Security & Data Protection Policy

ქართული

Last updated: October 1, 2026

This document describes the security measures COFOS has in place, and what we expect from you in return. Security is a shared responsibility — no measure on our side substitutes for reasonable practices on yours.

1. What COFOS does

1.1 Authentication & session security

• Passwords are handled entirely by our authentication provider, Supabase Auth, using industry-standard hashing. We never store or have access to plaintext passwords.
• On mobile, your session token is stored in the device's OS-level secure storage — the iOS Keychain or Android Keystore — rather than in plain, unencrypted app storage. A lost or compromised device does not, on its own, hand over a usable session.
• Non-Admin accounts are locked to a single registered device by default, limiting the blast radius of a single leaked credential.
• Admins can lock (immediately suspend login for) any staff account.

1.2 Authorization

Access control is enforced at the database level via row-level security policies tied to each user's role (Cashier, Manager, Admin) — not only hidden in the app's user interface. This means even a request that bypasses the app's UI is still subject to the same role-based restrictions.

1.3 Data in transit and at rest

All communication between the App and our backend is encrypted in transit (TLS). Data at rest is encrypted by our infrastructure provider, Supabase, as part of its standard hosting configuration.

1.4 Payment data

COFOS is not in scope for PCI DSS: it never receives, transmits, processes, or stores payment card numbers or other cardholder data. Card payments your business accepts are handled entirely by your own external payment terminal or provider. The card you use for your COFOS subscription is entered on the payment page of Flitt, not in the App; we never see it.

1.5 Crash and error monitoring

Our error-monitoring provider (Sentry) is explicitly configured with default personal-information collection disabled. Crash reports are used to fix bugs, not to reconstruct your business or customer data.

1.6 Vendor security

We rely on established infrastructure providers (Supabase, Sentry, PostHog, Firebase/Apple, Flitt) rather than operating our own servers, so the underlying physical and network security of your data benefits from their respective security programs and certifications, in addition to the application-level controls described above.

2. What we expect from you

• Protect your own credentials. Don't share Admin login details. Use the account-lock and device-lock features deliberately when staff leave or a device is lost.
• Keep the App updated. Security fixes are shipped as app updates — an outdated app version may be missing protections available in the current release.
• Report suspected issues promptly. If you believe an account has been compromised, a device has been lost while logged in, or you've noticed anything that looks like unauthorized access, contact us immediately at info@getcofos.com.
• Use your device's own security features. Screen lock, biometric authentication, and OS-level updates on the physical devices running COFOS are your responsibility and materially affect the security of data on that device.

3. Reporting a security vulnerability

If you believe you've found a security vulnerability in COFOS (as opposed to a general bug), please report it responsibly to info@getcofos.com rather than disclosing it publicly. We will acknowledge reports in good faith and aim to address confirmed issues promptly. We do not currently operate a formal bug bounty program.

4. Incident response

In the event of a security incident that we determine affects your data, we will notify affected Admin users without undue delay after we become aware of it and have enough information to provide a meaningful notification, describing what happened, what data was involved, and what steps we're taking. This commitment applies regardless of whether formal breach-notification law applies to your specific situation.

5. Limits of these measures

No system is perfectly secure, and no security measure — ours or yours — eliminates risk entirely. Our Terms of Service's disclaimer and limitation-of-liability sections govern the legal treatment of this reality; this document describes our practices, not a guarantee.