Your shop's records are yours

• Every shop is kept apart

  Every sale, product, customer and payment carries the shop it belongs to, and every request is filtered to the signed-in person's shop by the system itself. A changed or forged form cannot write into another shop.

• Staff see only what their job needs

  Six roles: owner, manager, cashier, stock keeper, accountant and viewer. Buying prices and profit show only to the roles you allow. Discounts, voids and stock corrections are for the people you trust with them.

• Nothing is quietly erased

  A sale is voided, never deleted, and a stock mistake is corrected with a new entry, so the trail is always complete. Money entries made by sales and payments cannot be edited by hand. Every change records who made it and when.

• Backed up every night, restore tested every week

  The whole database is backed up automatically each night. Every week the latest backup is restored into a separate database and checked, so we know a restore works before we ever need one.

• Passwords and links

  Passwords are stored only as one-way hashes that nobody, including us, can read. Repeated wrong passwords are slowed down. The website and the app talk to our servers over encrypted connections. A receipt shared with a customer opens from a long random link, not a number anyone could guess.

• Phones

  An optional PIN locks the app on a shared phone. Signing out deletes the shop's records from the phone, with a warning if anything is still unsent. The owner can remove a lost phone so it can no longer sync.

• Your data, your decision

  Export your records whenever you like; exports never include passwords and are removed from our servers after 7 days. Closing your shop needs the owner's password and gives you 30 days to change your mind. A late payment never deletes anything.

Found a weakness? Please tell us privately first through the contact page, so we can fix it before anyone else finds it. How we handle personal information is in our privacy policy.