Security and data

This page is a reference: where your business data physically sits, who can see it, how that access is revoked, and what to do if something has gone wrong. Instructions about signing in and passwords are in Account and sign-in.

Where the data lives#

The cloud and the region are determined by the brand you registered through — it is not an account setting and it does not change on the fly.

What follows from this in practice:

• Accounts of the two circuits are not linked. An account on cenaly.ru is a separate account with its own data; you cannot "move" an account from one cloud to another — a move means a new account and a data import.
• Some capabilities live in one cloud only. The cookie scanner, for example, works on the AWS brands, while on cenaly.ru starting a scan answers "not supported" by design — that is not a fault.
• Rarely read heavy media (call recordings, for instance) is kept in a separate cold archive of the brand — cheaper and in the same circuit; access to a file stays instant.
• Storefront files (menu, photos, public documents) are public on purpose: the guest's browser reads them without any authorisation.

Who has access#

How partner access works#

A partner never enters on their own. They send a request with a reason, a mode and a duration, and only the account owner decides it — not an employee and not our support. The rules that always hold:

• the default mode is view only; "view and edit" is granted by a separate checkbox in your answer;
• the time is limited (an hour by default, two at most), and one session is open at a time;
• throughout the visit a purple banner hangs in the interface with the firm's name, the person's name, the mode and a countdown;
• closed in any mode: subscription and payments, the owner's data, staff permissions, data export, integrations, mail, calls and telephony, counterparties and documents, the partner program — and the refusal comes from the server, not just from hidden menu items;
• an unanswered request expires in 24 hours, and you get a letter about every sign-in;
• revoking consent stops the running session;
• on cenaly.ru partner sign-in does not exist at all.

More about the program itself — Partner program.

Passwords, codes and sessions#

Useful facts:

• Signing out closes the session in all tabs of the browser; there is no "remember me" checkbox.
• Dismissal revokes the employee's phone extension across all locations at once — nobody leaves with a working softphone.
• Section access levels ("view", "edit", "configure") are set in the role. The honest boundary today: the "edit" level really does forbid writing that section's data on the server, while a "view only" mode of the screens themselves is not in place yet — so do not grant a section to someone who must not see its content.

Guest data and consents#

Two honest notes about "My data": the screen works with the data on the guest's device (what sits in their browser), not with the history on the server, and deleting there clears exactly that device. If a guest asks you to remove their orders and contacts from your base, you do it — in the Customers section.

An important separation: the banner and the documents the guest sees are yours, not ours. You are responsible for their content as the business owner; the platform provides the constructor, the hosting of the pages and the consent log.

Export and deletion#

• Take everything — Data export: one ZIP with settings, catalogue, orders, customers and reviews. Deliberately not included: staff PINs, integration keys and tokens, passwords — the archive often gets forwarded to an accountant or a contractor. Photos are not packed, links to them remain; a finished archive lives for 7 days.
• Delete the account — through a request to support after the export: there is no self-service button in the panel. The request is fulfilled within 30 days of being confirmed; after the deletion there is nothing left to take, so the export comes first, not later.
• Delete one guest's data — in the Customers section.

Backups#

There is no "restore the account to a date" button in the panel, and we do not publish retention periods for internal copies — so make your own copy: before a bulk import, a catalogue clean-up or a change in the menu structure, collect an export. It is the most reliable rollback available.

If you suspect a leak#

Top to bottom, in order:

1. Change the owner's password — /settings/access.
2. Switch off "Support access" if it was on, and look through the log of sessions: who signed in and when.
3. Delete the device codes and the panel QR codes you do not need right now (/client-codes).
4. Revoke the API keys on the "Access" tab and issue new ones only where they are genuinely used.
5. Change the cashier PINs and reset the passwords of the people you suspect; deactivate those who have left in /staff.
6. Write to support — How to get help. Attach the time of the incident, the brand and the account address, the location, and what you saw. This is a request about YOUR account; platform vulnerabilities go through a different channel — see below.

Report a vulnerability in the platform itself not to general support but to a dedicated address — security@cenaly.com (the address accepts mail from any brand; the same security@ mailboxes on brand domains — security@cenaly.com, security@cenaly.ru, security@masamenu.tr — are being connected). In the message: the page address, the steps to reproduce and what you managed to obtain. Please do not publish the details before we reply and do not pull other people's data "to check the scale". More about the channel — How to get help.

What we do not store#

• Payment card data. Neither numbers nor CVV: the card is handled by the payment provider (Stripe with its PCI Level 1 certification, for example), and only the result of the payment reaches us — see Payments and Stripe.
• Secrets in the export. PINs, keys, tokens and passwords are not included in the archive.
• Biometrics. That class of data is forbidden in the circuit and is not collected.

Work in progress#

A dedicated circuit for storing personal data — encryption by data class, a log of every access to it, retention driven by events — is in progress. We make no dates or promises about it here: when it covers another class of data, that will appear in the description of the relevant section. A portal for data subject requests (DSAR) is likewise in progress — today such requests are handled manually, through the export and the "Customers" and "Staff" sections. Two-factor sign-in to the panel (an authenticator app) is also in preparation — we promise no dates.

Limitations#

• There is no two-factor sign-in to the panel yet — it is in preparation. For now protect the sign-in with a long password and separate staff logins (one shared password for everybody is the worst option), and keep tablets and screens on device codes with a PIN.
• The split between clouds is hard: a cenaly.ru account and a cenaly.com account are different accounts and never share a single login.
• On cenaly.ru there is no partner sign-in, no log of support sessions, no account handover to another e-mail and no cookie scanner.
• The guest's "My data" clears the device, not the order history on the server.
• The "view" and "configure" access levels do not yet turn a screen into read-only mode (see above).
• There is no "which of my employees opened what" log in the panel; logs are kept for support and partner sign-ins.
• We do not declare certified cryptographic tools or formal personal-data perimeters: if your business is required to have them by law, discuss the task before connecting.

Troubleshooting#

FAQ#

Which country is my data in? It depends on the brand: cenaly.com and cenaly.com — AWS (us-east-1), cenaly.ru — Yandex Cloud in Russia, the Turkish brands — a copy of the circuit in eu-central-1 (Germany).

Can support enter my account without permission? No. The "Support access" toggle has to be on; you choose the scope, every session is logged, and revoking consent stops even a running session.

Does a partner see our money and our staff data? No. Subscription and payments, the owner's data, staff permissions, data export, integrations, communications, counterparties and documents are closed in any mode — the server refuses.

An employee has left — what should I revoke? Deactivate or delete them in /staff (that also removes the panel sign-in and revokes the phone extension), change the PINs they knew, and delete the device codes you no longer need.

Do you store our guests' card numbers? No. The card is handled by the payment provider; only the result of the operation stays with us.

How do I answer a guest who demands their data be deleted? Find them in the "Customers" section and delete the card; the local data on their own device they can wipe themselves on the storefront through the "My data" screen.

Do you have a DPA and other documents for an audit? The data-processing terms are described in Data processing agreement (DPA); ask support for a signed copy and the remaining documents.

Related articles#

• Account and sign-in — passwords, device codes, support access
• Account and location settings — what is configured where
• Staff and shifts — roles, location coverage, PINs
• Data export — take everything and make a backup
• Cookies and consent — the banner, the consent log, the cookie policy
• Legal documents — privacy policy and terms
• Customers — deleting a particular guest's data
• Data processing agreement (DPA) — what we process, on what basis and who the sub-processors are
• How to get help — where to report an incident; vulnerabilities go to security@ on your brand