How Kafoo keeps every business's data separate
Kafoo handles receipt data, VAT numbers and customer balances — information a business and its customers both need to be able to trust. Here's what actually protects it, described accurately rather than impressively.
Isolation between businesses
Each business's data is isolated from other businesses. No business can access another business's data, by design — not as a policy promise, but as how the platform is structured.
Access is scoped by role, not by convenience
Kafoo's platform recognizes four actor types — platform staff, business admins, employees, and customers — and each sees only what its role permits. That scoping is enforced on every request, not just at login.
Sensitive actions are logged
Actions like refunds, reviews, and plan changes are logged with who performed them and when, giving both a business and the platform a real record to review rather than having to take anyone's word for it after the fact.
Sessions don't stay open forever
Login sessions expire automatically after a period of inactivity, and carry a fixed maximum lifetime regardless of use. A session left open on a shared device doesn't stay open indefinitely.
What we don't claim
Kafoo does not currently hold third-party security certifications such as ISO 27001 or SOC 2. This is a description of the practices actually in place today, not a substitute for independent certification.
Read next
Read the full security page