Operations intelligence,
written by operators.

One says what left the shelf. The other says who received it and whether they should have. Our batch trace answers the first properly — every movement, every location still holding it, quantities in, out and remaining. There is no patient anywhere in the product, so it stops at the door, and that is a boundary we intend to keep.

First-expiry-first-out is a sentence in a procedure manual and a suggestion at the point of issue. What decides whether it actually happens is which batch the system proposes when somebody is dispensing at four in the afternoon with a queue.

You type a minimum you are never willing to go below. Until October 2026 a nightly job recalculated it and wrote its answer over yours; now a typed figure is kept, till sales count as usage, and each warehouse can hold its own level. What a par level is, and where it should live.

A batch with four months left is stock you can sell if you move it now. A batch with four days left is a write-off that has not been declared yet. Most pharmacy systems hold both as the same number, and the day the difference becomes visible is the day it stops mattering.

Toll millers, cut-make-trim units and fabricators hold large quantities of somebody else's material. There is no ownership field anywhere on inventory, so by default it is all on your balance sheet.

Two of the reasons on your stock-issue list post a receivable and sales revenue — at the item's selling price unless a sale value is entered — with no customer, no invoice and no tax. The form now marks which two and wants a second approver; the reason list is still worth auditing.

Material issued to a job used to be expensed at once and the finished output arrived as a debt to nobody. Both are fixed. What is left is the residual between what a job consumed and what its output was priced at — and why that number is worth reading rather than clearing.

Bills of materials and assembly orders are built; yield variance, standard cost and a production schedule are still yours to run. What a small Kenyan factory can do on that basis — and which of four kinds of factory it fits.

Ninety-four cartons left Industrial Area and eighty-nine arrived in Eldoret. The system knows what went on the lorry and what came off it — and has no opinion about the person in between.

Passbooks, receipt books and cheque leaves are accountable documents, not consumables. A stock count that agrees on quantity while nobody knows which numbers went where is not a control at all.

Expired stock and clinical waste are one control problem in two uniforms. The leverage is not the bin — it is the held state that stops stock being dispensed before it stops being present.

A caesarean consumes roughly the same forty items every time. Held as a procedure pack, one click raises a single check-out for all forty, so component stock stays true instead of drifting until the stockout is found in theatre.

A restaurant, a bar and a pool bar are four businesses drawing on one set of stores. There is no outlet entity, so an outlet is a location plus a counter — and a counter belongs to one person, which quietly rewrites your bar rota.

Staff meals, the manager's table, complimentary covers and guest amenities are why your food cost reads six points worse than it is. The movement is well handled here; the department you want to attribute it to is on neither an expense nor an adjustment.

A shirt in four colours and five sizes is twenty items, which is the correct structure for most retail rather than a workaround — but naming becomes load-bearing. The decision to make before your first five hundred items, and the variant grouping we can add if you outgrow it.

Cycle counting only works if the system can stop the sale that happens mid-count. This one does — the freeze reaches the till with a readable reason — plus blind counts, assignments and thresholds that clear the noise. One dimension is missing.

A hold here is a rule rather than a note — held stock genuinely cannot be issued. What that gives a school laboratory, what an inspection can be shown from records, and the one gap that depends entirely on whether somebody reads their email.

Updated October 2026: every item now carries a unit of measure, and an item in kilograms or litres holds 12.5 kilos exactly. One item still holds one unit, so choosing it well — the smallest you ever transact — matters, and conversion between bags and kilos is the piece we can add.

Three automatic stock alerts now watch an input store, and every input they read is a number somebody typed. Which of them helps a business that buys once a season, which will train your team to ignore it, and where the notice period is actually spent.

An asset is held by a person; consumable stock is held by a place. That asymmetry is why spray gangs, pickups and satellite stores end up modelled as warehouse locations — the workaround, its limits, and when to use a real custodian instead.

The one place serial tracking pays back in the first month. Read the serial and you know when it came in, when it sold and who supplied it — and six failures from one purchase order becomes a claim against your supplier.

Thirty vehicles, each individually costed, individually aging, each carrying unfinished paperwork. Item-per-vehicle is the model that works — and if credit is how you actually sell, this covers the yard and not the business.

An internal workshop has nobody querying the bill, which is why fleet stores leak more than commercial ones. Cost per vehicle without a vehicle record, tool custody that works, and the honest position on service scheduling.

The hardest inventory problem in Kenya, and not because of volume — the same alternator carries four names, so stock is counted three times and one person holds the mapping. What fixes it, in what order, and the vehicle record this does not have.

Overstock has an invoice; a stockout has no document at all. Which is exactly why every business carries too much of the first and cannot tell you what the second costs. The four layers of a stockout, and where the two curves cross.

Four effects you can actually measure, how to get a before-figure for each, and the honest reason two of them are smaller than any vendor said. Including why one figure should be left deliberately blank.

The figure you type on day one is what every future variance is measured against. Why the opening count has to be blind, what a proper count costs against copied figures, and how to value stock you are counting in.

The instinct is to bring eight years across. That is how a clean system ends up full of dirty data. The three categories of record, only one of which travels, and the four hours of deduplication that decide whether your reports mean anything.

Manufacturers price from a bill of materials and lose money on the difference between the recipe and the run. Where yield, landed cost and rework belong, why contribution beats full cost for pricing, and the quarterly re-derivation that keeps a price list honest.

Buyers increasingly ask which farmer, which day, which lot — and confine aggregators who cannot answer to the spot market. Choosing what a lot is, why backward traceability is the hard direction, and the distance between a record and a certification.

A clinic can be busy, well-run and quietly losing money on half of what it does. Building a consumable cost per service in an afternoon, and why waste concentrates in your least-used service rather than your busiest.

Linen is the stock nobody counts because none of it is expensive, and one of the largest recurring purchases in the building. Par levels, the quarterly circulating count, and amenities as a cost per occupied room night.

A shocking share of Kenyan produce is lost between farm and buyer, invisible because nobody measures where. Turning loss into a number at each step protects the margin.

Advancing seed and fertiliser on credit grows farmers — and quietly loses money when it is tracked as neither stock nor debt. How to run check-off without the leak.

Materials are the biggest job cost and the easiest to lose — not dramatic theft, a hundred small unmeasured gaps. Close them by measuring flow, not suspecting people.

A stockout is a clinical event and expired stock is money in the disposal drum — batch tracking, FEFO, consumables par levels, and the weekly hour that runs it all.

"I bought 3 tonnes of maize and sold flour — did I make money?" Recipe control, yields, landed costs, and quality holds for Kenyan processors.

Perishable stock, un-weighable portions, thin margins — store-to-kitchen flow, food cost decomposition, and the daily counts that decide the month.

Shrinkage is five problems, not one — theft, miscounts, damage, short-delivery, and paper sales — and each hides in a different gap. Close them all.

Expiry routinely eats 3–8% of drug spend invisibly. Where it comes from, the 30/60/90 routine, and the purchasing habits that stop it at the source.

The batch loop — plan, issue, produce, receive, reconcile — and the two numbers per batch that separate measured processors from hopeful ones.

The kitchen loses money in percentages; the bar loses it in bottles. Nightly bottle math, pour discipline, empties fraud, and variance by shift.

Supplier fraud starts with a bill, not at the bank. Whoever enters or last edits a supplier bill can no longer approve it — the rule the payment run already had — and a one-person finance team is not locked out.

Splitting a purchase to stay under a tender ceiling is the pattern every auditor looks for first. Our product will not spot it, and the reason is structural rather than a missing report: a procurement request in our system carries no money at all, and its department is free text. There is nothing at the moment of the split to compare against a threshold.

Almost every prequalified supplier list has the same defect: nothing removes anyone. Ours has a shelf life — a validity period you set, a date stamped at approval, and a job that runs at six every morning, expires the qualification and deactivates the supplier so they drop out of the selectable list. Here is the whole pipeline, and the five things it does not do.

Every procurement system advertises controls. The narrower question is where it will actually stop you. Ours stops you in exactly three places — and a budget overrun is not one of them.

Most approval controls ship as a settings toggle nobody finds. Expense approval switches itself on when you grant the permission — which makes the grant the policy decision, and removes the second source of truth.

Most Kenyan distributors do not own a fleet, they hire one. So transport is not a fuel problem but a rate problem: the arithmetic on the invoice is right, and nobody is checking the rate it was multiplied by.

You checked the WIBA policy, the NCA registration and the tax compliance certificate before they came on site. Eight months later one has lapsed and nothing knows — because the reminder machinery is pointed at a different module.

Four days, eight people spending across four committees, and a total that only exists after somebody spends a weekend assembling it — six weeks after every decision it should have informed.

Procurement controls fire when somebody raises a requisition. A contract renewing automatically raises none — so twenty obligations escalate quietly at whatever clause fourteen says.

Four of its six actions contain no language model at all — they are keyword tests and arithmetic. Why that is the right design for automation, and four experiments that test any vendor's "AI-powered" claim in twenty minutes.

The questions that cause trouble at a SACCO AGM are almost never about the loan book. Preparing the four predictable ones with evidence created during the year, and why a depreciation schedule cannot answer where the vehicle is.

The largest cost category on most projects has the weakest evidence behind it. Valuing work instead of processing a claim, comparing issued materials against valued progress, and mirroring retention on both sides of the chain.

A budget approved in January and consulted in November is a forecast that was overtaken. Vote heads as controls with owners, why committed spend is the number that matters, and budgeting by term rather than by thirds.

Retail margin is won at the buying desk and lost in the details nobody records. The four things you agreed, the check that pays for itself, and why longer terms can beat a lower price.

A firm with no cost of goods leaks money through overhead — subscriptions nobody reviews, disbursements never recovered, buying nobody approved. How to close the gaps without making finance the enemy.

What NGO teams should look for in an ERP — donor fund segregation, procurement governance, asset registers, and Kenya-specific compliance — with a practical evaluation checklist.

Term dates are known years ahead — yet week one is always a buying emergency. The term procurement cycle, the big four contracts, and kitchen arithmetic.

Freight, duty, clearing, transport, and currency all belong in the unit cost — or your margins are fiction and your best-sellers may be priced below cost.

The AGM question is never subtle: who supplied, at what price, who else quoted? Thresholds, conflict-of-interest discipline, and files that answer for themselves.

The seven procurement problems behind most NGO audit findings — emergency purchases, quotation theatre, undocumented approvals — and the fixes that hold up in the field.

Three supply chains in one apron — contracted dry goods, daily fresh buying with price-survey bands, and protein weighed twice. Each leaks differently.

Reorder points from consumption, shelf-life terms in writing, supplier performance tracked — the upstream half of facility stock control.

A complete, adaptable procurement policy for Kenyan NGOs — thresholds, committees, conflict-of-interest rules, and emergency procedures you can copy into your manual.

Churches buy constantly and own more than they realize — yet do both on trust and memory. Governing the spending and registering the assets is stewardship the members are entitled to expect.

The asset dashboard used to draw a flat 20% a year for everything. It now shows net book value as your depreciation posted it, counts the assets it cannot depreciate, and reminds people when equipment is due back or a warranty is ending.

Our asset register can tell you exactly what a departing officer holds — the list is one click away on their own record. Nothing in the process of them leaving asks the question, moving one person's custody to their successor is one action per asset, and while the incoming custodian can now sign for what they take, nothing requires them to. Three specific gaps, each of them closable with a line on a clearance form.

The asset register always knew who holds the cold-chain unit, where it stands and when somebody last laid eyes on it. Since October it also holds the date on the laminated card: a maintenance schedule that opens a work order before calibration falls due and chases the person responsible.

Two years on, somebody asks what the branch cost and nobody can say. A budget line fragments by category and resets at year end; a project holds the whole thing — with two gaps worth planning for.

Books go out in January to learners who exist in no database you own, and some come back in November. Which custody mechanism to bend, how far it bends, and the annual habit that stops the register quietly becoming a work of fiction.

You bought twenty laptops as stock and four are now staff equipment. That is a unit leaving your stock ledger and reappearing as a tracked asset — in two phases, with an approval in the middle and a cost basis inherited from your weighted average.

A record saying "issued to J. Otieno" settles nothing. One with an approver, a location and a verification date settles most things. And the default for the most important setting gates nothing at all until you configure it.

One needs twelve records, the other needs one record and a count. The choice quietly determines whether your register is maintainable — and it is much harder to reverse than to make.

Two different documents doing two different jobs, and conflating them is the most common mistake in Kenyan fixed-asset practice. Exactly which one you have today, what the dashboard's net book value counts and what it carries at cost, and what still needs a person at your year-end.

A cooperative tractor is a member service, a revenue line and an asset quietly consuming the society's surplus. Costing an hour honestly, the hire log that replaces an hours meter, and presenting the subsidy members never voted for.

The return trip costs more than the margin on the original job. Why two of the five causes are intake failures, treating each van as a counted stock location, and the parts you fit but never bill.

Buses are the most expensive assets most schools own and the least documented. Why the odometer reading at the pump is the whole fuel control, what a trip log should leave behind, and whether the transport fee covers the service.

Getting an asset onto the register is the easy half. Five ways assets leave, why scrapping needs its evidence created before the item is gone, and the rule that keeps a register credible: retire, never delete.

The generator that failed had been serviced twice in four years and nobody could say when. Maintenance as a recorded movement, the rising-frequency pattern that decides repair versus replace, and a preventive schedule that opens its own work orders.

Maintenance is where agencies lose money and trust at once — through repairs nobody tracked, approved, or verified. A work-order discipline from report to verified-closed.

A contractor's plant is capital designed to move — which is why it goes idle, goes missing, and breaks down unplanned. Custody, movement history, and service discipline.

For installers, distributors, and service crews the office is wherever the van stopped — job evidence, traveling stock, custody, and fleet discipline in one guide.

Broken equipment announces itself; miscalibrated equipment misdiagnoses quietly. Three maintenance tiers, calibration discipline, and the replacement horizon.

The auditor's schedule says what was bought; nothing says where it is. Fleets, branch fit-outs, ICT custody, repossessed collateral, and the register that survives elections.

Cost per vehicle, fuel-to-distance baselines that beat gadgets, and the route math that decides which vans deserve to exist. A method rather than a module — the honesty block says which parts we hold.

Schools budget annually for equipment they already own. Custodians by name, term verification rhythms, and maintenance that beats breakdown.

Collections fail between the first reminder and the first phone call. The dunning ladder sends staged messages by email, SMS and WhatsApp at the days overdue you choose, escalates to your own team, pauses for a customer on a plan — and lets a saved card pay a recurring invoice before anyone is chased.

Margin is rarely lost in one bad negotiation. It is given away in a hundred small concessions nobody recorded, by people trying to close a sale — which is why the fix is structural rather than motivational.

A credit limit stops the next invoice to a client who has stopped paying. Nothing stops your team logging another two hundred hours to them — one report will now tell you how many, but none of them refuses the hour.

A firm that sells time runs two separate clocks — the one payroll pays from and the one it invoices from. Only one can be locked at month end, and it is not the one you bill from.

A clinic billing KES 4m a month at ninety-day settlement permanently carries KES 12m of somebody else's money. Why you must measure two ages rather than one, and why a third of your ageing is yours.

A massage has no stock, and now it carries none: a service item sells at the till with nothing to allocate, books to its own income account and is bought through a confirmed delivery. How to set up a treatment menu, when to use the till or an invoice, and what a spa still plans around.

Corporate accounts and long-stay guests need the same invoice on the same day of every month. Credit limits, statements, matched payments and automatic chasing are all built. The generating is not — and an invoice nobody raised is completely silent.

Leads, deals on pipeline stages, an activity log and a weighted pipeline now sit ahead of the quotation. Where the seam falls, the four things a pipeline gives back, and why speculative quotations are still the worst available fix.

Exposure is the opening balance plus every open invoice plus the one you are raising. What the check measures, why paying frees headroom immediately, and the setting that silently switches it all off.

A commission scheme runs accurately here in about an hour a month, on data you already capture. The one join between user and employee to set up first — and the targets and automated commission engine we can add when the manual month stops scaling.

A return is the money, the stock and the story — and only the first is a credit note. Credit notes here carry an amount and no lines, and move no stock at all, which is how inventory quietly drifts upward.

A 38% landed uplift turns a 30% markup into a loss, and that is the ordinary imported container rather than a bad one. Three customers at three prices, and the supplier contract that holds your buying prices to an agreed rate.

A dollar-priced subscription is an unhedged monthly currency position renewed forever. What a 20% move does to it, the three second-order costs nobody quotes, and the difference between a contract currency and a display currency.

Whatever a vendor charges for, you will ration without deciding to. Per-user pricing pushes you into shared logins; per-module pricing breaks the records-referencing-records that made an integrated system worth buying. How to read either shape.

Real numbers in shillings, ours included. What the subscription costs, what the first three months cost on top of it, and the three line items every quote leaves out because they are your hours rather than the vendor's.

The cheapest sale a business can make is the second one to a customer it already has — and the reason most do not make it is that the record of the first sale lives in a salesperson's phone.

Kenyan businesses lose far more to slow payment than to bad debt, and chasing harder is rarely the fix. Most late payment is friction you created at invoicing — plus the escalation ladder for when it is genuine.

The delivery note that comes back illegible is why an invoice gets disputed six weeks later. Why a printed name beats a signature, how to express a partial delivery, and treating delivery paperwork as a receivables control.

Nobody decides to become a lender; it happens one favour at a time. Why exposure matters more than the invoice at the counter, how to set limits from behaviour, and the collection rhythm most retailers waive for their biggest customer.

License models, the implementation costs nobody quotes upfront, honest three-year totals in KES, and the questions that expose hidden pricing.

A closed till now waits for a supervisor who is not the cashier, the variance is journalled to Cash Over and Short when they sign, every M-Pesa and card payment keeps its reference, and each sale keeps the cost it was made at.

A cash session here is a real record — declared float, recorded drops, a counted close and a stored variance with a name on it — and the till refuses to sell without one. There is one catch that finds every shop on its first shift change.

A return runs stock, revenue, cost and cash backwards at once, and most of that is built and enforced here. One tender on the refund dropdown was implemented nowhere, and the ledger was quietly missing a leg on every refund ever given.

The counter cannot sell on credit, by design, and there is no fee account to charge. Two shapes a school shop can take, why the credit limit is the control that matters in week one, and the small thing that decides your whole term's collections.

A tenth off the price is two fifths off the profit, nothing goes missing from the shelf, and in most Kenyan shops nobody can tell you who authorised any of it. The arithmetic, the till limit and supervisor PIN that now exist, and the habits that still do most of the work.

One boolean per item decides whether VAT is added on top or extracted from within. Get it wrong on an imported catalogue and every sale is out by sixteen percent — quietly, until somebody reconciles a return.

A till is not a place in your shop — it is a record with a name, a warehouse, a location and exactly one person attached. Almost every argument about a short drawer traces back to one of those four fields being wrong.

The customer pays part by phone and the rest in notes. What your till records decides whether tonight's drawer reconciles — and recording it wrong manufactures shortages that nobody can trace.

Two independent guards against double filing, retries with backoff, the signed receipt stored on the invoice — and the two gaps a VAT-registered business must decide about before go-live: credit notes, and what a till does offline.

eTIMS is the one fiscal regime on this blog we integrate with rather than reconcile against. What changes at the counter, what happens to returns, and what to confirm with KRA.

The end-of-shift count is where most Kenyan retail disputes happen, and almost all of them are arithmetic nobody wrote down. The float, the drops, the expected figure and the variance.

The smallest document in your business and the one customers most often need. What belongs on the slip, why a stored copy settles disputes paper cannot, and the practical realities of digital receipts in Kenya.

Four decisions hide inside every return, and collapsing them into one hurried moment is what breaks the records. Why restocking must be deliberate, how exchanges are really two transactions, and how unrecorded refunds manufacture till shortages.

A till that sells and a stock system updated later will disagree by Friday. The warehouse behind each counter, the batch that leaves with the sale, and why the system should refuse a sale it cannot supply.

eTIMS on every receipt, shrinkage visibility, multi-branch control, and a straight answer on what happens when the line drops — what to demand from a retail system, with an evaluation checklist.

The 20-minute evening routine that keeps a shop honest — cash, M-Pesa, and card reconciled against the system, shift by shift, variances named.

A leaver’s final pay is assembled from the calendar, the leave balance, the contract, the loan ledger and the advances book. It is now its own payroll run: salary to the last day, leave encashed, notice pay, recoveries that never go below zero, and a Taxable switch HR decides.

Paying a bonus after payroll has gone out should not mean reopening a paid run, or taxing the bonus as if it were the month’s only income. Off-cycle runs pay chosen people, and every payslip is taxed on the month’s combined pay.

The board approves an establishment in November and by May nobody can say whether the organization is on it. The headcount plan sets planned seats and cost per head by position against the people and vacancies already on record.

A fixed-term contract runs out on a date nobody diarised, and the person keeps working. One Expiring soon list now shows contracts, probations, end dates and documents about to lapse, alerts HR and the line manager, and never expires a contract by itself.

A church pays pastors, employs support staff, relies on volunteers and hands honoraria to visiting ministers. Four relationships that look alike on a bank statement and are entirely different in law.

The roster is a plan and attendance is a fact, and the gap between them is the information you actually want. Plus why the locum paid from petty cash is invisible to every cost figure you have.

A school pays some staff, records others it does not pay, and hires more each term. There is one regular run per month with no pay groups, and no exclude-from-payroll flag — so keeping government-paid teachers quiet is a decision you make once, deliberately.

The only pay basis held is a monthly salary. What actually works for harvest crews and fundis paid by the day, the two employment-type vocabularies that do not match, and the legal clock nobody is watching.

A six-day week, Idd on a date nobody can print in January, and a leave balance that survives an argument. One setting drives leave, approval deadlines and SLA clocks — and attendance deliberately ignores it.

Most Kenyan employers have staff with no company email and no login. Two distribution paths, one token and PIN across four portals, and the finalised-runs-only guard that prevents the realistic incident.

An advance recorded as an employee loan is deducted by payroll in instalments, never more than the balance or the net pay left, and offered for recovery at final settlement when someone leaves. What the record holds, what the employee sees, and the consent that stays yours to collect.

The employee file is the least glamorous thing in HR and the first thing anyone asks for — in a dispute, at an audit, or when the person who knew everything about your staff resigns.

Leave is the first thing employees dispute and attendance is the first thing that quietly corrupts payroll. Both are the same problem: a record that either exists when it happened, or gets reconstructed later from memory.

Four statutory deductions, four sets of rules, and rates that move. What a Kenyan payroll run should do, why date-effective rules matter more than the arithmetic, and the reconciliation that catches errors before the money leaves.

The hardest question in a professional firm, usually answered by asking around. Capacity as a number rather than an impression, why utilisation targets create the wrong behaviour, and the weekly meeting that beats any tool under fifty people.

The largest controllable expense, paid from members' money, discussed in front of the members. Date-effective statutory rules, allowances that need a record made before payment, and presenting a wage bill as four drivers rather than one total.

Overtime is the payroll line nobody can defend and everybody pays. Why derived overtime beats claimed overtime, where the approval step earns its keep, and why the multiples that price it are yours to set.

Exits run on goodwill and a cake, and the risky parts get done later by whoever remembers. The four workstreams, why you reassign before you revoke, and the logins no offboarding process ever touches.

What each Kenyan compliance regime actually requires from your system — eTIMS invoicing, statutory payroll, withholding, records — plus vendor test questions.

The statutory stack done right, plus the NGO layer: allocating staff costs to grants, paying casuals and enumerators properly, and the monthly reconciliation triangle.

Every foreign-currency invoice and supplier bill now carries its exchange rate, posts in base currency at that rate, and books a realised gain or loss when it is paid at another. Without a rate, nothing posts — and reports still never add currencies.

A VAT-registered customer paid VAT on every invoice and could not claim any of it, because each one reached eTIMS as a consumer sale. The KRA PIN on the customer record now travels as the buyer PIN on invoices, POS sales and credit notes — cleaned, checked, and left off only when it would bounce.

A manual journal is the one entry no document stands behind. Journals are now drafted, approved above a threshold by someone other than their author, numbered only when they post — and once posted, undone only by a linked reversal that stays on the ledger.

A close answers three questions: did we hit the plan, is anything undone, and where did the cash go. GL budgets compare each account with the ledger, the close checklist works out most of itself, and the cash-flow statement is rebuilt by the direct method for any dates.

Our budget module gets the hard part right: money leaves a budget when the order is approved, not when it is paid, and a cancelled order releases the commitment. What it does next is the part to know about — it works out that you are over, approves the request anyway, and sends a notification explaining why. A control refuses; this one explains.

Cost-to-income is the one ratio every SACCO board knows and almost none can defend. Most societies could move theirs five points through classification alone — which means the number currently carries no information.

Residential and commercial letting sit in different tax regimes with different invoice obligations. And the compliance risk in eTIMS is not the invoices that transmit — it is the ones that quietly did not.

"Sync" does more work on integrations pages than any other word in software marketing. Ours pushes vendors, items and purchase orders out on a button and reads nothing back — including a note on where our own connector copy overstates it.

The feature that removes a daily job: a C2B payment quoting an invoice number attaches itself to that invoice. Collections, disbursements and reversal on your own Daraja credentials — plus the four gaps to plan a payout process around.

Running both systems is correct for one module, for four weeks, with a stop date announced in advance. The weekly reconciliation that makes the double work worth it, and the one thing that destroys the test entirely.

Stock gets counted; the financial side has no equivalent. The opening position arrives in two halves — open invoices and bills as real documents, everything else as one manual journal — plus why your chart of accounts has no numbers, and what stays with your accountant.

Nobody ever went bust on expense claims, which is why they go unmanaged for years. The four structural gaps that make ordinary behaviour expensive, and the approval design that closes them.

Profitable businesses run out of money regularly, and almost always with two weeks of warning nobody was looking at. A thirteen-week rolling forecast you can maintain, built from records you already have.

Every business runs on a rhythm of statutory deadlines, and missing them costs penalties. The recurring compliance calendar in plain terms — and how to let your system carry it.

Year-end is only painful when treated as an event instead of a consequence. The practical close checklist for a Kenyan SME — and how to make next year's close a formality.

A practical system for tracking restricted funds from grant agreement to donor report — fund segregation, budget lines, burn rates, and audit-ready advances.

One invoice per student, a unique payment reference, all channels into one ledger — how bursars end the evening matching game and make arrears report themselves.

Every operating shilling is a dividend shilling that left early — live budget envelopes, sitting allowances done properly, and the monthly five-number review.

A programme director should not read fifteen status reports to find the two projects in trouble. The portfolio dashboard judges every project on schedule, effort and budget, and says which check raised the flag.

Plans are re-planned one task at a time, and halfway through they are always broken. The timeline now takes a drag or a keystroke, flags the dependency it broke, and pushes the open tasks downstream by exactly the slip.

What you charge for an hour can be overridden on that hour. What it costs you cannot be overridden at all — so a mixed-grade firm reports margin improving in the month it is collapsing.

The only phase of a contract with cost and no production. The team has demobilised, the subcontractors are paid, and every repair from here comes straight out of margin — including the four you were never liable for.

Measured work is priced by the unit and consumed by the unit. Preliminaries are priced by the contract and consumed by the week — which is why a job that hit every material target still lost money on a six-week delay.

Forty-one tasks in a flat list gets abandoned by week three. Nine deliverables with steps beneath them does not. The structure that makes a plan readable — and the one number on the project page you should not take at face value.

The same fourteen steps, rebuilt from memory every quarter by whoever is free — and the two steps that only mattered once get forgotten. Templates and recurring tasks solve different halves of that, and confusing them is why people think neither works.

Agile metrics are genuinely useful to a small number of teams and pure theatre for everyone else. How to tell which you are, what the burndown actually computes, and the one setting that makes it read zero forever.

Logging hours tells you what a job cost. It does not pay anybody. Turning unpaid logged time into money that leaves your account — without paying the same hour twice or losing the trail to the bank.

Customers return because you know their car, and that knowledge lives in a folder that gets lost and a mechanic who leaves. How far a registration-prefix convention gets you, and the declined-work note that is worth more than any discount.

Most workshops make their money on parts and believe they make it on labour — and the two answers recommend opposite investments. How to get an overhead-per-hour figure, and what to charge when a customer brings their own parts.

A job card runs as a project here, which gives you parts at stamped cost, labour hours and a real margin per job from day one. Vehicle history across visits is the piece we can add on top, and it is worth scoping early.

Rollouts stall on small ambiguous decisions nobody has authority to settle. What the owner actually decides, the twelve to fifteen days it costs, why it should not be the IT person, and the six things to hand them in writing.

Phasing is the safe answer and it is not free — you pay in a seam somebody carries by hand. Which modules genuinely cannot be separated, and the three situations where switching everything on at once is the better risk.

Configuration takes a week. What takes ninety days is the organisation deciding which of its four stock figures is real, who is allowed to write off damage, and what replaces the WhatsApp group that currently approves purchases.

A cost that lands nowhere lands in overhead — and overhead is where project profitability goes to hide. The four routes cost reaches a job, and the one-field rule that closes all of them.

For a firm that sells expertise, time is the only inventory — and the one form of stock that vanishes if you do not count it the same day. Utilisation, realisation, and where the hours actually disappear.

An overrun is not an event, it is a trend that becomes an event. The reporting rhythm and the three numbers — budget, committed, actual — that let you see one forming in time to do something.

Retainers look like the most stable revenue a firm has and are often its least profitable work. Why you record time on fixed fees especially, the three billing models and their disciplines, and the final milestone nobody defines.

Variations are lost in small pieces, agreed on site under pressure and argued about at final account. Why the instruction matters more than the price, the five-line note that survives, and why coded costs settle higher than estimates.

Functions look like the most profitable business a hotel takes, until somebody costs one. Why an event is a project rather than a sale, the three numbers to fix before the day, and what costing six events tells you about which to chase.

Projects end twice — when the work stops, and months later when the last invoice and the last claim land. Why the reported margin is never the real one, the retention trap, and the one review table that changes future bids.

Most project plans are tasks with dates typed beside them, which is a wish rather than a schedule. What dependencies buy you, why slack decides which delays matter, and the procurement lead time nobody records.

The BQ is a promise made at tender; the site is where it meets reality. What live job costing takes, what a task-per-element gets you, and the line-level comparison that stays yours to make.

A contractor runs three businesses at once — materials, plant, and fixed-price promises. Where the money leaks on a Kenyan site, and how the profitable ones keep all three under control.

One target per category gives an urgent outage and a routine one the same clock. SLA targets are now set by priority, overridden by category where it matters, and every ticket shows which rule it took.

One ticket in six asks the same question. The helpdesk knowledge base now suggests published answers while the requester is still typing, counts every “This solved it”, and lets agents link articles into replies.

An IT desk answers the same printer three times a month and never sees it as one printer. Tickets now link to the asset they are about, employees pick their own laptop when they raise one, and every asset carries its support history.

Three buttons on a ticket, none of which changes anything. Why suggest-only is the design rather than the limitation, what each prompt is actually asked, and the one that will waste your time.

Somebody resigns on Friday. On Monday forty open tickets still have their name on them and every notification is going to a disabled account. What the system catches, what it does not, and the twenty minutes that prevent it.

The word "requester" hides four different kinds of person, stored differently, able to do different things — and one kind you assumed existed and does not. Which one raised a ticket decides what your reports can ever tell you.

Most helpdesk failures are silences, not slow replies — a ticket that reached the system and never reached a person. Every event, every recipient, every channel, and the four ordinary setups where the answer is nobody.

One checkbox decides whether a comment reaches your customer, starts the first-response clock, notifies anybody, or leaves your server. Four consequences from one boolean, and the two ways it goes wrong.

Most support portals fail because they ask people to create an account before they can complain. What makes an intake channel people actually use, and the honest limits of a portal.

The largest pile of untracked work in most Kenyan organizations is not customer support — it is colleagues asking colleagues for things. Why internal requests are the best place to start.

An SLA you cannot measure is a hope you have shared with a customer. What response and resolution targets require, why the pause makes them fair, and how to set targets you will not quietly abandon.

A ticket at the wrong desk teaches people the system is slower than walking over. Why the category carries the routing, how priority and category set the clock together, and what escalation means when nothing pages anyone.

Tickets received and closed are the two most reported and least useful numbers in support. The four measures that show whether a desk is coping, why reopens beat resolutions, and how to read satisfaction honestly.

The paragraph at the top of an AI dashboard is the part everyone reads and nobody interrogates. Every figure computed in plain code, the model forbidden to invent any, and a fingerprint that discards the sentence when the numbers move.

Three formats, a row cap worth knowing about, and a CSV convention for empty cells that changes how Excel totals a column. What to expect from an export today, and the wider formats and larger row limits we can enable for you.

One question, two modules. A report is built on exactly one dataset, which prevents a whole class of silent double-counting — and is why thirty-four cross-module reports ship prebuilt. Where you need another, we can add the joined dataset safely.

Certification marks the report the organisation stands behind — and guards against the quieter problem it exists for, which is a saved report drifting away from the data underneath it without anybody editing it.

A figure nobody should have appears in a group chat. Running a report and exporting it are two separate recorded acts here — which is the distinction that makes the question answerable at all.

Go-live is the start of the work. The three numbers to record before you switch on, the four reports worth thirty minutes a week, why every threshold you configured is a guess until day 60, and the four signs it is genuinely being used.

The most expensive report is the one somebody assembles by hand every month because asking IT takes three weeks. What a report builder removes, and how to avoid the mess when everyone can build one.

The gap between a report that exists and one that reaches the person who acts on it is most of the value. Scheduling, who to send to, and how to stop scheduled reports becoming ignored mail.

Every business asks for reporting and most end up with reports nobody opens. The difference between a report and a decision, and why reporting problems are nearly always records problems in disguise.

A dashboard with twenty tiles is a wall decoration. How to choose the six numbers that would have warned you about last year's surprises, and the rule that keeps a dashboard useful.

A lease that expires unnoticed costs more than a month of rent — it costs the negotiation you never had. Four dates per lease, what a turnover truly costs, and why the renewal conversation belongs at ninety days.

A shared report is a permission decision wearing a friendly interface. Roles versus named people, the difference between sensitive and export-restricted fields, and why row-level filtering is one report per audience.

Most board packs are assembled by hand in the four days before the meeting. What belongs in one, why a certified definition beats four accurate spreadsheets, and the four choices that make two reports disagree.

Single sign-on, approved devices and an office network secured the browser and nothing else. The workspace security policy now governs the AWRA app too: per-install device approval, an IP allowlist on every request, and session limits a fingerprint cannot stretch.

A statutory e-invoicing interface answers every request with the same four fields, and one of them decides everything. The connector puts the authority's own code in front of you rather than translating it away.

A revenue authority identifies your invoice by a number you choose. Three kinds of document were each choosing from their own sequence — two documents claiming one filing, invisible from inside.

The password on an M-Pesa request is not stored anywhere. It is built fresh for every call out of three pieces — one of which is the current time — which makes your server clock part of getting paid.

The response to a payment request is two identifiers and a suggestion to ask the customer for their PIN. Everything that matters arrives later, from a party that signs nothing.

Three SMS providers, one missing sender name, three behaviours: one omits the field, one substitutes a default, one refuses to send. A connector that assumed any of them would break on the other two.

A text message has no single moment of success. It is accepted, queued, handed to a network, delivered, perhaps read — and an API that answers immediately can only tell you about the first.

WhatsApp will not let a business send a message it has not read first. Every business-initiated notification uses wording approved by Meta in advance — which shapes everything about how the connector works.

An auditor asks to see one that was refused. Our product answers that well in the two places it records decisions properly — item master changes and deletions, both with segregation of duties. In the generic workflow engine, which has by far the richer approval model, the approver receives a task whose four states do not include yes or no.

Every public tender has an integration line and it is usually answered with a yes. Ours: tax filing to KRA runs automatically against real endpoints, queued so a sale is never blocked, with the receipt number stored on the record. IFMIS, nothing at all. The difference is structural rather than effort, and knowing why will help you write a better specification.

Our app holds a sale, a count line, a check-in, a check-out, a transfer, an asset movement and an approval through a dead connection. The count was the hard one to bring offline — a count is not a delta, and a stock freeze is a promise — and how that was solved is the useful part for a branch pharmacy with weak signal.

Hospital bills, school fees, funeral costs. The most pastorally sensitive money a church handles, usually the least controlled — and the person an informal process fails to protect is the minister.

Every ministry gets an allocation in January. In November nobody can say who stayed inside it — because a budget is set on a department and half of church spending cannot carry one.

A scheme can come in under budget and be heading for a special levy, because the operating shortfall quietly ate the reserve contribution. Only line-level variance shows it — a total never will.

Owners do not leave because rent was late. They leave because the statement did not tell them whether it arrived. Four numbers that must reconcile, and the client-account check that protects the agency.

A building becomes a project, a unit becomes a naming convention, a tenant becomes a customer. Which stand-in you pick decides what you can report for five years — and a department will quietly fail you.

A member you sell fertiliser to and buy maize from is a customer and a vendor, and nothing joins the two records. The instrument that gets you most of the way there, the sequence that survives an audit, and how the netting reads in your ledger.

Every AI feature is a data transfer decision wearing a friendly button. The complete inventory: what each feature sends, to whom, what never crosses the boundary, and how to answer your compliance officer.

A mixed container is the exact case where allocation matters most and the correct basis is unavailable. Why quantity allocation destroys a clip's cost, the split-delivery defect to work around, and why demurrage always lands after you start selling.

"Will this fit a 2014 Probox" is a database query executed by a man who has done it for eleven years. Why fitment is a licensed data product rather than a feature, what searchable fields genuinely buy you, and when to run a catalogue alongside.

Six routine tasks with a stopwatch against them and an annual figure each. The largest line is the one nobody complains about — and three of the six do not improve at all, which is the part that makes a case survive review.

One page, five parts: four measured numbers, one deliberately blank, the full cost including your own hours, a paragraph on what you are not buying, and three numbers with a ninety-day review date.

Free the way a puppy is free. Where the money actually goes, the three roles a self-hosted deployment quietly requires and nobody staffs, and the two situations where it is genuinely right in Kenya.

From a software company that would rather you buy at the right moment than cancel in month four. The sizes where a spreadsheet is still genuinely correct, and the six signals that say you have outgrown it.

A Nairobi build looks competitive against three years of subscription and never prices maintenance or the day the developer becomes unavailable. The four questions, a five-year comparison, and the two cases where building genuinely wins.

Real, predictable and absent from every proposal, because seven of the nine are your hours rather than the vendor's. Each with a rough shilling figure and the week it lands — plus three costs people budget for and rarely incur.

The subscription is under a third of it. The five components, a five-year model for a forty-staff distributor, and the recurring item nobody puts in the spreadsheet — two hours a month of somebody tending the thing.

What connects today, and what we can build next. Bank feeds, other mobile money rails, additional tax authorities, more accounting packages, inbound messaging, marketplaces and scheduled pulls — where each one stands, and how to get it into your workspace.

The cheapest integration available and the only one that changes behaviour rather than moving data. Six channels, why three topic channels beat one, and the mute problem that makes this look like it is working for months after it stopped.

Three different things get sold as offline and only one is worth anything to a driver in Kitui. Idempotent replay so a lost response cannot duplicate work, conflicts surfaced rather than resolved, and device trust that expires.

In Kenya an alert not on WhatsApp or SMS has not arrived. Both work on your own credentials, WhatsApp has one template rule that catches everybody, and the volume discipline matters more than the setup — because muting is silent and permanent.

Two APIs: a published Developer API that reads your records and writes their master data, with keys you issue in Settings, and the larger API the app runs on. Which to build on, why a user token carries that user's permissions, and why continuous two-way sync is not a shape either supports.

Thirteen templates download and eight import. Which is which, why the other five deliberately have no importer, the dependency order that stops a file failing on row one, and the fifty-row habit that substitutes for a preview.

Every integrations page is a grid of logos, and the tiles are four completely different products with four different failure modes. How to decode any of them with two questions, and which one to connect on day one.

Exit terms are the cleanest signal about how a vendor thinks, and you have most leverage over them before you join. The four questions, the answer almost no SME vendor gives well — attachments — and our own honest position.

A full day in a room three weeks early teaches almost nothing, and everyone involved knows it. Twenty minutes, one role, one task, at the moment of need — plus one uncomfortable rule about who should train the storekeeper.

Two hours before go-live, permission design is politically free. Six months later it costs a week and makes enemies. How to build roles from the four separations that matter, against 255 permissions — and where the model stops.

Six things that decide a rollout, ranked by how often they matter, and every one is organisational rather than technical. Features have never been the deciding factor — and the two that carry a project on their own are settled in a meeting, not bought.

Four of the Act's seven operational duties are wholly yours, three are shared, and none can be discharged by a purchase. The controller and processor boundary, what belongs in a processing agreement, and what the breach register does and does not do for you.

A second congregation creates an accounting problem before it creates a ministry one. The three models, why income must be recorded gross at the site, and the remittance reporting that keeps branches from resenting the centre.

The most sensitive data a church holds and the most useful. Deciding which giving is attributed and who may see it, why pledge totals are the wrong planning figure, and the annual statement that makes the record trustworthy.

A recharge recovering 88% of a bulk bill loses money every month, invisibly. The recovery ratio per building, why you record readings rather than consumption, and the handover reading that ends a whole category of dispute.

For a small part of a clinic store the question is never "how many" but "who, when and on whose authority". Where to spend two-person discipline, why small discrepancies get investigated here, and what a general inventory system cannot discharge.

You do not need to be a data business to be a data controller — an employer with payroll already is. Where personal data actually hides, what retention means in software, and the honest limit of any product. Not legal advice.

An auditor picks one line and asks you to rebuild it. The documents, the approvals and the change history together — plus the retention trap that makes evidence expire before the obligation does.

Kenyan businesses make everyone an administrator in the first two weeks because it stops the complaints — and deletes the meaning of every other control. Getting back to least privilege without blocking work.

Every term you want at the end of a vendor relationship is available before signature and none of it afterwards. No-cost export, post-termination destruction, the grace period on deletion — and where the disposal boundary actually falls.

One login per location is the most common security arrangement in Kenyan SMEs, and it turns your system from a record of what people did into a record of what a place did. Fixing identity first.

Ghost suppliers, inflated prices, adjustments that cover a count, ghost employees, and the till. Each needs two capabilities in one pair of hands — and each has an aggregate view that exposes it in ten minutes.

Most money flowing through an agency is not the agency's to spend. Keeping deposits, landlord funds, and agency income provably separate is the discipline that prevents disaster.

A managing agent is trusted with other people's buildings and other people's money. The four disciplines — collection, maintenance, trust funds, and owner reporting — that keep both in good order.

Collection is the heartbeat of an agency and where most bleed time. The cycle that ends the monthly matching game, ages arrears into a managed list, and reconciles every channel.

Money a firm holds for clients is not the firm's money, and proving that at any moment is a professional obligation. What proper segregation of client and trust funds actually requires.

Utilization tells you how busy your people are; profitability tells you whether it was worth it. In a firm that sells time, confusing them is how a fully-booked practice loses money.

Law, audit, and consulting firms sell time — but still run on operations they never systematize: which engagements make money, whether client funds are separate, and where the firm's money goes.

The moment produce hits the scale is when a co-op earns or loses trust. Weighing, grading, and paying fairly — and proving it — is the core of the cooperative promise.

A co-op sits between hundreds of farmers and a demanding market, and its value is trust — fair weighing and grading, correct on-time payments, and money that survives the journey. The disciplines that keep it.

Most ERP regret comes from buying the wrong size, not the wrong brand. A buyer's guide that starts from your operation, right-sizes the system, and gets you there without overbuying.

An open-source ERP can do the job — the real question is who makes it do the job and keeps it running. An honest comparison on total cost, implementation, developer dependency, and eTIMS/M-Pesa compliance.

ERP projects fail in predictable places — dirty master data, big-bang go-lives, demo-data training. The five-phase checklist from decision to retired spreadsheets.

Excel is free the way a leaking pipe is free — reconciliation labor, error rates, the one-person dependency, and stale-data decisions, computed honestly.

eTIMS mandates, M-Pesa-native operations, multi-branch growth — the forces pulling Kenyan SMEs off spreadsheets, and how the successful ones sequence the move.

Schools are three businesses in one uniform — fees, logistics, and assets. What operations software must handle, and where school money actually leaks.

The core system runs the loans; nothing runs the rest. Procurement, assets, branch expenses, and payroll — where member money leaks and governance is tested.

The menu is a price list for recipes nobody costed — how to cost a card, hold a portion, record waste as a transaction, and read the four-box menu grid. The recipe layer is a spreadsheet here, and the post says so.

Ten questions that separate partners who will still serve you in year three from vendors who disappear after the deposit — references, SLAs, compliance, and exit terms.

The second branch is where trust stops being a control system — live dashboards, governed transfers, and branch P&Ls that keep growth profitable.

The audits Kenyan NGOs face, the findings that repeat across the sector, and a 90-day plan that turns audit week from reconstruction into retrieval.

The advance lifecycle, per-diem rules that stop field drama, and M-Pesa discipline — closing the gap between when money moves and when evidence is captured.

A church runs on the trust of those who give to it — and trust in money matters is built by controls, not intentions. How well-run churches handle offerings, project funds, buying, and assets.

When members give toward a building, the money carries a promise. Pledges against receipts, restricted from general funds, spent transparently — how the promise is kept to completion.

Storage fills slowly and then all at once. What counts towards it, where to see what is using it, and what happens on the day a workspace is full — nothing stored is touched.

Most software meters something it does not tell you about until you hit it. Why every usage limit on every plan is published, and what actually happens when a workspace reaches one.

Running out of one thing is not the same as outgrowing a plan. Which limits an add-on can raise, which only the next plan up does, and the annual-billing detail that changes the arithmetic.

Your records are never on a clock; only the audit trail and the logs are. What a retention period removes, what it never touches, and why a plan can cap the audit trail but never shortens it.

Half the people an operations system needs to reach do not read email at work. Why every alert email now has a twin in the bell, addressed to a person rather than to the room.

Push notifications are the most valuable channel an operations system has and the fastest to ruin. A three-question test, a starting manifest, and how to set push one alert at a time.

A drawing of the escalation ladder our live chat climbs when a customer is waiting and nobody has answered: who is alerted at once, at 45 seconds, at two minutes, and what the customer is told at three.

A PDF proves someone owns a PDF. How AWRA Academy certificates are verified on a public page, why the learner’s email must be confirmed, and which staff your workspace can see are certified.

Live chat with AWRA support: offered only when someone is online, a clock instead of a spinner, files and screenshots, a bar that follows you around the app, and an email when nobody picks up.

What a support transcript has to carry to settle an argument three weeks later — every line, the files themselves, who ended it, and a second copy — and what ours does.

Google specifies its sign-in button down to the words on it and the grey behind the logo. The easiest way to break those rules is a tidy refactor of some other button.

One Google app sits behind sign-in, calendar sync, sending mail and the document archive. Sign-in asks for identity only, and the connector that asks for more copes with a person who agrees to only half.

Every operations system is also a mail server. A one-afternoon audit of every message it sends — recipient, switch, second channel, cadence and payload — and how AWRA OpsHub answers each column.

A system that confirms every success trains people to ignore the failure. Why routine confirmations like QuickBooks syncs now start switched off, and failures never go quiet.

Microsoft's directory sends no field saying an address was verified, because it does not need one — a work address exists only on a domain the organisation proved it owns. Except for guests.

One Microsoft sign-in button serves a corporate directory account and a personal one, and the profile it returns is the same shape for both. Knowing which way that decision went tells you what the button can enforce.

Switching off an email should not mean switching off the alert behind it. Why email and the in-app notice are separate switches on the same row, and which combination saves a stock-out.

Mandatory notices carry a duty optional ones do not: restraint. Set days, never two in a row, monthly after the first month, and an end — the schedule we hold our own account notices to.

A connection can hold an address, be switched on, and have proved it works — three separate facts. Collapsing them into one green tick is how a screen claims something nobody ever checked.

Social sign-in is safe when the provider says the address was verified. Microsoft's directory interface does not carry that field at all, which turns a one-line check into a question about what a corporate username proves.

On a shared service your records sit beside other organizations’ and the software keeps them apart. On a dedicated instance they sit in a database of your own. Same product, same releases — a shorter answer to one question.

How to read the data protection annex in a grant agreement, which questions hosting answers and which stay yours, and how to answer the who-else question in one sentence for every funder.

Shared cloud or a server in the cupboard used to be the whole choice. A managed dedicated instance gives you a system of your own and leaves the patching, backups and upgrades with the vendor.

Separation, keys, region, sub-processors, access, backups, exit and growth: ten questions that reveal how a vendor holds your records, what a good answer sounds like, and how we answer each one.

The questions every vendor security questionnaire asks about hosting, answered for a shared workspace and for a dedicated instance, with what sits behind each answer and the positions we hold.

A public body’s operational records outlive every supplier. What a ministry, county or state corporation should be able to say about the system that holds them, and where a dedicated instance fits.

SACCOs, banks and insurers are expected to account for every third party holding their data. The operations system is often the one missed. What the supervisor asks, and how to answer it in one line.

Most board data policies cover laptops and email and never name the system holding payroll, supplier bank details and the asset register. Seven clauses that close the gap.

What competes for a system on payroll day and at the close, what a dedicated queue and scheduler change, and what the Dedicated and Dedicated server tiers each do and do not share.

A dedicated instance runs the same product as a shared workspace and costs more. When it is money well spent, when it is not, and four questions that decide which side you are on.

Two separate parts of the product post to the same webhook and obey different rules about when to send. One is filtered by the tick boxes on the settings screen and the other is not, which reads as a bug and is correct.

Signing in, signing up and signing in from a phone must all return to one address, because that address was typed into a provider console by hand. What tells them apart is a marker.

One flag asks Airtable to make your value fit whatever the column is — and for a dropdown column, making it fit means adding a new option. The most convenient setting in the series.

The schema call identifies a table's key column by an opaque identifier. The write call wants its human name. A connector missing the translation fails on every table anybody has ever tidied.

A product with three ways to sign in has three places to forget the two-factor challenge. This one has three ways in and one place where signing in happens.

Signing in with a provider hands you an address and a claim about whether it was verified. Skip the claim and you have built an account takeover that works on anybody whose address can be guessed.

Attaching a private key to an Outlook calendar event means naming it with an identifier from the messaging API of the 1990s. Microsoft's modern interface carries it forward unchanged.

When this connector sends a purchase order from your Outlook mailbox, a copy lands in Sent Items — the actual message, in the actual folder, inside your own retention policy.

Every item now has a type, Stock or Service. A service sits in the same catalogue, carries its own price and income account, is sold and bought like any other item, and never touches stock.

Revenue on a goods invoice posts when the goods leave the warehouse. An invoice that carries only services has nothing to wait for, so it now posts the moment it is issued, to each service's own income account.

Goods and the service that goes with them, on one invoice. Each line is labelled for what it is, the stock check reads only the stock lines, and a confirmed order never backorders a service.

A fitting, a cut, a service, a callout. A service now sells at the counter with no stock, no shelf check and no cost of goods, and a refund never puts labour back on a shelf.

A service has nothing on hand, so by any arithmetic it is always low. Services are now left out of every low-stock alert, reminder, workflow, suggestion and nightly reorder recalculation.

A service can become a stock item at any time. A stock item can become a service only once nothing physical is attached to it, and the check runs on the form, through the API and at approval.

A service on a purchase order is now received by a delivery confirmation, not a check-in. Nothing enters stock, the cost is booked when the work is confirmed, and the people who sign for goods sign for work.

A delivery confirmation counts as received in the three-way match, so an order is not ready to pay while a service on it is unconfirmed, and paying past the match needs its own permission and a reason.

Awarding a supplier quote moves a stock item's selling price with its cost. For a resold service, the cost moves and the price stays where you set it, with the markup recalculated so it stays true.

Where withholding applies to service fees and not goods, a mixed supplier bill has to be split first. Withholding is now calculated on the service and typed lines, never on the stock goods beside them.

How much did services earn last quarter, and on what margin? An income account on each service, services in sales by item, and a margin shown as n/a rather than a flattering hundred per cent.

Moving typed service lines into the catalogue is mostly a spreadsheet exercise: an Item Type column on import that never flips an existing item, and services that reach exports, the API and the accounting sync as services.

Salesforce needs an administrator to create a field before the connector can identify its own records. A calendar event has a private compartment for exactly that — invisible to readers, searchable by us.

Most products disconnect by deleting their copy of the credential. The grant stays live in your account indefinitely — and the difference is which token gets sent back.

An automation platform learns what a payload looks like from one sample and builds every mapping against it, which makes a field that is sometimes absent worse than a field that is always empty.

You choose which parts of the business forward events, so something has to decide which part each event came from. Where a notification carries a tag that is a fact; where it does not, it is a keyword search over the sentence.

Seven providers in this series pin an interface version and only one does it with a date in a header. It is the best of the seven, for a reason that has nothing to do with the format.

The same email address has to be sent four different ways depending on what the destination column was declared as. Guess wrong and the whole record is refused.

The server matches a scanned code across fourteen record types. A phone with no signal matches four, on the same identifiers, and tells the operator exactly what it could not check.

A file picker hands back a reference into somewhere temporary. Queue that string with a delivery note attached and it works in testing and fails at a gate — the only place anybody needed it.

Each register is emptied and rewritten from the first cell on every run, which makes the tab a mirror rather than a record. One obvious cost, one hidden one, and one security property nobody asks about.

Every refresh clears the tab and writes it again from the first cell. That makes the sheet a reliable mirror and makes anything typed into it temporary — which everybody needs to know before the second week.

There is no screen for choosing which spreadsheet to export into, and its absence is not an omission. The permission this connector holds cannot open a file it did not create.

A queued approval that lost a race gets refused, and somebody has to decide whether to throw away their own capture. That decision needs both numbers on one screen — and a live connection to be worth anything.

Every value written to the spreadsheet is stored exactly as given, never interpreted. That is one query parameter, and it is the difference between exporting your supplier list and executing it.

The Marshall Islands passed a consumption tax in 2025 that applies to supplies made on or after 1 October 2026. Between those two dates sits every quotation, contract and recurring invoice a business raises — and almost no finance system can hold a rate and a date at the same time, including ours.

Five things have to be true before a notification reaches a phone, and when one fails the other four look broken too. Both ends of the chain now name the first one instead of listing all five.

Notion has no call that means create-or-update, so the connector asks first and then writes. Everything interesting about it follows from the gap between those two requests.

Send a contract naming a role the template does not define and everything succeeds — the document is created, the email goes out, and there is nothing for the recipient to sign.

A valid Notion token that has been shared with nothing can reach nothing, and it reports itself as working. The empty list that produces on the first attempt is the most useful thing about it.

A workspace policy and an MDM profile can both reach the same phone, and they answer different questions. The rule is that the stricter one wins on every setting, and that neither can loosen the other.

Sending a contract for signature is three calls, not one. The document is created, then it is not ready, and only when the provider has finished building it can it be sent.

A crew signs out at the end of a shift and drives back to a site with no coverage. Whether they can open the app comes down to a twenty-four hour window, a sealed session, and a password check that never leaves the phone.

A write into somebody else's table can fail for a reason that has nothing to do with the data: a column that is not there. Two filters decide what leaves, and they are not the same check.

The address of your Salesforce org is not a constant. It is handed to you at connection, it can change on a renewal, and a connector that stopped listening will fail on a day nobody did anything.

Most integrations decide what makes two records the same and tell you afterwards. This one reads the answer out of your own table, which moves the decision somewhere you can see it.

The offline queue used to move only while somebody was looking at it. Now it drains with the app closed — inside an eight-minute budget, on a schedule that costs nothing when there is nothing to send.

Before this connector writes a single record, somebody adds a custom field to your Salesforce org. Not a step we could have avoided — it is what makes every sync afterwards idempotent.

A phone hands you a location instantly and it is usually the worst one it will have all minute. Waiting eight seconds for a better one is the difference between a movement that lands and one your own policy refuses.

A camera pointed at a carton fires the same barcode a dozen times before the operator lowers their arm. Four windows decide which of those reads is a scan, and two of them exist because the other two were not enough.

The API accepts six photos on an asset movement. The phone stops at four, compresses every one, and shows you the running total in kilobytes. All three of those are the same decision about a queue row.

An inbound webhook endpoint has no login and no workspace in its address. One header decides which of thousands of workspaces an event belongs to, and where that decision is made is the whole security model.

Webhook senders retry when they are unsure, so every receiver has to decide what a repeat means. The rule turns on the difference between a request we have seen and a request we have finished.

Payment providers take amounts as whole numbers of the smallest unit, and the conversion from a decimal is one line that is wrong in a specific, reproducible way if you write it the obvious way round.

A payment webhook is an unauthenticated public endpoint that moves money. Ten lines decide whether that sentence is alarming or ordinary, and each of them looks removable.

A Mailchimp API key ends with the name of the server your account lives on. The credential carries its own routing — so a key with the suffix missing is not a credential at all.

Most syncs ask the remote system whether a record exists before creating or updating it. This one never asks — it computes the identifier and writes to it, and that difference is most of what makes a sync predictable.

Almost nobody writes the plain-text version of a transactional email, and almost every spam filter notices. This connector builds one from the HTML — three characters of code, a measurable difference.

Ten lines that convert a recipient list carry four separate defences. Three of the mistakes they catch fail loudly; one sends the message to nobody and reports success.

On most providers you connect an account and pick a sender. On Mailgun the domain is the unit — in the request path, carrying the reputation, in a region you chose once and cannot move.

Five connected accounts are tried in a fixed order before the platform sends anything, and a failure at any of them is a fall-through rather than an error. A good design with one uncomfortable consequence.

Every email this system sends is built in one provider's format, and the other four translate out of it. Not the tidy design anybody would draw — and a better one than the neutral format that would have replaced it.

Connecting your own email account moves four kinds of message and no others. Password resets and sign-in links keep going through the platform — enforced by the shape of the code rather than a setting.

When a message to five people fails for two, the useful information is which two. Most integrations throw that away and report one reason — and the difference is a minute of work against an afternoon.

Most APIs live at one address for everybody. Infobip gives each account its own hostname, which makes the base URL configuration rather than a constant — and turns a username field into a web address.

The value you paste into the sender field is sent under two different parameter names, chosen by its first two characters. That is Twilio telling you what kind of thing you gave it.

One event can leave the building through eight doors at once. What decides whether a chat integration is an asset or a muted channel is the four questions asked before each door.

On a Discord webhook the sender name is a value in the message body, chosen per message, with nothing checking it. Which makes the name in that channel a claim rather than a fact.

A Google Chat card with nothing in its body is refused. That sounds like it could never happen, and it happens on the shortest notification you will ever send.

Five of the six chat connectors decide a message was delivered by the response status. The sixth cannot, because its provider will answer two hundred and then say no inside the document.

Discord rejects an embed whose title runs one character over. It does not trim it — it refuses the whole message. So the connector trims first, to a number deliberately below the published one.

Two of the six chat connectors send to a list rather than a place, which means they can half-succeed. A result that is only true or false throws away the half you needed to know about.

Telegram puts the bot token in the request path rather than a header. Every proxy and access log along the route sees credentials the other providers keep out of the URL — worth knowing before you route alerts through it.

Six chat providers report success six different ways — an empty body, the digit one, no content at all, a document that says false while the status says fine. Deciding what counts as delivered is a real decision.

Four permissions govern who may view, create, edit and delete a proposal. There is no proposals feature — no record, no screen, no address. The permissions describe a plan, because a plan is what a permission list is made of, and buyers read it as evidence.

A Slack incoming webhook has no signature, no key and no account behind it. Whoever holds the URL can post to that channel as you, forever — which makes it a credential wearing a link's clothing.

A Teams notification is a card inside an attachment inside a message. Get the innermost part perfect and the wrapper wrong and nothing arrives — and two of the three layers carry no content at all.

Three SMS providers, one settings screen, three stored fields — and what those fields mean changes entirely with the provider. Where to put the seam in a multi-provider feature, and what it costs.

A workflow can be built with a wait in the middle — do this, pause three days, then do that. The pause works. Everything before it runs, the run is marked paused, and the log names the date it will continue. Nothing in the product ever comes back to it.

Object storage has no concept of declining a write. Put an object at an occupied key and the old one is gone. So the safety that stops a document being replaced lives somewhere else — and it is worth knowing exactly where.

Every Slack message this system sends carries its content twice — once as a formatted card, once as a plain line nobody in the channel sees. Drop the second and the phone notification that actually reaches somebody goes blank.

Colombia caps a till receipt at five UVT and Chile publishes a new unit value every single day. Both are legal limits denominated in something other than currency, so a system that stores them as an amount is not wrong yet — it is correct with an expiry date nobody wrote down, and it goes stale without any event occurring at all.

The OneDrive connector talks to one base URL. The same address answers who is signed in, which drive is theirs, whether a file is already there, and takes the bytes — which is why it is a couple of hundred lines rather than a subsystem.

Three of the four storage connectors need us registered as an application with the provider. The fourth needs nothing from us — you create a key in your own account, write its policy, and the relationship is between your workspace and your bucket.

A request for quotation has two routes to the quotes that came back. One is live. The other belongs to an earlier design that was replaced, never removed, and returns an empty list for every request that has ever existed — which is worse than a route that fails.

Drive remembers a folder by identity, so renaming it changes nothing. Dropbox remembers a location, so moving it changes everything. The same archive feature behaves differently on the two, and it was never a setting.

Most refresh tokens are issued once and used for years. Microsoft issues a new one every time you spend the old one, which turns a stored credential into a relay baton — and makes dropping it the one way to break the connection for good.

There are four recorded reasons an address can leave an automated email sequence: the person unsubscribed, an administrator removed them, the mail bounced, or it was marked as spam. Three of the four have never been written by anything.

Connecting Google Drive to a business system usually hands over the whole Drive. This connector asks for a scope that reaches only files it created itself — a boundary Google enforces rather than one we promise.

A connected Drive account archives nothing. There is a second decision after the connection — five document types, five switches — and the path a document takes from the moment it is produced to the moment it lands.

Four storage connectors archive the same documents under the same filenames. Ask each what happens when the name is already taken and you get four different answers — one skips, one refuses on principle, two would replace.

A custom report here belongs to whoever built it. The machinery deciding who may open a shared report is complete, careful and will never be consulted, because nothing in the product can create the record it reads — and the only test asserts the columns exist.

A supplier in your workspace and a supplier in QuickBooks are decided to be the same supplier by the display name, matched exactly, on every run. Everything downstream hangs off that one comparison — including what happens the day somebody renames one.

Sending a record to your accounting system and checking that it arrived intact are two different operations, and almost every integration only does the first. What the second one looks like when you build it, and the four refusals that keep it safe.

The role editor offers five separate controls over receiving stock — view, create, approve, adjust, reject. One of them governs a screen you can open. The other four can be granted or withheld all afternoon and nothing changes, which is worse than having one control, because it looks like five.

The offline queue on an AWRA handset has four ceilings, six automatic retries and one rule about the eighth day. Every figure is a decision somebody made — including what happens to a week-old check-in that nobody has sent yet.

Ten notification channels, one gate deciding whether a message may go out on any of them, and two that ship switched off. Which two, and why, is the most useful thing on this page.

Audit entries here are permanent: no administrator can remove the record of what they just did, because we took that button out. The cryptography we shipped alongside it is the interesting half; the permanence is the important one.

Leave arithmetic and workflow deadlines used to answer the same question differently. They now resolve through one calendar — and the interesting part is what happens when that calendar has no working days in it.

One screen answers whether the machinery is working, from eleven checks reduced to a single verdict. The rule that reduces them is three lines long, and the most important thing in it is where "unknown" is counted.

A rule about receipts can be an integration, an architecture or an accreditation, and only the first is something you can shortlist for. The third is answered by a public register in about two minutes and almost nobody evaluating from outside the country knows to look. Our own audit against one European regime, including the six days this site contradicted itself.

Sixty-five scheduled jobs run against a workspace, and the order they run in is a piece of design. Data is prepared before anything is pruned, prices are fetched before anything is charged, and every message to a person happens after all of it.

Every background job writes a row when it starts and updates it when it finishes, with its runtime, its queue, its attempt count and — on failure — the exception. The monitor is also written so it can never break the job it is watching.

Four East African authorities run four separate schemes against four separate interfaces, and one question separates them: can the sale complete when the authority cannot be reached? We built for one answer, for one country. The consequence we had never written down is that the receipt your customer carries out of the shop does not yet carry the fiscal reference — and a POS filing that failed three times had nowhere to go, which we fixed the day we published this.

The connectors here share one shape: they push rather than pull, they are safe to run twice, they stop at two hundred records a run, and the button and the nightly job are the same code. Each of those is a decision worth understanding.

Building a module is the visible half of adding one. The other half is declaring it in a dozen registries that decide whether anybody can find it, search it, report on it, recover from it or be told about it.

Every market that sets a retention period is really asking whether you can put back what the report said at the time. Three things differ by market and only one is the number of years — and our own audit log turned out to expire on a two-year default while a legal hold on the record it describes did nothing to stop it. We published that, fixed it the same day, and both dates are on the page.

Two mechanisms stop a request being processed twice, and they disagree about almost everything — including whether an identical second request is a duplicate or a legitimate new one. Both are right for where they sit.

The public interface has one property that decides most of its security: no route accepts an organisation identifier from the caller. The key carries it, so there is nothing for a client to get wrong or to change.

Deleting a workspace is a thirty-day request rather than an action, it can be cancelled for as long as it has not started, and exactly three tables survive it — including the record of the deletion itself.

A spreadsheet import here is all or nothing: one unacceptable row and the entire file is undone. That is the opposite of what most systems do, and it is right for a specific reason — a half-loaded file is worse than no file.

Subscription prices are held in shillings, shown in dollars and charged in shillings. Every part of that is deliberate, and the part worth understanding is which figure the server trusts when the two disagree.

Four tiers, four revenue shares and four client counts — recomputed nightly, applied automatically in both directions, with a sixty-day grace before a fall takes effect. Here is exactly what moves when a tier does.

A workspace does not lapse suddenly. Seven conditions are evaluated against five named thresholds, and one of them fires without any payment ever having failed — which is the one worth knowing about.

A plan controls two separate things: which permissions exist in your workspace, and how many of certain things you may have. They do not move together — the free plan grants every permission in the product, caps you at two users and sizes usage for an evaluation.

An email address can be an organisation owner, a staff account or a supplier login, and it cannot be two of them. The check that enforces it is deliberately unscoped — because its failure direction points the wrong way.

Thirty-two retention policies are created for every workspace and every one is switched on. They cover operational records rather than business ones — and a legal hold wins, deliberately, even when the evidence for it disagrees with itself.

The export and erasure tooling here is built around a user account — somebody who signs in. A customer is a record, not an account, and the difference decides what a data request against your workspace can be answered with.

A message this product sends on your behalf can leave through your own mail provider rather than ours, chosen per category rather than all at once. Five transports, one message body, and a fall-through that decides what happens when yours is unavailable.

Collecting from a customer and paying a supplier use the same provider account and are not the same capability. The outgoing side needs credentials the incoming side never asks for, and an organisation configured to collect is not yet configured to pay.

The unsubscribe link at the bottom of an automated email is a compliance obligation wearing the clothes of a convenience, and almost every way of making it more careful makes it worse. Here is what it does and why each step is missing on purpose.

A supplier signed into your portal can mark your purchase order closed. There are four conditions on it, and the fourth — that you have already paid in full — is what makes the whole thing safe.

Between five to nine and a quarter past, five reminder sweeps run — approvals, customers, supplier responses, late deliveries and expiring quotations. Each has its own switch, its own clock and, in one case, a check that runs before either.

Several jobs in the purchasing chain exist only to correct things that should not need correcting. They run every five minutes, every hour and every night — and a run that fixed nothing looks exactly like a run that had nothing to fix.

Suppliers apply to you through a public page addressed by your organisation's own slug, with no account and no login. Everything after that — the tracking link, the document requests, the eventual portal account — follows from decisions in that one route.

Your staff are authorised by role permissions declared in a map and tested against the real routes. Your suppliers are authorised by owning the record. Two models, both correct, and knowing which applies where is the whole of portal security.

The invoice reader returns the page as text and three candidate values: a total, a date and a document number. It returns no line items, and everything it does return is a suggestion. Knowing exactly that is what makes it useful.

Receiving happens a delivery at a time, so an order can be half in. There is no half-in status, and that was a decision — the fact is already answerable from the receipts, and a fourth state would have to be chased through every place the third one is named.

A tenant asks why their receipt is numbered 58 when last month's was 41. It is a fair question with an answer — and until August 2026 the honest answer for five document types was that the missing numbers belonged to somebody else's business.

A purchase order fully paid for a week closes itself at one in the morning. Closing writes two facts nobody observed — that it was delivered, and when — so the window is worth setting deliberately rather than accepting.

Receiving more than was ordered is blocked. Receiving less is recorded and accepted. That asymmetry is the whole design of the check at the receiving door, and the reasoning applies to a great many controls that get built symmetrically and then bypassed.

Somebody ticked tax exempt on a customer and wanted to know it had taken effect end to end. The one-sentence test that confirms a setting is wired to behaviour, and the afternoon that verifies them across your own system.

A workspace can read its dashboards in a second currency. Every converted figure is marked, carries a note naming the rate, and is kept off every document that leaves the building — and choosing your own currency turns the whole thing off.

A credit limit is evaluated at exactly one moment. What it compares, what it snapshots onto the invoice, and what it silently clears are all worth knowing — starting with the fact that a limit of zero means no limit at all.

We do not do US sales tax at all, and that is the first line rather than a footnote. Then what to ask everyone else, what to ignore, and the five things that should take us off your list.

Some organisations have jumps in their numbering from before August 2026 — 41, then 58. The cause was a deliberate compensation for a database constraint, the compensation is gone, and the gaps have deliberately been left where they are.

Card and mobile money collection run on your own provider credentials, so the money lands in your account without passing through ours. That choice has consequences for reconciliation, for risk, and for what happens when a key stops working.

Both are a percentage added at the till, which is where the resemblance ends. One is collected in stages and reclaimed; the other is collected once and avoided with a document. Software built for the first models the second incorrectly rather than incompletely.

Every automatic reorder point is recomputed at one in the morning from thirty days of demand, a lead time and a safety stock. Until October 2026 that meant every item; a figure somebody types is now marked Manual and left alone, and a warehouse minimum is never touched.

Overdue invoice reminders are gated by one clock per organisation rather than one per invoice. That decision is what stops credit control becoming a reason your customers filter your address — and it has a consequence worth planning around.

Every system numbers its invoices sequentially and almost none of them can tell you whether the sequence belongs to you. Ours could not: for five document types the counter was reconciled against a number unique across the whole platform. We published that, then fixed it the next day, and both dates are on the page.

Generated barcodes are unique within your organisation and nowhere else, checked against your items and your assets in one shared namespace. They are internal identifiers, not registered product codes, and the difference decides what you can do with them.

A serial number is one physical unit with its own location, supplier and status, and a column waiting for its warranty date. Every field is left alone when an update says nothing about it — except two, which are written every single time.

Five exclusions at the top rather than the bottom: no VAT numbers on the invoice, no VIES check, no reverse-charge treatment, no Belastingdienst connection, no Dutch reference customer. Then the questions worth asking everybody else.

A batch is identified by your organisation, the item and the number on the carton — nothing else. Receive that combination twice and the second delivery joins the first, filling in what was blank and rewriting exactly three fields that were not.

A blind count hides the expected quantity. Doing it properly means hiding three figures rather than one, hiding them in the data rather than on the screen, and hiding the same item everywhere else for as long as the session is live.

A refused clock-in is a row carrying where the phone thought it was, how sure it was, and which of eight refusals applied. One combination of those fields — a failure alongside a valid site code — is the first thing HR is shown.

Somebody clocked in on Tuesday and went home without clocking out. The system will not invent an end time for that day — not at midnight, not at the shift end — and that refusal is the most valuable thing about it.

A site can show a code that changes every thirty seconds and can also print one that never changes at all. Both are accepted, both come from the same secret, and knowing which is on your wall decides what a photograph of it is worth.

An employee assigned to four depots needs to be inside the radius of one, not all. Three numbers decide it — a radius you set, a distance the server computes, and an accuracy the phone reports — and only two of them are yours.

Zero-rated, exempt and reverse-charged all print as nothing and mean different things for who accounts for the tax and what can be recovered. Our schema has two values for the three, no value for the third — and charges the standard rate if you invent one.

The asset panel shows a health score and a confidence figure beside it. Both are arithmetic you can check by hand — five deductions with named caps, a proportional term, and a floor at twenty rather than nought.

Clocking in requires a registered device, and an employee who has not enrolled one is refused with an instruction rather than let through with a warning. The refusal is recorded, and both routes into the clock run the same check in the same order.

Software is shortlisted on whether the tax comes out right. In the Netherlands a cross-border invoice carries no tax at all, and what makes it lawful is a name, a number and a sentence on the face of the document — three things our own invoice template does not print, though the database holds all of them.

Asset movement approvals are governed by which actions the policy covers and which assets it applies to, and both have to agree. Set one and leave the other and the control reads as on while gating nothing at all.

An asset is tracked as one identified record or as a quantity in buckets, and the choice is free until the first unit moves. The bucket turns out to be a six-part key, which is why a pool of four hundred can become eleven rows nobody asked for.

The asset register used to draw a downward value line using one flat rate on every asset, so a building and a laptop both reached zero in five years, and it said so on the chart. Updated 14 October 2026: the dashboard now shows net book value from each asset's depreciation profile, with unprofiled assets carried at cost and counted.

An asset's purchase cost is stamped with your workspace's own currency by the system, not chosen by the person registering it, and stamped again on every edit. That is what lets the register total itself — and it is why an imported machine needs translating before anybody types.

When the product hands your browser a stored file, the type it declares is worked out from the file own bytes. That guess is why one header matters more on those routes than anywhere else — and why it is set before the list of routes that skip everything else.

A guard stopped automatic scoring from relabelling quotations a buyer had already awarded. It was written, reviewed and correct in intent, and it never once fired — because one side of the comparison was lowercase and the other side was not.

When support signs in as you, every request is written down: who, as whom, which route, from where, and a fingerprint of what was submitted. A fingerprint rather than a copy, deliberately — a log you could read your data out of would be a second copy of it.

A payment provider returns a reusable card token in the response to almost every call. Logging that response for debugging puts a live payment credential into log files, log shippers and backups — where nothing protects it, because nobody thinks of a log as holding card details.

The same organisation signing up in a browser stored one thing and signing up on a phone stored another. One normaliser now serves all three signup routes — and it makes the shape uniform without inventing the country nobody typed.

Low stock announces itself: there is an instant when the quantity crosses the line, and something can be hung on that instant. Stock that has stopped moving has no such instant, because it is defined by the absence of one, so it has to be gone looking for.

Four ways a search box lies, all of them silent: it searches the page instead of the list, a typed percent sign matches everything, an ungrouped condition drops your filters, and the escaping meant to prevent the second one does nothing on the database the tests run against.

An uptime check asks whether the website answers. It cannot tell you the scheduled half of the system died four days ago, because a box with dead cron serves pages beautifully. The fix is an alarm triggered by silence — and the hard part is knowing whether it is still connected.

Turning stock into a tracked asset does not produce an asset. It produces an adjustment and a pending record holding what the asset would be — and the asset is created on approval, at the quantity the approver settled on rather than the one that was asked for.

Four matching tolerances on a purchase order, and every one ships at zero, so any variance at all is a discrepancy. Over-receipt is refused, payment on a discrepancy is blocked, and an override is wiped the moment the documents change and the order reconciles.

Forty-nine kinds of record in this product delete by marking rather than removing. Twenty appear in the recovery centre. The other twenty-nine keep the row and offer nobody a way back — including nine that have a written retention policy naming them.

A workspace can make its password rules stricter and cannot make them weaker — the minimum length is a floor, and complexity has no off switch. Beside it sits a lockout keyed on the address typed rather than the account found, which is the only way to stop it becoming a directory.

Stock balancing suggests moving stock from where there is too much to where there is too little. Each warehouse can now carry its own minimum, which becomes its floor; a warehouse without one falls back to the item's single reorder point — and on the default of zero, nowhere is ever short.

A supplier prequalification application can be scored automatically, with a rationale, a per-factor breakdown and risk flags. What the score has not done is open a single uploaded certificate — the model reads text, not documents.

The application clock is one value for the whole installation, and the deployed value is Nairobi. Report schedules and workflow calendars each carry their own timezone and honour it properly. Every record stamped anywhere else does not, because there is one clock and it is not a column.

Every audit row is signed over its own content and the signature of the row before it, so an edit, a deletion or an insertion all stop the sequence matching. The interesting part is that a legitimate purge has to be explained by a record which is itself in the chain.

The item master carries duplicate detection, barcode collision checks, required attributes per category and an approval gate on nine critical fields. Every one of them is switched on. Three are configured to their most permissive setting, which is not the same thing.

Awarding a quotation line by line used to take the price from the form that submitted it. The figure had come from the server a moment earlier, so it looked like the vendor price — and anybody able to submit that form could reprice the catalogue.

A budget is a department, a category and a window. Purchase-order spend against it is department-scoped; expense spend is not, because an expense carries a project instead. One column of the report is departmental and the one beside it is organisation-wide — and it says so.

A ticket knows which department raised it and, to the minute, how long it waited. It holds no hours, no rate and no cost — and hours are costed a module away, against a task that carries no department.

For most of your staff the department on a purchase request is stamped from who they are, and the request is refused when it cannot be. For an administrator it is a free choice from the whole list, and nothing records that they made it on somebody else's behalf.

Fourteen tables point at the department list — payroll, budgets, purchase orders, assets, tickets, projects and the workflow queue. The record they point at holds two fields, the settings menu calls it a cost centre, and deleting one checks four of the fourteen.

Victoria makes a second-hand dealer keep goods exactly as they arrived for seven days, record where each item is stored, and — for scrap metal — never pay in cash. Our till is built for the other direction entirely.

HR records which department an employee belongs to. Procurement asks which department a login belongs to. Two columns on two tables — and when HR provisions that employee a login, the department does not travel with it.

Victorian payroll tax groups employers across company boundaries, makes the liability joint and several, and lets a grouping determination take effect from an earlier date. Our workspaces are built not to produce that figure — deliberately.

Japan makes the main contractor keep a register of everyone working below it, on site — and makes each tier tell the tier above who it engaged. The party who keeps the register is not the party who fills it in, and our supplier portal is already the right channel.

Victoria wants a written incident record within 48 hours, on a form the Authority defines, kept five years and shown on request to people who do not work for you. Every report we make well is one you designed yourself.

Japan gives a mail-order buyer eight days from delivery to send the goods back — and takes the right away if you published your own terms in the advertisement. The window is a property of a document, and our return row records neither the route nor the postage.

Japan's misleading-representation penalty is three per cent of the sales you made of those goods during the period the claim was displayed. We can produce the sales for any window, and a dated price list shows when a list price was in force; nothing here records when a claim was.

Hold a cheque too long and the drawer can be discharged to the extent of the damage your delay caused. A cheque carries three dates and a payment row here has one column — and the till cannot take one at all.

Singapore's packaging report is triggered by a turnover figure and made of kilograms by material. One of those we can produce for any period; the other has never been entered into the system by anybody — and the Act gives you exactly one year to start.

The Philippines requires nine disclosures before a consumer credit sale is consummated, and two of them are different interest rates. Our invoice holds a balance and a due date; the word instalment appears nowhere in the codebase.

In Victoria, whether a repair is urgent is a closed statutory list, and it decides more than a deadline: one route lets the renter spend your money, the other brings in a regulator. Our categories hold the clocks and not the consequence.

Victoria caps what a builder may hold at each stage as a percentage of the contract price, with the stages defined by what is physically built. Our projects module holds the stages in order and holds no contract price at all.

Canada gives you two days to report a product incident, counted from the day you became aware. That is a date about your organization rather than about a record — and it is the one date no operations system holds.

Canada's legal-tender limits are written in denominations, and a till records a payment as one number. The gap is not a compliance problem — it is a modelling one, and two of the missing pieces are worth having anyway.

A US forklift certification has no expiry date. Five things oblige you to retrain the operator and four of them are events, not dates — which is a problem for every mechanism built to watch a calendar.

Japan makes an employer of over a hundred people measure four things before writing a plan about women at work. Three are arithmetic over records this product already keeps. The fourth needs a column we do not ship, and we think we are right not to.

Singapore's security-of-payment Act defines a day, for every deadline in it, as any day other than a public holiday. Weekends count. That is a third unit of time, and most systems implement two.

Singapore presumes that goods failing within six months of delivery were faulty when they were handed over, and the seller has to establish otherwise. That makes the delivery date and the individual unit the two records that matter.

A British contractor files monthly, naming each subcontractor, what they were paid, and how much of it was materials. That third figure is defined as what the contractor is satisfied the subcontractor's own materials cost — not a number on any document you hold.

British price marking treats a price as five properties: a number to a stated precision, a unit, a condition, a currency and a relative type size. A price field is one of them — and two of the five belong to how something is printed.

A certified payroll has a period of one week, a scope of one contract, and a signature attesting to three specific things. None is a cost figure — and its most unusual requirement is something this product already does, in the wrong module.

The US food traceability rule is summarised as lot codes and a 24-hour clock. The sentence nobody quotes asks for your coding systems, abbreviations and a written map from your records to the elements it names — a document about your software.

Large UK companies publish how fast they pay suppliers twice a year, and every figure is a difference between two dates the Regulations define precisely. One of them is not the invoice date, not the date you entered it, and not the due date.

Singapore prescribes what a payslip contains, item by item. Two are dates of payment, two are the first and last days of a period, and one is a period that need not be the salary period at all — so we held our payroll against all eleven.

Indian e-commerce rules give a grievance officer 48 hours to acknowledge a complaint and one month to redress it. Three settings in an ordinary help desk decide whether either period is measured — and the one that matters is not a clock.

British lifting-equipment rules give you a six or twelve month floor, two events that bring the date forward, and a next-due date a named person writes into a signed report. A recurring reminder is none of those three.

Australia asks large buyers seven questions about their supply chains every year. Only one and a half are questions a system can answer from its own records — and a supplier register, by construction, stops at the company you pay.

The quotation importer opens PDFs, Word files and spreadsheets, and it will still refuse your supplier own letterhead quote. That refusal is the feature: a parser that guesses at a price it cannot actually find is worse than one that declines.

Japan caps overtime with four tests running at once — a monthly limit, an annual one, a rolling average across two to six months, and a count of how many months went over. Only the first can be answered by looking at a month.

Updated October 2026: every quantity the inventory module stores is now a decimal to three places, and every item carries its unit — pieces stay whole, kilograms and litres take fractions. What still has nowhere to live is the conversion between two units of the same thing.

Nigeria clears a business-to-business invoice before it reaches the buyer and reports a till receipt after it is issued. Those are two machines, not two settings — and only one of them can stand in front of a queue on a Saturday afternoon.

South Africa's employment equity regime sets numerical targets by sector and occupational level, and a certificate for government work turns on them. The report asks your HR record for three classifications, and a conventional employee record carries none of them as fields.

A sprint belongs to a project, and a task can only join a sprint in its own project. For a squad built around one engagement that is invisible; for a standing team carrying a client portfolio it is one cadence turned into four records, four burndowns and four velocities.

Peru sets a monthly valuation cycle for public works with the deadlines written into it — present within the first three days of the following month, supervisor reports within five, entity pays by month end. The binding deadline is not the payment one; it is how fast you can close a month.

A comment on the till code promised that failed fiscal filings were reconciled with a manual button. The comment had been copied from the invoice flow, which had one. The till did not, and the job gave up after three attempts.

A customer credit limit here genuinely refuses — past the line the invoice is created on hold. What the number never records is which currency it is expressed in, and the exposure it is weighed against is a sum of invoice balances that each carry a currency of their own.

The request-for-quotation form makes quantity compulsory. The API does not, on either creating or updating a line — and where it is missing, null is written. A supplier is then asked to price something without being told how much of it.

The till and the stock valuation once used different definitions of what an item cost. Both were defensible, both were implemented correctly, and the integrity report comparing them reported a variance that was purely a difference of opinion.

Ten stock statuses are declared. One counts as sellable and five count as a hold. The other four are neither — so stock put into one of them cannot be sold and is reported as not being on hold, which is the worst of both descriptions.

A tax rate here cannot be created above one hundred per cent by any route. It can be updated above it through one. The rule was written on two doors out of three, which is the ordinary way a validation gap happens and the ordinary reason nobody notices.

Satisfaction ratings used to come only from requesters with an account, so everybody who reached the desk without one was missing from the average. Now the app, the customer portal and a one-click email link reach every requester — and the denominator still belongs beside the figure.

The most common way a support team hits its first-response target without responding is to write a note to itself. One condition in this codebase makes that impossible, and it is worth knowing which one before somebody helpfully removes it.

The moment a report becomes a file it stops being a view of your data and becomes a copy. Live shared report links, and a stored metric series to reconcile against later, are both additions we can enable so the number stays current.

A report here is built on one dataset — a sound design that keeps a whole class of double-counting out of your numbers. The joins worth adding on top, where you need a supplier and a customer, or a purchase and a complaint, in the same row.

A login here can now carry an end date, so a contractor or fixed-term account lapses on the day it was agreed without anyone having to remember months later — with a notice three days ahead.

A journal entry used to carry an account, an amount, a reference and a description and nothing else. It now carries a department, a branch and a project, so the income statement reads profit by any of them — and that changes which questions are possible.

Overriding a customer credit hold here needs the permission to edit invoices — the same grant that lets somebody change one. Three modules away, an equivalent override was deliberately given a permission of its own.

Payroll here is maintained for one market and configurable for every other. Those are not two grades of the same feature — they are different products, and the difference is who is responsible on the day a rate changes.

A milestone here is a name, a due date, a status and a sort order — the one level between a task and a project that reports cleanly. Turning that date into something that gates, triggers and alerts is an addition we can wire into your workspace.

A project here can pay the people who worked on it, through a document with its own reference, approval and posting date. That is a second way of paying somebody, running beside payroll, and neither one knows about the other.

An employee’s pay package is designed as a dated series — draft, active, superseded, each with a start and an end. In practice every employee has exactly one, created the first time somebody opens the screen and edited in place from then on.

A project carries one money budget. Its actual cost arrives from four independent streams — logged time, purchases, expenses and stock issued to the job. So the system can say a job is eighty per cent through its money and cannot say which of the four is why.

An asset label has two readers. One is a person who will complain when it looks wrong, and one is a camera that will simply fail. We shipped a barcode that was invisible in dark mode and perfect in every screenshot — which is exactly the failure a machine reader produces.

When a message is handed to a mail or messaging provider, the provider hands back an identifier — its receipt for what it just accepted. There is a place to keep that identifier and nothing puts anything in it, so our record of a message and theirs cannot be joined.

There is a working document-expiry reminder in this product. It reads a date, respects your notification settings and warns you thirty days out. It is filtered to employees — so a work permit gets a warning and an equipment insurance certificate gets silence.

Nobody adopts an asset register with no assets. The interesting part of a migration is never the file format — it is the four columns you have that the destination has nowhere to put, and deciding in advance which of them you are prepared to lose.

A refund reversed the sale, returned the stock and balanced the drawer perfectly. It also left cash overstated on the balance sheet by the amount refunded, and a matching phantom balance in receivables — for the life of the workspace, in silence.

Twelve movement actions are declared in the code. Nine are written by something. The gap between those two numbers is where most custody claims live — and the page that got this right did so by listing what the service writes, not what the module is called.

An offline till is not one feature. It is four, they fail independently, and most systems claiming offline mode have built one or two. Here is the honest map of which are here — none — and what that means before you buy anything.

A till sale has no approval step to hang a lock on — the money moves and the receipt prints in the same breath. So the signature had to become its own lock: signed once, never replaced, and refused entirely once the sale has been reversed.

Our data export and erasure tooling takes a user account. An external ticket requester does not have one — that is the entire reason they were sent a tracking link. So the people most likely to ask are the people the tool cannot be pointed at.

This till takes cash, one mobile-money rail and a card. It briefly took a fourth on refunds — store credit — which reversed the sale, returned the stock, and recorded the debt to the customer nowhere at all.

The business day here is two clock times and one application timezone — simple and predictable for a single-site team. For a desk in Bengaluru promising four hours to a customer in Lagos, we can add per-desk business hours so each SLA counts in its own clock.

The breach alarm notifies the agent, then their manager, then the department — the right ladder in an organisation that has one. For a six-person business we can configure a flatter path, so the alert reaches somebody positioned to act on it.

A saved filter here belongs to one person. A report schedule can be driven by one. So the weekly figures a team runs on can rest on a private view that nobody else is able to open, inspect or inherit.

A support contract makes two promises — we will answer by then, we will fix it by then — and they need two alarms. Giving them one shared "already notified" flag would have meant the first breach permanently silenced the second.

A report schedule in this product carries its own timezone and computes its next run in it. The deadline engine three modules away has no timezone at all. The capability exists, once, in the place where getting it wrong matters least.

There is a report builder here and, by design, no raw SQL — everything protecting your data sits in the layer a raw query would go underneath. For analysts who want more reach, we extend the builder's datasets rather than lower that floor.

An employee record here does not require a user account, and that is deliberate — in most of the businesses this was built for, a majority of staff have never logged into anything. Every account-shaped feature therefore covers a minority of your people.

We published that this product stored no daily metrics and computed every dashboard figure from scratch. It was false, and it was on this page. Dashboard history is precomputed nightly, finished days are read from storage, today is always live, and a missing day repairs itself on read. The reason the check went wrong is worth more than the original article.

A task here can carry story points and a sprint, or estimated hours and a milestone, or all four at once. Only one of those vocabularies reaches the cost figures — so which one you plan in quietly decides whether your plan can be costed.

An employee's hour is recorded twice here — once as attendance that becomes pay, once as effort that becomes project cost. Linking the two, so you can compare what you paid for against what you billed, is an integration we can build into your workspace.

Copying a project rebuilds the whole structure — tasks, subtasks, dependencies, milestones, checklists — and deliberately resets every date, assignment and trace of progress. The list of what it resets is the most opinionated thing in the module, and we can tune it to your templates.

Tasks here can have subtasks, and subtasks can have their own. The tree is real, it survives cloning, and it orders work. Rollup arithmetic — hours, points and cost summing from children to parent — is the natural next layer, and one we can build for you.

This module will refuse to move a project from planning straight to completed. It will not refuse to spend twice its budget. One of those is enforced by a state machine and the other is a percentage on a screen.

You can close an accounting period here. It records the month, the moment, the person and a note, keeps a history of every close and reopening — and since October it is a lock as well: nothing posted afterwards lands in the month it just closed.

An external auditor asks for read access to the audit log. The smallest permission that opens it also opens settings administration — so granting the narrow thing they asked for means granting a great deal they did not, and two permissions built for exactly this govern nothing.

An asset here is born one of two ways: entered by hand, or converted from stock. Neither remembers the purchase order. For a business buying equipment against a grant, a client project or a capitalisation threshold, that forgetting is the whole problem.

You can record that an asset was verified. You cannot start a verification, assign it, track what is outstanding or close it. The stock module can do all four for a count — which makes this a design inconsistency rather than a missing feature.

An asset here can be owned, leased or borrowed, enforced across five write paths. A stock item can now be yours, a customer’s or a supplier’s on consignment — set on the item rather than on the shelf, and that difference in depth is worth understanding.

Two maintenance constants sat in this asset register for a long time with nothing that wrote them. A work order writes both now, from a preventive schedule that opens it when the service falls due — and the way the gap used to hide is worth knowing whoever you buy from.

Last service and next service already exist as columns on the asset table — the groundwork is in the schema. Turning them into a working service schedule, with reminders and a due list, is a short build we can do for your workspace.

Full imprest control — a float, recorded movements, an expected balance, a count and a variance — used to live only at the till. The back-office cash box now has a float, vouchers and top-ups, and the advance in a field officer’s pocket has a record of its own.

This product tracks where every asset is and who holds it, and it depreciates it too — method, life, residual value, a monthly journal and disposal with its gain or loss. Keeping the two views distinct is how you avoid an accurate book value for a generator nobody can find.

The stock module hides the expected quantity from the counter by default. The till displays Expected Cash to the cashier as a tile on the sale screen. Same product, opposite answers to the same control question.

Stock leaves this system by two paths, and the till keeps its own record. Bringing both onto one vocabulary, so a counter-only shop's consumption reports read correctly, is a unification we can apply to your workspace.

When a ticket breaches, this product tells the agent, then their manager, then the department. Assignment rules that decide who should own the ticket in the first place — before the deadline rather than after — are something we can add to your helpdesk.

Until October 2026 a discount at this till was four columns — a record of what happened, not a control over whether it should have. It now carries a user, a workspace limit and an approver by PIN. The reason is still typed, and recording versus governing is still the question to ask of any till.

This product used to send WhatsApp messages and not receive them. Since October 2026 an inbound message opens a ticket or threads onto the sender’s open one, agents reply inside Meta’s 24-hour window, and email intake is the channel still to open.

The working calendar is one working week and one holiday list per organisation. A desk covering six countries has six sets of public holidays and one calendar to express them in — and the per-purpose calendar that would solve it exists in code with no way to create one.

This product pushes a great deal at people — idle stock, expiring batches, lapsing documents, breached tickets. Threshold alerts on a dashboard number crossing a line are the natural next signal, and we can wire them into your workspace.

Stock valuation, receivables ageing, payables ageing and a payments register all exist and all work — every input a cash conversion cycle needs. Turning them into the three ratios, sized in days, is a report we can add to your workspace.

A report definition here can be submitted for certification, reviewed and marked certified. Pinning that certification to a specific version, so a later edit re-opens review, is a governance layer we can add for teams that need it.

One permission lets somebody schedule a report to a list of email addresses. The addresses are not checked against your user list, and nothing compares what the report contains against what each recipient is allowed to see.

A payroll engine that computes deductions correctly is only half of a filing; the other half is the reference numbers they are filed under. Why identity fields decide month-end, and the audit of our own schema we first got wrong.

Overtime here is requested, approved, locked into a period and — once you switch it on — priced through payroll at a working-day, rest-day or public-holiday multiple. What remains is putting that cost in front of the approver.

The timeline here draws your current dates against a snapshot of the dates you agreed to, and shows the variance per task. It is one of the better-built things in this product — and it has exactly one snapshot, with no record of when it was taken.

There is a figure here for work that has been done, is billable, and has not been invoiced. It is the closest thing this product has to work in progress — and the rate it uses can be set per entry, which is exactly what the cost side cannot do.

A task dependency here carries a type, and the critical path treats every link as finish-to-start in day offsets. Reading that type — and teaching the calculation about weekends — is a straightforward addition we can make to your workspace.

A job's actual cost here is four things added together. Three are measured. The fourth is hours multiplied by one rate you set for the whole project — and the wages you actually paid never enter the figure at all.

The accounting sync keeps a proper log — what it moved, when it started, how long it took, what went wrong. There is a column for who started it, and a defined way to read that column, and nothing has ever written to it.

A project can be attached to any other record in the system — the machine being overhauled, the building being fitted out, the contract it delivers. The attachment point exists, the way to read it exists, and nothing has ever filled it in.

An invoice line has eight columns. A per-line discount, a per-line tax rate and a fractional quantity are more than many systems offer. The unit stays on the item rather than the printed line, and there is no cost or project on it — and it is the missing cost that makes historical margin move.

Until October 2026 a discount at the till was an amount and a sentence, while a stock write-off of the same value needed a permission and a second pair of eyes. The till now has a limit, a named approver and a supervisor PIN. The reason is still a sentence, and that gap closes with people.

Document numbers are sequential per organisation, per type, per prefix and per year, zero-padded, and safe when two people press save together. What the key does not contain is a branch — so ten sites share one run.

A customer balance field is written only when somebody creates or edits the customer by hand. No invoice, payment or credit note touches it. And it is the opening balance of every statement and the base of every credit exposure.

A purchase can name the job it is for, and so can a stock issue — costed at the price stamped when it left the store, so a finished job cannot change price later. Two things never reach the job at all, and one of them will surprise you.

There are six ways to pay a supplier here and they write to two different ledgers. For a long time they shared no guard. The fix was not a check but a service all six had to call — and the reason that matters is the lesson rather than the feature.

A stocktake here does not change your stock. It raises adjustments somebody has to approve — so a counter can report what they counted and cannot set the record. The best decision in the module, and the three things it stops short of.

We have requests for quotation with real line items and recorded responses. We have sealed bids with a recorded opening. We have no request for proposal, no scoring model of your own and no panel. Those are not degrees of the same thing, and sealing is the one that cannot be substituted procedurally.

Our turnover report counts consumption from the till as well as from issues, rolls balances back through the period's own movements, and works over any dates. Then it hands you one figure for the entire company and stops.

Ask our stock reports what one warehouse holds and you get an answer. Ask the ledger and you now get half of one: a journal entry carries a branch, so the income statement splits by site, while the balance sheet stays one figure for the organization.

A sale from a till app can name the warehouse it came out of. The field is validated and then thrown away in favour of the counter’s own — which is the safe answer, and it leaves the field sitting in the one place a value that does nothing can still do something.

A customer tax profile carries an exemption and a rate override. Ticking the exemption genuinely exempts them. Typing the override does nothing, on purpose, and the page says so. The rule that separates the two is the most useful thing here.

A payment record carries a reference, a transaction id, an attachment, who recorded it, the balance after it, its currency and the journal entry it produced. It belongs to exactly one invoice — so one transfer settling four invoices needs four records.

An invoice is not created and sent in one act. It is drafted, approved by a named person at a recorded time, confirmed, then sent — and a customer over their credit limit stops it dead at approval. Having a lifecycle at all is the unusual part.

There is no delivery note. An invoice knows which warehouse the goods left from, and there is no separate document that travels with them and gets signed at the other end. For internal transfers there is exactly that.

Blacklisting a supplier does five things at once, refuses to be undone by accident, and blocks them from reapplying through the public form. Marking one preferred does nothing at all. Two flags on one record, and only one is a control.

A budget is a category and an amount, and a purchase reaches it by matching a free-text string on the item. Case is forgiven; a plural is not. So the spend you are not watching is the spend that was spelled slightly differently.

Receive more than you ordered and the system refuses, counting every earlier delivery so a split consignment cannot creep past one lorry at a time. Receive less and it never refuses at all. The asymmetry is deliberate, and the reasoning is worth more than the feature.

Our scanner bridge turns a phone into a paired scanner and stores every beep as an auditable event with a device, an actor, a resolution and an exception code. It is one of the better things in the product, and it decides exactly one thing where buyers assume four.

Send a hundred, receive ninety-seven, and the system used to record the three and nothing else. A short receipt now has to explain itself — a reason, who is responsible, and the value fixed at receipt — the same way a deliberate return always did.

A generator is serviced every 250 running hours, a vehicle at 10,000 kilometres, a compressor on its duty cycle. Every one of those is a number the machine keeps and the asset register does not, so the only schedule it can offer you is a calendar.

Two people agree to trade Saturday and somebody changes a name on the roster. The roster is now correct and the trade has left no trace — not who asked, not who agreed, not who approved, and not what the shift said an hour ago.

A till session opens with a float, records every drop, and closes with a counted figure and a variance against the person who counted it. All of it is about cash — so on a counter where most customers pay by phone, the strongest control in the shop is watching the smallest pile of money.

Our system records the result of an incoming quality check properly — a status on the consignment, a screen to set it, a summary and an analytics view built on it. What it does not do is stop you selling the goods that failed. Recording and enforcing live on two different records, and nothing connects them.

A stock item can now be ours, a customer’s or a supplier’s on consignment, and only ours is valued. The other direction — your finished goods sitting at a distributor until they sell — is still the difference between what is in the building and what belongs on the balance sheet.

Every count records the variance on every line — quantity out, value out, held against a review threshold. Then the session closes and the numbers stop. Nothing turns a year of variances into an accuracy figure, a trend, or an answer to which site is drifting. The data is complete; the measurement was never built.

We publish a free economic order quantity calculator. It is indexed, it works, and it tells you how many units to order each time. If you then buy our product there is nowhere to put that number — because our reordering does a subtraction, and a subtraction is not a policy.

We built anomaly detection into this product. It watches for items selling below cost, on thin margins, or priced at zero — every one of them a question about money coming in. It has never once looked at stock going out, which is the direction things actually disappear in.

A count plan asks how often you intend to count, requires an answer and stores it. Until 1 October 2026 nothing happened on that rhythm — no session was ever raised, and a plan reading "monthly" looked exactly like a control that was running. Now a daily job opens the count when it is due and tells the assignee. What the inert field taught us, and what is still left to build.

When stock runs low our system can raise a purchase requisition on its own. It raises it against a department. It does not name a supplier, look at who supplied the item last time, or consider who is cheapest — because nothing in the automation has any concept of who you buy from.

Your clearing agent bills you three weeks after the container cleared. By then some of the goods have sold. That freight and duty will attach to whatever is still on the shelf and to nothing that has already gone — so the margin you reported on the fastest-moving lines is the one that was most wrong.

You could tell our system how much a storage location holds, and until 1 October 2026 nothing read it — four times that quantity went in without comment. Capacity is now counted in stock units, shown as a percentage full, and raised as an Ops Center alert when a location goes over. It still never refuses a delivery, and why that is the right design.

Goods arrive against a purchase order and leave to a customer. Since October they can also go back to the supplier who sent them, as a return with a debit note that a payment run sets against the bill — rather than leaving your books as a write-off.

There was a supplier performance record in our database with three fields on it: on-time delivery rate, quality score, and pricing trend. Nothing had ever written a value into any of them. Since 1 October 2026 it stores every supplier's scorecard nightly from their purchase orders, shown on the supplier's page. What it measures, and what is still to come.

Every supplier payment is authorised properly and recorded one at a time. There is no payment run — no way to select forty approved invoices, review them as a batch, approve the batch and pay it. The control at the end of your purchasing process is strong, and nobody ever sees the total before it leaves.

In most of the world the inventory costing method is an accounting preference and any defensible one will do. In the United States it can be a commitment with consequences reaching past the ledger — which makes it the one market where "our system supports exactly one method" is a fact a buyer needs before signing rather than after. We support exactly one.

A ticket can only be assigned to an employee record — fine until you count how many people who actually answer tickets are not employee records. The owner, the administrator, the agency covering nights, the contractor on a six-month engagement.

The customer statement runs over any date range, carries a running balance, renders as a PDF and emails without duplicating on a retry. It is built from invoices and payments. A credit note is neither — so the balance at the bottom is higher than what the customer owes.

A customer can have many named contacts with roles and many structured addresses with labels and a default. It is a proper counterparty model. It also has a second free-text address field — so there are two places an address can live.

At six every morning a job finds suppliers whose qualification has lapsed, marks them expired and switches them off so they cannot be invited to quote. Until 1 October 2026 it told nobody. It now warns your buyers thirty days ahead and again on the day — and the supplier is the one party it still does not reach.

Every quotation, invoice and till sale carries eight fields recording the conditions it was raised under — country, currency, tax type, rate, enabled, inclusive, exchange rate and a timestamp. Change any of those settings tomorrow and the document does not move.

A high-value write-off here needs a second person, a dedicated permission and a value test that cannot be gamed by splitting it. What it does not need is a photograph, a note or any document at all — the file field is optional, everywhere, always.

The value on a purchase request is the quantity times the item's last recorded buying price. It is not a figure the requester supplied, it changes when somebody edits the catalogue, and nothing compares it to what you actually paid.

Each warehouse can now carry its own minimum and maximum, and Reorder reads them. Low-stock alerts still compare the national total against the item's reorder point, and safety stock and lead time still live on the item — so a distribution centre can sit at zero while the alert stays quiet.

A boxed machine on a rack is stock; bolted to a floor it is an asset. Our system moves it across that line properly, on approval, with a linked record — and the moment it crosses it gains capabilities it never had, a calendar service schedule among them.

Matching an order against a receipt against the supplier’s invoice is the standard control over paying for goods. For a long time we matched two of the three. The supplier’s bill is now a record of its own, and the third leg of the match reads it.

Every other way stock leaves your business has somebody on the other side of it — a customer, a project, a destination branch. A write-off has nobody. It is the one exit where the only evidence is whatever the person doing it chose to attach, and attaching anything is optional.

A purchase order in our system records what you ordered, when it is due, who acknowledged it and where the truck is. It does not record the one term that decides whether the freight on it was ever yours to pay — and we will attach that freight to your stock cost without asking, because nothing in the system knows.

We can run a request for quotation and compare what came back on price. We can keep them sealed until a recorded opening. What we cannot do is score bids against weighted criteria or record why the second-cheapest won — which is the part a grant-funded organization is usually required to be able to show.

You can attach five kinds of cost to a shipment in our system, and that is not a default you can extend — there is no screen anywhere that adds a sixth. In a region where inspection and treatment are a routine, separately-invoiced and highly variable cost of importing, the missing name is the one that would have told you which supplier is expensive to bring in.

A refund has to undo four things: the money, the stock, the revenue and the cost of sales. For a long time this product undid two of them and the drawer still balanced every night — which is precisely why nobody found it.

Apply a credit note and the invoice's amount-paid figure goes up by the credited amount. The invoice status says credited rather than paid, so the document is honest. The column is not — and anything measuring collections from it reads a credit as money received.

A requisition has line rows. A request for quotation has line rows. A purchase order has line rows. A supplier's quotation has a JSON blob — the one document whose detail is not queryable, and the one you most need to compare.

An item has one selling price and it is a field. Change it and the old value is gone — no revision, no effective date, no history. The documents remember what they were sold at; the catalogue remembers only the last decision.

Three-way matching compares what you ordered, what arrived and what you were billed. We do the first two properly, with tolerances and a payment gate. The third document is one we generate from our own prices — so we call this a two-way match.

Five documents, four handovers. At each one something is carried forward and something is dropped, and the dropped things are invisible on the screen where they happen. This is the map.

Our ABC report bands the catalogue on cumulative consumption value, which is the correct definition and not the common one. Our counting module can hold a class against a plan. Nothing carries the first into the second, so at catalogue scale the classification is never refreshed.

Our landed-cost engine spreads a freight bill by value or by quantity. It cannot spread it by weight or volume. For a landlocked buyer whose biggest cost is a lorry charging by the tonne, those were the two bases that would have been right.

A warehouse in our system has no country, no currency, no tax registration and no legal entity. For a single-country operation that is exactly right. For a distributor holding stock either side of a border, the building has no jurisdiction and the stock in it has no home.

One cost basis, weighted average, and no way to restate the past — a correction is a new transaction, never a revaluation. In a stable currency that is a footnote. Where prices move quickly it decides what your margin appears to be.

A freight bill is a fixed amount of money, so the goods it brought have to carry that amount between them and no more. Ours carried it once per delivery — an order arriving in two parts booked twice the freight that was paid. We found it by writing the test that did not exist, and the error hides best exactly where freight matters most.

When part of an order never turns up, the freight you already paid has to be carried by the goods that did. Ours divided by what was ordered instead — so a shipment arriving forty per cent short left every unit you actually held costed ten per cent under what it cost you. Where the balance never follows, that error never corrects itself.

A till session records a float, every cash drop, the expected cash, the counted cash and the variance, with who opened and who closed. It is a proper reconciliation. It does not stop the cashier seeing the expected figure before they count.

There is an anomaly detector here and everything it watches is a price — below cost, under five per cent margin, priced at nothing. It refreshes every fifteen minutes. And the cost it compares against is not the cost your ledger uses.

Forty monthly retainers are now forty templates and a daily run, with an alert when a period fails. The failure mode of recurring billing is still that one invoice is missing — because the run can only bill the clients it was told about.

Our vendor scorecard reports an on-time rate. On time means the order's planned delivery date falls within seven days of the order being raised — seven, for every supplier, everywhere. It never checks when anything actually arrived.

There is exactly one mobile-money integration in this product and the supplier record is shaped around it. Everywhere that provider is not the rail, a supplier payment is something we record rather than something we operate.

A supplier record knows who they are, how to pay them and whether they may trade with you. Agreed prices can sit on a supplier contract; the rest of the terms you trade on — payment days, delivery terms, lead time — live on a document, or nowhere.

Our quote comparison weighed a vendor rating that nothing filled in and every scoring engine dropped. Since 1 October 2026 it carries each supplier's stored track record from past orders, as a factor you switch on, with newcomers scored at the average.

Our stock transfer has a button marked Approve. It is a synonym for Dispatch, in the web application and the API alike, and the stock leaves the source in the same instant. There is no approved-and-waiting state, because there is no approved state at all.

Stock cannot go negative here: the issue is refused, per location, before anything is written. That is correct, and it has a price — the pallet standing in your yard that nobody has booked in does not exist, and cannot be sold.

Every bin location can be given a pick sequence. The field is validated, stored and displayed, and nothing in the product has ever sorted anything by it. The sixth inert field of exactly this shape, and what it tells you about reading a form as a promise.

Serial-number tracking for stock has a table, a model, three screens, two routes and a count on the dashboard. It has no code path that can create a row. The screens work perfectly and will always be empty — and the test that would have found it takes ninety seconds.

A customer has a credit limit and no payment terms. The limit is enforced properly — exposure across every open invoice, a real hold, the numbers snapshotted so history cannot be rewritten. How long they may take to pay is typed onto each invoice.

You can invoice in another currency, record the rate that applied and take payment in it. The ledger posts each document in base currency at its own rate and books the realised gain or loss when payment lands at another. What it keeps is one set of books — and revaluing what is still open at month end stays with your accountant.

An item used to have one selling price. It now has price lists — the customer's own, then a default, then the item price, with quantity breaks, dates and a currency — on quotes, orders, invoices and the till. What a person still has to catch is a price typed below the list.

Your suppliers can have logins — with multi-factor authentication, a forced first password change and rate limits on every action. From that login they answer quotations, accept or reject orders and set a shipping status. Where it stops is money.

How many suppliers you can keep active is governed by your plan, and switching one on at the limit is refused outright. An ordinary commercial arrangement, and an unusual thing to write about — which is why it is better read here than met mid-migration.

A requisition carries its department as free text; a purchase order carries it as a reference. The bridge is a lookup by exact name — and when it fails the order is raised, received and paid with no department, and no budget ever hears about it.

A purchase order has no currency field. It borrows the quotation's, and where there is none it falls back to your base currency. A supplier has no currency at all — the column existed once and was removed as unused.

Dead stock has no event to hook, so it is scanned for nightly, deduplicated, and cleared the moment the item moves. Good engineering, measured against one idle period for the whole catalogue — the same number for a filter and a gearbox.

Until 1 October 2026 every allocation went oldest-expiry-first, with no setting and no per-item policy — and a column on the item that looked exactly like one. That column is now a real setting: earliest expiry first by default, or earliest received first, per item, on every issue path. What a dead column does to a reader, and the shelf-life rules a switch cannot replace.

Updated October 2026: every item now carries a unit of measure, and tonnes, kilograms and litres take a quantity to three decimals. What remains is the conversion — buying maize by the tonne and selling it by the bag as one item — and for a bulk business that is where the margin lives.

Our demand forecast adds twenty-five per cent in March, June and December — three Gregorian months written into the code, identical for every customer in every country. In a market whose largest demand event moves eleven days earlier each year, that is not a small approximation.

A project here has one customer, which fits most delivery work cleanly. Organisations running one programme on money from three funders need a shared cost split across all three in set proportions — a funder dimension we can add to your workspace.

For about a year our aging report summed unlike currencies into one unlabelled figure. The repair was easy; deciding what a single honest total looks like was not — and the convention we landed on has a weakness we would rather publish than hide.

A push notification that never arrived is not one problem but five, they need five different people to fix them, and the worst of them — a send to an audience with no registered devices — used to be written to the log as a success.

On a phone, a signature is a swipe — and a swipe is also how you scroll a list, dismiss a sheet and pull to refresh. Who wins that gesture decides whether you capture a signature or the first inch of one. What signing on a device actually takes, why the mark travels as text rather than as a file, and the four questions to ask any vendor.

The most common request we turn down about signatures is a pad on the approval screen. An authenticated, permission-gated approval written to the audit trail is already the stronger record — and adding a drawing on top of it disguises a real control as a ceremonial one.

A hand-drawn mark on a screen proves almost nothing on its own — nobody can read a signature, which is close to the definition of one. What makes it evidence is the printed name beside it, the timestamp, and one rule about when it can no longer be changed.

Stock leaves as 100 and arrives as 97, and nobody is lying — the loading clerk counted one number and the receiving clerk counted another. A transfer is the only movement with two parties who can honestly disagree about one quantity, which is why one signature structurally cannot settle it.

We could capture a signature in ten places and could not answer the question a store manager actually asks. Recording evidence and controlling for its absence are two different capabilities, and shipping the first one is the easy half — plus the one design decision that separates a usable exception report from noise.

A help desk fills with personal data faster than any other module, and most of it belongs to people who will never have an account. Our public support path is built well for exactly those people — and the export and erasure tools take a user account as their argument. Also: tickets are on no retention timer and have no deletion path at all.

A quotation commits you to nothing and carries six fields describing tax and currency. A credit note reverses a taxable supply and carries none of them — no tax split, no currency, no line items. What that costs a single-country business is almost nothing; what it costs a group trading across four EAC currencies is an ambiguity on every unapplied credit.

EAC currencies differ in unit value by roughly thirty times, so adding two of them together produces a number that looks reasonable and is wrong by an order of magnitude. Three ways a system can answer "what did we spend", only one of them honest — and a report of ours that adds Ugandan shillings to Kenyan ones and calls a budget breached on the result.

Donor-funded work moves the unit of account off the cost centre and onto the award. Four cost streams accumulate against a project here and they are properly filtered — but the budgeting tool that holds lines and periods is keyed to departments, and there is no link from a budget to a project anywhere in the schema.

Egypt closes 30 June, Japan and India 31 March, Ethiopia on a date that is not the first of any Gregorian month. Our ledger turns out to be immune because it never modelled a year at all — and the damage is done by four convenience buttons and a handful of defaults that all assume 1 January.

Our helpdesk emails your customer when their request is updated. If they reply to that email, nothing happens — and the cost of that lands on your reporting rather than on your support desk.

A field called "notified at" was being filled in on tickets where nobody had been notified. A missing alert is a gap you can find; a false record of one closes the investigation and moves the blame to a colleague.

A support agreement makes two promises: we will get back to you, and we will fix it. We measured both and reported on both, and had an alarm on only one — the one that matters least to the person waiting.

A support promise measured in working hours has to know when you work in both directions — counting down, and giving time back after a pause. Ours knew in one, and the missing half put a Friday deadline at eleven at night.

Our helpdesk was built for organizations where plenty of staff have no company login — and then the breach alarm was wired to a login. The tickets nobody had picked up were the tickets nobody was told about.

The list was built where the business started, and it goes out unchanged to the other islands because nothing in the transaction suggests otherwise — same currency, same language, same group. Everything else has changed.

Colombian law makes the buyer confirm two things by electronic message before a credit purchase supports any deduction: that the invoice arrived, and that the goods did. The second is a statement about the world that only a receiving process can make — which turns the most improvised record in procurement into the one the money waits on.

Six questions with structural answers — a number, a yes, a name — including the one almost nobody asks: who maintains the municipal rate dataset, and on what schedule?

Ask where rounding happens, and ask to see the tax for one rate on a two-rate invoice. Five tests you can run yourself in fifteen minutes — with our own answers beside each, including the one that cannot be paid.

Your customer master holds what you need to know about a customer. It has nowhere to hold what your customer asserts about themselves — and some documents will not clear without it.

Almost every compliance obligation belongs to finance and is performed at a desk. This one belongs to the buyer and is discharged on a loading bay — by somebody who has never been told they are part of a control.

A free-text field with validation is not a smaller version of a coded one. Where a jurisdiction wants a value from a published list, the field either holds it or your document is not the document.

Everywhere else, voiding a document is something you do. Here it is something you ask for — and your customer can say no, or say nothing, which is worse.