Security log (who did what)

In the back office → Security log you see what happened, when, by whom, on what and from which IP address. Only the owner sees it. Times are in the store's time zone (Store details → Language & time). With the Action filter you see one kind of entry at a time.

What is logged

• Till: manager approvals (removing a sent item, cancelling a bill, giving money back, a discount or cash out above the limit), with who asked and who approved. See Cashier limits and manager approval.
• Card or IRIS outside the terminal: every payment recorded without the terminal while there is one, with the amount and who allowed it.
• Terminal: a card charged but not booked, a card overcharged, and a card that went through just after the cancel (it is booked by itself).
• Wrong PINs: one person locked, and when PIN entry stops for the whole store. See Staff and PINs.
• Drawer and availability: opening the drawer without a sale, "sold out" and "back on sale" from the till, pausing and resuming online orders.
• Till without internet: paid sales kept as they were charged on the device (e.g. an item sold out in the meantime, or a discount above the limit). See The till without internet.
• Devices and access: approving and revoking POS devices, phone sign-in links for staff, a user's role changed, a password set by someone else, API keys, accountant access, and when the partner or support signs in "as" the store.
• Money and subscription: the card payment account changed (online ordering), add-ons you switched on or off on Subscription, and erasing a customer.

For keys and IBANs only the fact that they changed is logged (the IBAN masked, e.g. GR16 •••• 1234), never the keys themselves.

Settings for the owner only: Receipts setup, Card terminals, the card payment account in Online ordering and your own SMTP account for newsletters. Managers don't see or change them.

For unusually many voids, refunds and discounts per staff member see Alerts for voids, refunds and discounts.