What we protect, and what’s still open.
In November 2026 we reviewed the code ourselves, using OWASP ASVS Level 2 as a guide. That’s not an external audit and not a certification. Here’s what we were able to demonstrate and what’s still outstanding.
Your business stays your business
Many businesses share one installation. Their data still has to stay separate.
- Every database query automatically runs with a filter on your own business.
- Test with real IDs from another business: 43 routes checked, no data leak.
- Every route is locked without sign-in unless deliberately released. New public routes get flagged in a test.
- Roles limited to one location only see that location in the back office.
Sign-in and devices
Back office and till have different requirements, and both are protected.
- Passwords with Argon2id, two-factor sign-in (TOTP) for owners and managers.
- New passwords are checked locally against a list of common passwords, with no third-party lookups.
- “Forgot password” by one-time link, valid for 60 minutes; afterwards all sessions end and two-factor sign-in stays on.
- Tills and kiosks are paired with a one-time code and can be revoked.
- Lockout after 5 failed attempts, request limits per IP on sign-in and public routes, per device on till routes.
- Session cookie readable only by the server; renewal detects reused tokens.
Traceable
What happens at the till and in accounts can be proven afterwards.
- Audit log for sign-ins, voids, cash book, exports and changes to users and devices.
- Till journal is append-only, with a hash chain and check function.
- No passwords, PINs or tokens in logs or the audit log.
Input and browser
Outside content enters the system through forms, images and e-invoices.
- Strict Content Security Policy with nonce, security headers on all pages.
- Images are checked by content and re-encoded; SVG uploads are excluded.
- E-invoice import with size limits and protection against manipulated XML.
- Online order prices always come from the server, never from the browser.
Customer data and backups
There are tools in the product for customer data. The templates and retention periods still need a legal review.
- Data export and anonymisation per customer; receipts remain because of retention duties.
- Consents are stored with a version, and reminder emails have a one-click unsubscribe link.
- Scripts for daily encrypted backups and an automatic restore test; live operation is still to come.
- A data processing agreement template exists and still needs checking by a lawyer.
What’s still open
These points are on our list before the pilot starts.
- There hasn’t been an external security audit yet.
- The hosting provider for live operation hasn’t been chosen yet.
- The real TSE, S-POS, Adyen and Mollie haven’t been tested against the real services, and the first pilot is still to come.
- Operation is tested with one server instance. Rate limits and real-time updates can run via Redis, but several instances in live operation haven’t been tried yet.
- Roles limited to one location still see the audit log and journal check for the whole business.
Want to know more?
Ask us about the detailed review results in a conversation.