Security

Operational security summary

Restore handles restaurant compliance workflows, provider marketplace activity, watchlist alerts, and public agency records. We keep the security model simple and practical.

Application Controls

• HTTPS-only production traffic with HSTS.
• Signed, HttpOnly, Secure, SameSite session cookies.
• Scrypt password hashing for account credentials.
• CSRF Origin and Referer checks on state-changing requests.
• Rate limits on signup, admin verification, and AI explainer routes.
• Provider marketplace access controls for claims, updates, and phone reveals.
• Security headers including CSP, frame blocking, MIME sniffing protection, Referrer-Policy, and Permissions-Policy.

Data Handling

Public agency data powers the open compliance viewer. Account details, provider workflows, saved leads, reveal logs, and billing workflows are separated behind authenticated endpoints. Public lead feeds redact direct contact details.

Reporting

Send security reports to security@restorecc.io. Please include the affected URL, reproduction steps, and any relevant request IDs. Do not access, modify, or disclose data that is not yours while testing.