Know who did what. Stop the quiet losses.

Yes, and this is the setting most owners turn on first. With the manager-PIN requirement on, a cashier, waiter or front-desk staff member cannot cancel an order, apply a discount, waive a charge or spend a diner's loyalty points without a manager standing there and entering their own PIN. The check runs on Restrofi's servers, not just in the app, and the approver's identity is taken out of a signed, short-lived token — the till cannot claim somebody approved when they did not. If you happen to have nobody set up who can approve, the gate steps aside rather than stranding your floor mid-service.

Twenty-five, grouped into operations, menu and stock, insights, money, and management. They are the granular things — viewing orders versus updating them, adding items to a running order versus removing them, opening the kitchen display, marking items sold out, seeing analytics, seeing billing, recording an expense versus approving one, managing suppliers, managing staff. Permissions that do not apply to your outlet, like the housekeeping and room ones, are hidden rather than cluttering the list.

Yes. Restrofi ships seven built-in roles — admin, manager, cashier, kitchen, waiter, front desk and housekeeping — and you can build your own on top with any combination of the 25 permissions. Templates are there to start from: Captain, Billing cashier, Counter staff, Kitchen chef, Order packer, Shift manager, Front desk staff and more. Roles that carry admin or manager authority can only be created by the owner, so a manager cannot quietly mint themselves a more powerful role.

Every staff member gets their own four-digit PIN. At the Restrofi Connect till they sign in with it at the start of their shift and switch operator during service, so the orders and bills they touch carry their name. PINs are stored hashed, wrong attempts are rate-limited so nobody can sit there guessing, and a PIN check cannot be used to work out who does or does not have one. If someone forgets theirs, the owner can reveal or reset it from the dashboard — and that view or reset is written to a record.

Yes. Set your Owner PIN in Dashboard → Staff (only you can set or change it, from your own login). After that, the Owner option on the Restrofi Connect till asks for that PIN, and a manager's or admin's PIN no longer opens it. It is stored hashed, never shown back, and wrong guesses are rate-limited.

Yes. Turn on the required name and phone switches in Settings and every staff order needs them, on the dashboard, the Restrofi app and the Connect till. The server checks it too, so an old app or till version can't skip it.

Only the owner. A refund that needs approval is held in a Refunds to approve queue instead of being sent to the payment gateway, and no manager or admin staff member can release it — not by mistake, not by argument. Your team can see the queue, which keeps everyone straight about what is pending, but the money does not move until the owner says so.

Sign-in does, for anyone who has already signed in on that till while online — Restrofi Connect keeps a scrambled, machine-locked copy of the check. Manager approval offline works the same way, and Connect tells you outright when there is nobody on that machine who can approve, rather than letting the void through quietly.

No. Custom roles, all 25 permissions, PIN sign-in and manager approval are part of Restrofi on every plan. What scales with the plan is the number of staff accounts — Premium (₹699 per outlet per month) and Chain include unlimited staff.