Security

You trust me with SINs. Here's how I keep them.

An employee file is a social insurance number, an address, a bank account. You're right to hesitate before putting that in a web tool. This page says exactly where it goes, how it's protected, who can see it, and what it's worth under the law where you are. No jargon, and no promise the code doesn't keep. Last updated: September 29, 2026.

In one sentence

Sensitive data is encrypted before it enters the database, with a key specific to your location, it's never shown in full, every time someone reveals it it's written in a log, and nobody on our side goes in without you asking.

What's encrypted, and how

Each employee's SIN, bank account, date of birth and address are encrypted at rest with AES-256-GCM, the standard banks use. The master key doesn't live in the database: it's in the server configuration, kept separate. And each location encrypts with its own key derived from the master key: one restaurant's files never decrypt with another's key. In production, I refuse to write an employee file if the key is missing.

On screen, you only see the ending: "••• ••• 482". To see the full number, you have to click "Reveal", and that click is logged with the name of the person signed in, the date and the time. The owner sees that log in the black box. Passwords for management accounts are hashed, never readable, even by us. Everything goes over HTTPS, nothing travels in the clear.

Where the servers are

Here are the providers that touch data, with the country. The first five run the product; the last two only see the sales website, and only if you accept cookies. Nothing is sold, shared or compared between restaurants.

Yes, the database is in the United States. We say it because it's true, and because Québec's law requires us to say it. Canadian privacy law doesn't forbid hosting outside Canada: it requires that we assess the risk before doing so, that we get equivalent protection by contract, and that we protect the data itself. That's why sensitive fields are encrypted by the application before they are written to the database, and the key is kept separately: what is stored is text that can't be read without it. The day a Canadian provider offers the same service at the same level, we move, and this page will change.

Who sees what

The owner sees everything about their location. The manager they invite sees the employee files (they hire), but not the cost settings, not the subscription, not the black box, and they can't delete an employee. The team, with the team code, sees the schedule, their availability and the handbook: never a file, never a number. Since v160, each person's mobile number can show under their name in the grid, so the crew can call each other; the owner turns it off in Settings, Modules. Each location is isolated from the others by its address and by its key. The platform account (Pista Studio) only enters a location at the owner's written request, for support, and it shows in the restaurant's black box.

Against abuse: rate-limited logins (8 attempts then a 15-minute pause), rate-limited team codes (10 attempts), a second factor (authenticator app) offered on management accounts, "sign out everywhere" which revokes every session at once, and a browser security policy (CSP) that blocks scripts that don't come from us.

How long, and how it gets erased

As long as the subscription is active. An archived employee stays on file because an employer's obligations last after they leave; the owner can delete them for good when the law allows it. When you close your account, you have 30 days to export (CSV and JSON, everything, in one click), then the location, the files and the logs are erased automatically. Every night, an encrypted backup of each location is taken and kept fourteen days (Monday's, three months), so that a mistake or an outage can be repaired; a deleted account therefore leaves the backups at most three months later. Neon also keeps a short-lived restore history.

The law in Canada

Outside Québec, the federal law, PIPEDA, applies to your restaurant (or your province's own law in Alberta and British Columbia). In Québec, it's Law 25, the provincial act on the protection of personal information in the private sector, modernized from 2022 to 2024. Both put obligations on your restaurant as an employer, and on us as a provider. Here's what we hold up on our end.

A named person in charge: the president of Pista Studio, bonjour@bonjourgus.com. A privacy policy in plain language, published. A privacy impact assessment for hosting outside Quebec, kept up to date at every change of provider. Consent asked before the site's advertising and analytics cookies (Meta, Google Ads, Google Analytics), and revocable in one click ("Cookies" at the bottom of the page). An incident register, and notice to the owner of every affected location and to the regulator (the Office of the Privacy Commissioner of Canada, or the Commission d'accès à l'information in Québec) when an incident presents a risk of serious harm. The rights of access, correction, erasure and portability: the export is open at all times, and an employee's request goes through their restaurant, which holds the file, with our help if it gets stuck. Protection by default: sensitive fields are masked and encrypted without you having to configure anything.

What stays on your end as an employer: naming your own person in charge (often the owner), collecting only what you need (the SIN is for payroll and tax slips, nothing else), and answering employees who ask to see their file. Gus gives you the tool; what you put in it is still your call.

What we don't claim

We have no SOC 2 or ISO 27001 certification: this is a product from a small team in Quebec City, built on providers that have them (Vercel, Neon, Stripe). We haven't had the code audited by an outside firm yet. If your restaurant is part of a group that requires it, tell us, we'll look together at what it takes.

A flaw, a question

Found something off? Write to bonjour@bonjourgus.com with "security" in the subject line: we answer on weekdays, same day, and we don't go after someone who helps us in good faith. For everything else, the privacy policy and the terms say who promises what.

Create my location · Twenty minutes with a human · Back to home