Security & Data Statement

The platform is hosted in Australia on Amazon Web Services (ap-southeast-2, Sydney). Our AI features run on Amazon Bedrock in AWS's Australian regions only, Sydney and Melbourne, so menus, invoices and conversations sent to them stay in the country.

Some specialist work is done by other providers, and several of those process data outside Australia: payments, messaging and phone calls, the automated assistant's voice and speech recognition, fault monitoring, and a couple of components on a venue's ordering page. Our Privacy Policy names each one, says what it receives, and names the country where we have been able to establish it.

Data is encrypted in transit (TLS) and at rest. Every request is scoped to one venue, so one venue's data is not reachable from another venue's account.

Access to production systems is restricted to a small number of people. Administrative actions taken inside the product are recorded in an audit log, and our platform administration console requires multi-factor authentication with no opt-out.

Card payments are handled by PCI-compliant payment providers. OrderGrid does not store full card numbers.