Built to see receipts, not card numbers.

What we process

From your POS: payment and refund events at receipt level — amount, currency, line items, tender type, till (device) and location identifiers, and timestamps. From Verkada: the list of cameras in your organization and the Helix event types you create.

What we never process

• Primary account numbers, card expiry, CVV or any PCI cardholder data — these never leave your processor.
• Video. safetill posts metadata to Helix; footage stays in Verkada Command.
• Customer identities beyond what your POS already prints on a receipt.

Credentials

Verkada API keys and POS OAuth tokens are encrypted with AES-256-GCM before they are stored. The encryption key is kept in a managed secret store and is only available to the running service. Verkada short-lived tokens are cached in memory and reissued automatically.

Tenant isolation

Every workspace is a separate tenant in a safe and secure database, with isolation enforced by the database itself rather than by application code. One workspace can never read or write another workspace's data.

Webhooks and APIs

• Square and Stripe webhooks are verified against their signing secrets and de-duplicated before processing.
• Public endpoints are rate-limited; all traffic is HTTPS with HSTS.
• POS scopes are read-only: payments, refunds, devices and locations. safetill writes nothing to your POS.

Infrastructure

safetill runs on Google Cloud and is hosted in the United States for now. Authentication is provided by Clerk; billing by Stripe. We hold no payment card data of our own customers either.

Your controls

• Disconnect Verkada or your POS at any time; stored credentials are deleted immediately.
• Delete a workspace and all of its connections, mappings and event history are removed.
• Export the full transaction and delivery log as CSV whenever you like.

Reporting a vulnerability

Please email the support address shown in the app with details and we will acknowledge within two business days.