Security and PDPA: who can see what, and a record of what changed

Why does a till need to care about PDPA?

Because a till is full of personal data. Customer names, phone numbers, company tax IDs, room numbers, signatures, staff records, payroll and commission. Thailand’s Personal Data Protection Act (PDPA) makes the business responsible for who can see that data and what happens to it. beevity is built so that the safe way is also the default way.

How does two-factor login work?

Two-factor login in beevity uses an authenticator app such as Google Authenticator, Microsoft Authenticator or 1Password. After the password or PIN, the app shows a 6-digit code that changes every 30 seconds. Each code is accepted once and never again.

• Setup takes a minute: scan a QR code, type the first code, save the 8 recovery codes.
• Remembered devices let a till skip the code for a set number of days, so shift changes stay quick. They can be revoked.
• A lost phone is solved by a manager, who resets the person’s two-factor setup; the next login enrols again.
• Secrets are encrypted at rest. Recovery codes and device tokens are stored only as hashes.

Five wrong attempts lock the account for 15 minutes, for passwords, PINs and codes alike.

How are permissions enforced?

Each role has a list of permissions, and the server checks them whenever a request comes in. Hiding a button in the app is a convenience; the lock is on the server. A few rules cannot be configured away:

• Nobody approves or pays out their own commission.
• A role cannot change a role above its own level, and nobody changes their own role.
• Money actions above a role’s limit need someone senior.
• Staff never see another person’s commission and cannot open reports.

What does the audit log record?

About 60 kinds of action, among them sales, line voids with approver and reason, refunds, price and credit overrides, payments, splits and merges, commission approvals and payouts, shift openings and closings, stock adjustments, settings changes, role and permission changes, PIN and password changes, and each login, successful or not.

beevity has no function to edit or delete an entry. The log can be searched by person, action, date and text.

Which PDPA tools are built in?

For staff:

• Consent for personal data, photos and marketing, each with version and date, and a printable consent form.
• Requests for access, correction, portability and deletion, tracked with a status.
• Export of a person’s data, without passwords, PINs or two-factor secrets.
• Deletion as anonymisation: names and contact details removed, credentials and two-factor wiped, remembered devices revoked.

For guests (from 1 December): a privacy consent when a guest is created, health consent for the intake form, export of everything stored about a guest, and erasure that removes the person but keeps the sales and tax records. See customer records.

What does security monitoring do?

beevity watches for patterns that point to a stolen login or a data leak: many failed sign-ins, one account opening hundreds of customer records, unusual exports, attempts to read another business’s data. Depending on the pattern it locks the account, signs it out or pauses exports, on its own and within seconds. The owner sees what happened on the security page and can undo the step in one tap. The security log itself is chained, so a changed or deleted entry would show.

We do not publish the exact rules and thresholds.

How is beevity developed?

Under ISO/IEC 29110, the international software-process standard for small development teams: every change is planned, recorded and tested before release. The certification audit was passed on 30 October 2026; the certificate is pending. Before a release, several hundred automated checks run against sales, commission, voids, two-factor login and PDPA exports.