Data & Security — ThriftFlowPOS

Last updated: July 13, 2026

This page is the plain-English version of how ThriftFlow protects the information in your store — written so a store owner, not just an engineer, can tell what's actually done.

Card data: out of scope by design

The single most sensitive thing in retail — the customer's card number — never enters ThriftFlow. In-store, the card is read by the physical terminal and authorized directly with the processor. Online, payment happens on the provider's own hosted page. ThriftFlow only ever learns "approved" or "declined" and the last four digits on the receipt. This keeps your card-security burden as small as it can be.

Each store is walled off

Every store runs in its own separate database. One store can't see another's data, and a problem in one never reaches the others. Our own support staff get least-privilege access, per-store passwords, and every time support signs into a store it's recorded in an access log the store can read.

Sensitive settings are protected

Refunds and price overrides require a manager PIN, and that check is enforced on the server — it can't be bypassed from a web console.
Payment-terminal credentials are encrypted where they're stored, so a stolen backup file can't be used to charge cards.
A card sale with an unknown outcome (say the terminal lost power mid-transaction) is fenced so it can't be silently charged twice.

Your data is backed up — and provably restorable

Every store database is backed up nightly, encrypted, and copied off the main server. Restoring a store has been rehearsed end-to-end: a store comes back in about thirteen seconds from a backup. Backups are useless if they don't restore, so we test that they do.

Donor and shopper privacy tools

Because stores hold donor and shopper information, ThriftFlow ships the controls a store needs to be a good custodian: export a person's data, erase it on request, and set how long records are kept before they age out automatically.

The server itself

Only the web and secure-shell ports are open to the internet; the database is never exposed. The system watches its own health — disk, memory, database load, and backup freshness — and raises a flag before a small problem becomes an outage. A weekly automated audit re-checks that every screen, report, and permission still works.

Reporting a concern

Found something that looks wrong, or have a security question? Email bmanderson22@gmail.com and we'll respond quickly.