Trust center
Your business, kept safe.
How Friendly protects your money, your team and your guests — in plain words. Questions? security@friendlypos.com
- SOC 2 Type II
- Audit in progress
- SOC 3 report
- Posted here when issued
- PCI DSS
- Cards handled by Stripe
- Penetration test
- Yearly, by an outside firm
- Data location
- United States
We only list a certification once the independent report is issued.
- Every business sealed off
- Your data is walled off from every other business — by the database itself, not just our code. 77 automated tests try to break the walls on every update.
- No card numbers, ever
- Card readers encrypt the card before it reaches us. Stripe handles card data; Friendly never stores it.
- Keys nobody can read
- Encryption keys live in hardware security modules. Passwords and PINs are stored only as one-way hashes that even our staff can’t read.
- You control our access
- Our support team can’t see your account unless you approve it — read-only, for up to 8 hours, and it shows in your activity log.
- Backups you can count on
- Continuous backups, copies in a second region, write-once storage. Your registers keep selling even if the internet drops.
- Email only — no texting
- Friendly doesn’t send text messages or robocalls. Marketing email always has a one-click unsubscribe.
Subprocessors
Who helps us run Friendly
We tell you 30 days before adding a new one.
- Amazon Web Services
- Hosting, database, backups (US)
- Stripe
- Payments, card readers, billing
- Amazon SES
- Email delivery
- Expo
- App updates & push notices
- Sentry
- Error reports (no personal data)
- DAVO by Avalara
- Sales tax (if you turn it on)
- DoorDash
- Delivery (if you turn it on)
- Payroll partner
- Payroll & tax filing (if you turn it on)
Documents
Read the fine print
Plain-language summaries first. Drafts until reviewed by our attorney.
Security questions before you switch?
Talk to our Mount Pleasant team — we’ll walk you through how your data is protected.