Security
Where the money and the data actually sit
The client is untrusted by design. Prices, ownership and payment truth are decided on the server; card data never touches Zecoa; each site’s kitchen sees only its own tickets.
HTTPS everywhere, a token per person
Every call between the apps and the backend runs over HTTPS. Customers and staff each sign in for their own token, sent on every request, so access is tied to a person rather than to a device that anyone can pick up.
Prices are computed on the server
The checkout sends a cart, never a total. Every item, add-on, discount and delivery charge is priced by the server from your own menu, so the amount charged is always the amount you set — not a number the client supplied.
Card data never touches Zecoa
Cards are tokenised by the payment gateway, which returns a reference that can be charged but is not a card number. Payments are authorised when the order is placed and captured only when you accept; reject it and the hold is released.
One kitchen never sees another's tickets
Each site subscribes to its own private realtime channel, derived from that restaurant's own identity, and orders are delivered to that channel only. A display can only ever show tickets belonging to the restaurant it signed in to.
Riders carry a capped float
Every rider has a cash limit. Once they reach it, dispatch stops sending them cash-on-delivery orders until they settle up, which keeps the amount of cash sitting on any one bike or in any one car bounded and accounted for.
Reliability
Built so the board never blanks.
- Orders push live, polling catches the rest
New orders arrive over a websocket on a private channel belonging to your site alone, so they appear without a refresh. Behind that, the apps poll on a short interval as a safety net, so an order still lands if the socket drops. A Connected / Reconnecting pill and a last-synced time sit on the screen, so staff always know whether to trust what they are looking at.
- It keeps ringing until someone answers
A new order sets off an audible alert and a pulsing ring on the ticket, and the alert re-plays on an interval for as long as anything is still unacknowledged. It stops when a person acts on the order, not when the sound finishes playing. Silence on a busy pass is a failure mode, so the software is built to treat it as one.
- The board never blanks on a dropped request
If a refresh fails, the last good board stays on screen rather than clearing — a blank screen mid-service is far worse than data a few seconds old. Refreshes also pause while a status change is in flight, so a background poll can never revert a ticket a cook has just advanced, and pause when the screen is hidden, catching up the moment it comes back.
- A jammed printer is not a lost order
Tickets can print themselves the moment an order arrives, to the printer you nominate. If a print fails it is retried, and if it still fails it goes into a print tray with a badge and a banner naming how many tickets are waiting — retry one, or all of them, with a tap. Every ticket also shows a dot for its last print attempt. Failed prints are visible instead of silent.
- The server prices every order, not the app
At checkout the app sends the contents of the cart — items, sizes, add-ons, notes — and no total. The server looks up every price from your own menu, applies discounts, points and delivery charges, and charges what it works out. There is nothing a modified browser or a fiddled request can do to change what an order costs you.
Data and leaving
Your list, your history, your menu — yours to take.
Who owns the customer data?
You do. Customer accounts, saved addresses, order history, loyalty balances and marketing permissions belong to your restaurant — not to a marketplace, and not to us. Zecoa runs the software that holds them. You can see the whole list, and you can take it with you. Nobody is going to email your customers a discount code for the place down the road.
Does Zecoa store card details?
No. Card details are handled by the payment gateway, which returns a token — a reference that can be charged but is not a card number. Zecoa never stores card numbers, and neither does your restaurant. Apple Pay and Google Pay run through the gateway's own hosted checkout, so the card itself never passes through us at any point.
What happens to my data if I leave?
It goes with you. Your menu, your customer list and your order history are yours to take — ask and we will get them out in a normal spreadsheet. On a subscription plan your domain and your payment gateway are already in your own name, so there is nothing to untangle there; on the commission plan, payments already collected are settled to you as usual.
Ask us the hard questions.
Bring your card-processing, data-protection and outage questions to the first call. We would rather answer them now than after you have moved a service across.