Most retail fraud is internal. So is most of our security.
Firewalls are not what protects a shop. The threat is far more often a trusted person making a small change nobody can see. Nostra is built so that every change is signed and nothing financial can be erased.
Access
Nobody gets more than their job needs.
Access is granted by named capability, not by rank. Refunding, selling an expired batch, adjusting stock, opening the drawer, seeing cost prices and exporting the ledger are all separate permissions.
- 199 permissions, each granted or withheld individually
- Branch scope enforced where data is fetched, not where it is shown
- PIN sign-in at the till, with throttling and lockout
- Mail and integration secrets encrypted and never shown back
Audit trail
A record nobody can quietly edit.
The audit log is not a feature you switch on. It is written by the same code that performs the action, in the same database transaction, so an action cannot succeed while its record fails.
- User, branch, till and device on every sensitive action
- Before and after values, so an edit shows what changed
- Overrides and authorisations name who gave them
- Financial records voided, never deleted, with the void itself logged
- Exportable for an accountant or inspector, behind its own permission
Backups and restore
A backup you have never restored is a rumour.
Most businesses discover their backup does not work on the worst day of the year. Nostra treats restore as the feature and backup as the prerequisite, which is why restore is something you can rehearse.
Scheduled and verified
Backups run on a schedule and are checked after they are written. A backup that cannot be read is reported as a failure, not recorded as a success.
Off-site, in storage you control
Copies go to S3-compatible storage under your own credentials and your own bucket. If you ever stop using Nostra, your backups are still somewhere you own.
Downloadable as one archive
Any backup can be pulled down as a single compressed file straight from the browser. No support ticket, no waiting.
Restore that keeps its own paperwork
A restore preserves the backup and restore records themselves, so the history of what was restored and when survives the restore.
Rehearsed, not assumed
A disaster recovery check runs on demand. Better to find a problem on a Tuesday afternoon than during an actual emergency.
Hosting
Hosted by us, or entirely by you.
Some groups want their data physically under their control. That is a legitimate position rather than one we argue with.
Hosted
We run, patch and back it up. You get a URL and staff accounts.
Self-hosted
Installs on ordinary shared hosting or your own server.
In transit and at rest
Served over HTTPS. Passwords hashed. Secrets encrypted with a key held outside the database.
Updates
Every release is tested against the full suite before it reaches a till.
Your data
If you leave, you leave with everything.
Export products, customers, sales, stock movements and the full audit trail in CSV, XLSX or PDF whenever you like. No request form, no fee, no waiting period.