security incident to support promptly. The Data Processing Addendum requires breaches affecting venue data to be reported without undue delay. UK GDPR reporting duties depend on the risk: notifiable breaches must be reported to the ICO within 72 hours of awareness, where feasible, and affected people informed where the risk is high.

Request access, correction, export or deletion through support. The published retention policy provides for deletion or anonymisation of operational data within 90 days of closure unless legal retention is required. See the privacy policy for the applicable rights and terms.

What we do not claim

Servio is an early-stage UK company. We do not hold our own ISO 27001 certification or SOC 2 report; named provider certifications apply to those providers. We do not sell venue or guest data. Sharing is limited to providers needed to run Servio, as described in our privacy policy. Send supplier security questions to enquiries@servio.uk for current information.

Where we stand on compliance.

Provider certifications and payment services do not certify your entire venue or replace your own obligations. Review the privacy, processing and service terms and ask for current documentation where you need evidence.

• Privacy and DPA
• Stripe payments
• HTTPS connections
• Published SLA