Security and trust

Your business runs on Cooku every day: sales, customers, cash and invoices. Protecting them is part of the product, not an extra. Here we explain, without unnecessary jargon, what we do to keep them safe.

• Encrypted connections: all traffic between your device and Cooku is encrypted (HTTPS).
• Passwords: they are stored with a one-way algorithm (bcrypt); nobody at Cooku can see them.
• Integration credentials: the keys for your payment gateways, WhatsApp, email and other services are stored encrypted (AES-256-GCM).
• Separation by business: every database query is limited to the business making it; a business never sees another business's data.
• Role-based permissions: you decide what each person on your team can see and do, and permission changes are logged.
• Cooku team access: support access to the platform is recorded in an audit log.
• Data minimization: personal data received from delivery platforms is automatically deleted after 30 days.

Cooku does not store full card numbers or security codes. Payments are processed by providers certified under the Payment Card Industry Data Security Standard (PCI DSS). For some payment methods, card details travel encrypted through our servers solely to be handed to the processor at that moment, without being stored or appearing in logs.

These are the providers that may process personal data to deliver the service. Most of them are based in the United States. Some are only involved if your business enables the corresponding feature.

• Railway: servers and database.
• Vercel: website hosting and cookieless performance metrics.
• Resend: email delivery.
• Cloudinary: image storage.
• Stripe: Cooku subscription billing and online payments.
• Meta Platforms (WhatsApp Business): service WhatsApp messages (only if the business enables it).
• Powertranz, Tilopay, PagueloFácil and Yappy: online payments with the processor the business chooses (only if the business enables it).
• Alanube: electronic invoicing in Panama (only if the business enables it).
• Google (Gemini) and Anthropic: automatic reading of supplier invoices and inventory reports, without diner data (only if the business enables it).
• DeepL and Google Translate: automatic menu translation (only if the business enables it).
• PrintNode: kitchen ticket printing (only if the business enables it).
• Uber Eats, Rappi, PedidosYa and DiDi Food: receiving orders from delivery platforms (only if the business enables it).

We will give notice of relevant changes to this list in accordance with the Data Processing Agreement.

If a major outage or a security incident affecting your information occurs, we will let you know by email and on the release notes page, with what we know, what we are doing and what we recommend you do. If it affects your customers' data, we will notify you within 72 hours at most from when we confirm it.

If you find a possible vulnerability, write to us at hola@usecooku.com with the subject "Security", including the steps to reproduce it. We will reply and keep you informed about the fix.

• Use only your own or test accounts; do not access, modify or retain data belonging to other businesses or people.
• Do not perform denial-of-service testing, social engineering or mass messaging.
• Give us a reasonable amount of time to fix it before making it public.

If you act in good faith and follow these rules, we will not take legal action against you for your research.

You can request a copy of your information, correct it or delete it by writing to hola@usecooku.com. The details are in the Privacy Policy (https://usecooku.com/mx-en/politica-de-privacidad).

• Terms and conditions for businesses: https://usecooku.com/mx-en/terminos
• Data Processing Agreement: https://usecooku.com/mx-en/contrato-de-encargo
• Privacy Policy: https://usecooku.com/mx-en/politica-de-privacidad
• Terms of use for diners: https://usecooku.com/mx-en/terminos-comensales

This English version is provided for convenience. In case of any discrepancy, the Spanish version published on this site for your country prevails.