Security

Card numbers are not stored on JET servers. When a card is presented, the terminal hands it to the payment processor, which returns a token. The token is what we keep, and it is useless to anyone who takes it: it can only be replayed against your own merchant account.

Our payment processor is a PCI DSS Level 1 certified service provider, which is the highest level the card schemes define. That certification is theirs rather than ours, and it is the one that actually covers the path your customers card data travels. If you are running a vendor assessment and need them named, ask and we will tell you.

Where a card is entered in a browser instead of on a terminal, it is entered directly into the processor’s own hosted field. The number does not pass through our application at any point.

Sales, menu, staff and customer records belong to you. We use them to run the product you are paying for and to answer the questions you ask the built-in assistant. We do not sell them, and we do not hand them to advertisers.

Traffic between your terminals, your back office and our servers runs over TLS. The public site is HTTPS only, with plain HTTP redirected.

If you leave, ask and we will export your data. See the privacy policy for retention periods and your rights over it.

Staff accounts carry roles. Discounting, voiding, opening the drawer, editing the menu and viewing reports are separate permissions rather than one manager switch, so the person who can comp a meal is not automatically the person who can change a price.

Voids, comps, discounts and refunds are recorded against whoever performed them. That record is the point: most losses at a counter are not sophisticated.

The built-in assistant will not change anything without showing you what it is about to do and waiting for a confirmation. It is bound by the same permissions as the person asking.

The POS is local-first. If your internet drops, the terminal keeps taking orders and keeps working, and it syncs when the connection comes back. This is the part that matters most, because an outage during service is not an abstraction.

We do not publish an uptime percentage. Anybody can print one, almost nobody measures it honestly, and a number with no measurement behind it is worth nothing to you. What we will tell you is who answers the phone, and how fast: a person in Delaware, at the number on this site.

If you find a vulnerability, tell us before you tell anyone else and we will work with you. Write to [email protected] with enough detail to reproduce it.

We will acknowledge it, tell you what we are doing about it, and credit you if you want to be credited. We will not threaten you for reporting it.

Plenty of POS companies put a row of compliance badges on this page. Here is ours, in words, so you can check it:

• We are not SOC 2 audited. If somebody sends you a vendor questionnaire, that is the honest answer to give.
• We do not hold our own PCI DSS Level 1 certification. The card data path is covered by the processor’s, named above.
• We do not own data centres. Our infrastructure is rented from commercial hosting providers, like almost every company our size.

If any of that changes we will say so here with the date and the report available on request. Until then, a business that will not tell you what it has not got is telling you something.