Business Continuity & Resilience

VenueCore runs on Cloudflare's global edge (compute + CDN), with Postgres + storage + auth on a managed Lovable Cloud backend, Stripe for card processing, and multiple AI providers behind a single gateway. No single vendor is a SPOF for read-only POS operation.

The till is a Progressive Web App with a service worker. If connectivity, Cloudflare or the backend is unreachable, the POS continues to: open tabs, take orders, print kitchen tickets to LAN printers, record cash and external-PDQ payments, and queue every event locally. Queued events sync automatically when the backend is reachable again. Integrated card payments (Stripe Terminal) require connectivity; venues are expected to fall back to their legacy PDQ or cash during a Stripe outage — both are first-class payment modes.

Card-processing depends on Stripe. During a Stripe incident the platform continues to operate; staff record card payments in "External card (PDQ)" mode with the legacy terminal's auth code, which is reconciled in the day's cash-up and accounting reports. VenueCore monitors status.stripe.com and surfaces a banner in the POS shell when Stripe is degraded.

Postgres and storage are managed by Lovable Cloud with daily point-in-time backups retained for 7 days and multi-AZ replication. On a regional incident, read replicas may serve cached menu / floor-plan data; writes queue in the POS service worker. Recovery Time Objective (RTO) target: 1 hour. Recovery Point Objective (RPO) target: 5 minutes for committed transactions.

AI features (Copilot, anomaly detection, forecasting, menu extraction, floor planning) call multiple model providers through a gateway with automatic fallback. If every provider is unavailable, AI surfaces show a clear "unavailable" state and the core platform is unaffected — AI outputs are never on a payment, food-safety or legal critical path (see AI Terms).

A global Cloudflare incident affects edge routing. The POS service worker continues to serve the last cached build and queue local events; published marketing pages may be unreachable. VenueCore has no manual failover to a second CDN today and treats this as an accepted upstream risk; the offline POS is the customer-facing mitigation.

Material incidents are posted to status.venuecore.solutions and emailed to the venue's primary contact within 60 minutes of detection, with hourly updates until resolved and a written post-incident review within 5 business days. Target platform availability: 99.9% monthly (excluding scheduled maintenance and third-party outages outside our control). SLA credits, where offered, are governed by the MSA.

Daily encrypted backups; quarterly restore drills; annual third-party risk review of Stripe, Cloudflare, Lovable Cloud and AI providers. DR runbooks are maintained internally and available under NDA on request for enterprise customers.