Security
Security, in plain words.
Amyn is in development. This page says what protects you here today, how the dashboard is built, and how to tell us about a problem.
Nothing loads that we did not write.
- This site and the dashboard are served over HTTPS only, the padlock in your browser. Browsers are told to refuse any other connection to amynpos.com.
- Strict browser security headers set what a page may load and where it may appear. No other site can show our pages inside its own. The only scripts, styles and fonts that run are our own.
- We load no code from other companies: no tag managers, no session recording.
- This site contacts only our own backend and, later, our help assistant. The privacy notice names both.
- The demo register runs entirely in your browser. It sends nothing to us.
Your business, in its own lane.
Your data is stored with a major cloud database provider in the United States. Every record carries the business it belongs to, and the database itself refuses to show it to anyone outside that business. This is a rule inside the database, not a filter in the app. A mistake in one screen cannot leak one business to another.
Within your business, people see what their role allows. A cashier does not see payouts. A bookkeeper can read but not change.
We don’t sell your data. No ad trackers, no analytics scripts from other companies, no training AI on your data.
Card data is designed to stay off our servers.
When a customer taps, inserts or swipes, the card data goes from the card reader to the payment processor. Our design keeps it off Amyn’s servers and keeps full card numbers out of our systems. We will confirm the exact flow when the processor is chosen.
PCI DSS is the card industry’s security standard for anyone who handles card data. The processor holds the card data. The split of PCI duties between the processor, Amyn and you depends on the final integration, and we will publish it before enabling payments.
Amyn keeps only what is needed to find a sale and refund it. That means the amount, the time, the card type, the last four digits and the processor’s reference.
Two steps for the people who can move money.
Owner and admin accounts require two-step sign-in with an authenticator app. That is a phone app that shows a fresh code for each sign-in. A stolen password alone does not open your account.
Every sensitive action asks for the code again: changing bank details, adding an owner, changing roles, exporting the change log, large refunds. Someone who finds a screen left open cannot do these without the phone.
Owners can require two-step sign-in for managers and bookkeepers as well. Every sign-in, failed code and password reset shows in your login activity.
A record you can read.
Every change in your account is written to a log: who made it, what changed, and when. Prices, menus, roles, refunds, devices and settings all appear there. Owners can read the log in the dashboard and export it.
Published menus are kept as versions. You can see what changed in each version and go back to an earlier one.
Found something? Tell us.
If you find a security problem, email info@amynpos.com. Say what you found and how to repeat it. We read every report and reply from a real inbox.
Our security contact is also published in the standard place.
Please stay within your own account and do not run heavy automated scans against the live site. If you reach data that is not yours, stop and tell us.
What we will publish before launch.
- Security testing of the site, the dashboard and the connection from your registers, completed before launch.
- The name of every service that handles your data, including the payment processor, in the privacy notice.
- Each policy with its version and the date it took effect.
We hold no security certification today and claim none. If that changes, it will be listed here.
Questions about any of this?
Email info@amynpos.com, or write to us through the contact form. A person answers.