Verify before you trust
Verify the company, source and data boundaries
Check who publishes Posnic, inspect the exact software source and understand which security responsibilities still belong to your shop.
Current boundary: public evidence is available, but Posnic does not claim an independent security audit or penetration test.
Identity and ownership
Organization and project proof
Use independent records, the public source organization and the pinned release history together. No single logo or website claim should carry the whole decision.
DPIIT company record
Certificate DIPP159427 states that Posnic Innovations Private Limited was incorporated on 21 July 2016. It was issued 8 March 2024; the Startup India recognition period ended 20 July 2026 and is presented as historical.
Public source and governance
github.com/Posnic/POS publishes the application, licence, security policy, governance, contribution process and versioned releases. GitHub also exposes its machine-readable citation metadata.
Named release maintainer
The archived evidence commit identifies Sridhar Bala as its author. Governance states that there is currently one effective maintainer.
Correction, 17 August 2026: We removed an image that had been labelled as Posnic's incorporation certificate after visual review showed it belonged to another company. We also replaced a generic Startup India logo with Posnic's actual DPIIT certificate and stated its ended recognition period.
Buyer verification
What buyers should verify
Start with product identity, data location, support and exit. Those checks matter before feature comparison or payment.
| Question | Where to verify | Why it matters |
|---|---|---|
| Is this the original Posnic? | posnic.com and github.com/Posnic | Avoid unofficial downloads, repackaged installers and fake support numbers. |
| Can I inspect the software? | Public source repository | Open source lets technical buyers inspect code, build from source and audit behavior. |
| What happens if I never pay? | Free open-source POS page | The local community edition is free for local use with no trial timer. |
| Where does my data live? | Posnic facts page | Data ownership and export matter more than a feature checklist. |
| How do I get help? | Support page | A POS problem is urgent when billing is blocked. |
| What if I need cloud later? | Pricing page | The upgrade path should be clear before the first outlet opens. |
Release-pinned security evidence
How Posnic data moves, and where responsibility changes
This is a publisher review of the exact archived source commit, not an independent audit, penetration test or customer deployment result. It names both the controls visible in source and the boundaries a shop still has to own.
Default desktop path in archived evidence run
Renderer to API to local database
Optional cloud and third-party integrations sit outside this default path and require a separate data-flow review.
-
Shop interface
Electron renderer
The tagged source enables context isolation, sandboxing and web security, and disables Node integration for the main application window.
Source configuration is inspectable; it is not an external runtime assessment. -
Application service
Desktop API process
The interface calls the bundled HTTP API. In archived evidence run, the server falls back to all network interfaces and the desktop does not explicitly set a loopback host.
Use host firewall and network controls; do not describe the archived API as loopback-only. -
Working records
Bundled MongoDB
The packaged database is configured for 127.0.0.1 and generated credentials. Local users, device security, backups and restore readiness remain operator responsibilities.
Local storage is a data-location fact, not a promise against loss or unauthorized local access.
Optional services
Cloud sync and user-chosen integrations can move data beyond the shop computer. Record every enabled destination, field, credential and retention rule.
Payment systems
Cash, UPI and Card were labels in published evidence. The terminal, provider, authorization, settlement and PCI scope are separate systems to verify.
Recovery
A backup on the same disk does not survive disk loss or many ransomware events. Keep an off-machine copy and prove a clean restore on a schedule.
Post-release desktop API correction
Source commit c67183b56ba711a8b2c63e5071625d619ad4007e makes the packaged desktop set HOST=127.0.0.1 before loading the API. The complete source suite passed 866/866 tests. This commit is not part of archived evidence run and is not represented as a shipped package result; until a newer release includes it, archived evidence run retains the network-listener boundary described above.
| Boundary | What the published evidence says | What the operator must do |
|---|---|---|
| Shop records | The free local edition keeps its working MongoDB database on the shop computer; a Posnic cloud subscription is not required. | Restrict operating-system accounts, encrypt the device where appropriate, patch it and protect exports and backups. |
| Desktop network | archived evidence does not force the API listener to loopback. The post-release correction is recorded separately above. | Block untrusted host and LAN access, assess the exact build and move to a release containing the correction when published. |
| Optional cloud and integrations | They are outside the default local path and act only when subscribed to or configured by the operator. | Document the provider, transmitted fields, legal basis, retention, access, failure behavior and exit process. |
| Payments | Published counter evidence stores payment-mode labels only; no terminal, authorization, capture or settlement was tested. | Map the actual card-data environment and confirm requirements with the acquirer or entity managing PCI compliance. |
| Backup and restore | The default backup location can remain on the same disk. A synthetic clean restore is product evidence, not a production recovery target. | Keep tested off-machine copies and set the business's own recovery point and recovery time objectives. |
| Release integrity | archived evidence run publishes SHA-256 checksums. The stable manifest records unsigned Windows and Linux packages and a signed but not notarized macOS package. | Download from the official release, verify the checksum and evaluate signing warnings before deployment. |
| Vulnerability handling | The security policy asks for reports at security@posnic.com and aims to acknowledge them within 72 hours. No measured response SLA or independent security audit is claimed. | Use a private report for suspected vulnerabilities and include the exact version, platform, reproduction steps and impact. |
Exact product sources
Payment boundary
PCI SSC states that payment terminals are in the cardholder-data environment and that applicable controls vary with the device and configuration. Read FAQ 1300.
Small-business controls
NIST's current basics include multifactor authentication, strong passwords, tested backups, updates and staff training. Read NIST Cybersecurity Basics.
For journalists, analysts and technical evaluators
Review Posnic independently
A credible POS review should identify the exact artifact, show what was tested and publish failures beside successes. Anyone may use this protocol and the linked public evidence without contacting Posnic. Access does not require payment, positive coverage or a backlink.
| Review step | Use this evidence | Keep this boundary |
|---|---|---|
| Screen editorial fit | Versioned reviewer brief | Posnic is POS software, not a merchant acquirer or integrated card terminal. The brief puts cost, support, signing, payment and hardware limits beside the product facts. |
| Pin one build | v1.6.1 release and pinned source | Record the filename, locally computed SHA-256, operating system and test date. Do not generalize to another release. |
| Separate package licenses | DEB package-license evidence and pinned third-party notice | Posnic source is AGPL-3.0-only; packages also bundle MongoDB Community Server under SSPL-1.0, which MongoDB states is not OSI-approved. Do not assign one license to the whole bundle. |
| Reproduce counter work | 24-control independent review protocol | Publish setup, stock, sale, return, report, close, backup and clean-restore evidence. A source test is not a shop result. |
| Separate supplied facts | Machine-readable product facts and human-readable facts | Publisher-supplied facts and screenshots must remain labelled as supplied evidence, not independent observation. |
| Resolve product identity | CodeMeta JSON-LD and citation metadata | Use the official repository, publisher, licence and platform fields. Do not inherit an unverified directory description, domain or price. |
| Cite the research files | Research catalog CITATION.cff | The citation covers the mixed publisher-created catalog, not one homogeneous dataset, independent result, DOI or blanket licence for underlying sources. |
| Verify file integrity | Publisher checksum list | A matching checksum proves artifact identity. It does not prove that the code is secure or suitable for a business. |
| Show product evidence | Product screenshots and published runtime evidence | Company screenshots illustrate the product. Reviewers should capture their own screen, logs and measurements for hands-on claims. |
| Publish conflicts and limits | Evidence and correction policy and info@posnic.com | No independent security audit or unaffiliated hands-on review is claimed here. Contact is for questions or corrections, not approval of the review. |
Current public status: publisher evidence is available; no unaffiliated hands-on review, customer production result or independent security audit is represented as completed.
Useful trust pages
Frequently asked questions
How can I verify Posnic is original?
Use posnic.com, the official GitHub organization, official release links, company contact details and the public source repository before downloading or paying.
Does Posnic lock my data?
The free local edition keeps its working database on the shop computer and does not require a Posnic cloud subscription. Local storage is not automatic protection from administrators, malware, device theft or a failed disk, so operators still need restricted operating-system access, device encryption, off-machine backups and restore tests.
Who maintains Posnic?
Posnic Innovations Private Limited publishes Posnic. The archived evidence commit identifies Sridhar Bala as its author, and project governance states that the project currently has one effective maintainer.
Can I review Posnic independently?
Yes. The public review protocol starts with an exact release and checksum, then covers setup, offline behavior, stock, sales, returns, reports, register close, backup, restore, hardware and claim boundaries. Access does not require positive coverage or a backlink.
Has Posnic POS passed an independent security audit?
No independent security audit or penetration test is claimed. Public source, publisher-run tests and release checks are inspectable evidence, but they do not replace an external review of the exact package, network, devices, users and integrations a business will deploy.
Does Posnic process card details?
The archived counter evidence stored Cash, UPI and Card as payment-mode labels; it did not connect a payment terminal or test authorization, capture or settlement. Merchants must map the real provider and card-data flow with their acquirer or qualified adviser.