Reports, audit evidence and security controls
This section explains report filters, exclusions, audit chaining and the module’s principal security controls.
Run the POS sales report
Run the POS sales reportChoose a date range and review the supplied summary.
Open guide →GuideUnderstand the default report period
Understand the default report periodUse the current calendar month in the relevant location timezone.
Open guide →GuideSet the report from and to dates
Set the report from and to datesSubmit valid dates; reversed values are normalised by swapping them.
Open guide →GuideUnderstand report timezone handling
Understand report timezone handlingInterpret date boundaries using the default location timezone.
Open guide →GuideUnderstand sales report exclusions
Understand sales report exclusionsKnow cancelled, void, refunded and returned orders are excluded.
Open guide →GuideReview total sales and collected values
Review total sales and collected valuesCompare order total and captured payment aggregates.
Open guide →GuideReview sales by channel
Review sales by channelCompare POS and e-commerce order totals.
Open guide →GuideReview the top-products report
Review the top-products reportSee up to 20 products by reported sales activity.
Open guide →GuideUnderstand report export limitations
Understand report export limitationsKnow version 1.0.0 exposes on-screen reports but no CSV/PDF export action.
Open guide →GuideTroubleshoot unexpected report totals
Troubleshoot unexpected report totalsCheck date/timezone, status exclusions, channel and payment state.
Open guide →GuideOpen the POS audit register
Open the POS audit registerReview the most recent 200 tenant events.
Open guide →GuideUnderstand tamper-evident audit chaining
Understand tamper-evident audit chainingKnow each event hash incorporates the previous hash and an HMAC key.
Open guide →GuideUnderstand audit tenant isolation
Understand audit tenant isolationKnow event queries and chain predecessors are tenant-scoped.
Open guide →GuideUnderstand audit event actors
Understand audit event actorsDistinguish staff/system actor IDs.
Open guide →GuideUnderstand audit reasons and summaries
Understand audit reasons and summariesUse structured redacted context rather than secrets.
Open guide →GuideUnderstand audit correlation IDs
Understand audit correlation IDsTrace related business events.
Open guide →GuideUnderstand audit-chain verification limitations
Understand audit-chain verification limitationsKnow the supplied UI displays hashes but does not expose a one-click full-chain verifier/export.
Open guide →GuideTroubleshoot a suspected audit inconsistency
Troubleshoot a suspected audit inconsistencyPreserve evidence and perform a controlled technical verification without rewriting rows.
Open guide →GuideUnderstand checkout CSRF and input validation
Understand checkout CSRF and input validationKnow staff/public POST actions use host form/CSRF and server validation.
Open guide →GuideUnderstand public token hashing
Understand public token hashingKnow only a SHA-256 hash is stored for public order access.
Open guide →GuideUnderstand API secret hashing
Understand API secret hashingKnow full API credentials are shown once and only hashes are retained.
Open guide →GuideUnderstand webhook secret encryption
Understand webhook secret encryptionKnow webhook secrets are protected with AES-256-GCM using a generated module key.
Open guide →GuideUnderstand rate-limit records
Understand rate-limit recordsKnow checkout/API windows are tenant-scoped and expired rows are cleaned by cron.
Open guide →GuideUnderstand no-store and security headers
Understand no-store and security headersKnow sensitive public/API responses apply restrictive caching/security behaviour.
Open guide →GuideUnderstand tenant-safe queries
Understand tenant-safe queriesKnow operational reads/writes include the current tenant key.
Open guide →GuideRun the POS security checklist
Run the POS security checklistVerify least privilege, HTTPS, tokens, API scopes, webhook endpoints, SMTP and audit evidence.
Open guide →