Data and Security
Hyvä POS is in closed beta
Hyvä POS is currently in a closed beta (pilot phase) with a small group of merchants. It is not yet generally available: the App Store release follows the pilot, and features and configuration may still change - possibly in backwards-incompatible ways - before the general release. Want to take part? Sign up at hyva.io/pos.
What lives on the device, how it is protected, and what happens when a device is lost or replaced.
What Is Stored Where
| Data | Where | Protection |
|---|---|---|
| Store configuration (URLs, settings, catalog cache) | App storage on the device | iOS data protection (encrypted at rest) |
| API tokens, OAuth secrets, Mollie API keys, fiscal signing credentials | iOS Keychain | Keychain encryption; secrets are deliberately kept out of the configuration file |
| Admin credentials (stay-signed-in) | iOS Keychain | Device-only: excluded from backups and device transfers |
| Staff PIN verification data | iOS Keychain | Stored as salted, slow hashes (never the PIN itself); device-only |
| Receipts and sales | Encrypted files on the device, grouped per month | iOS data protection; readable after first unlock so background sync works |
| Terminal identity (PRO) | iOS Keychain | Device-only by design: a cloned or restored device gets a new identity |
Passwords and PINs are never stored in plain text anywhere. Staff PINs are verified server-side against a strong hash when online and against a locally cached salted hash (computed with a deliberately slow algorithm) when offline, with constant-time comparison. Wrong-PIN lockouts are enforced server-side, and offline mode cannot be used to bypass them.
Network Security
All traffic is HTTPS, enforced by iOS itself; the app performs no plain-HTTP requests. OAuth-authenticated stores get signed requests on top, which prevents request tampering and replay. API sessions are ephemeral: no cookies, no shared browser state.
Where Receipts Live, and How They Recover
Receipts are the register's record of truth (local receipts), so their storage deserves precision:
- On the device: every receipt is written to encrypted storage the moment the sale completes, immutable from then on.
- In Magento: every sale also produces a Magento order, on both tiers. On PRO, the receipt itself syncs to Magento as well, creating a central, immutable receipt archive.
Recovery follows from that:
| Scenario | Free tier | PRO |
|---|---|---|
| App deleted / device wiped | Receipts on the device are gone; the Magento orders remain your record | Receipts are all in the central archive; nothing is lost |
| Device lost or stolen | Same as above; revoke the store's API token in Magento to cut access | Same, plus deactivate the terminal in the admin: the device locks on its next heartbeat |
| Device replaced | Reconnect the store on the new device and re-authenticate | Re-activate the terminal on the new device; history is in the archive |
Run PRO where receipts are legally material
In fiscal-compliance countries, and anywhere receipts must survive hardware, the PRO receipt archive is the difference between "the device is the record" and "Magento is the record."
Device Backups and Migration
iOS backups and device-to-device migration transfer the app's configuration and data files, but deliberately not the secrets: keychain items marked device-only (credentials, PIN caches, the terminal identity) never leave the original device. A migrated or restored device therefore asks you to re-authenticate the store, and on PRO it presents itself as new hardware that needs its own terminal activation. That is intentional: a backup of your iPad must not be able to impersonate your register.