When we designed the biometric system for our institutional cafeteria clients, the question was: webapp or desktop? The answer depends on the real deployment context.

Why offline-first matters

During lunch rush (hundreds of people in under one hour), institutional mobile network saturation can push API latency to 3-5 seconds. A cloud-first webapp is unacceptable for this use case. WinForms offline-first: local SQLite match under 800ms guaranteed, regardless of network state.

Why C# WinForms over Electron/Tauri

The .NET 4.8 runtime is pre-installed on 99% of enterprise Windows machines. Our installer weighs 8.5MB including the DigitalPersona SDK. The U.are.U 4500 SDK has native C# bindings — no IPC bridge, no WebView, no additional latency.

AES-256 encrypted SQLite templates

Biometric templates are sensitive data under Colombian Law 1581/2012. Plain-text storage was flagged as Critical-2 in our April 2026 security audit (C-02). Fix: AES-256 encryption per template before SQLite storage. Local match (load all active templates, extract feature set, verify against each): under 400ms for a few hundred registered employees per site.

Heartbeat telemetry

Every installation sends a heartbeat every 5 minutes to our FastAPI server. Fail-silent on the client (a network error must not interrupt offline biometric operations). Server-side: 15-minute silence triggers a Telegram alert before the client calls. Each active site generates 150 to 200+ heartbeats per week. Those numbers are contractual SLA evidence.

RSA-2048 signed licenses

JSON payload (tenant_id, machine_id, expires_at, features) + RSA-2048 signature verified against hardcoded public key at startup. Machine ID = SHA-256(CPU_ID + board_serial), truncated to 16 chars. One machine, one license.

The most expensive lesson

Not encrypting templates in v1. The security audit found it. Remote remediation via the auto-update system: no physical site visit required. Today, v2.0.0.0 is on the server waiting for distribution. The auto-update flow is the most operationally valuable feature we built.