On-premise by design
Two installers, one Windows service, no containers, no subscription in the path of a sale.
The server installer brings the .NET runtime, PostgreSQL, the service, the portal, the migrations, a protected secret store and the backup task. The register installer brings the lane application, the drivers helper and the enrolment wizard. Both are built, versioned and listed in release notes with every delivery.
DELIVERY
Serverone installer, one Windows service
DatabasePostgreSQL 16, bundled
Registerinstaller or MSIX, APK, iOS
Containersnone
Internet at the tilloptional, sync only
Topology
Registers at the stores, one server you control, your SAP Business One.
STORES · ANY NUMBER
Windows laneOwn SQLite database, durable outbox, printer, drawer, scanner, terminal
Android handheld · iPadSame application, same database model, phone layouts
Kitchen display · kioskA device mode of the register, no seat for a KDS
Store hub (optional)The server binary in store mode: shared tables, held tickets and kitchen orders when the WAN is down
CENTRAL SERVER · YOURS
One Windows serviceAPI, portal, workers, posting engine, SignalR hubs, health endpoints
PostgreSQL 16Installed by the installer as a service; row-level security per tenant; scheduled backups
HTTPS, own certificatePinned by every register; TLS required; security headers; rate limits
WhereYour server room, a VM in your data centre, a CERTICONS-hosted VM or a cloud VM. The registers need only its address.
SAP BUSINESS ONE 10
Service LayerEvery read and write, HANA or SQL Server; sessions pooled per company; never the DI API, never the company schema
DocumentsA/R invoices, incoming and outgoing payments, credit memos, journals, inventory documents, sales orders, deliveries
Fields provisioned by the portalUser-defined fields and tables added once; existing definitions are never changed
Connect Agent (optional)The server binary in agent mode next to SAP, outbound only, when the server cannot reach the Service Layer
Lines between the boxes are HTTPS. Registers never talk to SAP; SAP never talks to registers. Only the server holds the SAP credentials, protected by DPAPI or AES.
From a blank server to a selling lane
An afternoon, by the runbook.
The cut-over runbook names every step and its check. A drill installs, upgrades, repairs and uninstalls both installers on a clean machine before a build is released.
1
Run the server installerIt installs PostgreSQL, provisions the database and roles, issues the certificate, registers the service and the backup task, and opens the firewall rule.
2
Sign in to the portal and connect SAPEnter the Service Layer address, the company and a posting identity. Test the connection, provision the fields, run the first master data sync.
3
Model the organisationCompanies, stores and registers; roles from templates; configuration profiles inherited tenant → company → store → register, with a catalogue describing every setting and SAP account pickers filtered by role.
4
Enrol the registersRun the register installer, scan the enrolment QR from the portal; the device gets its certificate and token, pulls its data and configuration, and sells, online or not.
5
Sign off the hardwarePrinters, drawer, scanner, scale and terminal from the register’s peripherals screen; terminal adapters are enabled per company after the live sign-off.
SERVER REQUIREMENTS
Operating systemWindows Server 2019+ or Windows 10/11
DatabasePostgreSQL 16, bundled
Runtime.NET 10, bundled
SAP Business One10.0, HANA or SQL Server, Service Layer reachable
Sizing[CPU / RAM / DISK PER TIER]
REGISTER REQUIREMENTS
Windows10 or 11, 64-bit, installer or MSIX
Android10+, APK or managed configuration
iPadiOS 15+, Apple Business Manager
Network at the tillOptional. Needed only to sync.
COMMANDS THE SERVICE ANSWERS TOmigrate · provision-db · cert init · check · backup · restore · secrets · B1 field provisioning from the portal
Operating it
Upgrades in place, backups you can restore, registers you can reach.
Upgrade in placeRun the new server installer over the old one; migrations apply on start. Registers receive the build through the update channel with a staged rollout and a checksum, and re-pull their data once per version.
Backups and restoreA scheduled PostgreSQL dump with a tested restore command. Configuration bundles export and import between environments.
Monitoring and alertsHeartbeats with backlog, drawer cash and platform; alerts by e-mail for offline registers, posting failures, exceptions; health endpoints for your monitoring.
Remote actionsForce a sync, lock a register, push a configuration, wipe a lost device with a second administrator’s approval through a device-signed door.
Support bundlesRolling logs on both sides and a bundle from the portal or the register that never contains PINs, tokens, card numbers or secrets.
Integrations without a vendorA public API with keys and scopes, signed webhooks, an OData feed for Power BI, a scheduler, and server extensions and register hooks as plug-ins enabled per company.
Where the server lives is your decision
Three ways to host, one product.
Your premisesNext to SAP Business One in your server room. The Service Layer is on the LAN; registers reach the server over your WAN or VPN.
Your cloud VMA Windows VM you own on any provider. The Connect Agent bridges to SAP on your LAN, outbound only, when the Service Layer is not exposed.
A CERTICONS-hosted VMWe run the Windows VM for you under your name, with the same installers and the same backups. Still your licence, still your data, still one tenant per server.