Security Overview

Contents

1. 1. In short
2. 2. Where your data is kept
3. 3. Encryption
4. 4. Keeping each business's data separate
5. 5. Sign-in protection
6. 6. Audit trail and tamper detection
7. 7. Backups and recovery
8. 8. Payments and money
9. 9. Artificial intelligence
10. 10. Our team's access
11. 11. Monitoring and incident response
12. 12. Certifications
13. 13. What you can do
14. 14. Reporting a vulnerability

Version: 1.2 · Published: 16 October 2026 · Effective: on acceptance for new Workspaces; for Workspaces that accepted an earlier Version, on the date STAK gives in its notice under clause 20 of the Customer Terms of Service · Governing text: English (clause 23.9 of the Customer Terms of Service)

Issued by: STAK Global, LLC, a limited liability company formed in the State of Delaware, United States of America (file number 10798493), which owns STAK (ستاك) and the Services. Contact: [email protected].

This Security Overview explains in plain language how we protect your business's data and keep copies of it, as things stand on the Effective Date of this Version. We update it when that changes. It is for information only. Our contractual commitments are in the Data Processing Agreement. Expressions defined in the STAK Customer Terms of Service have the same meaning in this Security Overview.

1. In short

• Your data is encrypted while it travels and while it is stored in our systems.
• Each business's data is kept separate from all others in the database itself.
• We make continuous Backups, and keep daily and monthly copies in another country, protected against early deletion.
• We do not store card numbers, and we never receive or hold your money.
• Every important change is recorded in an audit trail that no User can alter.
• We do not currently hold ISO 27001 certification or a SOC 2 report. We will say so here when we obtain them.

2. Where your data is kept

2.1 The Services run on Amazon Web Services cloud infrastructure in the Frankfurt region, in the Federal Republic of Germany. Backups are copied to a separate Amazon Web Services region in the Republic of Ireland. This separation means a copy of your data can be kept even if the entire primary hosting region fails.

2.2 We may in future move hosting to another region. We will notify you at least 30 days in advance. Temporarily running the Services from the Backups in the Republic of Ireland after the loss of the primary hosting region is not a move, and we will tell you about it without delay.

2.3 STAK is provided by STAK Global, LLC, a company formed in the United States of America. Our hosting provider and some of our service providers are also subject to United States law. We protect your data against unlawful access by any government as set out in clause 13 of the Data Processing Agreement: we disclose data only on a binding request, tell you unless the law prohibits it, limit disclosure to the minimum, and challenge requests we reasonably consider unlawful. Your data is encrypted while it is stored and while it travels.

3. Encryption

3.1 Every connection to the Services is encrypted with TLS version 1.2 or later, and the application verifies the database server's identity on every connection.

3.2 Databases, disks, files, Backups and the secrets store are encrypted at rest with AES-256, using keys managed through Amazon's key management service or by the hosting provider.

3.3 Your employees' files and clinical records are additionally encrypted within the application with separate keys, and the keys for connecting to Payment Service Providers and other providers are kept in a separate secrets store encrypted with a separate key.

4. Keeping each business's data separate

4.1 Every record of a business's data in the database carries the identifier of the Business it belongs to. The database itself enforces row-level security rules that stop the application from reading or writing another Business's records. This is an independent layer of protection beneath the application's own checks.

4.2 The database account the application uses has no permission to bypass these rules.

5. Sign-in protection

5.1 You can sign in with:

• a verification code sent by WhatsApp to a verified number;
• a passkey, using face or fingerprint recognition;
• a Google, Apple or Microsoft account.

An authenticator app can be used as a second step after signing in. We do not use passwords.

5.2 You can require two-step sign-in for specific roles, and Owners and Admins are alerted when anyone changes their verification methods. Each person is alerted when their own Account is used from a new device. On the Plans that include them, you can also set a session idle time-out, and Owners are alerted when anyone signs in from a new device.

5.3 Each Staff Member gets a defined role and permissions, and their access can be limited to particular Branches. Staff on shared Devices use a six-digit personal identification number (PIN), and sign-in with it locks after five wrong attempts.

6. Audit trail and tamper detection

6.1 Every important change is recorded in an audit trail, with who made it, when, from where and from which IP address. No User can alter or delete this trail, except that carrying out a request to erase an End Customer's data removes that person's identity from its entries while keeping what was done, by whom and when. The trail is deleted with Customer Data on termination under the Terms.

6.2 Accounting entries are linked in a chain that reveals any later change to them, and you can check their integrity from the Security page.

7. Backups and recovery

7.1 We make continuous Backups of the databases, which allow them to be restored to any moment within the last 35 days. We also make:

• daily Backups, kept for 35 days;
• monthly Backups, kept for 12 months;
• a logical Backup of the database (a database dump) every night, kept for 35 days in locked storage.

7.2 Daily and monthly Backups are copied to Ireland. The policy of the backup vaults in Frankfurt and Ireland prevents anyone, including our own team, from deleting a Backup before its retention period ends or changing that period. The vaults are also locked in the hosting provider's compliance mode, which is designed so that no one, including anyone who might take over one of our accounts with the hosting provider, can delete a Backup in its first 35 days.

7.3 Every month we test restoring the database from Backups. We aim to lose no more than 15 minutes of data if a database fails, and no more than 24 hours if the entire hosting region is lost, in line with the recovery objectives in the Service Level Agreement.

7.4 We keep Backups to restore the service, not as an archive for you. So please export your data regularly from the Plan and billing page or from each App.

8. Payments and money

8.1 The Services are designed so that card numbers do not pass through or get stored in our systems: payment takes place on the Payment Service Providers' own pages or on their certified card acceptance terminals and apps. The Services' screens contain no field for card numbers or their security codes, and you can ask, from the Security page, for text fields to be scanned for card numbers entered by mistake.

8.2 Your money settles directly from the Payment Service Provider to your bank account. We never receive or hold it.

8.3 Changing the bank account registered in STAK to receive settlements needs an extra verification step and takes effect only after 48 hours. Owners are alerted immediately so they can cancel it.

9. Artificial intelligence

9.1 Data is sent to the AI provider only when a User asks for an AI Feature, uploads a document for one to read, such as a receipt, or when an automation a User has set up runs an AI step, and only the data needed for that request or step is sent.

9.2 Your data is not used to train artificial intelligence models. AI Features change a record only after your express confirmation, or under an automation that an authorised User has set up and switched on.

10. Our team's access

Access to the Production environment is restricted to a limited number of named staff and requires multi-factor authentication, and the start of every access session is logged. Administrative access to servers goes only through Amazon's systems management service, with no direct login to servers.

We look at your data only in these cases:

• to provide support you ask for;
• to operate, maintain and restore the Services;
• to investigate a Security Incident or a suspected breach of the Acceptable Use Policy;
• where the law requires it.

11. Monitoring and incident response

11.1 We monitor the cloud infrastructure automatically around the clock, with immediate alerts to our team. Every administrative action on the cloud infrastructure is logged, and threats and excess permissions are detected automatically.

11.2 If a Personal Data Breach affects your data, we notify you without undue delay: within 24 hours of becoming aware of it where feasible, and in any event within 48 hours. We tell you what happened and what we have done about it.

12. Certifications

We do not currently hold ISO 27001 certification or a SOC 2 report. We do not hold PCI DSS certification either, because the Services are designed so that card data does not pass through our systems: it is processed on the Payment Service Providers' own pages or their certified terminals and apps. The Payment Service Providers you connect to the Services hold their own certifications. We will list here any certification we obtain in future.

If you take card payments through your STAK pages, the buyer is sent to your Payment Service Provider's own page, or you use its certified terminals and apps, so STAK's pages never collect card data. Check your own PCI DSS duties with your Payment Service Provider; a business that uses such a redirect usually completes the shortest self-assessment questionnaire (SAQ A). STAK does not claim PCI DSS certification.

13. What you can do

• Switch on two-step sign-in for Owners and Admins.
• Give each Staff Member only the permissions their work needs, and remove access for anyone who leaves straight away.
• Export your data regularly, at least once a month.
• Keep point-of-sale Devices connected until sales recorded offline have finished synchronising, before wiping or signing out of any Device.
• Keep your devices' systems and browsers up to date.
• Tell us immediately about any suspicious activity.

14. Reporting a vulnerability

If you discover a security vulnerability, email us at [email protected]. We handle reports confidentially. We authorise good-faith security testing within the limits in clause 10 of the Acceptable Use Policy, and we make no complaint or claim against anyone who stays within those limits and reports the vulnerability to us without delay.