Security Architecture & Data Protection
Protecting food & beverage operations with zero-trust architecture, multi-tenant boundaries, and strict financial compliance.
Hardened Multi-Tenant Isolation
Every database query, API invocation, and menu payload is strictly partitioned by tenant foreign keys. Automated test suites verify cross-tenant access denial across 100% of core entities.
Cryptographic Email OTP & Hashing
Account verifications utilize 6-digit cryptographic OTPs with SHA-256 hashed storage, 10-minute automated expiry, 60-second resend cooldowns, and a 5-attempt brute-force lockout.
Zero Secret Exposure Architecture
Payment gateway secrets (Stripe sk_live, Paymob HMAC keys) are restricted exclusively to server-side environments and never exposed to client-side bundles or admin UI portals.
Server-Authoritative Quota Enforcement
Product limits, branch quotas, staff seat allocations, and pricing calculations are validated strictly server-side, preventing client manipulation of cart totals or tiers.
Rate Limiting & DDoS Defense
API gateways and authentication routes are shielded with throttles (10 req/min on OTP, 5 req/min on resend, 60 req/min on public menu queries) preventing enumeration and denial of service.
Sanctum Token & RBAC Authorization
7 granular roles (Super Admin, Owner, Manager, Cashier, Waiter, Kitchen, Delivery) are enforced on every route with explicit positive and negative permission barriers.
Responsible Security Disclosure
If you believe you have uncovered a potential security vulnerability in Talabq SaaS, we encourage you to report it immediately. Our security engineering team will investigate and deploy remediation within 24 hours.