What Happens When the Network Goes Down

Putting your till in a browser raises fair questions, and most vendor answers to them are written to reassure rather than to inform. This page is the opposite. Every claim below is something the system actually does today, and where the answer is unflattering it is written out rather than left off.

When the network drops

A cashier can keep selling. The app itself is cached on the device after the first visit, your products and customers are held locally, and a sale taken with no connection is stored on that device and sent when the connection returns.

Now the parts most pages would leave out.

• Sync is manual. Coming back online does not replay the queue by itself. Somebody presses Sync.
• The queue is on that one device. If the sale was taken on a particular phone, that phone is what holds it. A different device cannot recover it.
• Only selling is queued. Stock adjustments, purchase orders and the rest still need a connection.
• The local product list has to have been loaded once online. A brand new device that has never connected has nothing cached.
• Retries are capped. After five failed attempts a queued sale stops retrying and is flagged for someone to deal with, rather than silently disappearing or endlessly re-sending.

The honest summary is that you can keep trading through an outage, and that recovering afterwards is something a person does deliberately rather than something that happens on its own.

When the power goes

There is no server in your shop to lose. It is a browser application on your own phone or laptop, so it lasts as long as that device's battery does. We are not going to imply anything about your mains supply, because we have no control over it and neither does any other software vendor who tells you otherwise.

One business cannot see another

Separation is enforced in the database with row level security, which matters because it means the rule holds underneath the application rather than inside it. A mistake in a screen cannot reach another business's rows, because the database itself will not return them.

On top of that, what each staff member may do is checked on the server for every request, not hidden in the interface. Hiding a button is a presentation choice. Refusing the request is a control.

There is a record of who did what

Sensitive actions are written to an audit log, and the log strips sensitive values before it stores them. This is the same machinery behind the loss-prevention side of the product: a question like "who voided that sale" has an answer that does not depend on anyone's memory.

Your data leaves with you

There is an export button in the app. It produces a zip of your business's data, it is available to anyone on your team with permission to manage the business, and it is rate-limited and logged like any other sensitive action. You press it yourself. You do not email us and wait, and there is no retention period during which we hold your records hostage while you decide.

It is worth asking any vendor you are considering whether they can say the same, because the ones who cannot tend not to raise the subject.

Accounts are rate-limited

Signup and login attempts from a single address are capped per hour. It is a small thing and it is the difference between someone being able to grind at your login page and not.

What we will not claim

Still worried about something

Ask before you buy rather than after. The contact section on the homepage reaches a person, and the answer will be the same shape as this page.

See it against your own stock

Thirty days, no card. We set it up and train whoever stands behind the counter, and you pay nothing until you decide to stay.

Start free Rather talk to a person