Your data stays yours — and stays apart.
Many businesses share the POSCountr platform, so we built separation into the database itself. Here is exactly how your data is protected — no vague promises.
- Separated at the database, not just on screen
- Every sensitive action leaves an audit trail
- HTTPS everywhere, backed up every day
How one business is kept from another
A request has to pass all five before it touches a single row — and the last one lives in the database, not in our code.
- 1
Your address
Each business signs in on its own address, which accepts only its own people.
- 2
Your session
Every request carries a signed token naming your business, checked on the server.
- 3
Your role
Owners, managers and kitchen staff reach only the screens and outlets their role allows.
- 4
Your rows
Every query is scoped to your business before it runs; objects are re-checked before any change.
- 5
The database
PostgreSQL row-level security refuses any row that isn’t yours — the last line, even if code above it had a bug.
Eight things we do for every business
Database-level separation
Every business’s rows are fenced off by PostgreSQL row-level security, under four more checks in the application — five layers in all. A query without a business scope sees nothing.
Your own sign-in address
Your team signs in at your-business.poscountr.com, and that address only accepts your people.
PINs for the floor, passwords for owners
Six-digit staff PINs refuse easy patterns and must be changed at first sign-in. Repeated wrong attempts lock that device out, for longer each time.
Sessions you can end instantly
Short-lived sign-in tokens, refresh tokens stored only as hashes and rotated on every use. Signing someone out, blocking them or changing a password ends their sessions at once.
An audit trail
Cancellations, payment-mode changes, Tally exports, book locks and support access are recorded with who, when and why.
Least privilege
Managers see one outlet. Kitchen staff see the kitchen board. Support access to a business is read-only and needs a recorded reason.
Encrypted in transit, backed up daily
HTTPS everywhere with HSTS and a strict content-security policy; the database is backed up every day and restores are tested.
Modules you didn’t buy stay off
A module that isn’t switched on for your business is refused by the server itself, not just hidden in the app.
Security questions
Can another business on POSCountr see my data?
No. Every row of business data carries its business’s identity, and the database itself refuses rows from any other business (PostgreSQL row-level security), on top of four checks in the application.
Can POSCountr staff see my data?
Support can open a business in read-only mode to help you, only with a recorded reason, and every such visit is in the audit log. Support cannot change your sales or settings that way.
What happens if a phone is lost or an employee leaves?
Deactivate the person, or change their PIN or password, and every device they were signed in on is signed out at once.
Do you sell or share my data?
No. Aarvin Ventures never sells your data and uses no advertising trackers. See our Privacy Policy and Data Processing Terms.
How do I report a security issue?
Email sannagiri@aarvinventures.com with the details. We acknowledge reports within 48 hours and ask that you give us reasonable time to fix an issue before disclosing it.
Security at a glance
- Isolation
- PostgreSQL row-level security + 4 application layers
- Sign-in
- Owners: email & password · Staff: Business ID, username & 6-digit PIN
- Sessions
- 60-minute tokens · rotated refresh tokens · instant revoke
- Transport
- HTTPS only, HSTS, strict Content-Security-Policy
- Hosting
- Hetzner Online (servers in Singapore and Germany), delivered through Cloudflare
- Backups
- Daily database backups with tested restores
- Audit
- Cancellations, payment changes, exports, book locks, support access
See POSCountr on your own business.
A 30-minute walkthrough on WhatsApp video or at your counter in Hyderabad. We set you up, import your products and train your team.
Already a customer? Get the app.