Why We Ask for Your PIN Again Even Though You're Logged In — The Story Behind Sudo Mode

There's one complaint we heard fairly often early on: "I'm already logged in — why do I have to enter a PIN again just to open settings?"

It's a fair question. In most business software, logging in once means you can go anywhere until you log out. We deliberately didn't follow that pattern, and the reason comes down to something that makes a register tablet fundamentally different from an office laptop: a register tablet is almost never used by one person.

Why Security on a Register Tablet Is a Different Problem

Think about how a register tablet gets used across a day. It's awake from opening to close. It sits on a counter within reach of anyone standing behind it. It's handed between different cashiers across shifts. It gets left unattended for a few minutes while whoever was on it helps in the kitchen or runs an order out.

Now compare that to a personal laptop. One owner, closed when you walk away, a screen lock, and usually in a room customers never enter.

The "log in once, roam freely" model was designed for the second situation. Applied to the first, it means anyone standing in front of a tablet that hasn't been logged out has full access to your business settings — changing menu prices, viewing revenue reports, managing staff accounts, reaching subscription settings.

This isn't a claim that your staff can't be trusted. Most can. But good security is about reducing opportunity, not judging people. And a tablet left awake for three minutes is an opportunity that doesn't need to exist.

The Decision We Made

We separated two things that most software treats as one: who you are and whether you're standing here right now.

Logging in answers the first question. Sudo mode answers the second.

Here's how it works. The operational POS screens — taking orders, accepting payment, printing receipts — are never interrupted. What's gated is the administrative side: settings and management. Before you reach those, you re-enter the manager PIN, even though your login session is still perfectly valid.

After that you get a working window. The default is 15 minutes, and each business can set it anywhere from 1 to 240 minutes. A cafe whose tablet lives in a back office might be comfortable with 60 minutes. A cafe with the tablet on an open counter might choose 5.

The Detail That Keeps It From Being Painful

We were worried this would feel obstructive. What saved it was one technical decision: the window slides rather than counting down to a hard stop.

Every time you open another admin page, the clock resets to zero. So as long as you're actively working — editing ten menu prices, adding three staff members — you're never thrown out mid-task. The 15-minute limit isn't "15 minutes since you entered", it's "15 minutes since you last did anything."

That difference is enormous in daily use. A hard timer locks you out mid-sentence. A sliding one only locks a tablet that has genuinely been abandoned.

One more detail: if you've just signed in, you get the window immediately without being asked for a PIN twice. Requesting credentials twice within ten seconds isn't security, it's just irritating — and irritated people look for ways to shorten the procedure, which makes security worse, not better.

The Other Side: Why We Let You Trust a Device

We applied the same principle to two-factor authentication, but from the opposite direction.

If you enable 2FA, you can mark a device as trusted and skip the 2FA code on it for 30 days. That looks like loosening security, but the intent is the reverse: 2FA that demands a code on every single sign-in from the same tablet makes people turn 2FA off entirely. Security that's been switched off protects nothing.

One decision worth explaining: device trust survives signing out. That seems strange until you think about a shared tablet. A manager signs out at the end of a shift so the next cashier doesn't land in their account — but it's still the same tablet in the same place. Forcing a fresh 2FA code every time someone signs out would punish exactly the habit we want to encourage.

Trust ends in three ways: the 30 days expire, you revoke it yourself from the devices page in account settings, or you disable 2FA — which clears every trusted device you have.

How We Store the Device Token

This part is technical, but we think it's worth stating openly because it concerns your data.

When a device is marked trusted, we generate a random token and store it in a cookie in your browser. What we keep in our database is not that token — it's a SHA-256 hash of it.

This is the same pattern as storing passwords properly. It means that even if someone managed to read our database, they still couldn't forge a valid trusted-device cookie — all the database holds is a fingerprint of the token, not the token. Verification runs one way: the cookie arrives, gets hashed, and is compared against what's stored.

We also record a device label and a last-seen timestamp, so the trusted devices page shows you a list you can actually recognise and revoke anything you don't.

What We Learned

The biggest lesson: security that inconveniences people gets switched off, and security that's switched off protects nothing. Every time we tightened something, the next question had to be "will people look for a way around this?" If the answer was yes, the design wasn't finished.

That's why sudo mode has a sliding window rather than a hard timer, why the timeout is configurable per business instead of a number we picked for everyone, why a fresh sign-in doesn't ask twice, and why devices can be trusted at all. Each one is an attempt to put friction only where it actually buys something.

We also learned that business owners tend to be stricter than we assumed once they understand the reasoning. When 15 minutes was the only option, some users asked to make it shorter — not longer. That's why the timeout is configurable now, and why we'd rather explain how this works here than hide it behind a line about how much we value your security.