Allergen safety platform
Every other
system
advises.
SafePlate
refuses.
Reference tools have existed for years. They tell a server what is in a dish and leave the decision to a person under pressure. SafePlate sits inside the till your staff already use and stops the order instead.
A guest declares a peanut allergy. A server taps a dish that contains one. The till will not take it.
- Status
- Live, pilots underway
- Coverage
- FSA 14 plus ingredient level
- Built for
- UK hospitality
- Measured
- 369,262 requests
2m
people in the UK live with a diagnosed food allergy, and every one of them has to trust a stranger’s memory to eat out.
02/The problem
Right now the control is somebody’s memory.
Friday, eight o’clock. Ninety dishes on the menu, fourteen regulated allergens, a supplier who changed a recipe on Tuesday and a server three weeks into the job. A table asks whether the laksa has peanuts in it.
The honest answer is that the server is guessing, and the folder behind the pass is out of date. Everyone in hospitality knows this. The industry has responded with better folders.
The industry responded with better folders
03/At the moment of order
The dish does not become unavailable. It becomes unorderable.
The guest’s allergies are attached to their seat, not to a note in the corner of the ticket. Every dish a server taps is checked against that seat before it can join the bill.
The item cannot be added to the bill.
Table 12 · Seat 2
Peanut · severe
Order 4471
Starters
Soups
Salads
Mains
Grills
Seafood
Sides
Desserts
Drinks
Contains peanut · blocked at till
01 / 03Block
Strict
Item is hidden from the order screen.
Cannot be added by anyone, on any device, at any seniority. There is no manager override to ask for.
Schools, healthcare canteens, venues led by children
02 / 03Override
Moderate
Item visible but blocked.
A manager PIN unlocks the item. The override is timestamped and the reason is logged to the audit trail.
Mid volume restaurants, group chains, casual dining
03 / 03Warn
Advisory
Soft warning at the till.
The item is orderable. The server is prompted to confirm verbally with the customer, and that confirmation is logged too.
Bars, coffee shops, occasion led service
05/Beyond the FSA 14
The regulated list is not the boundary of what hurts someone.
People react to garlic, to onion, to nightshades, to one specific spice. None of it appears on the statutory fourteen, and a system built only around that list treats those guests as somebody else’s problem.
SafePlate treats them as enforcement targets with the same rigour as peanuts. A guest can declare an ingredient, a group of ingredients, or a trigger in their own words, and the engine blocks on all three.
The statutory fourteen
● Declared by a guest, enforced identically, outside the regulated list
06/Inside a service
One room, every seat covered.
Tills, kitchen screens, the floor plan and the diner’s own profile all read from the same allergen engine. A server, a chef and a guest checking their phone see the same answer at the same moment.
- Devices per venue
- Tills, kitchen screens, manager phones
- Kitchen
- Tickets carry the allergy, not a note
- Diner
- Passport profile travels between venues
Till
Kitchen screen
Manager phone
● Safe to serve/● Priority allergy at this table
When the checker cannot be reached, the till stops.
It is the only behaviour the code allows
07/Measured, not claimed
Put under the load of ten restaurants trading at once.
Not synthetic traffic. Simulated servers seating parties with real declared allergies, sending tickets, moving tables, splitting bills and taking payment, on a commodity server costing twenty pounds a month.
- 35,599
- allergen checks run
- 2,157
- dishes refused
- 33,442
- items added to bills
- 1
- failed request
369,262
requests across the run, on a commodity server, and exactly one of them failed.
Failing closed is easy to write in a specification. Staying closed under sustained load is the part nobody can promise without measuring it.
17,067 canonical ingredients/6,438 human confirmed
real rows, pulled out of the live database
08/The ingredient database
Seventeen thousand ingredients. Six thousand of them signed off by a person.
A new venue does not start from an empty table. Menu items are matched against 17,067 canonical ingredients, of which 4,940 carry their FSA-14 allergen codes.
The engine will not block on a row a person has not confirmed. 6,438 are confirmed today. The rest are proposals: the model suggests, a human signs off, and no diner’s order is refused on a model’s word alone.
It runs on the till you already bought.
Live
Live
Roadmap
Roadmap10/Pricing
Per site, per month. The more sites, the less each one costs.
Volume tiers from £79 down to £49, exclusive of VAT. Every tier includes the full allergen engine. What changes is scale and reporting, never the safety.
Single
One site
£79
per site, per month
Standalone restaurants, solo operators
Small group
Two to five sites
£69
per site, per month
Local independent groups
Mid market
Six to twenty sites
£59
per site, per month
Regional chains, single cuisine groups
Enterprise
Twenty or more sites
£49
per site, per month
National chains, contract caterers
£250 one off onboarding per site. Covers menu mapping, the EPOS connection and floor training. The first two pilot venues run free for four months.
Full pricing and FAQ11/Either side of the till
Two more apps, and neither of them is the till.
One belongs to the guest and travels with them. One belongs to whoever is responsible when a block gets overridden at half past nine on a Saturday. Both run against the same engine as everything else on this page.
Passport
Since Mar
Oliver R.
oliver#4417
1 outside the 14
- Last shown
- Thu, 21:40
- Venues
- 4 recognised
For the diner
SafePlate Passport
A portable allergen profile, carried between restaurants.
- Profile travels between every SafePlate venue
- QR code and a short tag, scanned at the till
- Directory of venues, favourites and their offers
- Push notifications from restaurants they follow
iOS and Android in build
A guest declares once and keeps it. They sign up with a username and a password, no email needed, and get a QR code and a short tag. Any participating restaurant can look either one up at the till. The declaration belongs to them, so the fourth restaurant knows what the first one knew.
Overrides
Tonight
Override21:34
Satay chicken
Table 12M. Okafor
Confirmed verbally
Override20:58
Walnut salad
Table 4R. Šimek
Substitution agreed
Override19:12
Sesame flatbread
Bar 2A. Whyte
Trace risk accepted
- Tonight
- 3, two venues
- Estate
- 11 tables open
For the operator and for me
SafePlate Gatekeeper
Every override, the moment it happens.
- A push on every allergen override, with who and when
- Every open table across the estate, live
- Scan a diner passport at a chosen till
- Pair a POS or kitchen screen by scanning its QR
iOS ready, Android next
An audit trail is not much use if nobody reads it. The moment anyone bypasses a block, Gatekeeper pushes a notification carrying the table, the time and the person. A second screen shows every open table across the estate at once. It is also where a new venue gets approved, and how a till or kitchen screen is paired.
12/On the device
Three ways of looking at a plate, and they have to agree.
A guest holds their camera over the food and gets an allergen read against their own profile. It runs entirely on the handset: no server call, and the photograph never leaves the phone.
Point at the plate
- Satay saucePeanut
- Groundnut oilPeanut
- CorianderClear
- Rice noodleClear
Not safe for this profile
Beta, running on device
It works in a basement with no signal.
The models are converted to CoreML and bundled with the app. The conversion is checked against the original before it ships, so nothing is lost on the way down to the handset. There is no upload, no queue and no round trip.
What it reads against is the same knowledge base as the rest of the platform: SafePlate’s own labelled dishes, the ingredient ontology behind chapter 08, and public sources including Open Food Facts and Nutrition5k.
Not one model guessing. Three independent signals read the same plate and vote, so a miss in any one of them does not hide an allergen the other two can see.
01
Look, then apply the rules
Apple's Vision framework identifies what is on the plate, and the labels go through the same allergen matching the SafePlate backend already runs: 282 ingredient patterns and 254 synonyms, ported across rather than rewritten.
Deterministic. Reads the same rules as the till.
02
A model trained for this
A FastViT-T8 trained from scratch: first across 101,000 general food images to about 80 percent, then fine tuned on SafePlate’s own restaurant dishes to predict all fourteen regulated allergens directly.
Learned. Recognises dishes nobody wrote a rule for.
03
Compare against what it has already seen
MobileCLIP embeds the photograph and matches it against a curated gallery of 10,574 real, allergen-labelled dishes. No fixed list of classes, so a dish it has never been trained on can still find its nearest relatives.
Retrieval. Strongest exactly where training data is thinnest.
- 14
- regulated allergens predicted
- 10,574
- labelled reference dishes
- 600+
- reference photos per allergen
- 101,000
- images in the first training run
How it was built
Trained, measured per allergen, and changed when the measurements said so.
A mistake, caught and reverted
Mixing external seafood photography into training broke the classifier’s calibration. It was spotted, reverted cleanly, and the same images later turned out to work fine for the retrieval route instead. Two approaches, two failure modes, diagnosed separately.
A bug fixed upstream
Open Food Facts’ own image-serving URL scheme was silently failing on most European barcodes. That was found and fixed while gathering data, which is infrastructure work rather than data collection.
The breakthrough: stop training, start showing
Lupin had nine training examples. No amount of class weighting or oversampling fixes nine. Switching that allergen to the retrieval route and growing its reference set instead took it from 9 real examples to 1,007, and every one of the fourteen now sits on more than 600.
What it will not do
It never tells a guest a dish is safe. It reports what it detected and defers to the staff and to the till.
The scanner is labelled beta in the app, behind a disclaimer that does not go away. The enforcement on this page happens at the till, against a declared profile and a mapped menu. A camera pointed at a plate is a second opinion, not the control.
The rarest allergens, lupin, molluscs and sesame, still have measured accuracy gaps, and the app says so where a guest can read it. A system that knows which of its answers to trust least is the only kind worth pointing at food.
13/Who is behind it
He left software for kitchens. I went the other way.
A system that takes a dish off a menu has to be right about food and right about software, and being wrong in either direction lands on the same person at the same table. That is not a thing one discipline gets to decide on its own, which is why this was never going to be built by a developer alone.
Navhi Ifode/Founder
He has spent more than a decade cooking for other people. Nobody has ever cooked safely for him.
Food enthusiast, not just a chef.
Navhi is allergic to honey. It is not one of the statutory fourteen, so it appears on no label, sits in no allergen matrix, and asking after it has never once produced a confident answer. Not because anyone was careless. There is simply nowhere in the system for an allergen the law does not name, so the question lands on whoever happens to be standing there. Chapter 05 of this page argues that the fourteen are a floor rather than a ceiling. It is not an abstract argument here.
He would rather be called a food enthusiast than a chef. The eagerness to learn is what has been the crux of his entire career, and it is the philosophy of perpetual curiosity he instils in every student he teaches: the idea that the best chefs never stop learning. It is also the correct posture for anyone working on allergens, where the thing that hurts somebody is nearly always the case nobody thought to look up.
Chapter 05
It is not an abstract argument
Eagerness to learn and grow.
- 2013Left a career in IT for professional kitchens. The analytical half never went anywhere, which is the reason this partnership works at all.
- SinceHelped open and develop kitchens across Lagos and Abuja, and now oversees seven restaurants as group executive chef.
- NowHead chef instructor and culinary consultant, teaching the people who will run the kitchens this has to work in.
Akhil Raghav/Cofounder and CTO
I built every part of this, and there is nobody I can hand the blame to.
The engine that decides. The till that refuses. The kitchen screen, the admin, the two apps, the migrations, the servers. That is a statement about accountability rather than about heroics: when a venue reports something wrong, the person who reads it is the person who changes the code. A fix is hours, not a release train and a queue.
Five years building for other people's businesses came first, on their deadlines and inside their constraints. Useful for exactly one reason. You learn early that software is judged on its worst day rather than its best, and that the worst day arrives mid service, never on a quiet Tuesday with somebody watching.
The rest of the time I am on a Himalayan 450, usually above the treeline. Riding remote teaches what the refusal rule teaches. You plan for the thing that goes wrong a long way from help, because optimism is free right up until it is not.
What that means in practice
- One person reads the complaint and changes the code
- Fixes ship the same day, not the next release
- Nothing is promised here that is not already running
- The person who wrote it is the person you meet
First commit 15 January 2026. Still the one being woken by it.
Build
break
fix
repeat
Above the treeline
Between us that is a kitchen that knows what actually happens on a busy pass, and software that will not let it be forgotten. Neither half is sufficient. That is the entire argument.
Allergens the law names
14
A floor, and not a ceiling
Requests under load
369,262
One of them failed
Dishes it will guess on
0
Unsure means refused
People to ring when it breaks
1
Same day, not next release
14/Pilots open
Bring your three hardest dishes.
Thirty minutes. Take the three items on your menu you would least like to explain to an allergic guest, and watch SafePlate handle them on your own data.
We will only use this to contact you about a demo.
- UK only for now
- No card
- No trial signup
01
You send three dishes
The three on your menu you would least like to explain to an allergic guest. A photo of the menu is enough.
02
I map them
Each one decomposed against the ingredient database and checked, on your data rather than a demo dataset.
03
Thirty minutes, live
I run them through a till in front of you, including the one that gets refused, and you keep the mapping.