Security & reliability
Safe by design. Open about how.
ResoFlow holds your customers’ details, your bookings and your money records. Here’s where that data lives, who can get in, and what happens if something goes wrong.
Layer by layer
Every layer between the world and your data.
What each layer does — and the screen where you’d see it working.
Where
Where your data lives
Bookings, customer records, orders and settings are stored in the EU, on Google Cloud. Sign-in accounts are processed in the United States, and some services — payments, email, texts, the edge network and support — may handle limited data outside the UK and EU. Each is named in the sub-processor list in our Data Processing Agreement, with the legal safeguards it uses. We never sell personal data. Your customers’ data is processed on your behalf, under our Data Processing Agreement.
Every planRead the sub-processor listSigning in
Who can sign in
Two-step sign-in on every plan: your password, then a 6-digit code from an authenticator app — with eight single-use recovery codes for a lost phone. Owners and admins can add a passkey and sign in with Face ID, a fingerprint or their device’s screen lock instead of a password — a passkey also answers “Confirm it’s you”. Your own phone or computer can stay signed in — say “Yes, it’s mine” — until it’s gone 30 days unused. A shared device signs out after 30 minutes unused (you choose the time, from 5 to 240 minutes) and after 24 hours at most; a staff PIN sign-in lasts 12 hours. See every signed-in device, sign one out, or sign out everywhere. You get an email when your account signs in from a new device.
Every planHow to set up two-step sign-inYour team
Your team
Each person has their own PIN on the shared tablet, and only sees what their role allows — Owner, Admin, Manager and Host built in, plus up to five roles of your own. The staff portal only opens on devices you’ve paired. Revoke one and it’s signed out; restrict sign-in to your venue’s own internet if you have a fixed address. Staff tap their name, then type their PIN. Five wrong PINs lock that person’s PIN for an hour, and a third lock in a day holds until you clear it on the staff page. PINs are stored as one-way scrambles, never as the numbers themselves.
Plus, Pro and CompleteHow staff sign in with a PINKey actions
Actions that matter
Refunds, bulk deletions and access changes ask you to confirm your password first — then you’re trusted for 60 minutes, so a run of admin work only asks once. On a shared device, someone allowed to approve an action — a deposit refund, say — can do it with their own PIN instead. The Activity log records who did what, and when — refunds, sign-ins, settings. Money records are also kept for seven years.
Activity log from PlusFilters and export from ProHow to see who did whatPayments
Payments
Your subscription, and your customers’ deposits, tickets, gift cards and orders, are processed by Stripe. Card numbers go straight to Stripe — ResoFlow never stores your card details, or your customers’. Customers pay into your own Stripe account. ResoFlow never holds your money. Refunds are made from ResoFlow, and a payment that needs a closer look stays visible for follow-up.
Every planHow to connect StripePublic pages
Your public pages
Requests from your dashboard and staff devices must prove they come from our real app before they’re answered — a check called App Check. Public forms like your booking page carry a bot check from Cloudflare: invisible for almost everyone, a quick tap for the rare visitor it isn’t sure about. Your data is encrypted on its way between your device and ResoFlow, and where it’s stored.
Every planWhy it says “Checking your connection…”Our team
Our own team
To help you, the ResoFlow team can look at your account — read-only, with every look recorded. Customer email addresses stay hidden unless one is revealed, and a reveal shows in your Activity log. Our team only changes your venue’s data inside a 60-minute session you start: read out a one-time code, accept a request, or set a standing grant of up to 90 days. A banner shows while it runs, and you can end it at any moment. A few jobs run outside a session through our own locked-down tools — changing your venue’s name or web address when you ask in writing, applying a setup with you while you’re with us, and returning a guest’s payment that couldn’t complete — and each one is recorded in your Activity log. Every change made in a session is in your Activity log, and you’re emailed when it ends. A session can never refund money, delete data, change the owner or export your data.
Every planHow support access worksRecovery
If something goes wrong
Your data is backed up every day, and a job checks every day that the backup actually completed. Print the day sheet at the start of service: every booking, table, allergy and note on paper, on every plan. If your internet drops, service carries on from the sheet. How the platform is running is public at status.resoflow.co.uk. If a personal data breach ever affects your data, we tell you within 72 hours of becoming aware.
Every planOpen the status page
Card numbers never touch ResoFlow.
They go straight to Stripe — for your subscription, and for your customers’ deposits, tickets, gift cards and orders.
By plan
What you get, plan by plan.
Most of it is on every plan, including Free. Choose a plan to see its column.
Each paid product but Team adds a staff sign-in of its own; roles and permissions, Manager-PIN approvals and the Activity log come with Plus and above. The customer account is where customers see, download and delete their own records.
Questions
Straight answers.
The questions venues ask about their data. More in the Privacy Policy and the help centre.
Found a security problem? [email protected]
Where is my data stored?
Your core data is stored in the EU, on Google Cloud. Sign-in accounts are processed in the United States, and some services — payments, email, texts, the edge network in front of our pages and support — may process limited data outside the UK and EU, under the UK IDTA or the EU Standard Contractual Clauses. Each one is named in the sub-processor list in our Data Processing Agreement.
Do you sell or share my customers’ data?
No — we never sell personal data. Your customers’ data is processed on your behalf under our Data Processing Agreement, only to run the service. ResoFlow never sends your customers marketing; only you do.
Can the ResoFlow team see my bookings?
To help you, the team can look at your account read-only, and every look is recorded. Changes only happen in a 60-minute session you start, every change shows in your Activity log, and you’re emailed when it ends. A few jobs run outside a session through our own tools — changing your venue’s name or web address when you ask in writing, applying a setup with you while you’re with us, and returning a guest’s payment that couldn’t complete — and are recorded in your Activity log too.
What if ResoFlow goes down in the middle of service?
Print the day sheet at the start of service — it’s on every plan — and carry on from paper if your connection drops. How the platform is running is public at status.resoflow.co.uk, no sign-in needed.
Is Rezo trained on my conversations?
No. Support conversations are never used to train any AI model. Rezo runs on Google’s AI in the EU and answers from our own help centre.
How do I report a security worry?
If you think someone has got into your account, email [email protected] straight away — and use Sign out everywhere and change your password.
Kept safe, from the first booking.
Start free with no card — or read the Privacy Policy and the Sub-processors list first.