The Problem
Authentication was never designed
for modern retail security
Every day, enterprise retailers lose millions to authentication methods that were never designed for modern retail security.
Barcode Cloning
Manager badges with printed Code 39/128 barcodes can be photographed or photocopied in seconds. Cashiers scan cloned badges to perform unauthorized voids and refunds — directly stealing from the register.
Shoulder Surfing & PIN Sharing
Manager PIN codes are easily observed, memorized from surveillance footage, or shared verbally by busy managers trying to keep queues moving. Once shared, there is no way to revoke a known code.
Zero Non-Repudiation
When internal theft occurs, managers deny involvement: "someone copied my badge." Legacy systems provide no cryptographically binding proof linking the physical manager to an override event.
The True Cost
$164M+ in Lost Labor Annually
With 300 overrides per store per day at 15 seconds each, Dollar General alone loses over 7.4 million manager-hours annually. At a fully-loaded rate of $22/hour, that's $164 million in recoverable administrative labor — before accounting for shrink losses from cloned credentials.
87%
Faster Override Resolution
The AuthPoint Solution
Hardware-secured credentials,
bound to the manager
Transition from static, scannable identifiers to dynamic, hardware-secured cryptographic credentials that are physically bound to the manager.
Cloning-Immune
MIFARE DESFire EV3 cards with mutual AES-128 authentication. Cannot be photographed, photocopied, or duplicated.
Sub-Second Override
Tap-and-authenticate in under 2 seconds — 87% faster than the 15-second PIN/barcode baseline.
Replay-Proof Encryption
DUKPT (Derived Unique Key Per Transaction) generates a unique ciphertext block for every tap. No network replay possible.
Cryptographic Audit Logs
SHA-256 payload hashing + hardware-signed entries ensure 100% non-repudiation. Tampering is immediately detectable.
Offline-First Resilience
Local Edge Bridge caches credentials and authorizes overrides during WAN outages. Audit logs buffer and relay when reconnected.
Zero New Hardware
Leverages existing Verifone MX925/M400 PIN pads with integrated NFC. Only new acquisition is the encrypted scan cards.
Legacy vs. AuthPoint
| Capability | Legacy System | AuthPoint System |
|---|---|---|
| Credential Type | Scannable 1D Barcode / PIN | MIFARE DESFire EV3 (Cloning Immune) |
| Override Latency | 15 seconds (manual entry) | < 2 seconds (tap & authenticate) |
| Card/Token Security | Photocopy / memorize | AES-128 mutual auth + DUKPT encryption |
| Network Traffic | Static (replayable) | One-time ciphertext per tap (replay-proof) |
| Audit Trail | Manual logs (repudiable) | Hardware-signed SHA-256 (non-repudiable) |
| Offline Capability | None | Full offline with local cache + buffered relay |
Return on Investment
Measurable returns
from day one
AuthPoint delivers measurable financial returns from day one — eliminating shrink vectors while recovering thousands of manager-hours.
$164M
Annual Recovered Labor Value
7.4M manager-hours recovered across 19,000 stores
12–18%
Shrink Reduction
Eliminating barcode-clone and PIN-share fraud vectors
6 Days
Hardware Payback Period
$120/store card cost recouped in under one week of labor savings
Enterprise ROI Calculation
Calculate Time Saved
300 overrides/day × 13 seconds saved = 1.08 hours/day/store
Annualize Per Store
1.08 hours × 365 days = 394.2 hours/store/year
Scale to Enterprise
394.2 hours × 19,000 stores = 7,489,800 hours/year
Apply Labor Rate
7.49M hours × $22.00/hour = $164.8M recovered annually
Per-Store Economics
Technical Architecture
Centralized control.
Local resilience.
Our dual-layer architecture combines centralized management with local resilience — ensuring sub-second authorization even during network outages.
AUTHPOINT SAAS CLOUD
Central Identity Plane • Global Configuration • Immutable Compliance Ledger
STORE-LEVEL EDGE BRIDGE
Local SQLite Credential Cache • Offline Authorization • Buffered Audit Relay
POS REGISTER TERMINAL
Toshiba TCxSky Linux • Verifone MX925/M400 PIN Pad • AuthPoint POS Client
SaaS Cloud Plane
- Multi-tenant API gateway with tenant-scoped isolation
- Central credential registry with AES key diversification
- Immutable WORM-style audit ledger
- Real-time configuration push via WebSockets
Edge Bridge Plane
- Lightweight store server daemon (Express + SQLite)
- Local credential cache with SHA-256 Merkle sync
- Offline-first fallback — 100% uptime during WAN outages
- FIFO audit buffer with transactional retry relay
Terminal Client Plane
- Runs on Toshiba TCxSky Linux (JavaPOS stack)
- XPI (E06/E07) & VIPA (DED10000/FF7F) protocol support
- Form Agent XML screen push for PIN pad UI
- Built-in fallback: keyboard wedge, JavaPOS CCID, PIN pad micro-agent
Pricing
Transparent pricing,
built for massive scale
A transparent hybrid model designed for massive scale. No hidden fees, no per-seat licensing.
Hardware
$8–12per scan card
- MIFARE DESFire EV3 4K
- Custom branded + serialized
- $65–70/reader (Elatec TWN4)
- ~$100/store kit (10 cards + reader)
Most Popular
SaaS Platform
$30per store / month
- Real-time credential management
- Automated AES key rotation
- Immutable audit (7-year retention)
- Store health monitoring
- Multi-region, multi-tenant
Integration
$15Kone-time fee
- Custom POS software integration
- Verifone XPI/VIPA configuration
- Enterprise-wide deployment
- Staff training & documentation
- 30-day support included
Enterprise retail runs on trust.
Let AuthPoint help you secure every transaction with hardware-backed authentication.
What happens next?
Discovery Call
We learn about your current POS environment, override frequency, and security requirements.
Custom Pilot Plan
We design a pilot for 3–10 stores including hardware provisioning, integration, and training.
Enterprise Deployment
Full rollout across your store network with ongoing monitoring and support.