I built a custom web-based operations and POS system for a growing retail business that buys products from customers. Our workflow includes reverse logistics, inventory intake, required holding periods, price matching, inventory searches, eBay and Shopify integrations, automated product listings, and reporting requirements tied to local regulations. Standard platforms did not support these processes well, so we created our own system and are now expanding to additional locations.
The application does not process or store credit card details; Shopify handles payment processing. Our software mainly manages intake, inventory, operations, integrations, and internal workflows. It is currently hosted on Vercel and accessed through a browser on Windows PCs in our stores.
I know that security is an area where I need experienced professional help, but I want to understand the basics before hiring someone. Would wrapping the web app in a Windows EXE or desktop shell make it safer, or should I continue treating it as a normal web application? What should I do to secure the store computers, prevent unauthorized remote access, protect the backend and database, manage authentication and permissions, monitor activity, segment the network, and handle backups? I want to understand what qualifications and questions to look for when hiring a security professional.
3 Answers
Treat the retail PCs as dedicated terminals. Use Windows Assigned Access or kiosk mode, separate standard user accounts for daily operation, no local administrator rights, automatic updates, endpoint protection, host firewalls, and restricted remote-access tools. Consider disabling or controlling USB storage and limit the machines to the applications and websites they actually need. Put the POS devices on their own network or VLAN, separate from guest Wi-Fi and other business systems, and restrict their outbound and inbound traffic as much as practical.
The fact that payment processing is handled elsewhere reduces your card-data exposure, but it does not make the rest of the system low-risk. Your application still contains valuable operational and possibly customer information. Have an experienced application-security professional review the authentication flow, authorization checks on every API endpoint, database permissions, third-party integrations, dependency updates, error handling, and deployment configuration. A web application is a reasonable architecture for this use case; the security comes from its design and operational controls, not from hiding it inside a desktop executable.
An EXE wrapper generally does not provide meaningful security. It mostly changes how the application launches, while the important protections still need to exist on the server. Use strong authentication with MFA, role-based access control, HTTPS, secure session handling, input validation, rate limiting, audit logs, and least-privilege service accounts. Store secrets only in protected server-side environment variables, never in the client, and do not expose the database directly to store computers or the public internet.
That makes sense. I was mainly wondering whether a desktop wrapper would add protection, but I’ll focus on securing the web application and its backend instead.
The key point about dedicated accounts is that employees should use a normal, non-administrator Windows account for the POS. Keep administrative credentials separate and use them only for maintenance.