Pulling the latest…
A guest scans a code, orders from their phone, and hears their name when the drink is up. Behind that small moment is a first name, sometimes a phone number, and an operator’s whole event. This page says plainly how all of it is protected, written for the operators, venues, and planners who put their guests in front of it.
Alongside Events is a web application hosted on Vercel, with its data in a single Supabase project, database, sign-in, photo storage, and the live feed that keeps the barista’s queue current. Every request from a guest, an operator, or a couple reaches our application over an encrypted connection, is checked at the edge, and is answered by our server before anything is read or written. Payments go out to Stripe and Square and come back as a signed confirmation. Texts go out through Twilio. The AI barista asks Anthropic’s Claude. Email goes through Resend. The operator’s iOS app talks to the same database under the same rules. Everything is in the United States, and there is no server of ours to patch.
Each operator’s events, orders, guests, and clients are walled off inside the database itself, tied to that operator’s signed-in identity on every query, the database enforces it, not just the application. On top of that, every action re-checks that the person asking owns the event they are touching, and a visit to any operator page without a sign-in is turned away before a single thing renders. A test in our codebase fails if a new operator page is ever added without that check.
The one credential that can see across operators lives only on the server, in a module that refuses to be shipped to a browser. Nothing marked public in our configuration is a secret.
Guests and couples never make accounts. Their pages are addressed by long random links, the kind that cannot be guessed or counted up to, and we make sure those links are not passed along when someone follows a link out to another site. A couple can add a PIN; a leaked couple link is regenerated in one click; a hired barista’s link stops working two days after the event.
Every public action that could cost money or bother people is rate-limited twice, once on the server answering and once in the database, so a burst spread across many servers is still counted. That covers placing orders, PIN attempts, sign-in codes, the AI barista, forms, and the operator’s own test-text card. Photos are checked by their contents rather than their name; location and camera details are stripped before anything is stored; nothing a guest uploads is shown until the operator approves it.
A phone number is kept only when a guest types one and ticks a box we never pre-tick; at the walk-up register the barista reads the same words aloud and records the yes. Before any message goes out it passes, in order, the event’s stop switch, a rule that practice events never text, the event’s message allowance, the operator’s own do-not-text list, a carrier check that refuses numbers outside the US or that cannot receive texts, and a claim on the order itself so the same alert can never be sent twice. Every message opens with the operator’s business name and ends with STOP and HELP. Replying STOP is honoured at the carrier and by us, per operator, so leaving one cart’s texts does not silence another’s. Numbers are removed seven days after the event.
Operators pay on Stripe’s checkout page. Guests, at carts that charge, pay on Square’s. Card numbers are typed there and only there; what comes back to us is a signed confirmation, an identifier, and an amount. One payment can create exactly one order, the database refuses a second, and refunds happen in Stripe or Square, never by editing an order here. This is the lightest footprint the card networks define for a merchant, and we keep it that way on purpose.
Every connection is encrypted and browsers are told to insist on it. The database and photo storage are encrypted at rest. The few things we must store and later read back, an operator’s connection to Square, Instagram, or their espresso machine, are sealed with a server-only key before they are written, and changing that key cleanly closes every stored connection rather than scrambling it. Guest phone numbers are also kept as a salted one-way fingerprint for the “welcome back” memory. An operator’s API keys are shown once and stored as a fingerprint too.
Retention is enforced by daily jobs, not by policy alone: raw phone numbers are removed a week after the event, the fingerprint at thirty days, an unfinished checkout at six hours, and routine bookkeeping within ninety. Each job reports in, and a health check notices if one stops. An operator’s events stay until the operator deletes them; backups clear within thirty days. The full schedule is in the privacy policy, and the deletion page says how to ask for anything to go sooner.
The AI barista, signature-drink ideas, review tagging, and the morning-after debrief use Anthropic’s Claude. It sees what a guest typed, the menu, the couple’s drink brief, review text, and aggregate numbers. It never sees a phone number, a last name, or a photo, and under Anthropic’s commercial terms none of it is used to train anything. Spending is capped per event and per visitor so a shared link cannot run up a bill.
Write to support@alongsidecoffee.com. You will hear back within seven days, usually the same day. We ask for a reasonable window to fix before anything is published, and we will credit you if you would like. Our dependencies are audited and open advisories in production are held at zero; each fix ships with a test that would catch the same problem again.
No advertising or analytics trackers. No selling, sharing, renting, or licensing of anyone’s data. No card data. No health data. No guest accounts. No texting without a tick, and no texting after the event. We follow the SOC 2 control model without holding an attestation, and we say so rather than imply otherwise. No system is perfectly secure; this page is what we do about that. The rest of the promises are in our terms and privacy policy.
Questions? Email us at support@alongsidecoffee.com.