Security at KitchenReady

Last updated July 10, 2026

The short version: your surveys live on Google's certified cloud infrastructure, every account's data is isolated and enforced server-side, payments are handled entirely by Stripe, and you can turn on two-factor authentication and delete your account & data yourself, any time.

1. Infrastructure

KitchenReady runs entirely on Google Cloud / Firebase (Firestore, Cloud Storage, Cloud Functions, Firebase Authentication, and Firebase Hosting). Google Cloud independently maintains SOC 1, SOC 2, and SOC 3 attestations and ISO/IEC 27001, 27017, and 27018 certifications for this infrastructure. Data is encrypted in transit (TLS) and at rest by default.

KitchenReady itself does not currently hold its own SOC 2 or ISO 27001 certification. We say that plainly because vendors who imply otherwise are the ones to worry about. If your organization requires a formal attestation to purchase, contact us — that demand is exactly what will schedule the audit.

2. Tenant isolation

Access control is enforced server-side with default-deny Firestore and Cloud Storage security rules:

Every rule set begins by denying everything; access is granted narrowly per collection and path.
You can only read and write your own surveys, photos, and voice notes.
Team sharing keys off a server-verified company membership — a user cannot see another company's surveys by typing a company name into their profile.
Billing, plan entitlements, and usage counters cannot be written from a browser at all — only our Cloud Functions can change them.
These rules are covered by an automated test suite that runs on every code change.

3. Sign-in security

Authentication is handled by Firebase Authentication (email/password and Google sign-in).
Two-factor authentication (authenticator app / TOTP) can be enabled by any user from the Account page.
Sessions use Firebase's short-lived, automatically rotated tokens.

4. Payments

All payments are processed by Stripe, a certified PCI DSS Level 1 service provider. Card details are entered on Stripe's checkout pages and go directly to Stripe — card numbers never touch KitchenReady's servers or database.

5. Application hardening

Strict browser security headers in production: Content-Security-Policy, Strict-Transport-Security (HSTS), X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy.
Plan limits and AI usage caps are metered and enforced server-side, not just in the UI.
Privileged administrative actions are recorded in an append-only audit trail that cannot be edited or deleted from any client.
Uploads are restricted by content type and size at the storage layer.

6. Your data, your control

Export: every survey exports to a PDF report you keep.
Deletion: you can permanently delete your account — including all surveys, photos, voice notes, and your profile — yourself, from the Account page. Any active subscription is cancelled as part of deletion.
Details of what we collect and how it's used are in our Privacy Policy.

7. HIPAA

KitchenReady documents commercial kitchens — equipment, utilities, and site conditions. It does not create, receive, or store protected health information, including when the site being surveyed is a healthcare facility. HIPAA therefore does not apply to the service, and we do not sign Business Associate Agreements.

8. Reporting a vulnerability

If you believe you've found a security issue, email info@ai-elevates.com with the details. We read every report, we'll respond promptly, and we won't take legal action against good-faith research.

9. Questions

Security questionnaires, compliance questions, or anything this page doesn't answer: info@ai-elevates.com.