Security

Last updated November 2026. This page is a working draft that is being reviewed by legal counsel before general availability.

Your business's data stays yours

Every business on Niwala App has its own separate account. Access is enforced by the database itself (row-level security), not just by hiding buttons, and it is covered by automated tests that check one business can never read or change another's customers, orders, payments or drivers.

People only see what their job needs

• Owners and managers choose each person's role: owner, admin, manager, staff, finance, kitchen or driver.
• Drivers see only the stops on their own route, with the details needed to deliver.
• Kitchen staff see what to prepare, with allergies and notes, but not customer emails, phone numbers or payments.
• Niwala support staff can only view a business's account read-only when helping, and every view is recorded in an audit log.

Payments

Card payments are handled by Stripe. Niwala App never stores card numbers. Payment events from Stripe are verified with a signature and processed exactly once.

Location and photos

A driver's location is shared only while their route is running and they have chosen to share it, and customers see it only until their own delivery is complete. Drop-off photos are stored privately and shared through links that expire.

Hosting

The application runs on Vercel and the database on Supabase (PostgreSQL). Data is encrypted in transit (HTTPS) and at rest by our providers.

Questions? Email hello@niwala.app.