Security & your data
How Zero POS looks after your shop’s data
Your sales, your customers’ details and your team’s hours and pay all live in Zero POS. This page explains, in plain words, what protects them. Every point describes what the product does today and, where there is one, the screen where you can see it.
Signing in
Easy for your team to get in, hard for anyone else
Nobody should have to type a password at the counter, and nobody should be able to guess their way in.
Face ID or Touch ID instead of a password
Anyone on the team can save a passkey on their phone, tablet or computer, then sign in with Face ID, Touch ID or the device’s screen lock. A passkey only works on Zero POS’s own address, so a look-alike website can’t use it. Zero POS never receives a face or a fingerprint: it keeps only a public key, which can’t sign anyone in on its own.
In the appMy profile → Passkeys
Read the guidePasswords are never kept as typed
Zero POS keeps only a scrambled, one-way version of each password (a bcrypt hash), so nobody, Zero POS included, can read a password back. New passwords need at least eight characters, and the ones attackers try first, like “password123”, are refused.
Guessing is slowed right down
After a few wrong passwords in a short time, signing in to that account is paused for a while, even when the guesses come from different places. Passkey sign-ins and password-reset emails have limits of their own too.
Signed in on your own devices, safely
A seller’s phone or tablet stays signed in, so nobody types a password in front of customers. The session is kept in a cookie that is only ever sent over an encrypted connection (HTTPS). Browsers are also told to reach Zero POS over HTTPS only, and to remember that for a year.
A lost phone, or someone leaving
“Sign out of all devices” ends every session on every device at once. When someone leaves the team, use Deactivate: their account stops working on every device straight away, and their sales history stays on the books. A password change also signs that account out of its other devices.
In the appMy profile → Sign out of all devices · Users → Deactivate
Inside your workspace
Each business apart, each person in their place
Your shop’s records stay in your workspace, and inside it each person sees and does only what their role allows.
Each business is kept apart
All workspaces share one database, and every record in it is marked with the workspace it belongs to. Whenever Zero POS looks something up for you, it adds your workspace to the question automatically. A lookup that forgets its workspace is refused with an error instead of being answered.
Opening today’s sales, behind the scenes You ask for
today’s sales
Zero POS adds
in your workspace only
You get
your sales, nobody else’s
No workspace?
refused with an error
Permissions by role
Everyone has a role: owner, administrator, manager, seller and a few more. Each role has its own list of what it may do, from refunding a sale to seeing cost prices, exporting customers or seeing other people’s pay, and the owner decides which are switched on. A person can also be kept to certain shops. The checks run on Zero POS’s servers, so a hidden button is never the only lock.
In the appSettings → Permissions
Read the guideA record of who did what
Zero POS keeps an activity history of the changes that matter, such as sales and refunds, stock, money, customers, staff and settings: who made each change, and when. Nobody can edit it or delete it from inside the app.
In the appActivity history
Zero POS support
When we help, it’s on the record
Sometimes the quickest way to help is to look at your workspace. This is exactly how that works.
How support can get into your workspace
The owner can let Zero POS support work in the workspace for 24 hours, 7 days or 30 days, and take that back at any time. Without that permission, a support session can look but can’t change anything, and new workspaces start without it. The one exception is an override our team has to confirm on purpose, and it is recorded like everything else support does.
In the appSettings → Workspace & data
Every visit shows up in your own history
Each time support opens your workspace, the visit is written into your activity history, and anything recorded during it is marked as done by support. The owner can list every visit on a screen of its own.
In the appActivity history → Support access
A second factor for our own team
Zero POS’s own staff console asks for a second factor, a passkey or an authenticator app, before anyone can open, download or close a workspace, or send someone a password reset. It has to have been proved within the last few minutes, on that same device.
Your data
Your records, and your way out
What your shop keeps in Zero POS belongs to your shop. Card numbers never reach it at all, and you can take everything else with you whenever you like.
Card numbers never reach Zero POS
Card payments are taken on your shop’s own card machine. Zero POS only records that the customer paid by card, and how much. It never sees, asks for or stores a card number.
Take everything with you, any time
The owner can download the whole workspace whenever they like, as one zip file: every sale, customer, product and setting, and the activity history, in a standard format (JSON) that other software can read. Passwords and passkeys are left out. Reports and customer lists also export as spreadsheets (CSV) for your accountant.
In the appSettings → Workspace & data → Download my data
If you close your workspace
Inside your workspace, only the owner can close it, and nothing is erased on the spot. It is closed and scheduled for deletion 30 days later. Until then it stays intact, you can still download everything, and one tap brings it all back.
In the appSettings → Workspace & data → Cancel workspace
The legal side
The documents behind this page
The privacy policy explains what personal data Zero POS handles, and why. The data processing agreement is the contract that covers the personal data your shop keeps in Zero POS: your customers’ and your team’s.
See it all in your own workspace
Passkeys, permissions, the activity history and the download button are all there from the first day.
Free during early access · no card needed
Questions about security? Write to us
Already use Zero POS? Sign in