Security and data handling

What Biskèt stores about your customers

Only the customer’s first name (up to 40 characters), your order number and external_id, and the driver’s display name. Never a phone number, an address, an email or a payment card detail: unknown fields are refused, so none can reach us by accident. Payment references (external_ref) are opaque ids. The first name prints on the kitchen slip and the pickup ticket. It is kept 400 days (the accounting horizon), then replaced by « — ».

Transport and requests

TLS 1.2+ only, HSTS. JSON bodies up to 64 KiB. Every request is validated against the contract at the edge and again in the database. Every authenticated call is audited (key, route, status, request id; never bodies). Logs hold no personal data.

Keys and secrets

• API keys are stored as a peppered hash: a database copy cannot reveal or verify them. They are shown once.
• Each partner sees only its own objects: an object of another partner, or a location you are not connected to, answers 404.
• Webhook signing secrets live in a vault; deliveries go only to public https addresses, re-checked on every delivery.

What we ask of you

• Keep keys and webhook secrets on your servers, in a secret store; never in a mobile app, a browser or a repository.
• Verify every webhook signature on the raw body, and the timestamp.
• Tell us at once if a key leaks: partners@bisket.ai with the key’s prefix.
• Report vulnerabilities to security@bisket.ai.