Security
Your takings, your data, protected properly
Tillio is built by a founder with a cyber security background, and it shows in the details. These are the controls in the Tillio POS today. We don't claim certifications we don't hold.
How Tillio keeps each venue safe
A separate database for every venue
Each venue has its own address and its own database. A venue's access code is rejected everywhere else, so one venue can never read or change another's data.
Passcodes checked by the server
Staff passcodes are stored as salted, slow hashes and checked by the server. Shared screens only see staff names and roles.
Roles and manager approval
Staff, Manager and Owner roles. Refunds need a manager's approval that works once, for that refund only. Admin needs a manager or owner.
Sessions and lockouts
Sign-ins expire after a shift-length period, end on sign-out or when someone is blocked, and repeated wrong passcodes trigger a wait.
Paired kitchen screens
Each kitchen screen is paired with a one-time code, limited to its stations, and can be removed instantly.
QR orders can't set their own prices
Phones only send what was chosen. Prices are calculated by the server from your menu. Customer details are kept only if you ask for them, and removed after 90 days.
Card details never touch Tillio
Card payments happen on your terminal or through your own Stripe account. Tillio records the method and amount, never card numbers.
Backups and history
Every venue's database has point-in-time recovery, every refund and void records who did it, and you can export your data at any time.
Where Tillio runs
Tillio runs on Cloudflare's global network. Every connection uses HTTPS. Venue databases are created in Cloudflare's Oceania region, close to Australian venues.
The POS has automated tests covering tenant isolation, price tampering and access control, and they run automatically on every change to the POS code.
Found a security issue? Please email hello@tillio.com.au with the details. We'll respond and keep you informed while we fix it.
Questions about security?
Ask us anything about how Tillio handles your data. We'll answer in plain English.