Security

Your business data, treated like it matters

Security decisions in ADVATOUCH are structural, not add-ons.

On the tablet

  • Local-first database — your operations keep working without internet.
  • Session tokens stored in encrypted storage on the device.
  • Dedicated-device (kiosk) mode with device administration and remote seat revocation.
  • Signed application updates delivered in-app.

In the cloud

  • All traffic over TLS; short-lived access tokens with rotating refresh.
  • Passwords stored only as salted PBKDF2 hashes.
  • Integration credentials — Meta access tokens and JoFotara keys — encrypted at rest and never sent to your device or browser.
  • Encrypted, schema-validated backups restorable only by your account.

Payments

  • Card payments happen on MEPS's hosted page — card numbers never reach our servers.
  • Offline CliQ / bank transfers activate only after manual verification.

This website

  • Sessions ride in httpOnly cookies — never readable by page scripts.
  • Strict Content-Security-Policy, HSTS, and no third-party trackers.
  • Found a vulnerability? Email [email protected] — we take reports seriously.