Security built into every sign-in
Your SeroPOS account holds sales, customers, supplier balances and staff logins, so the protection starts at sign-in. Two-step verification, device controls, role permissions and an activity log are built in, and card details never leave the terminal.
Two-step verification
A password on its own is easy to steal through a phishing email or a reused password. With two-step verification on, SeroPOS asks for a second check after the password: a code from an authenticator app, a code sent by text message, or a passkey in the web back office. The same account signs in to the app and the back office, so the second step protects both.
Set it up in the back office from your user menu, under Security. For an authenticator app, scan the QR code and type the code it shows. For text messages, confirm your mobile number. For a passkey, follow your device's own prompt. It takes a couple of minutes per person.
- Authenticator app codes
- Text-message codes
- Passkeys in the web back office
- Ten single-use recovery codes
Recovery codes and trusted devices
When you turn on two-step verification you get ten recovery codes. Copy them or print them and keep them away from your phone. Each code works once, so if your phone is lost or replaced you can still sign in, then set up the new phone and regenerate a fresh set, which cancels the old ones.
On a device you use every day, such as the till at the front counter, you can trust it for 30 days so staff are not asked for a code at every sign-in. Signing in anywhere new still asks for the second step, which keeps the counter quick without leaving the account open to anyone with the password.
Every signed-in device, and a way to sign it out
The Security page lists where you are signed in: each device and browser using your account. If you see one you do not recognise, sign it out on its own, or sign out everywhere else in one step and keep only the device in front of you. It is worth checking after a staff member leaves or a tablet goes missing.
When your account signs in on a new device, SeroPOS emails you about it. If it was not you, the Not me link in that email takes you straight to securing the account, so you can act within minutes instead of finding out at month end.
Require two-step verification for everyone
One weak password on the team is enough to expose the business. An administrator can turn on the company rule Require two-step verification for everyone, and every user is then asked to set up a second step before they can carry on. The rule covers managers, cashiers and your accountant alike.
Combine it with trusted devices for shared tills. Staff sign in once on the counter device and keep working, while anyone trying the same login from home or a new phone still meets the second step.
Role permissions on every screen
Every screen in the back office checks permissions, and users can be limited to the locations they work at. Roles decide who can view purchase prices, edit prices or discounts, delete sales, process returns, close the register, see stock value or change settings. You can cap the discount a user may give and limit which customers and suppliers they see.
In the app, roles have separate POS Access and Web Access settings: sales and transactions, checkout buttons such as Clear, Hold and Split, payment types and admin sections. A locked option still shows with a lock badge. Tapping it asks for a manager's password to approve that one action, so a refund can be authorised at the counter without handing out the manager's login.
An activity log you can read
The Activity Log report in the back office records who did what and when: the user, the type of record, the action and a note. Filter it by user, record type and date to see who changed a price, edited a sale or deleted a product. Only administrators can open it.
The till keeps its own trail too. Clearing an order logs a line void, kiosk and kitchen display mode need a manager's credentials to exit, and if you invite an accountant, a separate log shows when they opened your books and which screen they used. Withdrawing an accountant's access takes effect immediately.
Card data stays with your processor
SeroPOS does not ask for, type in or store card numbers. Card payments are taken on your processor's integrated terminal from Global Payments, Moneris or Gravity Payments: the customer taps, inserts or swipes on the terminal, the processor approves the payment, and SeroPOS receives the result and the amount. QR menu and online orders are paid through your own Stripe account.
Keeping card details on the terminal keeps them out of your point of sale, which reduces what you have to protect. Your processor can tell you what it needs from you for card-security compliance. For money safety, an approved card charge is recorded before the sale is saved, and a duplicate-charge guard warns if the same card is charged the same amount twice in a row.
Frequently asked questions
Does SeroPOS store my customers' card numbers?
No. Card payments are taken on your processor's integrated terminal from Global Payments, Moneris or Gravity Payments, and online orders are paid through your own Stripe account. The card is read and approved by the processor, and SeroPOS only receives the result, such as approved or declined, and the amount. Card numbers are never typed into or stored by the app.
What happens if I lose the phone I use for two-step verification?
Sign in with one of your ten recovery codes. Each one works once. Then open Security in the back office, set up two-step verification on your new phone and regenerate your recovery codes, which cancels the old set. If you also want to be sure the lost phone is locked out, sign out every other device from the same page.
Can I make two-step verification compulsory for my staff?
Yes. An administrator can switch on the company rule Require two-step verification for everyone. From then on, each user is asked to set up an authenticator app, text-message codes or a passkey before they can carry on. Trusting a shared till for 30 days keeps sign-in at the counter quick while new devices still need the second step.
How do I stop a cashier from giving refunds or big discounts?
Give them a role without the refund permission and set a maximum discount on their user. In the app, the refund option then shows a lock, and tapping it asks for a manager's password to approve that one refund. The same works for price overrides, editing completed sales and opening admin screens, so managers approve exceptions without sharing their login.
Does SeroPOS have a SOC 2 report or similar certification?
Not today. We do not hold a SOC 2 report or a similar third-party attestation, and we will not claim one until we do. It is on our roadmap. What we can describe is what is built into the product: two-step verification, device sign-out, role permissions, an activity log and card payments that stay on your processor's terminal.