Security and compliance
Built to an application security standard, checked by tests that run on every build.
CertiPOS follows the OWASP Application Security Verification Standard at level 2, with the checklist and its named gaps published to customers. The security review is a set of generated tests that probe every endpoint for cross-tenant access, leaked secrets, malformed input and open redirects.
IN SHORT
Tenancyrow-level security on every table
TransportHTTPS, your certificate, pinned
Identitydevice certificates, TOTP, PIN policies
Authorization170+ rights, approvals, journal
Audithash chain, append-only events
The controls
What protects the data, the money and the evidence.
Tenancy and transport
Row-level securityEvery server table carries the tenant and a policy created in the same migration; the database enforces it under a forced role, so no query can cross a company by accident.
HTTPS with your certificateThe server issues or imports its certificate; every register pins its fingerprint from the enrolment QR; TLS can be required for every call; HSTS and security headers are on.
Content Security PolicyThe portal allows no external origin and uses a per-request nonce for scripts; fonts and icons ship inside the server.
Identity
DevicesA register enrols once with a code and receives an X.509 certificate from a per-tenant CA; tokens are short-lived and device-bound; a retired register cannot come back.
PeoplePIN, card or badge sign-in on the register with lockout, history, expiry and length policies; portal sign-in with a password, two-step codes and recovery codes; single login with take-over.
SessionsIdle lock and logout per register, action after posting, training mode, time clock with forced clock-out.
Authorization and audit
Rights, not rolesOver 170 named rights with allow, deny or approval and thresholds; roles with rank; the register shows a tile only when its own right is granted.
ApprovalsBy PIN, card or remotely from a manager’s phone; per action, ticket or session; performer and approver always different; every override journaled with reason, attempted and allowed values.
EvidenceAppend-only ticket events with a per-register hash chain and sequence; configuration change diffs; read audits; a permission journal verified server-side.
Operations
SecretsSAP passwords protected with DPAPI or AES; a protected secrets file; configuration answers, audit rows and support bundles never contain a secret.
Logs and bundlesStructured logs that never contain PINs, tokens, card numbers or secrets; rolling files; support bundles from the portal and the register.
Rate limits and headersSign-in and API rate limits per address, request size limits, security headers, a signed webhook receiver with an SSRF guard.
Fiscal readiness
The foundation for e-invoicing, ready for per-country plug-ins.
Immutable sequenceA per-register sequence and hash chain, invoice types simplified and standard, buyer fields, a QR payload hook.
Fiscal provider contractAn IFiscalProvider plug-in interface with a “none” provider today; country plug-ins for KSA (ZATCA), the UAE (FTA) and Jordan (JoFotara) are planned, not certified.
One document per ticketPer-ticket posting gives each sale its own SAP invoice, which is what the e-invoicing regimes require.