Security
Your sales data, treated like money
Plain answers to the questions your IT person, or your accountant, will ask before trusting a POS with the numbers your business runs on.
Your own database
Not a shared table with your name in a column. Every business gets a separate database, and if a request cannot prove which business it belongs to, it does not run at all: the isolation fails closed.
Encrypted in both places
Traffic between your tills and our cloud is encrypted in transit, and your data is encrypted where it's stored. Nobody reads your numbers on the way past, including us.
Access control at the till
Role-based permissions decide who can discount, refund, or void; staff sign in with device-bound PINs; and sensitive actions land in an audit trail with who-did-what detail.
Filters can't go fishing
Search and filter requests are checked against an allowlist of fields you're actually allowed to query. An unrecognized field is rejected, not quietly answered, so nobody can probe for data that isn't theirs.
Till seats are counted properly
Your device limit holds even when several tills try to register at the exact same moment. We test for that exact race, because a limit that leaks under load isn't a limit.
Offline data stays put
Sales captured during an outage live on your own device until they sync. They never sit in a third party's queue, and the reconciliation into the cloud is traceable afterwards.
Personal information, handled under South African law
We process personal information under POPIA. You can see what we hold, correct it, or ask us to delete it, and our privacy policy says exactly what we collect and why.
- Your customers' details are yours, not ours to trade
- Access, correction and deletion on request
- Cancel whenever, and export your data for 30 days after you leave
For how we handle personal information, see the Privacy Policy (including your POPIA rights).
What we are not
We are an early-stage company. We do not hold SOC 2 or ISO 27001 certification, and we will not pretend otherwise or hide it in a footnote. We also do not publish an uptime guarantee, because we would only be inventing a number.
What we will do instead is walk you through our actual security posture in as much detail as you want, engineer to engineer. Bring your IT person and ask hard questions.
Questions, concerns, or a responsible disclosure? Email info@abosto.com and it will reach the people who wrote the code.
Checks that run before anything reaches you
Contract gate
A test suite runs against a real, assembled stack and blocks a merge if any app's responses drift from the shared contract. Nothing ships on the assumption that it still fits.
Fails closed
Where something could be ambiguous, which business a record belongs to, whether a limit has been reached, the system stops instead of proceeding on a guess.
Typed on the way in
Values are checked against their field's declared type when they're saved. It sounds small; it's the difference between a report you can trust and one that's silently wrong.
Bring your hardest question.
We'll answer it properly, and tell you when the answer is "not yet".