Signed Once, Never Replaced
A till sale has no approval step to hang a lock on — the money moves and the receipt prints in the same breath. So the signature had to become its own lock: signed once, never replaced, and refused entirely once the sale has been reversed.
Most records in a business system are locked by an approval. Somebody signs off, the state changes, and after that the thing cannot be quietly rewritten. A till sale has no such moment. It is complete the instant it happens.
That absence turns out to be an interesting design constraint rather than an obstacle, and the rule it forced is better than the one an approval gate would have produced.
The rule
A sale can be signed once. After that, never again — not corrected, not replaced, not overwritten by a supervisor.
The reason is specific. Without that rule, a cashier could change whose name is attached to a transaction long after the customer left the shop. That is precisely the thing a signature exists to prevent, so allowing it to be replaced would leave the mark decorative.
With no approval to lock the record, "already signed" has to be the lock itself.
And the second condition
The window also closes when the whole sale has been returned. Once everything has gone back, there is nothing left to have been bought, and a signature taken after the reversal attests to a purchase that no longer stands.
That is a subtler rule than the first and it is the one most systems would not have. A signature is usually treated as evidence about a moment; here it is treated as evidence about a claim, and the claim can cease to exist.
What is deliberately still allowed
A late signature. If the pad was not working, or the customer was still counting change, or the cashier simply forgot — the mark can still be taken while the sale stands unsigned and unreturned.
This is the part that separates a considered rule from a strict one. A time limit would have been easier to implement and would have punished the honest case — the customer who is still at the counter when the tablet finally wakes up — while doing nothing at all about the dishonest one, which is a replacement rather than a delay.
Unsigned, sale stands
Can be signed
Whenever. There is no clock, and adding one would only hurt the honest case.
Already signed
Refused
By anybody, including a supervisor. This is the whole control.
Sale fully returned
Refused
There is no purchase left to attest to.
Partially returned
Can be signed
Something was still bought, so the mark still means something.
Three implementation details worth stealing
-
The drawn mark and the typed name are alternatives
A sale counts as signed if either is present. Some counters have a pad and some have a keyboard, and requiring both would mean the shops without a pad simply never sign anything.
-
The file path is hidden from serialised output
The image is served through a tenant-gated route. Exposing the path in an API response would let anyone holding it fetch the image directly, which quietly bypasses the check that route exists to perform.
-
The receipt prints either way
The signature travels inside the printed document as inline data rather than as a link, because the receipt renders without fetching anything remote. If the file has gone, the receipt still prints — just without the mark. A missing image must never be a reason a customer cannot have their receipt.
The general rule this came from
Where one mark permanently locks a record and cannot be re-taken, an unstorable drawing must be refused at the point of capture rather than accepted and lost — because there is no second chance. Where the mark can be taken again later, a warning is enough. The till is firmly in the first category, which is why it is stricter here than elsewhere in the product.
Two, for trades where the docket is the contract
The capture and the lock are done. These are the two things a business asks for once signatures are load-bearing rather than a courtesy.
A signature requirement per counter or per value
Today a signature is optional everywhere. Where a docket is the delivery evidence — trade counters, wholesale, anything leaving on account — the useful control is a refusal to complete above a threshold without one, which is a rule rather than a habit.
An unsigned-sales report with an ageing view
The complement to the rule: what left the counter without a mark, by counter, cashier and day. Cheap, and it is the report that tells you whether the habit is holding before a dispute tells you it was not.
How it works: you describe the requirement, we return a written scope, timeline and cost, and once agreed it is built into your environment and maintained as part of the product. If a signed docket is how you prove delivery, raise the threshold rule — it is small.
Talk to us about signature captureWhat AWRA OpsHub does today
- A drawn signature or a typed name against a sale, either of which counts as signed.
- A once-only rule: signed sales cannot be re-signed, replaced or corrected by anybody.
- A refusal to sign a fully returned sale, because there is no purchase left to attest to.
- Late signing, permitted deliberately while the sale stands unsigned and unreturned.
- The signature image served through a tenant-gated route, with the stored path withheld from serialised output.
- The mark inlined into the printed receipt, and a receipt that prints regardless if the image is missing.
What it does not do
- Any requirement to sign. It is optional everywhere, on every sale, at every value.
- A per-counter or per-value signature rule.
- A report of unsigned sales.
- A signature on a refund, distinct from the one on the sale.
- Any verification that the signature belongs to the person named beside it.
Not ours, by choice
- A signature here is evidence that somebody marked the sale, not proof of who they were. No system that captures a drawing on a screen can claim more than that, and we would treat a vendor who does with suspicion.
- The once-only rule is deliberately inflexible and there is no supervisor override. That is the control; an override would remove it.
- Nothing here is Philippine. Cebu is here as a market where counter retail and small-format wholesale sit side by side and a signed docket is ordinary practice rather than a formality.
Our position
Capture the signature at the counter while the customer is there, and understand exactly what it proves: that a mark was made against that sale and has never been changed since. That is a narrow claim and it is a genuinely useful one. If you need signing to be compulsory rather than available, that is a small build and worth naming before you rely on the habit.
Ask what locks the record
For any system, ask what makes a completed transaction unchangeable. If the answer is a permission rather than a state, the record can be rewritten by whoever holds that permission — and the [audit trail](/glossary/audit-trail) will show it as a normal edit.
Talk about till recordsFrequently asked questions
Can a supervisor correct a signature taken in error?
No, and deliberately. There is no override, because an override is exactly the mechanism the rule exists to prevent. The correct handling of a mis-signed sale is a note against it, not a replacement of the mark.
What if the signature pad fails mid-transaction?
The sale completes and can be signed later, which is the case the late-signing allowance exists for. What must not happen is an unstorable drawing being accepted and silently lost, since there is no second chance on a till sale.
Does the customer get the signature on their copy?
Yes, inlined into the printed receipt. If the stored image has gone missing the receipt still prints without it — a missing file is never a reason to withhold somebody's receipt.
