Security and Protecting Your System¶
Securing your system isn't a luxury — it's what protects your money and your restaurant's data. These steps take a few minutes and make a big difference.
1. Change all default codes before first use¶
As soon as you receive the system, change every code that came to you as a default: - The admin code (access to the management dashboard). - The screen codes (the admin screen and the Kitchen Display System). - Staff PINs (each person has their own PIN).
⚠️ Warning: Any default code left as-is = an open door for anyone. Change them all from Settings → Security before you start real work.
2. Each staff member has their own PIN — don't share the admin code¶
Every staff member logs in with their own personal PIN, so the system knows who performed each action. The admin code is a shared secret that unlocks everything without identifying who's logging in — use it only for the owner/manager, and don't write it on a piece of paper next to the cashier.
3. Lockout after wrong attempts¶
If someone tries to guess a wrong code too many times, the system locks automatically:
| Location | Wrong attempts | Lockout duration |
|---|---|---|
| Staff PIN | 8 attempts | 15 minutes |
| Screen code | 8 attempts | 15 minutes |
The correct code clears the counter immediately. This stops guessing attempts even if the login device is changed.
4. Manager approval for sensitive actions¶
Risky actions — void/comp an item and canceling an order — require manager approval. The staff member who isn't authorized asks the manager to enter their PIN, which generates an approval token: - Valid for 3 minutes only. - One-time use and tied to the same order it was approved for — it can't be reused on another order.
🔒 Security: The approval is logged in the name of the manager who approved it, so you have a clear trail for every sensitive action.
5. Suspend a staff member as soon as they leave¶
Any staff member who has left the job, suspend or delete them immediately from staff management. The system blocks any suspended or deleted account from logging in to any app (cashier/waiter/driver) right away.
6. Admin-code login alert¶
Every time someone logs in with the shared admin code, the system logs an alert in the notification center. If you see a login you don't recognize, change the admin code and rely on personal logins.
7. Review the loss-prevention report periodically¶
Open the voids/exceptions report periodically and see who performed the voids/comps and who approved them. This reveals any unusual pattern early, before it grows.
💡 Tip: Card payment (QNB/MPGS) is still experimental for now — don't rely on it for real operations until it's officially enabled.
Next: Customer privacy