- When enterprise-grade security evidence is required as a procurement prerequisite
- The vendor markets PCI DSS claims for the online store, but SOC 2 / ISO 27001 evidence was not found in public sources captured for this review. If procurement requires those artifacts, consider vendors with published security portals and AOCs or SOC reports available under NDA.
- When predictable, fully bundled pricing is a strict requirement
- The add-on model (marketplace connectors, accounting integrations, stock control, enterprise feature packs) can substantially increase cost relative to a single all-features bundle. Organizations seeking fewer modular fees should compare competitors' bundled tiering.
- When extensive third-party review validation is critical
- Public review volume for this product is low in the sources accessible to this review. Organizations requiring extensive peer validation should prioritize vendors with larger public review footprints or strong local references that can be directly contacted.
- When operations are outside Indonesia and rely on region-specific integrations
- Despite global positioning statements, the strongest documented integrations are Indonesia-centric. Global operators may prefer regionally dominant POS/ecommerce stacks depending on deployment region.
- Current limitations acknowledged by the vendor
- Public-facing marketing emphasizes product breadth and does not prominently list limitations; procurement teams should rely on trials, pilots, and a written Statement of Work for risk identification.
- Roadmap / "new" features
- The vendor markets an "AI" capability; available details indicate analytics and query assistance functionality rather than fully autonomous operations. Organizations should evaluate data access controls and accuracy for AI-generated insights.
- Scale limitations
- The vendor claims it can scale across outlet sizes, but public benchmarks (transactions/sec, documented max SKU counts, or maximum outlet counts) were not located in the captured materials.
- Security/compliance gaps (public documentation)
- Vendor asserts PCI DSS Level 1 for online store security, but supporting audit artifacts were not publicly published in the captured sources.
- SOC 2 and ISO 27001 were not publicly documented in accessible materials.
- Data residency and subprocessor list were not clearly documented publicly.
- SSO/SAML/SCIM capabilities were not clearly documented publicly.
- API limitations
- The vendor references APIs in marketing but comprehensive developer documentation was not captured in the accessible materials used for this review.