Card payments
Card payments are processed by Stripe on the restaurant’s own connected Stripe account. Card numbers are entered on Stripe’s secure checkout or on Stripe card readers and never touch TableSpark. TableSpark keeps the payment reference, the amount and the status, so each order, deposit or gift card can be matched to its payment.
Hosting and storage
The platform and every restaurant site are delivered through Cloudflare, with all site traffic served over HTTPS. Custom domains get managed SSL. The database, authentication and media storage run on Supabase. Passwords are stored only as secure hashes by Supabase authentication, so they are never visible to TableSpark.
Every restaurant kept separate
Each restaurant’s data is isolated by restaurant in the database with row-level security, so one restaurant’s account works with its own records only.
Accounts, teams and roles
- Optional two-step verification for accounts, switched on by the account holder in Settings → Security.
- Four team roles: owner, admin, editor and staff. Staff see their own shifts.
- An append-only audit log records voids, discounts, reopened bills, refunds and price changes: who made the change, when, and why.
Your guest records
Guest records stay under the restaurant’s TableSpark account, in its Inbox and guest list. Guests and leads can be exported to CSV at any time. Account owners can delete their account from account settings (GDPR self-delete).
Email is delivered through Resend, and restaurants can send guest email from their own domain. The privacy policy lists every provider we work with, what each one does and what it handles.
Report a security concern
Email hello@tablespark.uk and a human will read it. Include what you found and where, so we can reproduce it. For data requests, see the privacy policy. To check whether our systems are running right now, see the system status page.