Are these production controls?

This page describes the intended control model. The website demos are local samples, not evidence that role enforcement, STOP, audit retention or live agent execution is deployed.

Does STOP undo an action?

No. Stopping pending work is different from reversing a completed action. Undo would only be available for a supported reversal, with its own permissions and confirmation.

Which providers and data locations are used?

The website source includes Vercel Analytics and Resend for enquiry email. The full live-agent provider list, processing locations, retention and AI data-use terms have not been confirmed here.

How can I report a concern?

Contact hello@erpfy.app with a non-sensitive description and affected public route. Do not send credentials, private guest records or exploit details containing personal data.

YOUR TEAM.YOUR CONTROL.

A clear boundary between reading, drafting and acting. Know what needs a person’s decision.

Explore the boundaries

Restaurant manager and supervisor reviewing a proposed change and an open logbook

INTENDED CONTROL MODELConfirm the implemented safeguards with ERPFY before enabling live agents. This website is not a security certification.

ACCESS IS NOTA BLANK CHEQUE.

Same request: “We’re out of burrata.” Different boundaries.

Check the ingredient records.

Explain the latest recorded count and the dishes mapped to burrata. No menu availability changes.

Illustrative permission model. These controls do not grant access or change a venue.

Proposed tiers—not a statement of deployed permissions.
Tier	Boundary	What still needs review
Read	Permitted records only	Source, venue, timestamps and missing data
Prepare	A draft, not execution	Exact items, recipients and supported channels
Approve	Authorised, scoped decision	Server-side access and the connected system’s result

THE RIGHT PERSON.THE RIGHT RESTAURANT.

Role before request

An agent should not reveal a report simply because someone can name the venue.

Verified identity

A linked phone is an access channel, not permission to impersonate another role.

Checks at execution

The connected service must enforce access. A visible button or chat reply is not a security boundary.

A decision worth coming back to.

A useful trail connects the request, the records, the preview and the person’s decision with the system’s result. It should help the next shift understand what happened—not just save a conversation.

The request, the decision and the outcome.

Explore the drawings with your pointer or touch. Keyboard: Tab into a drawing, then use Enter or the arrow keys; Escape returns it to rest. Illustrations only—no venue actions.

A DECISION TRAIL.NOT JUST A CHAT HISTORY.

What a useful audit record needs.

The request, relevant sources, exact preview, operator decision, system result and time belong together. A successful-looking message is not enough to establish that a change happened.

STOP is for pending work.

The proposed STOP control should halt work that has not completed. Completed payments, purchases or messages must not be described as automatically reversible.

ASK ABOUT THE DATA.BEFORE CONNECTING IT.

Confirm processing providers, countries, retention periods, deletion handling and AI-provider data-use terms for the actual service. Those operating details are not established by an interactive website example.

Keep credentials, full card details and unnecessary personal information out of agent requests. Review sensitive tasks in the authorised app workflow.

Responsible disclosure

Start with a non-sensitive report to [email protected]. Include the affected public route and a brief description; ask for an appropriate channel before sending private information.

Before you get started

GOOD QUESTIONS.CLEAR ANSWERS.

SET THE BOUNDARIES.THEN TRY THE WORKFLOW.

Talk through the records, permissions and review steps your venue needs.

Book a demo