CalcyBill™ Cloud
The counter stays offline. You do not have to be.
Cloud is an addition to the counter, never a dependency of it. A bill commits locally first and the upload happens afterwards, in the background, retried until it lands. Switch the cloud off entirely and the till does not notice.
No separate cloud bill. It is part of the licence, kept running by the same maintenance that covers updates and support.
Bills commit at the counter first
What it gives you
Six things, and none of them is a dependency.
Combined sales, wherever you are
Every branch's takings, recent invoices and per-branch totals on one screen, installable on the phone. It keeps the last good snapshot when the signal drops.
Counters that stopped checking in
A till that has gone quiet shows on the dashboard before anyone rings to say the shop is shut.
Enrolled, not logged in
A counter is enrolled once with a one-time code. Its token is encrypted by Windows itself, and the server keeps only a hash of it.
Identity comes from the token
Every query derives the tenant and the branch from the device token. A client cannot ask for someone else's shop, because it never gets to name one.
A sale can never upload twice
Each event carries a UID unique inside the tenant, so a lost response and a retry are one sale, not two.
Remote billing — owner trial
Billing from a phone against a branch's catalogue exists and works, with its own WEB invoice series and stock that cannot go below zero. It stays an owner-only trial until the conflict queue is visible.
Connecting a counter
Two steps, once per till.
Type the shop's own passphrase once, right there in the app. It is not asked again after that — the token it gets back is encrypted by the Windows credential store immediately, and every counter still gets its own token to revoke.
Click Go online
Right there in the till's own topbar. Nothing to install, nothing to open elsewhere.
Enter the shop's cloud passphrase
One prompt, inside the app. The counter connects itself from there.
What it deliberately does not do
The limits, before you find them.
Every one of these is a decision, not an omission. A sync that pretends to more than it can guarantee is how a shop ends up with two different answers to what it sold today.
Stock levels are never synced
The ledger is. Syncing a level would lose a movement the moment two tills sold the same item at once; syncing the movements and adding them up cannot.
Only completed sales go up
Immutable events, append-only. Remote catalogue editing and refunds need explicit conflict rules, and they will arrive as their own migration rather than as a surprise.
Remote billing is an owner trial
It works, with its own WEB invoice series and stock that cannot go below zero. It stays owner-only until the conflict queue is visible on screen — the rare case where local sales exhaust stock before a queued web bill imports.
Security
Four rules the server holds to.
The token is a hash on the server
It is displayed once at enrollment and stored on the till by the Windows credential store. What the server keeps is a SHA-256 digest, which cannot be turned back into a token.
Nobody names their own tenant
Every query derives the tenant and branch from the token that made it. The request has no field in which to ask for another shop.
Uploads are bounded
100 events, 1 MB per request, 256 KB per event. A misbehaving client cannot become an outage.
A counter can be revoked
The owner lists enrolled tills and cuts one off. A machine that leaves the shop stops being able to reach it.
The till does not need it. You might.
Install CalcyBill, bill a day on it with the cloud switched off, and turn it on only when you want the shop in your pocket.