Where the reviewed products stand
Compare documented control across the named products and routes. Open a review for its plan, region and agreement (this is a selected sample).
0–10 on both axes · Higher and further right means more documented control
Exact scores & review links (3)
| Vendor | Data access & portability | Build & act |
|---|---|---|
| Toast ↗ | 6.2* | 5.3* |
| Lightspeed Restaurant ↗ | 5.6* | 4.1* |
| Permute ↗Publisher self-assessment | 8.0* | 7.1* |
Axes average three dimensions each: access, third-party access and exit horizontally; action, continuity and business logic vertically. Fixed 0–10 scale, midlines at 5 (overall grades use separate weights). * Some evidence is unresolved. Marker colors identify companies, not score bands. How to read the map ↗
Permute is included as a reference (it owns this site and is a publisher self-assessment). Its score is excluded from sample averages. Read the Permute review ↗
Reviews retain the named POS product and version. Financial sales, item records and order creation can require different grants (a reporting credential does not authorize every live POS operation).
Compare the six dimensions
| Overall control | |
|---|---|
| Data access | |
| Third-party accessibility | |
| External action | |
| Continuity | |
| Data exit | |
| Business logic and customization | |
Product scopes, dates & reviews
Toast
Point of sale · Checked 2026-10-17
Toast restaurant POS: permission-scoped order, check and selection records at US restaurant locations. Standard customer API reads and separately approved partner/custom order writes are assessed as distinct routes; no whole-product, payroll or payment-processing export claim.
Read findings and sources ↗Lightspeed Restaurant
Point of sale · Checked 2026-10-17
Lightspeed Restaurant K-Series custom integrations: Financial API sales records and Items API catalog reads/writes for one approved restaurant business and its locations. Excludes Retail, Restaurant L-Series, orders-api, reservations, property-management interfaces and partner-only real-time events.
Read findings and sources ↗| Customer control | Toast ↗ | Lightspeed Restaurant ↗ | Permute ↗ |
|---|---|---|---|
| Category | Point of sale | Point of sale | Databases and data platforms |
| Overall control | |||
| Data access | |||
| Third-party accessibility | |||
| External action | |||
| Continuity | |||
| Data exit | |||
| Business logic and customization | |||
| Assessment scope | Toast restaurant POS: permission-scoped order, check and selection records at US restaurant locations. Standard customer API reads and separately approved partner/custom order writes are assessed as distinct routes; no whole-product, payroll or payment-processing export claim. | Lightspeed Restaurant K-Series custom integrations: Financial API sales records and Items API catalog reads/writes for one approved restaurant business and its locations. Excludes Retail, Restaurant L-Series, orders-api, reservations, property-management interfaces and partner-only real-time events. | Permute hosted workspaces / scoped REST and TypeScript SDK access to connected query sources, file datasets, managed database records, operation code and custom apps. Signed enterprise contracts and upstream vendor rights remain separate; no live tenant migration or reliability test was performed. |
| Assessment checked | 2026-10-17 | 2026-10-17 | 2026-10-12 |
| Read the findings | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ |
Scores are out of 10. * Incomplete evidence discounts verified capabilities (unknown answers stay unknown). Planned migration drives data exit. Scoring method ↗
Who can connect?
Yes No- Unknown
| Connection method | Customer credentials | Integrator credentials | Provider approval required |
|---|---|---|---|
| Toast ↗ | |||
| Toast approved partner order API ↗ | |||
| Toast customer Standard read-only API ↗ | |||
| Toast bespoke restaurant integration ↗ | |||
| Lightspeed Restaurant ↗ | |||
| K-Series approved merchant custom API ↗ | |||
| K-Series approved partner application ↗ | |||
| Permute ↗ | |||
| Scoped customer REST / TypeScript SDK ↗ | |||
| Permissioned end-user MCP ↗ | |||
A check means the column applies to that route (customer credentials can still require provider approval). Report exports use the customer account without separate API credentials. Open a connection method for its authentication, requirements and last review date.
What each review covers
Toast ↗
Toast documents paginated order reads, modification windows and customer-created read credentials. Standard access requires RMS Essentials or higher at each location and cannot write; partner order creation and check updates require a separate approval and certification path. Merchant-directed AI processing is allowed with merchant consent, while API-derived model training requires Toast approval.
Toast restaurant POS: permission-scoped order, check and selection records at US restaurant locations. Standard customer API reads and separately approved partner/custom order writes are assessed as distinct routes; no whole-product, payroll or payment-processing export claim.
Lightspeed Restaurant ↗
K-Series offers a paid custom API add-on for a restaurant business using its own team or a trusted developer. That route exposes financial and item interfaces, including item creation and updates, but excludes orders-api and webhooks. Paginated current-state retrieval supports scoped rebuilding; retained change replay and a complete product export remain unverified.
Lightspeed Restaurant K-Series custom integrations: Financial API sales records and Items API catalog reads/writes for one approved restaurant business and its locations. Excludes Retail, Restaurant L-Series, orders-api, reservations, property-management interfaces and partner-only real-time events.
Permute ↗
Scoped APIs expose SQL reads, managed records and customer-authored operation code. Customer-built apps are supported, while complete workspace recovery, outbound CDC and minimum-plan access terms remain unresolved.
Permute hosted workspaces / scoped REST and TypeScript SDK access to connected query sources, file datasets, managed database records, operation code and custom apps. Signed enterprise contracts and upstream vendor rights remain separate; no live tenant migration or reliability test was performed.