Data and security
For owners, IT and accounting · October 2026
How Sixtop handles your data
Sixtop reads your systems overnight and turns them into store-level reporting and analysis. It is not a live feed: yesterday’s business is in the portal the next morning. Sixtop only reads from your systems. It never writes back.
How we ask for logins
Only through a private setup page on sixtop.ai, sent to you after you ask for it. We never ask for a password by email, text or phone. If someone does in our name, it isn’t us: write to connor@sixtop.ai.
| Source | Brings | Updates |
|---|---|---|
| CaesarVisioncloud data export | Sales, orders, tenders, discounts, Hot-N-Ready, waste, inventory counts, cash drawers | Daily by about 9am EasternPrevious business day |
| Altametricslabor | Time punches, payroll, roster | Punches dailyPayroll and roster weekly |
| TimeClock Pluswhere used | Time punches | Through the dayDuring store hours |
| QuickBooks Online | Profit and loss by store | WeeklyAs current as your books |
| LCE Gateway | Last year's history, so comparisons work from day one | Once, at setup |
| DoorDash | Delivery orders, fees, refunds, cancellations | DailyRecent days reload each morning, since DoorDash finalizes late |
Anything else you run on, such as your card processor, bank feed, scheduling or vendors, can be added once its data can be pulled automatically by API or scheduled export.
A number is only as reliable as how it was recorded. Some come straight from the register. Others depend on someone keying them in. Knowing which tells you what to spot-check.
| Metric | Recorded by | What to know |
|---|---|---|
| Sales, orders, tenders, discounts | System | Register transactions. |
| Theoretical food cost | System | What sales should have used, by recipe. |
| Labor dollars | System | Closed weeks are payroll actuals. The current week is punch hours times each employee's own rate. |
| Hot-N-Ready production | Keyed | Crew logs what goes on the shelf, and when. |
| Waste | Keyed | Keyed as expired, dropped or remade, and that choice changes what the waste means. |
| Inventory counts, actual food cost | Keyed | Weekly counts. Late or edited counts are flagged. |
| Cash drawers and deposits | Keyed | As counted and entered in the store. |
| Labor hours | Keyed | Time-clock punches, including manager edits. |
| Profit and loss | Books | QuickBooks, by store. A month is complete once it's closed. |
| Delivery orders, fees, refunds | System | DoorDash. Refunds and cancellations can land days after the sale. |
System: recorded automatically by the register or a platform. Keyed: entered by crew or managers, and only as good as the keying. Books: entered by your bookkeeper, and as current as your close.
- Read-only
- Sixtop only reads from your systems. It never writes back to them.
- Isolation
- Your own database and your own application deployment. Nothing is shared with other customers.
- Your logins
- Entered on a private setup page and encrypted in your browser before they are stored. Nobody can read them back from that page, and the setup copy is deleted once your portal is built. QuickBooks connects by Intuit sign-in, so we never see that password.
- In transit
- TLS (HTTPS) on every page, API call and vendor connection.
- At rest
- AES-256 encryption of the database and its backups. Backups are taken daily.
- Hosting
- In the United States, on Supabase and Vercel.
- Patching
- Code dependencies are watched for known vulnerabilities and fixed promptly. The hosts patch the servers and database.
- Monitoring
- Sign-in and export activity is checked automatically throughout the day, and Sixtop is alerted to anything unusual.
- What we keep
- Only what reports use. From payroll: employee ID, name, store, job, hours and pay, with no contact details. Birth dates, used for minor-labor rules, stay on the server and are never shown. Cards: last four digits only.
- AI
- Runs on Anthropic's Claude API, which doesn't train on your data.
- Vendors
- Supabase, Vercel, GitHub, Resend and Anthropic.
Our written security and incident-response policy is available on request.
- Owner / exec
- All stores and pages, including the P&L.
- District manager
- All stores' operating pages. No P&L. Opens on their home store.
- General manager
- Their assigned stores only.
- Pages
- What each role sees can be adjusted for your organization.
- Users
- Your admins manage users, roles, store access and other admins. New users get a one-time invite link and set their own password. Removing someone cuts access on their next click.
- Activity
- Every sign-in, page view and export is recorded by user and visible to your admins, including Sixtop support's own access.
- Change log
- Every change to users and access is logged, whoever made it. Your admins can review and export it. It can't be edited or deleted from the app.
- Your data
- It's yours. If you leave, you can export it for 30 days, then it's deleted.
- Incidents
- If your data is ever involved in a security incident, we notify you in writing without unreasonable delay, with what happened and what we're doing about it.
Monday to Friday, 9am to 6pm Central
Excluding holidays. 99.5% monthly uptime target. Maintenance is announced 24 hours ahead, and failed data loads alert Sixtop automatically. Live status and uptime history: status.sixtop.ai
| Severity | Example | First response |
|---|---|---|
| Critical | Portal down, or a security issue blocking core use | 2 support hours |
| High | Core features degraded across users or stores | 1 business day |
| Standard | Limited-impact issues, questions and requests | 2 business days |
Questions about anything here? connor@sixtop.ai