Security and data protection
What Owlly does with your data, how it is protected, and where our reach ends. Every point on this page corresponds to a specific mechanism in the code, not to an intention.
Last updated:
Encryption at rest
KSeF tokens, company tax identifiers and buyer identifiers captured at the till are encrypted in the database, not merely on the disk. The key does not live in the repository.
Encryption in transit
All traffic to Owlly, and between Owlly and its providers, runs over TLS. The application does not answer on plain HTTP.
Two-factor authentication (TOTP)
Available on accounts with administrative access, with recovery codes. Enrolment is voluntary, and enforcing a second factor for superusers stays a separate, deliberate step — locking the only administrative account out of a live platform is not a security improvement.
Per-user permissions and tenant isolation
Access is granted per page and per company. Every query is scoped to a company the user has access to, so two restaurants’ data never meets inside one query.
Document AI pinned to the EU region
The OCR processor runs in the `eu` region, enforced in configuration. Documents sent for recognition do not leave the Union.
Nightly encrypted backups
A dump of every database each night, compressed and encrypted with AES-256-GCM before it touches the disk, and pruned on a schedule. With no key configured the job refuses to write rather than writing plaintext.
Data export — GDPR Art. 20
A complete export of the account’s data in a machine-readable format, on request.
Erasure — GDPR Art. 17
Identity and contact data are erased on request. Two limits we will not cross are described below, because the law does not permit it.
What we will not do — and why
Employee records belong to the employer
For staff records the restaurant is the controller, not Owlly. An erasure request from a waiter is handled by their employer — erasing those records on the employee’s request would destroy documentation the employer is legally required to keep.
Financial rows survive, pseudonymised
Polish law requires invoices to be retained for 5 years and payroll documentation for 10 (up to 50 for staff first registered for social insurance before 2019 without ZUS OSW/RIA). So identity and contact data go, while financial rows remain with the link to a person removed — GDPR Art. 17(3)(b). Claiming we delete everything would be more convenient and untrue.
Questions from procurement or IT: info@owlly.eu