weighhub
Customer loginTry the demoSample data · read-only · no sign-upRequest a quoteالعربية
Try the demoSample data · read-only · no sign-upSystemControlsPlansArticlesAboutCustomer loginالعربية
Controls

Tampering is not stopped by force. It is exposed by the record.

Ten rules the server enforces on every company, not settings tucked away in a menu. Each one says what it records, what it refuses, and how you check it yourself without asking us.

  1. Entry method
  2. Correction trail
  3. Hash chain
  4. Integrity check
  5. Fraud review
  6. Time and locks
  7. Permits, once
  8. Sign-in and devices
  9. Isolation and backups
  10. Public verification
01 · Entry method

On every ticket: from the scale, or typed by hand.

As it happens: the operator types the number before the indicator settles, and nobody can later tell which number went on the ticket.

  1. A weight is published only by an approved scale device presenting its own device token; there is no field where a browser types a number.
  2. A reading is captured only when stable and less than 12 seconds old. Otherwise the capture is refused.
  3. Two-step weighing shows a capture button and nothing else, unless an administrator grants "Enter weight manually" to a named user.
  4. Quick weigh always allows typing, and the ticket then says "manual".
  5. Heavy manual entry by one operator raises a flag in fraud review.

How to check: open any finalized ticket in the demo and read the "Entry method" line.

From the scale (automatic) Manual

An approved weighing session — entry method: from the scale123
  1. The "Entry method" line on every ticket: from the scale, or manual.
  2. Ticket state: finalized. Finalizing is a logged action under a name.
  3. Who created the session and who approved it, by name and time.
02 · Correction trail Full audit logs: Professional+

A ticket can be corrected. It cannot be corrected quietly.

The old value stays beside the new one, with the name of whoever changed it, the time, and the reason.

  1. A correction is an addition, not a replacement: the new line is written under the original, and the original stays readable.
  2. Logged under a real name: create, approve, cancel pending, correct, edit pending, delete, quick weigh, print, reprint, stock movements, transfers, every financial entry, user create, edit and delete, session termination.
  3. Filter by user, action and date, with a timeline for each ticket.
  4. A push notification reaches managers' phones on every correction or deletion.

How to check: open "Audit logs" in the demo and search for any correction.

TimeActionByOld → newReason
09:12CreateAhmed S.— → #0042—
09:14ApproveBranch managerpending → approved—
09:15PrintAhmed S.copy 1—
11:02CorrectBranch managertare 7,120 → 7,720tare misread
11:03ReprintAhmed S.copy 2after correction

Illustration — sample. Names and figures are fictional.

03 · Hash chain

Each audit-log line carries the fingerprint of the line before it.

  1. Every row carries an HMAC over its own content plus the previous row's hash, so the rows link into one chain.
  2. The signing key is held by the application server. The database never sees it.
  3. A verification script walks the chain row by row and reports any row that was altered, forged, deleted or reordered.
  4. What it is: a log that exposes tampering. What it is not: it does not stop someone with database access from trying; it makes the attempt visible.

How to check: ask us for a chain verification report on your company's database.

TimeActionByOld → newFingerprint
09:12CreateAhmed S.— → #0042a91f…3c0e
09:14ApproveBranch managerpending → approved7d4b…e152
11:02CorrectBranch manager7,120 → 7,720c208…9f7a
11:03ReprintAhmed S.copy 25e6d…b043

Diagram of the mechanism — the fingerprints are not real.

04 · Integrity check All plans

Numbering gaps and twice-used permits appear in the integrity check.

  1. A gap in the serial numbers, whether a create the server rolled back or a row that was removed, is surfaced for review, not hidden.
  2. One exit-permit number used for two vehicles, or on two different days.
  3. A multi-material trip shares one permit only for the same vehicle on the same day. Anything else is raised.

How to check: open "Integrity check" in the demo.

00380039— — —00410040 — for review
0112 · 03/09 · 12340112 · 04/09 · 5678One permit, two days — for review

Illustration — sample. The first strip is ticket numbering; the second is a permit number with its date and plate.

05 · Fraud review Professional+

Ten arithmetic rules review ninety days and tell you where to look.

  1. The rules review the last 90 days of tickets every time the page opens. Plain, stated arithmetic, not a sealed box.
  2. A manager confirms or dismisses each flag, with the operator's real name beside it.
  3. A flag proves nothing by itself. It tells you where to look.

How to check: open "Fraud review" in the demo.

The dashboard — today's inbound and outbound totals and the pending ticket count1
  1. "Needs attention — 28 anomalous weights for review": the count of open flags on the dashboard. One tap opens the list.

Rule · what it checks · severity (| low · || medium · ||| high)

  1. Negative net — tare above gross after approval, so the net is below zero.
  2. Tare ≥ gross — the tare equals or exceeds the gross within one session.
  3. Tare far from the vehicle's usual — today's tare drifts from the median tare of the same plate.
  4. Same plate twice within minutes — two weighings of one plate closer together than a plausible trip.
  5. Net far above the material's usual — the net exceeds the material's average by a wide margin.
  6. "Rounded" manual weight — a hand-typed number ending in more zeros than the scale usually produces.
  7. Ticket outside working hours — a weighing at night or on a day off, per your company's settings.
  8. Operator heavy on manual entry — the share of manual weighings in one operator's total for the period.
  9. Identical net repeating for one customer — the exact same figure for the same customer, time after time.
  10. Empty trip — an approved session with zero net; the severity rises when it repeats.
06 · Time and locks

A weighing outside working hours reaches you at once, and a past day cannot be edited without a declared reopening.

  1. Night guard: you set working hours and days off in Cairo time, and any weighing outside them reaches managers as an immediate alert. The weighing itself is not blocked; it is reported.
  2. Daily lock: tickets older than a number of days you choose cannot be edited or deleted without an explicit reopen, which is itself written to the audit log.
  3. Stuck trucks: a session pending for more than an hour is flagged for follow-up.

How to check: after go-live open Settings → Daily lock in your account, set the number of days, then try to edit an older ticket.

An illustrative week card: working hours shaded, and a weighing at 23:40 flagged for follow-up.

07 · Permits, once

A permit code means nothing elsewhere, and is never accepted twice.

  1. The QR code on the permit is an opaque token, not a link: it opens nothing in a browser and means nothing to a generic scanner.
  2. Only a guard signed in to that branch can resolve it, inside the app.
  3. A second scan is refused.
  4. The approver's name is stamped on the permit. Cancelling it before exit leaves it marked "cancelled" rather than erasing it, and the cancellation is written to the audit log under a name.

How to check: open "Exit permits" in the demo and read the "Approved by" line on any permit.

Exit permit
Permit no.0112
PlateSAMPLE 1234
DriverSample driver
Ticket #0042 · sand18,340 kg
Approved byBranch manager · 13:58

Scanned once — 14:02, gate 1

Second scan attempt 14:07 — refused.

Scanned — once
08 · Sign-in and devices

Sign-in only from approved devices, every sign-in logged with its city.

  1. Six roles: system administrator, branch manager, user, gate security, read-only viewer, and finance viewer Enterprise. The last two are locked to reading, and no setting opens them.
  2. Per-user page and action switches: a single-purpose account lands on its one page and sees nothing else.
  3. Device lock per user: an unknown device waits, with its city, until a manager approves it under a label such as "Gate scale 1".
  4. The sign-in log keeps country and city, device and browser, GPS if permitted, and a map link. A sign-in from a new country is flagged and pushed.
  5. Lockout after repeated wrong passwords, sign-out from every device, and a mandatory password change on first sign-in. Sign-in events are purged after 365 days.

How to check: open "Sign-in log" in your account and find your own last sign-in with its city.

New device
UserAhmed S.
CityCairo
BrowserChrome · Windows
StatePending approval
Switch (default)System adminBranch managerUserGate securityRead-only viewerFinance viewer
Weighing page✓✓✓—✓—
Reports page✓✓✓—✓✓
Gate log✓✓—✓✓—
Finance page✓✓——✓✓
Quick weigh✓✓✓———
Print ticket✓✓✓———
Correct session✓✓————
Delete✓✓————
Approve exit permit✓✓————

Defaults when an account is created. The system administrator flips any switch per user, except for the two read-only roles and gate security, which no switch can widen.

09 · Isolation and backups

One database per company, and a full copy every night, kept elsewhere.

  1. Your company's address resolves to exactly one database. An unknown address returns "not found", and no table is shared with any other customer.
  2. A full copy every night around 22:30 Cairo time to a private store under your company's own prefix, the last 30 kept. Download one, or trigger one now, from Settings. Enterprise adds a permanent monthly snapshot.
  3. Retention: a stated period on Basic and Professional, written into your quote; unlimited on Enterprise. Anything past it is archived before deletion, and the audit and wallet trails stay.
  4. Images and private files sit behind a proxy that opens only for a signed-in user, and company addresses carry a no-index header. The privacy page in the app is written to comply with Law 151 of 2020 and is reviewed with counsel.
How to check:
  1. Read the address bar in your browser: your company's name before the dot.
  2. Download a backup from Settings and open it.
  3. Copy a licence image link and open it without signing in. It will not open.
  4. Search for your company's address in a search engine. It will not appear.

yourcompany.weighhub.com isolated

DatabaseOne per company, no shared tables.
BackupsEvery night around 22:30 Cairo time, the last 30 kept, download from Settings.
RetentionLimited · Limited · Unlimited, by plan, archived before deletion.
Private filesBehind sign-in, and the company address carries a no-index header.
If the subscription lapsesSign-in, password change, activation, verification and privacy keep working; everything else goes to the activation screen. After termination you have thirty days to export your data (Terms §17).
10 · Public verification

The ticket verification page keeps working even if the subscription stops.

  1. The link /verify/‹id› on your company's address opens without signing in.
  2. Four states: genuine · pending · void · not found (possibly forged).
  3. The figures are read from the database the moment the page opens, not from the paper in hand.
  4. Who uses it: the customer at delivery, the auditor at year end, a checkpoint on the road.

How to check: scan the QR code on any ticket the system printed with your phone camera, and compare the figures.

Genuine Pending Void Not found

Verify ticket
Ticket no.#0042
CustomerSample customer
MaterialSand
PlateSAMPLE 1234
Gross26,060 kg
Tare7,720 kg
Net18,340 kg

Genuine — figures from the database, now

Typeset illustration, not a screenshot.

Open the demo, then the audit log, and find a correction yourself.

If the sample data holds no correction, look for a reprint or a cancellation. They are logged the same way.

A walk through the log
About 5,000 sample tickets across 3 sample branches, from your phone or PC.
Try the demoSample data · read-only · no sign-up
No commitment
A quote on your way of working
A reply to your email within one business day, no commitment.
Request a quote