What gets installed on a device: the warehouse PDA, the till, the order screen and the food-safety tablet. Here they are, with their version and their fingerprint, so you can check that what you download is what we say it is.
Each in the shapes it comes in: pick by the device you have, not by what you want to do. Every card carries the version, the size and the hash of what you download.
What you do with goods in the store: receive what arrives, count it, restock the shelf, order and report losses. On a gun terminal it reads with the trigger; on a normal phone, with the camera. It works with no signal and sends when it comes back.
Incoming orders - from the menu, the till or the counter - in three columns you drag as they get prepared. It works the same in a kitchen as behind a shop counter: wherever something is ordered, prepared and handed over.
The desktop till: it charges offline, signs receipts under VeriFactu and syncs sales when the network comes back.
HACCP records on the back-room tablet: temperatures, cleaning with its product and dose, labels and deliveries. Signed with the PIN of whoever does it and stored in the ERP with the server's time, with no paper to file.
Android asks the first time: «Install unknown apps» for the browser you download with. It is a notice that the file does not come from a store, not a fault.
It installs like any other app. On a warehouse terminal, do it with the device plugged in: it cannot be left half done.
In the ERP: Sales → POS → Terminals → Pair, type «PDA». It shows the terminal key and, with it, the QR that pairs the device.
Next to each download we publish its SHA-256 fingerprint. Use it to check that the file you have is exactly the one we published and not another that slipped in along the way:
sha256sum atazel-pda.apk # Linux, macOS
certutil -hashfile atazel-pda.apk SHA256 # Windows
When you install something that does not come from Google Play, Android warns that it cannot vouch for the file. It is not saying there is a virus: it is saying it has not seen it before. That warning appears for any company app installed this way, and no certificate removes it - only publishing on Play would, which for a working app on a fleet of terminals is not worth it.
What you can do is check that the file is ours. We publish two fingerprints: the file one, which says nobody tampered with it on the way, and the one of the certificate that signs it, which says it came from us. The second cannot be forged without our key, and does not change between versions.
With the Android tools, on any computer:
apksigner verify --print-certs atazel-pda.apk
It asks for two permissions and no more: internet, to talk to your ERP, and camera, to read codes - and that one can be denied if the terminal has a scan gun. No contacts, no location, no files. Android backup is disabled on purpose: your terminal key lives inside, and it has no business travelling to any cloud.
Because it is not a consumer product: it is the working app for a customer's fleet of terminals, updated when that shop finds it convenient and not when an app store decides. You download it here, with the fingerprint published alongside.