Permissions, records and encryption come first.
The till, guest details and staff records live in one system. Here we explain who can see what, which actions leave a trail and how data is protected.
- Card data
- Never enters PergePOS
- PIN
- Stored as a hash, never as itself
- Offline
- Selling continues, nothing is lost
Who sees what?
Account roles work in the web panel, staff roles on a device paired to the branch. One never stands in for the other; everyone sees only the branches and actions they are allowed to.
Account roles
- Owner
- Everything; deleting the business, transferring ownership and cancelling the subscription are theirs alone.
- Business manager
- Everything across all branches except ownership actions.
- Branch manager
- Menu prices, staff, floor plan, stock, cash approval and reports in assigned branches.
- Accountant
- Reports, e-documents, house accounts, invoices and subscription payments; doesn't sell.
- Viewer
- Read-only access to reports.
Staff roles (PIN on the device)
- Cashier
- Orders, payments, limited refunds, shifts, cash drawer and Z report.
- Waiter
- Opens tables, takes orders, sends them to the kitchen; payment rights depend on the branch setting.
- Kitchen
- Preparing, ready and recall on the kitchen display.
- Courier
- Takes delivery orders, marks on the way and delivered, records cash on delivery.
- Head cashier
- Cashier rights plus the approval PIN for voids, large discounts, comps and opening the drawer.
Access and separation
- Every record belongs to a business, and branch data also to a branch; queries run within that scope. A request for another business's record returns not found.
- Panel accounts, paired devices and guest sessions carry separate keys; one session never works for another's actions. Revoking a device in the panel ends its session too.
- Voids, large discounts, comps and opening the drawer ask for the head cashier's approval PIN above a threshold. Each approval is single-use and expires quickly.
- Repeated wrong passwords lock the account for a while, and the response doesn't reveal whether the account exists. Verification codes have an attempt limit.
Records and continuity
- Voids, refunds, comps, discounts, opening the drawer, price changes, Z reports and staff or permission changes are written to the activity history. Frequent voids or large discounts raise a notification.
- When the internet drops, the POS and waiter terminal write transactions to a log on the device and send them in order when the connection returns. Offline transactions are flagged in the panel.
- Every transaction carries an ID generated by the device; the server never applies the same ID twice. Payments and closing go through a conflict check.
Payments and card data
Card data never reaches us
Card payments are taken on the venue's payment device or by the payment institution. Card numbers never enter PergePOS and are never written to records or logs.
We don't collect money from guests
Payment happens on the venue's device or with its contracted payment institution; PergePOS records and documents the result. Payment link results are verified by querying the provider.
Fiscal documents
The check slip is not a fiscal document and says so. Fiscal receipts come from the venue's cash register; e-Archive and e-Invoice go through the private integrator the venue chooses.
Encryption
Encrypted connections
The panel, devices and guest surfaces talk to the server over HTTPS.
Secrets are stored encrypted
Payment institution, integrator and platform keys are encrypted in the database and never returned in lists.
PINs and passwords are hashed
Staff PINs and account passwords are stored as salted hashes, never as themselves. After five wrong PIN attempts the staff member waits a minute.
Personal data
- Guests open the menu with the table code, order and pay; no account or phone number is asked for.
- Loyalty requires phone verification, a privacy notice and explicit consent; marketing permission is asked separately. Guests can ask for their data to be deleted.Guest privacy notice
- Loyalty and customer data belong to the venue; PergePOS is the data processor. The data processing agreement sets out the roles and obligations.Data processing agreement
- For staff we keep name, role and a PIN hash; shift and sales records are kept for the legal retention period.Data protection notice
Frequently asked questions
Does card information pass through PergePOS?
No. Card payments are taken on the venue's payment device or by the payment institution; PergePOS only records the result and the amount.
Can a branch manager see another branch's data?
No. Branch managers see only the branches they are assigned to; reports and the assistant follow the same limit.
Are transactions lost when the internet drops?
No. The POS and waiter terminal write transactions to a log on the device and send them in order once the connection returns; nothing is applied twice.
Can guest data be deleted?
Yes. A guest in the loyalty programme can ask for their data to be deleted; as data controller, the venue handles the request from the panel.
Where do I report a security issue?
Write the details to info@pergepos.com; we'll look into it and get back to you. Please don't share the issue publicly until it is fixed.
Questions? Write to us.
If you have a question about permissions, data or data protection specific to your venue, write to us and we'll look at it together.