Data Security

Data Security Architecture & Practices

At CakeLelo.com, protecting customer records, branch order pipelines, and financial transactions is foundational to our engineering standards.

1. Encryption In Transit & At Rest - **TLS 1.3 Encryption:** All traffic between your browser and our servers is encrypted using modern 256-bit cryptographic ciphers. - **Encrypted Database Storage:** Passwords are never stored in plaintext; all user passwords utilize salted **Bcrypt** cryptographic hashes with work factor 10. - **API Token Security:** All admin and staff sessions use cryptographically signed, HTTP-only, SameSite-protected session cookies to prevent Cross-Site Scripting (XSS) and token theft.

2. Strict Role-Based Access Control (RBAC) - Our backend enforces server-side privilege validation on every API endpoint. - Branch staff and kitchen leads can only view orders assigned to their respective branch kitchen and cannot inspect customer payment card details or global business metrics. - Comprehensive **Audit Logging** records all administrative state modifications with timestamps, user IDs, and client IP addresses.