Trust
Security.
Your sales, your stock, your payroll — this platform holds the numbers your business runs on. Here is exactly how we protect them.
Last updated July 10, 2026.
Tenant isolation
Every record is scoped to your company on every single query, enforced at the API layer — never by trusting what the client sends. One customer can never see another’s data.
Permissions that mean it
Granular role-based permissions per page and per action, checked on the server for every request — not just hidden buttons in the UI. Branch-level scoping keeps each location’s data where it belongs.
Encryption
TLS for everything in transit. Cloud data lives in a managed database service with encryption at rest.
Authentication
Passwords are hashed with bcrypt — we cannot read them. Sessions use short-lived access tokens with refresh rotation, so a leaked token expires fast.
Signed device activation
Desktop tills activate with cryptographically signed (RS256) licenses bound to a hardware fingerprint. A copied install on unknown hardware simply doesn’t run.
Offline-safe sync
Tills keep working offline and sync back through a delta engine designed to be idempotent — reconnecting after an outage never duplicates or drops your documents.
Audit trail
Key actions are logged with who did what, and when — so unusual activity in your account has a paper trail.
Backups
Automated backups of cloud data through our managed database provider, so a bad day doesn’t become a lost business.
Card data never touches us
The POS records which payment method a sale used — cash, card, credit. The card transaction itself happens on your own payment terminal, with your payment provider. Card numbers are never sent to, processed by, or stored on our servers, which removes the single most attractive target from the system entirely.
Offline by design, not by accident
A till that stops when the internet does is a security and a business problem. Our desktop tills hold a local, licensed copy of your working data so selling never stops, and the sync engine reconciles with the cloud safely when the connection returns. The local device is part of your security perimeter: lock the machine down, give each cashier their own login, and use roles to limit what a till account can do.
Your side of the deal
- Use strong, unique passwords — we hash them, but we can’t make them strong for you.
- Give each staff member their own account and the smallest role that does the job.
- Remove access the day someone leaves.
- Keep till devices physically secure and their operating systems updated.
Certifications, honestly
We do not yet hold formal certifications such as SOC 2 or ISO 27001, and we won’t pretend otherwise. What we hold ourselves to today is the engineering above — isolation enforced on every query, permissions enforced on every request, and encryption everywhere data moves or rests.
Reporting a vulnerability
Found something? We want to know. Email security@posforretail.com with details and steps to reproduce. We respond promptly, we fix real issues fast, and we won’t take legal action against good-faith research that stays out of other customers’ data.