Product previewView full size
Multi-tenant point-of-sale and inventory platform for running your own retail subscription business
01 / 12
Why Tillora - Multi-Tenant POS & Inventory SaaS
What makes it better
than the alternatives
- 01
Multi-tenant SaaS architecture
Tenant isolation, subscription plans with limits, free trials, grace periods, automatic Stripe/PayPal billing, custom domains and platform-wide announcements built in
- 02
Single-project deployment
The Next.js web app (admin + POS) builds into public/app/ and is served by Laravel on the same domain; no separate frontend hosting required
- 03
PIN-based cashier authentication
6-Digit PIN sign-in at the register with per-device brute-force protection, supervisor override for restricted operations, and lock screen handoff between staff
- 04
Offline-capable POS
Cart state persists in localStorage, conflict resolution on sync, and customer-facing display with a public token endpoint for second-screen receipts
- 05
Commission engine with goals
Staff earn tiered commissions on sales, tracked per period with configurable goals, automatic calculation on order completion, and manager approval workflow
Point of Sale (Cashier)
- Touch-friendly cart with barcode scanning (Code128
- EAN-13
- UPC-A
- QR)
- Split payments across cash
- card
- mobile
- gift card and store credit in one transaction
- Held/suspended carts
- returns and refunds with stock rollback
- PIN sign-in (6 digits)
- supervisor override
- cash drawer and register sessions with Z-reports
- Thermal
- A4 and email receipts; customer-facing display; offline sync with conflict resolution
- Product search by name
- SKU
- barcode; variant selection; bundle/kit support
- Coupon and discount application; loyalty points earning and redemption at checkout
Multi-Tenant SaaS (Super Admin)
- Tenant isolation with UUID primary keys and global scopes on tenant_id
- Subscription plans with limits (stores
- terminals
- products
- users
- orders/month)
- Free trials
- grace periods
- trial-to-paid conversion
- expiration checks (daily job)
- Tenant invoices with line items
- reminders (email job)
- automatic payments via Stripe/PayPal webhooks
- Custom domains per tenant (tenant_domains table
- domain verification)
- Platform settings: name
- logo
- favicon
- support email
- mail config (SMTP/Mailgun/SES)
- gateway credentials
- registration on/off
- Announcements (broadcast to all tenants)
- support tickets
- system health dashboard
- logs (Pail)
- audit log
- backups
- Impersonation: superadmin can sign in as any tenant user with a time-limited token
Inventory & Purchasing
- Multi-location stock tracking (stores
- warehouses); stock transfers between locations with approval workflow
- Stock takes (physical inventory count)
- adjustments
- low-stock alerts (configurable thresholds
- email notifications)
- Batch and serial number tracking (stock_batches
- stock_serials tables)
- Purchase orders with line items
- receiving (purchase_receipts)
- supplier management (suppliers
- supplier_contacts)
- Supplier payments (supplier_payments)
- purchase returns (purchase_returns)
- Inventory reservations (stock held for orders)
- automatic stock deduction on sale
- rollback on return
- Stock ledger (stock_movements) with reason codes
- user tracking
- audit trail
Products & Catalog
- Nested categories (tree structure with parent_id)
- brands
- units (pieces
- kg
- liters
- etc.)
- Product variants (size
- color
- etc.) with SKU
- barcode
- price
- stock per variant
- Product bundles and kits (bundle_items table
- stock deduction for components)
- Barcode generation (Code128
- EAN-13
- UPC-A
- QR) and printing (thermal labels
- A4 sheets)
- Image upload (main image + gallery
- stored in storage/app/public/products)
- CSV import and export (products
- variants
- stock levels)
- Price overrides per customer group
- pricing rules (bulk discounts
- time-based promotions)
- Product caching (Redis) for fast POS lookups
Customers & Loyalty
- Customer database with full purchase history (orders
- returns
- payments)
- Loyalty programs with configurable tiers (bronze
- silver
- gold
- platinum)
- points earning and redemption
- Birthday rewards (automatic coupon generation)
- referral system (referral_code
- referred_by_id)
- Store credits with transaction history (store_credit_transactions)
- gift cards with balance tracking
- Customer groups and segmentation (customer_groups
- customer_group_members)
- Customer blacklist management (is_blacklisted flag
- blacklist_reason)
- Customer-specific pricing (customer_prices table
- overrides product base price)
Staff & Roles
- 4 roles: superadmin (platform owner)
- admin (tenant owner)
- manager (store manager)
- cashier (POS operator)
- Granular permissions: 25 groups
- 93 slugs (view-products
- access-pos
- manage-users
- etc.) seeded by PermissionSeeder
- Role-based access control enforced by middleware (AdminMiddleware
- ManagerMiddleware
- CashierMiddleware
- SuperAdminMiddleware)
- Per-route permission map (config/permissions.php) checked by EnforceRoutePermission middleware
- Shifts and time clock (shifts table
- clock_in/clock_out timestamps)
- Commission engine: staff earn tiered commissions on sales
- tracked per period with configurable goals
- automatic calculation on order completion (SyncOrderCommissions job)
- manager approval workflow
- PIN authentication for cashiers (6-digit PIN
- pin_lookup table for fast verification
- per-device brute-force protection
- supervisor override)
Finance & Reports
- Multi-currency support (currencies table
- exchange rates
- currency_code on orders/payments)
- Tax zones and rules (tax_zones
- tax_rules
- tax_rates; automatic tax calculation on checkout)
- Expenses (expenses table
- expense_categories
- linked to finance_accounts)
- Profit & loss calculation (revenue - COGS - expenses
- per period
- per store
- per product)
- Sales reports (by date
- store
- cashier
- payment method
- product
- category
- customer)
- Product reports (top sellers
- slow movers
- stock value
- margin analysis)
- Inventory reports (stock levels
- movements
- adjustments
- transfers
- low stock)
- Customer reports (purchase history
- loyalty points
- store credit balance
- lifetime value)
- Staff reports (sales per cashier
- commissions
- shifts
- time clock)
- Tax reports (collected tax by zone/rate
- remittance due)
- Scheduled reports (report_schedules table
- RunScheduledReportJob
- PDF/CSV export
- email delivery)
Billing & Payments
- Stripe integration (stripe/stripe-php ^22): subscription creation
- payment intents
- webhooks (payment_intent.succeeded
- invoice.payment_failed)
- PayPal integration (PayPalApi service): subscription creation
- payment capture
- webhooks (BILLING.SUBSCRIPTION.ACTIVATED
- PAYMENT.SALE.COMPLETED)
- Payment authorization and capture (payment_authorizations
- payment_captures tables; pre-auth for card-present
- capture on order completion)
- Payment methods (cash
- card
- mobile
- gift card
- store credit) with gateway mapping (payment_methods table)
- Split payments (multiple payment records per order
- sum to order total)
- Automatic subscription payments (ProcessAutoPaymentsJob
- daily cron
- retries failed payments)
- Invoice generation (tenant_invoices
- invoice_items
- PDF rendering with DomPDF)
- Invoice reminders (SendInvoiceRemindersJob
- email 7/3/1 days before due
- overdue notices)
- Recurring invoices (GenerateRecurringInvoicesJob
- monthly/yearly billing cycles)
Platform & Security
- 6 languages: English
- Bangla
- Arabic (RTL)
- Spanish
- French
- Hindi (i18next
- react-i18next
- backend lang/ files)
- Web installer (/install route
- InstallerController
- creates .env
- runs migrations
- seeds superadmin)
- In-app updater (/update route
- UpdaterController
- downloads update package
- runs migrations
- clears cache)
- Webhooks (webhooks table
- webhook_logs
- configurable events: order.created
- payment.processed
- stock.low)
- Notifications (notifications table
- InAppChannel
- low-stock alerts
- invoice reminders)
- Two-factor authentication (TOTP
- pragmarx/google2fa-laravel
- QR code setup
- recovery codes)
- Rate limiting (throttle:api-auth
- 5 attempts/min for login/PIN/2FA
- configurable AUTH_RATE_LIMIT)
- Audit trail (activity_logs table
- LogsActivity trait
- CriticalAuditEvent for sensitive actions)
- Log redaction (LogLineRedactor
- masks email/password/token in logs)
- Security policies (security_policies table
- max_pin_attempts
- pin_lockout_duration_minutes
- force_pin_change_days)
- Public demo mode (DEMO_MODE=true
- DemoSeeder
- EnsureDemoAccounts middleware
- BlockInDemo middleware
- demo reset job)
Languages & stack✓ Verified from the source · 326,777 lines of code
| Language | Version | Framework | Used for | Share of code |
|---|---|---|---|---|
| PHP | — | — | Web, API | 48.1% |
| TypeScript (React) | — | — | Front-end | 32.9% |
| TypeScript | — | — | Front-end | 12.5% |
| HTML | — | — | Front-end | 2.8% |
| SQL | — | — | Database | 2.5% |
| CSS | — | — | Styling | 1.1% |
| JavaScript | — | — | Front-end | 0.1% |
| Shell | — | — | Scripts | 0% |
- Primary language
- PHP 8.3
- Framework
- Laravel 13.0
- Database
- MySQL 8.0 / MariaDB 10.5
- Authentication
- Sanctum Bearer tokens, 2FA (TOTP), PIN sign-in
- Licence
- Single-site
- Screens
- 85
- Database tables
- 162
- Supported languages
- English, Bangla, Arabic, Spanish, French, Hindi (RTL: Arabic)
- Browser support
- Modern browsers (Chrome, Firefox, Safari, Edge)
| Minimum | Recommended | |
|---|---|---|
| CPU | 2 vCPU | 4 vCPU |
| RAM | 4 GB RAM / 20 GB SSD | 8 GB RAM / 40 GB SSD |
| OS | Ubuntu 22.04+ / Debian 11+, PHP 8.3, Node.js 20+, MySQL 8.0+ / MariaDB 10.5+ | Ubuntu 22.04+ / Debian 11+, PHP 8.3, Node.js 20+, MySQL 8.0+ / MariaDB 10.5+ |
| Est. monthly hosting | $25 | $25 |
```bash cp .env.example .env # Edit .env: set DB_*, APP_URL, mail, Stripe/PayPal keys docker-compose up -d docker-compose exec app php artisan migrate --seed docker-compose exec app php artisan storage:link # Visit http://localhost or your domain ```
```bash
sudo apt update && sudo apt install -y php8.3 php8.3-{cli,fpm,mysql,mbstring,xml,curl,zip,gd,bcmath,intl} mysql-server nginx git composer nodejs npm
git clone <repo> /var/www/tillora && cd /var/www/tillora/Tillora
composer install --no-dev --optimize-autoloader
cp .env.example .env
# Edit .env: DB_*, APP_URL, mail, gateways
php artisan key:generate
php artisan migrate --seed
php artisan storage:link
cd frontend && npm ci && npm run build && cd ..
sudo chown -R www-data:www-data storage bootstrap/cache public
# Configure Nginx: root /var/www/tillora/Tillora/public, try_files $uri /index.php
sudo systemctl restart nginx
php artisan queue:work --daemon &
``````bash # Upload Tillora/ to public_html/tillora # In cPanel: create MySQL database, note credentials # SSH or File Manager: cd public_html/tillora cp .env.example .env # Edit .env: DB_*, APP_URL php artisan key:generate php artisan migrate --seed php artisan storage:link cd frontend && npm ci && npm run build && cd .. # Set document root to public_html/tillora/public in cPanel # Add cron: * * * * * cd /home/user/public_html/tillora && php artisan schedule:run ```
```bash cd Tillora composer install cp .env.example .env php artisan key:generate touch database/database.sqlite # Edit .env: DB_CONNECTION=sqlite, DB_DATABASE=/absolute/path/to/database.sqlite php artisan migrate --seed php artisan storage:link cd frontend && npm ci && npm run build && cd .. php artisan serve # Open http://127.0.0.1:8000, login: superadmin@demo.com / password ```
Quality report
Manually reviewedHow to read the quality report
What this is. Every project on Vibe96 goes through an automated audit of its source code before a reviewer in Dubai checks it by hand. The score is out of 100; 75 is the minimum to be listed, and any single failing check blocks a listing regardless of the score.
- Security
- No real credentials in the code, every data-changing route protected, admin areas role-gated, no SQL built from user input.
- Code structure
- A developer can navigate and extend it: clear module boundaries, no giant files, little copy-paste.
- Docs & completeness
- The setup guide, example config, schema and required files the builder committed to are actually in the archive.
- Dependency health
- Packages pinned, no known critical vulnerabilities, no abandoned libraries in production paths.
- Build & deploy
- A clean machine can restore, build and start it by following the shipped instructions.
Warnings are problems that didn't block the listing; they stay visible here until a later version clears them. The audit reads the code — it does not run it — so always try the live demo before you buy. Lines of code are counted from the same audited archive.
81/ 100
Automated audit score
✓ Passed the auditReviewer notes (6 minor)
Dependencies mostly current; a few outdated packages but no known critical vulnerabilities; weak default credentials and demo passwords ship to production buyers; moderate code duplication and some oversized files; business logic generally well-separated; several unscoped deletes/updates and missing indexes on foreign keys reduce safety; strong auth/authz with minor ownership gaps on read endpoints and one public display token route; build reproducible with gaps: missing frontend build in setup, docker env unclear, no version pins. None of these stop the software from working; the developer has been told and improvements come in a future update.
Versions & updates
1.0.0
First release18 Oct 2026✓ Reviewed & audited
No updates yet. New versions appear here with a changelog.
Buyers receive updates free for 1 year.
What you get
- </>Full source codeThe complete audited source, delivered as a download from your account. No obfuscation.
- ▤DocumentationSetup guide, architecture notes, CLAUDE.md and AGENTS.md.
- ↻One year of updatesEvery new version the builder publishes, free for 12 months.
- ♧30 days of supportInstallation and defect support through Vibe96 tickets.
