Built for operators who need to trust their data.
OneCount handles stocktake data for hospitality venues. This page explains how access is controlled, how data is protected, and how you can always get your records out.
Permissions follow your structure.
OneCount uses role-based access at the organization and venue level. You control who can count, who can review, and who can make changes.
- ✓Start and run sessions from the mobile app
- ✓Enter counts for assigned venues
- ✓View their own session history
- —Dashboard management features
- —Other users' data
- —Billing or account settings
- ✓All Staff permissions
- ✓Review and close sessions
- ✓View venue-level variance and history
- ✓Add catalog items and locations
- —Invite or remove team members
- —Delete the organization
- ✓All Manager permissions
- ✓Invite, manage, and remove team members
- ✓Access all venues in the organization
- ✓Manage organization settings
Every count is on the record.
Stocktake history is never deleted or overwritten. Sessions are preserved with entry-level detail — what was counted, by whom, and when.
Each session captures the following for every entry: the item counted, the quantity entered, the user who entered it, and the timestamp. This record persists after the session is closed.
Managers and owners can review session history from the dashboard at any time. Sessions cannot be silently edited after closing — any correction would create a new session record.
For venues with Square POS connected, the audit trail includes the theoretical usage data derived from sales, alongside the actual count — giving a complete record of variance origin.
Your data, your records.
OneCount is not a system of lock-in. Export is a control mechanism — use it for compliance, internal reporting, or backup.
Auth and data storage.
OneCount uses Supabase for authentication and data storage — an established, open-source backend with strong security defaults.
Authentication is email and password based. OAuth (Google, Apple, etc.) is not currently required. All authentication is managed by Supabase Auth, which handles token issuance, session management, and credential storage.
Data is stored in a managed PostgreSQL database with row-level security enforced. Only authenticated users with the correct organization membership can read or write their organization's data.
The OneCount dashboard and API routes run on Vercel's serverless infrastructure. Static assets are served via Vercel's CDN.
If you have specific hosting or data residency requirements, contact us to discuss.
Report security issues
We take vulnerability reports seriously and will respond promptly.
If you discover a security vulnerability in OneCount, please report it to us privately. We will acknowledge receipt within two business days and work with you to understand and address the issue before any public disclosure.
Contact: hello@onecount.ai
security.txt — Standard security contact and disclosure policy file.
Security questions
Common questions before rolling out to a team.
Bring reliability to every count.
If governance and audit trail matter to your operation, start with a controlled pilot rollout.