Security Measures Appendix

86'd and 86 Operations are brand names for this service. The legal operating entity has not been finalized; it will be named here before this document can be accepted or become binding. DRAFT — PENDING LEGAL REVIEW. This document has not been reviewed by counsel and is not yet a binding agreement. Implemented controls (engineering benchmarks, not certifications): separate tenant per restaurant enforced on the server for every request; role, location and field-level permissions; two-step verification (authenticator app or passkey) required for owners and users with financial/admin permissions; one-time recovery codes; session timeouts and remote sign-out; re-verification for exports and security changes; rate limiting and lockouts; CSRF protection; HTTPS in transit; encrypted storage of MFA secrets and integration credentials (application-level encryption); passwords hashed with bcrypt; payment card data never stored (Stripe hosted checkout); upload content checks; tamper-evident platform audit log; owner-visible audit history; owner approval for every support session. Not yet independently verified: encryption at rest and backup configuration of the hosting provider, restore testing, penetration testing, SOC 2 or ISO 27001. No certifications are held.