IT Support for Restaurants & Hospitality in the GTA

If you take cards, your acquirer expects you to meet the PCI Data Security Standard. How much work that is depends on scope: which systems store, process or transmit card data, and which can reach them.

Keep scope small. Use payment terminals that encrypt the card at the point of entry and integrate with the POS without the POS ever seeing the full card number; ask your processor exactly what your setup is. Put POS terminals on their own network segment, never on guest Wi-Fi, and never let a back-office PC used for email share that segment. Change every default password on terminals and routers.

Your acquirer tells you which self-assessment questionnaire applies.

Guest Wi-Fi should reach the internet and nothing else. It needs its own network, client isolation so guests cannot see each other's devices, and bandwidth limits so a guest streaming video does not slow the kitchen display system.

Staff devices, the POS, cameras and the office PC each get their own segment. A single shared password on one flat network is the setup we most often see, and it means anyone who has ever eaten there can reach your cash register.

Reservation systems, online-ordering and delivery apps, and review sites all hold a login that controls revenue. Attackers phish those logins, change payout bank details, or post as you.

Turn on multi-factor sign-in on every platform that offers it, give each manager their own login rather than sharing the owner's, and check payout details monthly. Any email asking you to "verify your account" goes to the platform's site typed by hand, never a link. If a payout has been diverted, call the platform and your bank, then report to the Canadian Anti-Fraud Centre.

Hospitality turnover is high and accounts pile up. Remove POS codes, platform logins and email the day someone leaves, and change any shared passwords they knew. A one-page checklist at the manager's desk does more than a policy nobody reads; use our employee offboarding security checklist.

Booking names, phone numbers, emails, allergies and loyalty data are personal information under PIPEDA. Keep it in the booking system, not in exported spreadsheets, and know what to do if it leaks: the OPC's breach pages explain when a breach must be reported. This page is practical guidance, not legal advice; confirm how the law applies to your organization with counsel.

Before you talk to any provider, test your domain with our email spoofing check and work through the printable IT risk self-check.

If you only do four things this month, do these, in this order. Each is cheap and each closes a gap we see often in this sector.

1. 01

   1.

   Ask your processor whether your terminals encrypt at the point of entry, and which PCI questionnaire applies.

2. 02

   2.

   Separate guest Wi-Fi from the POS and the office, and change every default password.

3. 03

   3.

   Turn on multi-factor sign-in on booking, delivery and payout accounts, and check payout bank details.

4. 04

   4.

   Write a one-page leaver checklist for managers.