Your sales data is your business. Here's how we look after it.

We only read

Sidecar asks Clover and Square for read permissions and nothing else. It can see your sales and products; it can't change a price, add an item or move money. Nothing Sidecar does to your data travels back to your till.

Our Square connection requests no write permissions at all, and we check that automatically every time the code changes.

Your keys are locked, and the lock is kept elsewhere

The key or sign-in that lets us read your account is stored encrypted. The key that unlocks it lives outside the database, so even a full copy of our database wouldn't contain anything that opens your Clover or Square.

Each business is walled off by the database itself

Every row of every table belongs to one business, and the database refuses to return rows from any other. It isn't a rule our code has to remember to follow on every page — it's enforced underneath, where a bug in a report can't get around it.

We test that one business cannot read another's data through the same accounts our application uses.

Register PINs are never copied

Clover returns staff PINs when we read your team. We throw them away. In Sidecar a PIN approves refunds and opens the drawer, so an old one should never quietly carry those rights across.

Disconnect, and we stop

Delete your Clover key or remove Sidecar in Square and our access ends at once. For Square we're told the moment you revoke, and stop trying to read rather than waiting to find out.

We only act on messages we can verify

When Square notifies us of a sale, we check the message was signed by Square before doing anything with it. A forged one is recorded and ignored — it can't trigger an import or disconnect your account.