We are a software house.
Retail is one of the cases.
We are known for 24/7 autonomous stores, and that is only part of it. We also build vademecums with audited dosing, marketplaces with identity verification, bots on the official WhatsApp API and multi-tenant panels with Spanish tax handling.
Every family below rests on something that is running, with figures that can be checked. Anyone can write a list of technologies.
01
Critical software with auditable data
When a wrong number is a clinical or regulatory error, not a cosmetic bug.
There is software where a wrong figure shows up the next day, and software where it shows up in a post-mortem or an inspection. In the second case it is not enough for the code to work: you must be able to prove the figure is correct, where it came from and who validated it. We build systems where verification is part of the product, not a phase that gets cut when the deadline bites.
What proves it
- A veterinary vademecum in production with 132 dose rules verified across four independent planes, and a mutation test that injects 559 errors and catches 556.
- A biotech manufacturing system where every figure carries its certainty level and its evidence, and nothing experimental can release a batch. 356 automated tests.
- A gate on deployment: if the data audit fails, publishing aborts.
02
Apps and PWAs for field work
No signal, wearing gloves, in direct sunlight. That is where it actually gets used.
An app that only works on wifi and indoors is useless in a pen, on a site or in a warehouse. We design for the worst case: no network, screen in the sun, thick fingers. That drives concrete decisions —touch target size, contrast, what gets downloaded ahead of time— and it is verified by measuring, not by opinion.
What proves it
- An installable app that reloads fully with the network cut, checked on every deployment.
- Eleven screen sizes verified: zero overflow, zero text under 11 px, zero touch targets under 40 px.
- A high-contrast mode for reading in direct sun, and contrast verified against WCAG AA with the real composited background.
03
Retail, point of sale and money control
Where there is a till, the backend decides. Never the client.
The moment a system takes money it stops being an app and becomes accounting. Price is decided on the server —never accepted from the phone—, every charge is idempotent so a double tap does not charge twice, nothing is ever deleted and every void leaves a trail. It is not paranoia: it is what separates sales software from a money pit.
What proves it
- A POS with till opening, closing and cash count, discrepancy calculation and per-role discount caps. 168 automated tests.
- Stock movement ledger, per-store price history, logical voiding and returns with cumulative control that prevents over-refunding.
- Store isolation verified with centralised guards across 121 API handlers.
04
Marketplaces and trust platforms
Verified identity, reputation and payments. The catalogue is not the hard part.
Building a classifieds board is easy. The hard part is two strangers closing a deal worth tens of thousands without knowing each other: you must verify who each one is, stop them leaving the platform in the first message, give disputes a channel and move money without becoming a payment institution. That is what we build.
What proves it
- Biometric identity verification with document, selfie and liveness, never storing the image or the document: only the status and the evidence of consent.
- Detection of attempts to take the deal off-platform that beats the usual evasions —numbers spelled out, “at”, “dot”— without wrongly blocking a nine-digit price.
- Dual payment rails by country, seller reputation unlocked by mutual handshake, and a dispute queue with suspension.
05
Conversational bots and applied AI
WhatsApp, Telegram, voice and vision. With deterministic guardrails where it counts.
A language model is excellent at conversation and terrible at guaranteeing. So whatever must not fail is not entrusted to the model: it goes into deterministic rules that can be tested. The model attends, understands and replies; decisions with consequences are made by auditable code, or by a person.
What proves it
- A sales bot on the official WhatsApp API with verified signatures, language detection, technical datasheet delivery and handover to a human with a web inbox.
- In a health case, risk questionnaires run on buttons and rules, not on the model: 100% accuracy on its test battery and zero leaks across 17 red-team attacks.
- A physical interface with a 3D robot, camera-recognised gestures and voice with a wake word, configurable per client.
06
Multi-tenant SaaS and admin panels
Several companies on one instance, each one's data where it belongs.
A multi-tenant panel always breaks in the same place: someone queries by identifier without filtering by company, and suddenly one client sees another's data. It is solved with centralised isolation, not with care — care runs out by the third screen. And the panels we build are capable, not mock-ups: if it has to issue invoices with gapless fiscal numbering, it issues them.
What proves it
- A panel with CRM, invoicing with gapless fiscal numbering, accounting, a Spanish tax module, double opt-in newsletter and an automatic daily digest.
- Per-company isolation through shared scoping functions, with per-administrator permissions and commissions.
- A quarterly pack for the accountant: issued-invoice ledger, income and expense ledger, and one PDF per invoice.
07
High-performance web with SEO and GEO
Server-rendered content, structured data and genuinely multiple languages.
AI search crawlers do not run JavaScript: what is not in the server HTML does not exist for them. And a “multilingual” site that translates the buttons but leaves the content in one language ranks in no other market. We do both properly, and check it with tests that fail the deployment if something breaks.
What proves it
- Forty city silos native in five languages —native content, not half-translated— with nine-variant hreflang and nested structured data.
- Over a hundred taxonomy pages generated with incremental regeneration, and automatic `noindex` when a category runs out of content.
- Initial payload cut by 77% in one case, measured before and after instead of assumed.
08
Self-hosted infrastructure and operations
Own servers, email that arrives and backups known to restore.
Hosting on your own servers takes more work and gives more control: the data is where you say it is, the bill does not spike by surprise, and no provider can cut you off over a quota. In exchange you must do the boring part properly —certificates, email, backups— and check it works instead of assuming.
What proves it
- Six production servers with self-renewing certificates and automatic proxy reload.
- Email with verified SPF, DKIM and DMARC, including resolving a real incident of a compromised mailbox used as a spam relay.
- Backups with genuinely tested restores: a weekly process restores them into a scratch database and compares. A backup nobody has restored is not a backup.
FAQ
Frequently asked questions
Does Scan and Buy only build autonomous stores?
No. Autonomous retail is the line we are known for, but we build custom software across eight families: systems with auditable data for regulated sectors, applications for field work without coverage, point of sale and money control, marketplaces with identity verification, conversational bots, multi-tenant panels, web with SEO and GEO, and self-hosted infrastructure.
Which sectors have you worked in?
Retail and hospitality, veterinary and animal health, biotech and laboratory, agriculture, construction and refurbishment, health, hotels and personal branding. The technology repeats across sectors; what changes is the regulatory framework and the user's vocabulary.
Do you work with clients outside Spain?
Yes. There are projects in production for Spain and for Argentina, with different payment gateways, currencies and regulators by market, and native content in up to five languages. Adapting by country is not translating: it is changing the payment method, the currency, the regulator and the registration the user expects to see.
What does it mean for data to be auditable?
That you can prove it is correct, where it came from and who validated it. In practice: every figure declares its source, automated checks verify it from independent angles, and deployment aborts if any of them fails. In a veterinary vademecum in production that means 132 dose rules verified across four planes, with a mutation test that injects 559 errors and catches 556.
Do you host yourselves or on third-party cloud?
Our own servers, with self-renewing certificates, email with verified SPF, DKIM and DMARC, and backups whose restore is genuinely tested every week. It takes more work and gives more control: the data is where we say it is and no provider can cut the service over a quota.
What do you need to build?
Tell us the problem, not the solution. We'll handle the latter.