Passwords and PINs
Login passwords and staff PINs are stored as bcrypt hashes, not as readable text. The system can check a password; it cannot show it back to you. A reset replaces it.
Security
Boring where it matters.
Who can open the till, what is written down, where the data sits and what happens when the server has a bad night. These are the controls that are in place — not a badge we cannot show you.
Who gets in.
A till is shared by people who should not share the same permissions. The system separates the person from the login, and the login from what it is allowed to do.
Two-factor authentication
Every account can switch on two-factor authentication in Settings → Security. An authenticator app supplies the code, and recovery codes cover the phone that ends up in a taxi.
Groups are roles
Permissions are set once on a group and everyone in it inherits them. A team member can exist without a till login at all, and a cashier does not need the rights of an owner.
What was done, and by whom.
The activity log keeps the sale actions: what was added, what was removed, a quantity changed, a receipt cleared, a discount given, a payment cancelled. Each row carries the user, the time and the IP address, so a question about the evening has an answer that is not a memory.
Money is not trusted to the browser. The rows that decide about a discount or a cancellation are written by the server, not by the till screen. The log is scoped to the venue, and only people with the log permission can open it.
In every log row
The user and the time
The action and the receipt as it stood
The IP address and device
Discounts and cancellations, written by the server
Visibility limited to the venue
Where it runs.
The application and its database run on a server at Hetzner in Falkenstein, Germany. The public site and the panel are served over TLS. Card payments are completed on the Adyen terminal; the till does not store card numbers.
Each venue is its own tenant. Users, products, orders and activity rows are tied to that tenant, and the panel scopes them to it. One venue does not see another venue’s evening.
Every night the database is dumped and the operational files are backed up. Both are copied to storage away from the server. The fiscal archive has its own copy and is mirrored append-only, so a backup rotation cannot quietly remove a fiscal record.
Controls in place
TLS on the site and the panel
Tenant-scoped records and users
No card numbers stored in the till
Daily database dump, copied off the server
Operational backups kept for 14 days
Fiscal archive mirrored separately, not rotated away
Security, asked plainly.
The questions we can answer from the system, and the ones that belong in writing.
How do I switch on two-factor authentication?
Open Settings → Security, start the setup and scan the code with an authenticator app. Confirm the six-digit code, then keep the recovery codes somewhere other than the phone. The account is not protected by 2FA until that confirmation succeeds.
Can I see who cancelled a sale or changed a discount?
Yes — that is what the activity log is for. It records the user, the time, the action and the IP address. A user with the log permission can open it in the panel; a cashier without that permission cannot.
Does removing a staff login remove their history?
No. The log row keeps the name and the action as they were at the time. Removing a login closes the door; it does not rewrite what happened while the door was open.
Do you store card numbers?
No. The card is entered and processed on the Adyen terminal. The till records the payment result, not the card number. There is no card number field in the order.
Where are the backups kept?
The nightly database dump and the operational volume backups are copied to a Storage Box away from the server. Operational backups rotate after 14 days. The fiscal archive has a separate copy and is not part of that rotation. We do not publish a restore time we have not measured for your venue.
Are you ISO 27001 certified?
We do not put certification badges on this page. If a tender needs a specific certificate, a data-processing agreement or a security questionnaire, write to us before the deadline and we will answer in writing with what we can evidence — including the answer “we do not have that” if that is the truth.
A question that belongs in writing?
Send it before the demo. We would rather answer a security questionnaire honestly now than discover the gap during a tender.