Security

Last updated: 15/10/26

This page sets out the safeguards built into Mendmate and how we run it. It is a factual overview, not a certification. When something changes, the date above changes with it.

Where your data lives

  • Mendmate runs on a dedicated server at Hetzner Online GmbH in Germany (EU). The application and the database are on the same server; your records are not sent to a separate database host.
  • Connections to the server are HTTPS only. The database accepts connections only from the application on the same machine, not from the internet.
  • The database is backed up nightly.
  • Card details never reach our server. Stripe collects them in its own hosted fields and we store only Stripe's reference.
  • Customer signatures are stored with the ticket in our database, not with a third party.

Who can see what

  • Every account belongs to one shop. Every query is scoped to that shop on the server, so one shop can never read another shop's records.
  • Four roles: owner, manager, technician and front of house. One permission matrix, enforced on the server for every action, not just hidden in the interface.
  • Staff can be confined to a store. They see that store's tickets, stock and sales and nothing else.
  • Mendmate's own staff access is a separate flag on the account, never a shop role.

Signing in

  • Passwords are hashed with bcrypt at 12 rounds in production. We never store or log a plain-text password.
  • Sessions are signed tokens that expire after 7 days. They travel only in the Authorization header, never in a URL.
  • Five failed sign-ins lock the account for 15 minutes.
  • Sign-in and signup are limited to 20 attempts an hour per address, and password resets to 3 an hour. Reset links expire after one hour and are stored only as a hash.
  • New accounts confirm their email address from a link that expires after 24 hours.

In the browser

  • HTTPS everywhere, with HSTS so browsers refuse to load Mendmate over plain HTTP.
  • A Content Security Policy that allows scripts only from our own domain. No third-party scripts run on the site or in the dashboard, except Stripe's own payment form where a card is taken.
  • X-Frame-Options DENY, nosniff, Referrer-Policy and Permissions-Policy headers on every response. Cross-origin requests are allowed only from an explicit list of our own origins.

Payments

  • Card payments and our own subscription billing run on Stripe. Mendmate never sees or stores a card number or CVV.
  • Payment webhooks are checked against their signature on the raw request body before anything is parsed or acted on.
  • Taking payment and issuing a refund are permissions. A technician cannot issue a refund.

Your data is yours

  • Export everything, customers, tickets, invoices, sales and stock, as one CSV per collection or one JSON file, from the dashboard, free, at any time.
  • If a trial or subscription lapses, the account goes read-only after a 7-day grace period. You can still sign in, read everything and export it. Nothing is deleted.
  • Every ticket status change is validated on the server and written to an audit log with the user and the time.

How we run it

  • Secrets live in environment variables on the server, never in source control.
  • Administrative routes fail closed: if their guard fails to load, the route is not mounted.
  • Logs hold the minimum. No passwords, no card data, no print payloads.
  • One founder runs the service from Bristol. If something breaks, you are talking to the person who can fix it.

Sub-processors

The companies that handle your data on our behalf:

  • Hetzner Online GmbH (Germany): application hosting and the database.
  • Brevo (EU): transactional email, such as sign-in links and quote emails.
  • Stripe: card payments and subscription billing.
  • 20i Ltd (UK): mailboxes for our @mendmate.co.uk addresses.

Nothing else is switched on. If we add a provider for text messages, image storage or error monitoring, it is listed here and in the privacy policy before it goes live.

UK GDPR

Showday Tickets Ltd (company no. 17168332) is the data processor for your shop's records and the data controller for your own account details. Our data processing agreement sets out the terms.

Reporting a vulnerability

If you believe you have found a security issue, email security@mendmate.co.uk with steps to reproduce. We aim to acknowledge within 2 working days, and we ask that you hold public disclosure until a fix is released.