Security
Audit trail (current scope)
Today we log only the AI assistant's tool calls. A general audit trail across reservations, staff, vouchers or billing is not yet part of the product.
Every tool call from the AI assistant — creating a reservation, editing a menu item, looking up staff data, etc. — is recorded in the `ai_tool_calls` table with the calling user or API key, the tool name, the arguments and a timestamp.
Not yet in scope
Honest scope note
A general, tamper-evident CRUD audit log across reservations, staff, vouchers and billing is not implemented — there are no retention tiers, no S3 streaming, and no export. If this gap is blocking a compliance requirement for you, please reach out via the contact page.
What does exist today
- Role-based access (admin / manager / employee) — see Roles.
- Row-Level Security on every restaurant-scoped table for tenant isolation.
- GDPR-compliant data export — see GDPR export.