Loss prevention & oversight · built for convenience chains

Every store bleeds
$200–400 a week.
Keystone sees where.

Your stores are staffed around the clock. Your numbers aren't. Being in the store and reviewing the data are two different jobs, and on almost every shift nobody is doing the second one — so theft and error drain the business quietly, and never show up as a line on any report you run today. Keystone compares every register on every shift, ranks what actually looks wrong, and tells you exactly what to check.

It runs every day and stops loss before it happens. It's built to catch skimming and sweethearting — the things no other system can see — and to explain the loss you already know about but can only guess at.

Book a walkthrough ▸ See the 60-day pilot No POS replacement. Runs on the journals you already export.

Every shiftcompared, not just covered

Every registerreviewed, every day

48 hoursbefore an ignored item climbs

60 daysto proof on your own data

01The problem

Every shift has someone in charge. No shift has anyone checking the numbers.

Your stores are covered. Two partners on the floor, an assistant manager when the manager is off — that part works. But running a store and reviewing its data are different jobs, and the second one isn't on anybody's shift.

Nobody standing behind the counter is comparing tonight's basket size to the same shift last month, or this cashier's coffee count against everyone else who works mornings. That comparison happens at corporate — by hand, weeks later, for a fraction of the stores, by the one or two people experienced enough to know what to look for.

And presence isn't a control. The partner working next to you isn't auditing you. Sweethearting and under-ringing look like a normal shift to everyone in the building — which is the whole reason they work.

Shop 214 · who's watching the numbers

Morningmanager on Afternoonasst. manager Evening2 partners Overnight2 partners

Staffed, every hour. Now the same week, by who is reviewing it:

Morningnobody Afternoonnobody Eveningnobody Overnightnobody

Weeks later is when the numbers get looked at — by one auditor, by hand, for a handful of stores at a time.

02Why it's invisible today

Your exception report checks two columns

Most exception reporting flags line voids and no-sales above a threshold — and the people taking money know it. Everything that actually drains a store lives somewhere else, in patterns that only exist across weeks.

↺

Post-sale voids

Ring the sale, wait for the customer to leave, void the record, keep the cash. The drawer still balances perfectly.

♡

Sweethearting

Free coffee for a friend. It never rings as anything at all — it just shows up as quietly lower sales whenever one person is on.

≡

Under-ring persistence

One $1.50 wobble is noise. The same wobble on 40 straight shifts is a pattern — and it stays under every threshold ever set.

◎

Lottery & fuel skims

All-cash channels with round-number tells: activation-to-settlement gaps, expired-but-live ticket redemption, drive-offs landing on exact dollars.

⌖

Orphan refunds

A refund with no parent sale — the single highest-yield tell in the category, and one almost nobody reports on.

The sub-threshold partner

If the report only surfaces someone above a fixed cut, the person just below it never appears — no matter how long the behavior runs.

03The loss you can see

You already know you're losing money. You're guessing at why.

Your audit finds what didn't match the books — we're short $500. Keystone catches the pattern before it reaches the books — and for the shortages you've already found, it connects the data you're sitting on to the reason they happened.

Today a corporate auditor digs backward and reasons it out: bad audits started around six months ago, a new hire started then, so it's probably her. That's an educated guess about a real person, built from memory. Keystone replaces it with a named, dated pointer — and the comparison that produced it.

What you get today

“Something's wrong at Shop 14. We're short $500 and we don't know where it's going.”

Somebody now reviews a whole shift of footage, or several, and hopes.

What Keystone hands you

“Cashier Smith, Tuesday evening shift, markdown pattern on FTG items, $47 cumulative — watch 07:42–07:45 on the DVR.”

Your guy watches thirty seconds instead of a whole shift. Same evidence, two orders of magnitude less labor.

04How Keystone sees it

It compares everything to everything, continuously

Every cashier against their shift peers and against their own history. Every shift, product, and store against its own norm, its district, and the chain. The comparison a great auditor does by hand — run for every store, every day.

A clean exception report doesn't mean a clean fingerprint. Coffee running a third under everyone else on the same morning shift, week after week, is a tell no threshold will ever catch. That's the first thing Keystone puts in front of you — with the comparison that produced it, the dollar exposure, and the exact DVR window to pull.

keystone · district overview

District 7 — this week

week 28 · updated 6:00 AM All 24 shops reporting

Exposure surfaced

$4,918

12 items need review

Shifts watched

504 / 504

every register, all week

Audit hours saved

41.5

9 packets auto-generated

Items cleared

verified normal — no action

What looks off — ranked

severity × recency × exposure

Review

Shop 214 · morning coffee running −33% vs shift peers

4th consecutive week · traffic normal · DVR window queued

$1,240est. 30-day

Review

Shop 307 · tobacco dip short on 3 audits running

tightened after last count · same opening shift · both partner-controlled keys

$43030-day est.

Verify

Shop 221 · markdowns collapse when no manager is scheduled

$212/day managed vs $71 unmanaged · waste or walkout

$846gap this month

Verify

Shop 118 · lottery variance clusters on one closing schedule

6 of the last 8 shortages share it

$3908-week drift

Watch

Shop 129 · drawer-open time creeping up on overnights

avg 11s → 19s over 3 weeks · still below the alert line

—early signal

Illustrative interface with demonstration data. Every row carries the comparison behind it, the dollar rail it belongs to, and what to check — never a conclusion about a person.

Open one item and you get the fingerprint, not an accusation

Transactions per shift: normal. Voids: normal. Traffic: normal. Items per basket, average ticket, and coffee per shift: well under every peer working the same daypart, consistently, on weekday mornings. That's a pattern worth thirty seconds of footage — and the screen says so in those words.

Keystone partner detail screen: a cashier's sales fingerprint compared against shift peers, showing coffee per shift down 33 percent and average ticket down 28 percent while transactions and voids read normal, with a note explaining what to verify on camera.

Demonstration data. The panel reads: “This is a data pattern to check, not a conclusion.” That sentence is enforced by the software, not left to whoever writes the report.

05Prevention, not autopsy

It stops loss before it happens

We don't wait for your count to be wrong. We watch the rate things are happening — and a rate moves weeks before a variance does.

An audit is a post-mortem: it tells you what already walked out, three weeks or three months after it started. Keystone is looking for the patterns that precede loss, which is why the intervention lands while the number is still small. Say something at $5 and it usually stops. Wait, and it compounds for six months.

↗

Markdowns jump 40% in two weeks

Flagged now — before the shrink shows up on a single count. Nothing is missing yet. That's the point.

▲

A manager's voids spike

Caught the week it starts, not after it's been running a month. And a manager on the void report is a root-cause tell in itself.

⊕

Nothing individually alarming

Low-level signals never break a threshold on their own. Keystone ties multiple pieces of data together across weeks and finds it early anyway.

◷

Weeks-to-months of head start

Loss surfaces long before it would reach an audit or an exception report — which is the entire difference between preventing it and accounting for it.

↺

Get in at $500, not $2,500

The drifting store identified three weeks early, and hit before the number grows. The same visit, at a fifth of the loss.

Most of it is carelessness

Roughly three-quarters of loss isn't theft. Early beats severe: coaching the careless 75% costs a conversation, not a case.

06The other half

It clears people as fast as it flags them

A tool that only accuses gets rejected — especially in a company where everyone knows everyone. Keystone spends as much effort exonerating as detecting: the slow cashier who's genuinely fine, the shift that looked off and reconciles, the high void count fully explained by store context.

Roughly three-quarters of retail loss is carelessness, not theft. The valuable, friendlier outcome is coaching that 75% early — and closing the other cases in seconds instead of carrying weeks of quiet suspicion about someone who did nothing wrong.

Partner profile · reviewed

Voids per shiftHigh

ReasonEBT-heavy store · split-tender corrections

Sales vs. peersNormal

Basket size vs. own historyNormal

DispositionCleared

No further review. High voids fully explained by store context — weeks of suspicion, closed in seconds, with the reasoning kept on the record.

07Detection that acts

The flag doesn't die in a manager's inbox

Detection was never the hard part. Getting anyone to act on it was. Managers get the report and don't follow up — so Keystone makes the first response automatic, and independent of whether anyone feels like doing it.

The fix that works is the early conversation: say something at $5 and it usually stops. Wait, and it compounds for six months. Keystone has that conversation at machine speed — then escalates on a clock if nobody responds, carrying the cost of the delay with it.

Step 1 · immediate

The cashier

A fair, private, coaching-toned heads-up at the first pattern. Never an accusation, never a verdict.

Step 2 · same day

The manager

The item, the comparison behind it, the dollar exposure, and the exact camera window to verify.

Step 3 · 48 hours

The district

Ignored items climb automatically. A "managers not following up" report is itself a root-cause signal.

Step 4 · escalated

Corporate

With the cost of inaction attached — and named on the desk of whoever sat on it.

08The other bleed: labor

The 4 AM count, deleted

Your auditors hand-count every item at dawn, then reconcile on a calculator across eight handwritten pages. Keystone turns that into a phone that already knows every price and does the case math — and writes the paperwork itself.

A typical audit cycle runs every few weeks per store, which means a pattern starting today may not surface for months. Automating the counting is what frees the auditor to have the conversation that actually prevents the loss.

Keystone counter app on a phone: a scanned coffee cup sleeve resolves to its retail price and case size, cases and loose units entered separately, with running category totals and a note that closing the count generates the audit packet.

▦

Scan, don't write

Every scan resolves price, key, and case math instantly. The count stays human; the data entry disappears.

✎

The packet writes itself

Close the count and the audit packet generates — variance against theoretical, before she leaves the cooler.

◈

Blind and attributed

The counter commits their number before any expected value is revealed. Append-only and attributed, with automatic recount requests — so nobody counts to the number.

Demonstration data. Case math, retail value, and running category totals resolve as she scans.

09Coverage

What it watches

Twenty-five detection signals across the register, the cash, the count, and the all-cash channels — every one carrying an honest confidence label and the comparison that produced it.

Register & cash

Void drift, delayed-void sequences, self-balancing patterns
Line voids and no-sales — against peer and self baselines
Under-ring persistence — sub-threshold, across weeks
Skim-without-drop and drawer-open duration
Till tapping — intra-shift sequence analysis
Orphan refunds and end-of-shift refund clustering
Manager override abuse — peer-normalized

Sweethearting & discount

Basket suppression — baskets that shrink for one person
Markdown and override abuse
Credit and discount violations
Repeat-receiver detection — the same beneficiary across discounts

Lottery, fuel & restricted

Activation-to-settlement variance by ticket day
Expired-but-live ticket redemption
Drive-off patterns and fuel attachment analytics
Phantom fuel refunds — the 3 AM refund with no parent sale
Restricted-category sales against restricted hours

Counts, waste & vendors

Blind, attributed, append-only counting with recount requests
Count-variance clustering — counting problem vs. pattern problem
Waste and expiry exposure before the dollars expire
Vendor reconciliation and expected-credit gaps
Audit-schedule optimization — which store to hit next, and why

Oversight of the oversight

Review-priority ranking — stores and people, worst first
Manager responsiveness on a separate rail
Precedent watch — today's pattern mix vs. the run-up to past cases
Coverage clock — events reviewed, days covered, gaps flagged
Silence treated as an outage — a store sending no data is never a clean report

Evidence & review

DVR pull windows on every flag — timestamp, register, what to look for
Camera blind-spot registry — caveats that cut both ways
One-tap void dispositions, permanently recorded
Conclusion-free case dossiers, generated not assembled
Append-only trails on counts, actions, and dispositions

10The liability spine

It never accuses anyone. That's architecture, not policy.

Ask any monitoring vendor one question: when your system flags someone and it's wrong, what exactly did it put in writing about that employee — and who's on the hook for it?

Keystone's answer is structural. The system reports data; humans conclude. There are no verdicts, no characterizations, and no accusatory language anywhere in its output — enforced at a single chokepoint in the code that every alert, document, and API response passes through. It's the reason these reports are safe to put in front of HR.

Monitoring-notice laws, by construction

No person is named in any output until a monitoring notice is both delivered and acknowledged. New York Civil Rights Law §52-c is satisfied by the architecture, not by a binder — and the same gate exceeds Connecticut's §31-48d posting standard and Delaware's acknowledgment path. In states with no statute, you're ahead of the law instead of behind a lawsuit. Per-store jurisdiction rules ship in the product.

⊞

Documentation a defensible process needs

Every flag carries a conclusion-free dossier, an action ladder, and a permanent trail: event ids, the comparisons behind it, DVR windows, and notice status. Append-only counts, attributed actions, immutable dispositions — evidence built to survive a dispute.

◫

Separation you can audit

Managers never see across shops — not in rows, and not in composed text either. Cash-pattern, operational, and count-variance dollars stay in three separate books, so a real skim can't hide inside operational noise and no single inflated number ever gets reported.

Built to exceed the applicable standards; multi-state entries are counsel-reviewed per jurisdiction at onboarding. Keystone does not provide legal advice.

11Fit

You replace nothing

Keystone isn't a POS and doesn't compete with one. It reads the journals your systems already produce and sits on top of the registers, cameras, and back office you own. The rollout is a login, not a hardware project.

⇄

Your POS stays

Journal presets for major convenience POS platforms today; a new export format is a parser, not a project. Part of onboarding is a POS hardening checklist — which controls to turn on in your system, then verification from the journal that they're actually being enforced.

▷

Your cameras stay

Keystone is DVR-brand-agnostic. Every flag ships exact pull windows — timestamp, register, what to look for — so a 40-hour tape review becomes a targeted two-hour one on the cameras you already own.

⛨

Your data stays yours

Single-tenant deployment per chain: your instance, your database, nothing commingled. You own 100% of your data, with full export and certified deletion terms written into the agreement.

12The math

The number nobody is putting in front of you

Conservatively, a single convenience store bleeds $100–200 a week in product cost to theft and error — and closer to double that once you count the margin you never earned on it. Across a chain, that's a multi-million-dollar line that never appears as a line.

Recovered, it isn't revenue with costs attached. It's margin already paid for — which is why the return case doesn't depend on catching everything, or even most of it.

Illustrative industry ranges for a chain of this size, not a forecast. The pilot measures yours from your own history.

$100/wk/storethe floor — product cost only

× 2 for marginwhat you'd have made selling it

× 400 shopsthe chain-wide bleed

$4M–$8M / yrrecovered, it lands as margin

Recover 15%$600K–$1.2M back to the bottom line

Audit hours savedanother audited store per week per auditor, no new hires

Catch it at $500not at $2,000 — the drifting store, identified three weeks earlier

13Straight answers

What Keystone is not

The credibility is the product. Here's where the boundaries are, before you ask.

Not a video platform

Keystone doesn't sell cameras or store footage. It tells your existing DVR exactly where and when to look. Direct click-to-clip against a specific DVR brand is scoped as a pilot deliverable.

Not computer vision

No AI watching the checkout. When you add vision or self-checkout, those events become one more input Keystone correlates against the journal and the drawer count.

Not your inventory system

It doesn't replace perpetual inventory or the back office. It's the layer that audits their honesty — which counts to distrust, and where variance clusters.

Not a black box

Statistical detection against self, peer, and seasonal baselines, with an honest confidence label on every signal, plus early warning matched against your own case history. Every flag can show its work.

Not a guarantee

No vendor can promise zero false positives, and anyone who does is selling you something. What Keystone claims is that it reviews everything — every transaction, every register, every day — and reports its own gaps when it doesn't.

Not a thief hunt

Most loss is carelessness. The default posture is coaching early and clearing the innocent quickly; the investigation path exists, but it isn't the point.

14The ask

A paid 60-day pilot. One district. Your real data.

Keystone runs on one district's actual numbers, calibrates to your baselines, and reports back exactly two things: the hours returned, and the loss your current reports missed.

Small enough to approve in one conversation. You see the return on paper before anything scales — including a dated accounting of loss that already happened, pulled from your own history.

Weeks 1–3

Wire the district's data. Comparison engine and weekly packs running on real baselines. Parsers validated against your actual journal exports.

Weeks 3–8

Alerts and the accountability loop go live. First items surfaced and verified on camera. Notice-delivery flow executed on your HR rails.

Day 60

Before and after: the hours returned, the exposure surfaced, the retro autopsy, and the number as it scales chain-wide.

Every store bleeds$200–400 a week.Keystone sees where.