How apps are checked and kept safe
Every listed app is checked and listed in one signed list. An app your administrator installs from Desk installs only after they agree to what it will do.
Before you install
Two kinds of app
Apps your administrator installs from Desk, and apps iVendNext installs inside your site, such as payments, tax and connectors. Each card says which.
Every listed app is checked
We review an app before its first listing, and again when a new version sends data to a new address, lets an outside service read and write through its own user, or needs more Desk users. A listed version never changes: any change is a new version.
The list is signed
One list, signed by iVendNext. Your site checks the signature itself, with a key built into iVendNext, and refuses an older list once it has seen a newer one.
The card says what the app does
Where it sends data, whether an outside service reads and writes through its own user, and how many Desk users it needs. All worked out from the app itself, and checked again by your site.
A key opens one site
A key names one shop's site and fails on any other. Free apps get their key automatically, and only sites iVendNext hosts can ask for one.
Nothing installs from Desk without your consent
Your administrator reads What it will do, written by iVendNext from the app itself, and ticks the box. A new version asks again.
While it runs
Apps come in through your front door
An app installed from Desk never connects to your database. A service of its own reads and writes through the API as its own user, which your administrator makes or chooses for it, with one narrow role and a key.
Every press is signed
When a cashier presses an app's button, your site signs the call with a secret it made at install. The app must check that signature before it reads the call, and the kit's template, which hosted apps start from, refuses a call signed with another shop's secret.
Hosted apps run apart
An app on iVendNext App Hosting runs in its own box at its own address, with its own secrets and logs and no shared database.
Four rules every app from Desk keeps
Money enters a sale only before payment, where the cashier sees it. No app changes iVendNext itself. Its server code runs on its maker's server; inside your site it is only settings and records, or a sealed WASM rule CitiXsys certified. Its screens use the places iVendNext opens for apps.
When an app is down
The till keeps selling. The cashier reads that the app could not finish and that nothing was added to the sale.
When you remove it
Uninstall cleans up
Your site first saves the app's records to a private file. Then it removes the records, fields, roles and buttons the install added. Your own records stay.
The app forgets you
A hosted app installed from the App library's public list is told goodbye and forgets your site, with the secrets and key your site gave it. An app from your Made for you shelf is not told yet: ask your partner to disconnect it.