FIG. 6 shows the operation of modules 22 in processing a request for a digital postal indicium. At 72 the selected one of modules 22 receives the indicium request and the requested meter record and, at 76 confirms that sufficient funds are available. If not the request is rejected at 78; again in a manner whose details form no part of the subject invention. At 80 the selected module constructs an indicium message having an appended indicium signature, which when printed in relevant part on a mailpiece will evidence payment of postage in the amount shown, and at 84 updates the requested meter record and appends a meter record signature. Generation of indicia and updating meter records is more fully described in specifications for the Information Based Indicia Program (IBIP) published by the United States Postal Service and further discussion is not believed necessary for an understanding of the subject invention.) At 86 the selected module updates the audit data. (Updating the postage and transaction data is a matter of simple addition. Updating of the error correcting code will be described further below.) At 88 the updated audit data is stored in nonvolatile memory 24, and at 90 the signed indicium message and signed meter record are sent to server 14 for processing as described above. The audit data and the indicium are transmitted to the server at the same time. The indicium is forwarded to customer 12 and a copy of the audit data is stored in server 14. While perhaps less secure than data stored in modules 22, audit data stored in server 14 can be verified against that in modules 22 and can be used, for example, when a module is off-line.