Account and business boundaries
Seller accounts use email verification, hashed password credentials, secure session cookies, same-origin protections, and sign-in rate limits. Every private request re-checks business membership on the server; hiding an interface control is never treated as authorization.
Public ordering protections
The server validates public input, recalculates prices, and atomically checks deadlines, inventory, pickup capacity, and duplicate-submission keys. Customer status links use random tokens instead of sequential order identifiers.
Data and service operations
Production secrets stay out of browser code and source control. Uploaded files are checked for business ownership, type, and size. Application logs are designed to exclude customer contact details, addresses, free-text notes, private links, passwords, payment details, and email bodies. Database migrations, backup procedures, dependency checks, and incident-response guidance are maintained with the service.
e-Transfer safety boundary
Interac e-Transfer is an offline payment method. Payment at pickup is the default. If both sides explicitly choose full prepayment, Dishfolk shows a verified, snapshotted recipient only in the private order link after seller acceptance. It never accepts a customer claim or screenshot as proof, connects to bank or email accounts, or verifies the transfer or a refund. Sellers must check their own banking app before recording receipt. Dishfolk never asks for banking credentials or reads bank email.
Your responsibilities
Use a unique password, keep devices and sessions secure, sign out of shared devices, give account access only to trusted people, and collect only the customer data needed to fulfil orders. Do not place passwords, payment-card details, government identifiers, or unnecessary health information in notes or uploaded content.
Limits
No online service can guarantee absolute security or uninterrupted availability. Dishfolk does not claim a security certification, compliance badge, penetration-test result, or guaranteed service level.
Report a concern
Email support@dishfolk.ca with “Security” in the subject. Include only the information needed to identify the issue; do not send passwords, payment details, customer lists, or private order links.