Security & RBAC
Authentication, roles, audit logs, and how MenuPi protects your menu data.
Updated May 18, 2026·5 min read
Authentication
MenuPi uses email + password (or Google sign-in), with optional TOTP-based two-factor authentication. SSO (SAML/OIDC) is not available.
Roles
| Field | Type | Description |
|---|---|---|
| Owner | role | Full access, billing, transfer ownership. Cannot be removed by other roles. |
| Manager | role | Manage screens, integrations, team. No billing or ownership transfer. |
| Editor | role | Create and publish scenes/playlists. Cannot manage team or integrations. |
| Viewer | role | Read-only dashboard access. Useful for franchisees who watch but cannot edit. |
Audit log
Every privileged action — sign-ins, publishes, integration changes, user invites — is recorded. Available at Settings → Audit. Exportable as CSV. Retained 12 months on Growth, 36 months on Enterprise.
Data protection
- TLS 1.3 in transit; POS credentials encrypted (AES-256-GCM).
- No customer PII is collected by the player — only operational telemetry.
Compliance docs
The DPA and subprocessor list are at /legal.