The system where the money comes in needs more than a username and a password
Granular permissions, an audit trail, atomic operations and data that cannot be rewritten.
Seventy-four permissions, not five roles
“Manager”, “cashier” and “server” is what almost the whole market offers, and it is not enough. A captain may need to apply a discount but not void a payment. A night auditor may need to see every shift close without touching any of them. An outside accountant may need the reports without seeing a single guest record.
In Inn every sensitive operation has its own permission, grouped by area: cash, receivables, catalog, reservations, staff, settings and reports. They are assigned per person and per property, and the server verifies them on every operation. It is not a screen that hides buttons: it is a lock on the server side, which is the only place where a lock works. Hiding a button stops nobody who knows what they are doing.
The permissions a restaurant should always keep separate
What happens on the server side
Every movement has an author
Who, what, when and why. Voiding requires a reason. Adjusting a corporate account requires a reason, and that reason shows on the statement the customer sees. Nothing is deleted: it is voided, and the void is written next to what it voided. A record that can be deleted without a trace is not an auditable record, it is a version of events.
- Author, timestamp and reason on every sensitive operation
- Voiding requires a reason and stays next to what it voided
- The adjustment reason shows on the customer’s statement
Operations that never stop halfway
Charging and closing a check is one indivisible operation: either both things happen or neither does. There is never an in-between state where the payment is recorded and the check is still open, which is exactly where double charges are born. And if the server taps the button twice because the network was slow, the second tap does not charge again.
- Charging and closing is one operation
- No in-between state where double charges are born
- The second tap does not charge again
Prices are set by the server
The server’s device never decides how much something costs. It sends what was ordered; the server calculates price, tax and total. It is the difference between a system that can be manipulated from a tablet and one that cannot. It is worth asking any vendor you are evaluating.
- The tablet sends what was ordered, not what it costs
- Price, tax and total are calculated on the server
Isolation between properties
Every query verifies which property the record belongs to and which property the person asking has access to. It is not a screen separation: it is a check on every read and on every write.
- A check on every read and on every write
- Permissions per person and per property
Supply chain
No server at your site to patch. Continuous updates, with no maintenance window. Continuous backup. And an internal dependency policy with a quarantine period and vulnerability review before any third-party component comes in: most of the serious incidents of recent years came in that way, not through the front door.
- No server at your property to patch
- Continuous updates and continuous backup
- Quarantine and vulnerability review for every third-party component
Privacy
Your data is yours. Exportable whenever you want, in an open format. It is not sold, not shared with third parties and not used to train models. Your guests’ personal data is handled under the principle of least necessary: whoever does not need to see it does not see it, even if they work for you.
- Exportable whenever you want, in an open format
- Not sold, not shared, not used to train models
- Least necessary for your guests’ data
Frequently asked questions
Where does my data live?
In managed infrastructure, with continuous backup and no equipment at your properties.
Can I revoke someone’s access immediately?
Yes, and it takes effect on their next action, not the next day.
Can I see who did what?
Yes, with author, timestamp and reason.
Do you store card data?
No. A card payment is recorded as a method, not as a number.
Can I request a completed security questionnaire?
Yes. Ask for it in writing and we deliver it completed.
Your restaurant already sells. Your system just does not know it.
Fifteen minutes, with your menu and your tables. Nothing to install.