Last updated April 24, 2026
Security & compliance
Cuadra was designed to never see your full card number, and to make every operational change verifiable after the fact. This page summarizes how.
Card payments — PCI-DSS SAQ-A
We do not process, store, or transmit card data (PAN, CVV, expiration) on any Cuadra system. When you pay for a plan or subscription, you are redirected to the Recurrente hosted checkout, which is PCI-DSS Level 1 certified. Recurrente owns card processing; Cuadra only receives the transaction outcome (success/failure + reference id). Our regulatory scope is SAQ-A.
Customer and operational data
All communication with Cuadra is encrypted in transit. Data at rest is encrypted and backed up automatically; uploaded files (receipts, consent photos) are encrypted at rest as well. We enforce per-tenant isolation at the database level: every query verifies the operator’s active business before returning rows.
Immutable audit log with HMAC chain
Every operationally significant change (cash session open/close, order edits, DTE issuance or cancellation, inventory adjustments) writes a row to audit_log. Each row cryptographically signs the previous one with HMAC-SHA256 under a daily-rotated key. Deleting or modifying a row breaks the chain and our verifier detects it. The result is a tamper-evident, audit-ready record years later.
Vulnerability reporting
If you discovered a vulnerability in Cuadra, write to security@cuadra.gt. We respond within 48 business hours. Please do not publicly disclose the finding until we have shipped a fix — we patch fast, and that gives the rest of the customer base a chance to land the patch before the bug is weaponized.