Engineered to be trusted
Business software handles your money and your records. Here is how we build it so that the numbers are right, the data is protected and the system can be maintained for years.
What we will not compromise on
History is never rewritten
Stock movements, audit entries, price changes and salary history are append-only, and the database itself blocks edits and deletes. Corrections are new entries, not overwrites.
Permissions on the server
Hiding a button is not security. Every action is checked against the user's role on the server, so typing a URL or calling the API directly gets the same answer: not allowed.
Money is exact
Amounts are stored as exact decimals, never floating point. Totals reconcile to the cent, and every report type is cross-checked to give identical totals.
Safe under real concurrency
Two tills selling the last item at the same moment is tested with real parallel processes, not assumed. Row-level locks make sure only one succeeds.
Everything leaves a trail
Sign-ins, sales, voids, refunds, price and permission changes are recorded with who, what and when, and visible to the owner.
Sensitive data is need-to-know
Cost prices, profit, salaries and personal documents are visible only to roles that need them, and never leak into list screens or logs.
Protection at every layer
Accounts & sign-in
- Passwords stored only as salted, slow hashes, never in plain text
- Account lockout and rate limiting against guessing
- Two-factor authentication on our enterprise platform
- Forced password change for admin-issued temporary passwords
- Idle sessions end automatically
- Login activity view showing who signed in, from where and when
Application & data
- CSRF protection on every state-changing request
- Prepared statements everywhere, to prevent SQL injection
- Output escaping and strict content-security policies
- Exports neutralise spreadsheet formula injection
- Database roles with only the privileges they need
- Encrypted backups with a rehearsed, verified restore
We run a security review before any system goes live and fix what it finds. We will also tell you plainly where a design has limits, for example where an offline-first app trades some server-side control for working without internet.
How we know it works
| Practice | What it means for you |
|---|---|
| Automated tests | Our larger systems carry hundreds of tests covering sales, costing, permissions and reports. Each change is re-tested before release. |
| Real-browser testing | We drive the actual screens, as a cashier would, to catch the bugs that code review cannot see. |
| Independent cross-checks | Report totals are compared against hand-written database queries, so two methods must agree. |
| Test on a copy first | Risky changes are rehearsed on a scratch copy of your database. Backups are taken before any schema change. |
| Data audits | Stock, bills, cash sessions and numbering are audited for gaps and mismatches, with results documented. |
Modern, mainstream, maintainable
We choose widely used tools, so you are never locked in to something only we can maintain. You own your data, and we can host it on your own server, your own network or a cloud provider you choose.
Ask us anything
If your business has specific compliance or data requirements, tell us up front and we'll design for them.