Implemented security controls
Tenant isolation, route guards, role permissions, token rotation, API key hashing, webhook signing and SSRF protections are implemented product controls.
Compliance Roadmap.
Current security and privacy controls plus future compliance work, with clear boundaries around unclaimed certifications.
Current controls
These are implemented controls customers can review today without relying on unsupported certification language.
Operational controls
Release gates, production env validation, backups, rollback, worker recovery, route isolation checks and source security checks are part of launch operations.
Privacy controls
Privacy, DPA, subprocessors, data retention, export/delete and support-session boundaries are documented for customer review.
Public claim boundary
Limvero does not claim SOC 2, ISO 27001, PCI DSS, fiscal certification or provider certification until each fact is completed and documented.
Future roadmap
These items require provider selection, legal review, evidence collection or third-party assessment before public claims are made.
Formal security audit
A third-party audit can be planned after production provider selection, stable operations and legal review of audit scope.
SOC 2 readiness
SOC 2 readiness requires evidence collection, control ownership, vendor review, access reviews and auditor engagement before any public claim.
ISO 27001 evaluation
ISO 27001 is a future management-system project and is not claimed until formal certification is achieved.
PCI and payment scope
Payment card data should remain with certified terminal/acquirer providers. Limvero does not claim PCI DSS scope or certification by default.
Provider-specific certifications
Fiscal, payment, marketplace, hosting and delivery claims are made only after the selected provider integration is contracted and verified.
Procurement evidence pack
Security questionnaires, architecture diagrams, subprocessors, backup/restore and incident materials can be assembled per customer procurement process.
Compliance roadmap language is intentionally conservative: planned audits and certifications are not represented as completed trust badges.
Plan a clean restaurant rollout.
Talk through locations, POS devices, kitchen workflow, menu migration, API needs and security review before launch.