You are about to leave a tablet on top of a fridge, or bolted to a farm-stand shelf, and let strangers pay with their cards on it while nobody is watching. If that gives you pause, good — it should. It is exactly the right question to ask before you flip an unattended checkout live.
Here is the honest answer to it: at a well-built self-checkout, the customer's card number never touches your tablet, never touches its storage, and never touches the checkout software's database. Once you understand why, the fear moves off the parts that are actually safe and onto the two or three things that genuinely deserve your attention.
Name the fear precisely
"Is it safe" is really three separate worries stacked on top of each other:
- Skimming — can the tablet, or the app running on it, secretly copy card numbers as people pay?
- Data at rest — if someone walks off with the tablet, or a thief pries it open, are hundreds of past customers' cards sitting inside it?
- Tampering — can someone swap a sign, install something, or trick the next customer into paying the wrong place?
They have different answers. The first two are handled almost entirely by architecture — how the payment is wired — and the good news there is real. The third is handled by how you physically set the till up, and that part is on you. Let's take them in order.
The one fact that changes everything: the number never lands on the tablet
Modern card payments are built so the merchant — and the merchant's software — never sees the raw 16-digit number. When a customer taps a card, holds up a phone wallet, or dips a chip, the card is read by the payment provider's own component (for TallyTill, that's Stripe, a PCI-DSS Level 1–certified processor). Stripe encrypts and tokenizes the card inside its own certified systems and hands back a token — a stand-in that is worthless to a thief because it can't be replayed to make a fresh charge somewhere else.
The checkout app only ever sees that token and the dollar amount. So does the server behind it. The actual account number is never written to the device, never cached, never logged, never synced to the cloud.
Follow that chain back through the three fears:
- Skimming? The app never handles the number, so there is nothing for it to copy. A rogue app would have to defeat the processor's own encrypted entry, which is the part built and audited specifically to stop that.
- Data at rest? A stolen tablet is a stolen $150 tablet. There is no store of card numbers on it to breach, because none were ever written there.
That is the difference between a purpose-built checkout and, say, a paper form where people jot a card number, or a spreadsheet where you "just type it in for now." Those do create a pile of live card data. A tokenized checkout deliberately never does.
What "we never store it" means for your paperwork
If you take cards, you are subject to PCI DSS — the card networks' security standard — whether you have ever heard of it or not. The practical question is how much of it lands on you.
When card capture is fully outsourced to a validated provider's hosted or SDK-based entry, most small merchants qualify for SAQ-A, the shortest of the self-assessment questionnaires — a handful of questions rather than a full audit. You are not storing, processing, or transmitting card numbers yourself, so the bulk of the standard simply doesn't apply to you. (Your exact obligations depend on your acquirer and how you take payments, so confirm your bracket with them — but outsourced card entry is what keeps you in the simple lane instead of the hard one.)
There's an even simpler path for the security-conscious: QR payment. When a customer scans a QR code and pays inside their own banking or wallet app, no card number is entered on your shelf at all. The whole transaction happens between the customer and an app they already trust on a phone they already own. Your tablet just shows a code and waits for the confirmation.
The risks tokenization does not solve — and how to close them
This is where honest content earns its keep. Encryption fixes the data problem. It does not fix the physical problem, and a self-serve till lives or dies on how you set it up in the real world.
- Someone swaps your signage. The oldest trick in unattended retail is social engineering: a bad actor tapes their own payment QR over yours so customers pay them instead. The fix is to never rely on a loose printed sign as the payment target — keep the pay step inside the checkout the customer is already using on your screen, so there's no separate code to swap. Walk the till periodically and photograph its normal state so you'd notice a change.
- Someone walks off with the tablet. Financially this is a hardware loss, not a data loss — but you still want to shut it out of your account. Good checkout software lets you revoke a device remotely, so a stolen or lost till stops being able to ring up sales the moment you flag it, from anywhere.
- Someone tries to leave the checkout and poke around the tablet. An unlocked tablet is a tablet a curious teenager will happily explore. Lock it down: kiosk / screen-pinning mode pins the device to the checkout screen so it can't be exited into settings, the browser, or other apps without an admin PIN, and it disables the shortcuts people use to escape a locked screen.
None of those three are exotic. They are the unglamorous, physical half of running an unattended point of sale — and they matter far more, day to day, than the encryption question everyone worries about first.
A short lock-down checklist before you go live
If you're setting up an unattended till this week, do these five things:
- Confirm your processor handles card entry (so no card data ever touches your device or software).
- Turn on kiosk / screen-pinning mode so the tablet can't leave the checkout screen.
- Set an admin PIN and don't tape it to the fridge.
- Keep the pay step on-screen, not on a separate printable QR that could be covered or swapped.
- Know how to revoke the device from your account — and test it once so you're not learning under pressure.
Do that, and the tablet on your shelf is genuinely one of the safer ways to take money while you're not there: the sensitive data is somewhere you never have to guard, and the risks that remain are ones you can see, walk up to, and lock.
Try it without putting a card down yourself
TallyTill turns a phone or tablet you already own into an unattended self-checkout — cards, tap-to-pay, and QR — with the card data handled by Stripe and kiosk lockdown built in. The Stand plan is free: no credit card to start, no expiration. You can set up a catalog and see the whole checkout flow before you ever bolt a tablet to a shelf.
Create your free account and walk through it once — the security model is a lot easier to trust once you've watched where the money actually goes.