Your business, kept separate
Every record in Grow+ (orders, menus, customers, stock, staff) belongs to one business. The system checks that on every request, and if it can't tell which business a request is for, it returns nothing rather than guessing. Staff from one shop can never see another shop's data.
Payments
- Online payments go straight to your own merchant payment account. Grow+ never holds your money.
- Customers enter card and online banking details on the payment provider's checkout page. We never see or store full card numbers.
- Your payment account keys are encrypted before they are saved, and only the business owner can change them.
- An order is only marked paid after we confirm the payment with the payment provider directly. A forged “paid” message is ignored.
Sign-in and staff access
- Passwords and staff PINs are stored as one-way hashes. Nobody at Grow+ can read them.
- Each staff member has a role. Cashiers sell; managers approve refunds, discounts and cash float changes with their own PIN; only the owner manages the plan and payment account.
- Repeated failed sign-in attempts and one-time codes are rate limited.
- Customers confirm their phone number with a one-time code before they can sign in.
Devices
- A POS, kiosk, kitchen display or Mini POS joins your shop with a one-time 6-digit pairing code that expires. The code is stored hashed.
- You can see every paired device in Merchant Admin and remove a lost or stolen one straight away.
In transit and at rest
- All connections to Grow+, Merchant Admin and shop websites use HTTPS.
- Shop websites on their own domain get their own certificate automatically, after the owner proves they control the domain.
Your customers' data
- Customers can delete their own account from inside your app.
- We don't sell personal data. See our Privacy Policy for what we collect and why.
Found a problem?
If you think you have found a security issue in Grow+, tell us through the contact form or email [email protected], with “Security” in the subject and the steps to reproduce it. Please give us a chance to fix it before telling anyone else, and don't access or change data that isn't yours while testing.