Allergen enforcement for UK hospitality
That cut is the product. SafePlate puts it through any dish a guest at the table cannot safely eat, at the till, before the order reaches the kitchen.
The obligation
The duty sits with the operator, not with whoever is asked.
Under the Food Information Regulations, a venue must give accurate allergen information for everything it serves and keep it current as recipes change. In practice that obligation is discharged by a server recalling a supplier substitution made on a Tuesday, during a Friday service, from memory.
SafePlate moves the control off that memory and into the till. The check happens where the order is taken, it happens on every line, and it fails closed: when the checker cannot be reached, the till stops rather than guesses.
Measured
14
FSA-regulated allergens enforced
Plus ingredients and triggers a guest declares in their own words.
0
dishes served on a guess
A dish whose allergens nobody has confirmed cannot be sold at all.
369,262
requests under load
One failed. The refusal path holds under the volume of a full service.
100%
of exceptions attributable
Every override carries the name of the manager who authorised it.
How the control works
Four steps, and a record at every one.
- 01
The guest declares at the table
Allergens are recorded per seat, not per booking, and travel with the cover through every order added to that table for the rest of the service.
- 02
The till checks before it accepts
Each line is checked against the declaration of the seat it belongs to. A conflict is refused at the point of sale, and the refusal names the ingredient it matched so the kitchen can verify it against the recipe.
- 03
An exception requires a named manager
A refused dish can still be served, but only on a manager’s personal PIN. A venue-wide code cannot authorise it, and the record carries the individual, not the venue.
- 04
The kitchen is told what was checked
Instructions reaching the pass are separated into those whose allergens were resolved and those that were only typed. Typed text is never treated as verified.
The record
An allergen record survives the order, the venue and the account.
Every allergen decision is written to an audit trail that cannot be deleted by deleting what it refers to. Removing an order does not remove its safety record; nor does removing the venue. A venue that has taken an allergen order is retired rather than erased, deliberately, because the trail has to outlive the thing it describes to be worth keeping at all.
Diner allergen profiles are held encrypted. Every exception names the manager who authorised it, with the time and the table, and is exportable for inspection.
What you install
Four surfaces, on hardware you already own.
No proprietary terminal, no rip-and-replace of the point of sale. Menu import runs from your existing EPOS where there is one, and from a photograph of the menu where there is not.
Front of house
The till
Runs on the iPad the venue already has. Seats a table, records what each cover declares, and refuses a line that conflicts with it.
The pass
The kitchen screen
Tickets with the allergy table flagged, and instructions separated into those that were allergen-checked and those that were only typed.
Management
The dashboard
Menu sign-off, compliance export, and the venue’s own safety settings: which allergen mode the till runs in, and who may override it.
The responsible manager
Gatekeeper
A push the moment anyone overrides a block, carrying the table, the time and the person. An audit trail nobody reads is not a control.
Asked and answered
The four questions every operator asks.
- “Our staff will just override everything.”
- They cannot. An override needs a manager’s personal PIN, not a venue code, and it is recorded against that individual with the dish and the reason. The dashboard shows the rate. A venue whose override rate is climbing has a training problem the system has just made visible.
- “What happens when the internet goes down mid-service?”
- The till stops taking orders on tables with a declared allergy rather than accepting them unchecked. That is deliberate and it is the only behaviour the code allows: an allergen check that silently degrades to no check is worse than no system.
- “Our recipes change constantly.”
- A dish whose allergens have not been confirmed by a person cannot be sold at all, because the till will not offer it. Changing a dish takes it out of service until somebody signs it off again, which is the behaviour the regulation implies and the folder behind the pass has never had.
- “We already have an allergen matrix.”
- So does every venue that has had an incident. A matrix is a reference document that depends on somebody consulting it correctly under pressure. This is a control that acts on the order.
Before you ask anyone
A running venue you can open right now.
A complete instance, mid-service: tables seated, allergies declared, a signed-off menu, and a week of trading behind it. It signs you in on its own, it resets nightly, and it is separate from every real venue, with its own database and its own credentials.
Opens signed in. No password, no form.
See it refuse an order on your own menu.
Send three dishes. They are mapped against the ingredient database and run through a live till, including the one that gets refused. Thirty minutes, and the mapping is yours to keep.