Books added to, never edited
Each entry carries a fingerprint of the one before it. The database refuses updates and deletes, and an altered amount, a changed name or a missing entry in the middle is caught by the check.
Today · in trialsSecurity & trust
Built so changes show, and honest about the limits.
We say “tamper-evident”, not “tamper-proof”. Below is what is built, then what is not.
The books file is encrypted on the PC
The books are a local file on the shop PC, encrypted at rest. A test checks that no readable text is left on disk, and that this check can fail.
Today · in trialsEverything that leaves the shop is logged
Each outgoing call to a connected service is written to a hash-chained log the owner can read. The path is kept; the request body, headers and query are not. Connection keys are locked to the PC.
Mechanism builtMoney is whole paise
No decimals in any money path, so totals cannot drift. An amount that cannot be read is refused, and never becomes zero.
Today · in trialsChecked every night
Each closed day is re-checked against the books, and a robot plays a full café day on a throwaway copy of the till and reads the result from the books, not the screen.
TodayPeople, rights and PINs
What a person may do is set by role. Differences at day-end and corrections need a reason and a PIN.
Today · in trialsSecurity & trust
Books that can't be quietly edited.
Financial facts are append-only and hash-chained. A correction is a new entry that points at the old one; the history stays. If an old entry is changed, the chain breaks and the check says so.
The entries above are an illustration, not real data.
Known limits
What we do not claim.
| Limit | Where it stands |
|---|---|
| Removing the most recent entries is not caught by the chain check alone | A known limit. Other checks cover it: invoice numbers must run without a gap, the live books must be present, and backups. An off-site copy is Planned |
| Insights uses an external AI service | To word an answer, your question and the figures it looked up are sent to that service. We do not say your data stays on the PC for Insights. |
| Sign-in from outside the shop, phone approvals, cloud copy | Planned Designed, not built. |
| Independent security audit | Not done yet. Sorto is pre-launch. |
| Privacy rights and removal of a customer's number | Our Privacy Policy and data retention page are drafts. A removal design for records that are never edited is In progress |
Found something that looks wrong? Write to hello@getsorto.in.
Ask us anything about how the books are kept.
We will show the checks and tell you which parts are still being built.