Letting staff bill without showing them your margins
Why one shared login is the most expensive habit in a small shop, and how to split access sensibly.
6 min read
In short
- A shared login fails at two different things: keeping cost prices private, and knowing who made an entry.
- Ask what a person needs to do their job, not whether you trust them.
- Selling price must be visible to bill at all. Purchase price and margin do not.
- Individual logins protect honest staff too — they can point at the record and be cleared.
Almost every small shop starts with one login that everybody uses. It is simpler, and when it is you and one helper it genuinely does not matter. It starts mattering the day your helper can see what you paid for the goods.
Two separate problems
It is worth being precise, because they need different answers. The first is confidentiality: you may not want staff knowing your purchase prices or your monthly profit. The second is accountability: when something is wrong, you want to know who entered it.
A shared login fails both. Everyone sees everything, and every entry is attributed to the same person, which is the same as attributing it to nobody.
Give people the smallest set that lets them work
The useful question is not "do I trust this person" but "what does this person need in order to do their job". A cashier needs to create bills, look up a product and add a customer. They do not need to delete an order, adjust stock, view profit and loss or change staff permissions.
| Cashier | Manager | Owner | |
|---|---|---|---|
| Create and print bills | Yes | Yes | Yes |
| Add customers | Yes | Yes | Yes |
| See stock levels | Yes | Yes | Yes |
| See cost price and margin | No | Yes | Yes |
| Adjust stock, purchases, expenses | No | Yes | Yes |
| Reports | No | Yes | Yes |
| Manage staff and permissions | No | No | Yes |
The specific line worth drawing is cost visibility. Selling price has to be visible to bill at all. Purchase price and margin do not, and that is usually the information owners most want kept in the family.
Accountability is the quiet benefit
Separate logins mean every bill, every stock adjustment and every discount carries a name. This is less about catching theft than about ending arguments. When an entry is wrong, you can ask the person who made it what they meant, instead of guessing across four people.
It also protects your staff. If everyone shares a login, then everyone is equally suspected whenever something goes missing. Individual logins mean an honest employee can point at the record and be cleared.
When someone leaves
With a shared login, an employee leaving means changing the password and telling everyone the new one — which people write down, and which usually gets skipped. With individual logins you disable one account and nothing else changes. Do it the same day.
Common questions
Can staff use a billing app without seeing my profit?
Yes, if the app separates roles. A cashier needs the selling price to raise a bill, but not the purchase price, the margin or the reports. Khata lets you give staff their own login with a limited set of permissions.
Why is one shared login a problem in a small shop?
It fails at confidentiality and accountability at once. Everyone can see your cost prices and profit, and every entry is attributed to the same account — which is the same as attributing it to nobody, so a mistake cannot be traced to whoever can explain it.
What should a cashier be allowed to do?
Create and print bills, look up products and stock levels, and add customers. They generally should not be able to delete an order, adjust stock, view profit and loss, or change staff permissions.
What should I do when an employee leaves?
Disable their individual account the same day. With a shared login you instead have to change the password and redistribute it to everyone, which people write down and which usually gets skipped entirely.
Khata is free to use
Billing, khata, stock and reports on your phone. No card, nothing to cancel.
See what you getstaffpermissionssecurityroles