Nobody chooses a till for its audit trail. Nobody watches a demo and thinks, what really excites me is the offline mode. These are the boring features, the ones that get skipped in the sales conversation in favour of the slick order screen and the colourful reports. And then one day the internet drops in the middle of a Saturday service, or your accountant asks a question you cannot answer cleanly, and the boring features turn out to be the only ones that matter. This is a short defence of the unglamorous, because the unglamorous is what protects you.
For choosing a till in general, the EPOS guide covers the wider picture.
Offline mode: the feature you need on your worst night
Your internet will drop. Not might, will. A line goes down, a router sulks, the provider has an outage, and it will happen at the least convenient moment, because that is how these things go. The only question is what your till does when it happens.
A till that depends on the connection and stops taking orders when it drops is not fit for a restaurant. Picture it: a full room, food going out, and suddenly you cannot ring an order or take a payment. That is not an inconvenience, it is a stopped service, and it happens through no fault of yours at the worst possible time. A genuine offline mode means the opposite: the till keeps working through the outage, orders and payments carry on, and when the connection returns everything reconciles cleanly with nothing lost. The guest never knows anything happened.
This is the single most important reliability feature a till has, and it is invisible right up until the moment it is the only thing you care about. When you choose a till, ask exactly what happens when the connection drops, and do not accept a hand-wave. The honest providers will describe it precisely, because they built it on purpose. The vague answer is itself the answer.
The audit trail: boring until the accountant calls
The audit trail is the other unglamorous essential. It is the complete record of everything that happened on your till: every sale, every void, every discount, every correction, in the order it occurred. It sounds like paperwork and it is actually protection, on several fronts.
It protects your accounts, because a clean, complete record is what lets your end-of-day actually reconcile and your bookkeeper trust the numbers. It protects you with HMRC, because a proper transaction record is what you want to have when questions are asked about what was taken and how. And it protects you in disputes, because when something is queried, a refund, a missing item, a staff question, you have a true record of what happened rather than a guess.
The key quality is that it is trustworthy, which specifically means it cannot be quietly altered after the fact. A till where transactions can be silently edited has an audit trail in name only, because a record that can be rewritten is not really a record. The strongest approach chains the records together cryptographically, so that changing any one of them would be detectable. That sounds technical and the practical effect is simple: the history you rely on is genuinely the history that happened, and nobody, including a dishonest member of staff, can rewrite it without it showing.
Why these get skipped, and why that is a mistake
These features get overlooked for an understandable reason: they do nothing visible on a good day. On a normal service with a working connection and an honest till, you never notice the offline mode or the audit trail, so they feel like they do not matter. The mistake is judging them by the good days. Their entire value is on the bad days, the outage, the dispute, the HMRC query, and on those days they are worth more than every flashy feature combined.
It is a bit like insurance. You do not feel the benefit until the thing you insured against happens, and then it is the only thing that matters. A till chosen only on its good-day features is a till chosen without thinking about its bad days, and the bad days come.
Where Grace fits
Grace's EPOS is built with these as foundations, not afterthoughts. The offline mode is genuine: the till keeps working through a connection drop and reconciles cleanly when it returns, so an outage does not stop your service. And the audit trail is hash-chained, meaning every transaction is recorded in a way that cannot be silently altered, so your records are trustworthy for your accountant, for HMRC, and for any dispute. These are not features I expect to win a demo. They are the features I expect to matter on your worst night, which is exactly why they are built in. You can see the EPOS module for the detail.
It is built this way because the offline mode exists for a real reason: the line went down on a Saturday and I needed the till to carry on. If a feature cannot survive a Friday night, it does not ship, and surviving a Friday night includes surviving the moment the internet does not.
FAQ
Why does an EPOS need an offline mode?
Because your internet will drop at some point, usually during service, and a till that stops taking orders when the connection goes is not fit for a restaurant. A genuine offline mode keeps the till working through an outage and reconciles cleanly when the connection returns. - q: "What is an EPOS audit trail and why does it matter?" a: >- It is a complete, tamper-evident record of every transaction, void and discount, in the order they happened. It matters for your accounts, for HMRC, and for resolving disputes, because it means your records cannot be quietly altered after the fact and your end-of-day actually reconciles. - q: "What makes an audit trail trustworthy?" a: >- That it cannot be silently edited. The strongest approach chains records together so that changing one would be detectable, which means the history you rely on is genuinely the history that happened, rather than a version someone could quietly rewrite.