Security
Last updated: 4 September 2026
LaventTech is operated by L'AVENT ROASTER PTE. LTD., Singapore.
Security is central to how LaventTech is built. This page describes our approach honestly. We state what we actually do, and we are equally clear about the certifications we have not obtained.
- Your staff sign inRoles and positions decide what each person may do
- Requests are tenant-scopedEvery query is bound to your café
- Stored in SingaporeApplication servers and primary database
- Backed up dailyWith restores tested, not assumed
Tenant isolation
Each merchant's data is separated at the architecture level. Every request is scoped to a single merchant, so one merchant cannot reach another merchant's data.
Access control
Staff access is controlled per person and per role, with granular module and section permissions, so people reach only what their job requires.
The different areas of the product — point of sale, management, staff portal and customer-facing pages — use separate session areas, so a session for one area cannot be used to reach another.
Sensitive actions such as large manual discounts and voids require an additional authorisation and are recorded in an audit trail.
Credentials
Passwords and staff PINs are stored hashed, never in readable form. Repeated failed sign-in attempts are rate-limited and locked out. Secrets and API keys are held server-side and are not exposed to the browser.
Payment data
LaventTech does not store full card numbers, expiry dates or security codes.
Online card details are entered into the payment provider's own secure components; in-person card details are captured by the payment terminal and the provider. We retain only the payment outcome and the provider's reference, so that reports reconcile.
Merchant payment accounts and settlements remain separate to each merchant. LaventTech does not pool or hold merchant funds.
Infrastructure
The platform is served over HTTPS with HSTS, and the application servers and managed database are hosted in Singapore with the database on a private network.
We apply reasonable technical and organisational measures, keep dependencies current, and restrict production access to the people who need it.
What we do not claim
We do not claim PCI DSS certification, an external security audit, ISO certification, or any regulatory approval. Card data is handled by the payment provider precisely so that those obligations sit where the expertise is.
If and when we complete such steps, we will state them here accurately and be able to evidence them.
Reporting a vulnerability
If you believe you have found a security issue, email info@laventtech.com with enough detail to reproduce it. Please do not test against another merchant's data. We will acknowledge and work with you on it.
Singapore · info@laventtech.com
Questions about this policy? Email us and we'll help. See also our contact page.