This guide walks you through the app one screen at a time: what each page is for, the steps you take on it, what the app will refuse to do and why, and what each action changes elsewhere.

It is written for the people who use the app — HR, attendance clerks, payroll and finance staff — not for developers. You do not need to know anything about databases or code to read it.

What the app does#

It keeps four kinds of work in one place:

1. Attendance — who is in, who is away, who has not been recorded yet, and the punches behind those numbers.
2. People — employee records, contracts, transfers, promotions, documents and official letters.
3. Pay — daily pay, monthly payroll runs, pay statements and salary payments.
4. Finance — salary advances, employee loans, deductions and the approvals behind them.

Each layer feeds the next. Attendance decides what the day is worth, daily pay turns that into money, the payroll run collects a month of it, and finance recovers what the employee owes.

How a screen is laid out#

• The dark sidebar on the left is the menu. It is grouped: Attendance, People, Equipment & EPI, Pay, Finance, Reports, and a single Settings entry at the bottom. Click a group heading to fold it away. On a phone the sidebar becomes a drawer behind the menu button.
• The top bar has, from left to right: New (a short list of things you can start right now), the bell (notifications), a light/dark switch, the language chooser (English, French, Arabic — Arabic flips the page right to left), and your account with Sign out.
• The page itself always starts with its title, one line explaining what it is, and the buttons for the main actions on the right.

What you can see depends on your permissions#

Two people can open the same workspace and see different menus. The sidebar only lists pages your account is allowed to open, and inside a page the buttons you are not allowed to use are not drawn at all. If somebody describes a page you cannot find, it is almost always a permission, not a bug — ask whoever administers accounts to check your roles.

Pay is a separate permission from the rest of the employee record: it is possible to be allowed to edit someone's details but never see their salary. When that is the case, amounts are simply absent from the page.

If your workspace has more than one company, you only ever see the employees of the companies you have been given access to. Everything — lists, reports, counts, searches — is already filtered that way, so a number you see is a number for your companies.

How to read each page section#

Every page in this guide is written the same way:

• What it is for — one sentence.
• Who can open it — in plain words.
• The journey — the steps in the order you take them.
• Rules — what the app refuses, and the reason behind it.
• What it changes — the effect elsewhere in the system, because almost nothing here is local: recording attendance changes pay, and approving pay freezes it.

Dialogs (the small windows that open on top of a page) are documented right under the page that opens them. Two shapes recur everywhere:

• A form window asks for something — dates, amounts, a reason — and saves when you confirm. Closing it with Escape, the X or the backdrop throws the typing away, and a form with unsaved changes asks first.
• A confirmation states what is about to happen, in words, and offers one button that does it. Where the action cannot be undone, it says so.

One more appears by itself: when your session has expired, a window says so instead of throwing the page away. Chapter 1 explains what to do with it.

The chapters#

Chapters 2 to 11 are being written area by area; this list is the plan and the index.

Setting a workspace up? Read the settings chapters (8 to 11) first. The day-to-day pages — attendance, pay, finance — only record what those settings define, and several of them refuse to work at all until the matching setting exists.

Older topic notes#

Thirteen earlier files in this folder (salary-advances.md, employee-loans.md, deductions.md, payroll-recovery.md, payroll-integration.md, approval-inbox.md, reports-and-statements.md, termination-financial-review.md, employee-finance.md, finance-overview.md, notifications.md, payroll-adjustments-settings.md, company-global-shift.md) describe the finance, payroll and schedule modules in a shorter, more technical form.

Everything in them that a user needs has been folded into the chapters above — chapters 5, 6, 7, 9 and 10. They are kept as a reference for the exact rule names and codes a developer or an administrator may want to quote, and they are not maintained as part of this guide. Start with the chapters.

How far this guide has been tested#

Every page and every dialog in the app is documented. How much of it was used rather than read differs by area, and it is worth knowing which is which:

• All 33 settings pages were configured and walked: the leave rules, absence types with a real allowance and real pay bands, insurance types, the grade and échelon ladder with a salary on every level, bonus types, promotion rules, loan and deduction types with their policies and approval workflows, EPI profiles, exchange rates and contract templates. The figures and the wording in chapters 8 to 11 come from those screens in that state.
• The operational chapters — attendance, daily pay, a payroll run closed end to end, a salary advance approved and paid, equipment issued, letters numbered and written — were walked the same way.
• Some flows are described from the code rather than from use: the electronic signature rounds, hire requests, probation decisions, employee transfers between companies, and anything that depends on more than one company, because the demo workspace has one. Those sections are accurate about the rules and may differ in small details of wording or order.

About the screenshots#

• They come from a demo workspace, so every name, number and date in them is invented. Nothing in this guide shows a real person.
• The app is still being built. If a screen looks slightly different from its picture, trust the screen; the words around the picture are kept up to date first.

Everything in this chapter is the part of the app you meet before you do any real work: signing in, finding your way around, the dashboard, the setup guide, your messages and your own account.

Sign in · /login#

What it is for. Getting into the workspace. It is the only page you can open without an account.

Who can open it. Anyone. It is the only public page in the app.

The journey

1. Type the email address your administrator gave you.
2. Type your password. Show reveals it if you want to check what you typed.
3. Tick Keep me signed in on this device on your own computer, so you are not asked again every day. Leave it unticked on a shared machine.
4. Press Sign in. You land on the dashboard.

Rules

• There is no sign-up and no "forgot password" link. Accounts are created by an administrator, and only an administrator can reset a password for you. The page says so under the button.
• A wrong email, a wrong password and a deactivated account all give the same message. This is on purpose: a stranger must not be able to learn which addresses have accounts.
• After five failed attempts the page stops accepting tries for a while and tells you how many seconds are left.
• If your administrator created your account or reset your password, the app asks you to choose a new password before you can do anything else. Until you do, only your profile page works.

What it changes

• Signing in starts a session in this browser. Signing in again in another tab of the same browser uses the same session.
• If your account is deactivated while you are signed in, the next page you open signs you out.

Finding your way around#

The sidebar on the left is the menu, grouped by the kind of work: Attendance, People, Equipment & EPI, Pay, Finance, Reports, and a single Settings entry at the bottom. Click a group heading to fold it. On a phone the sidebar hides behind the menu button at the top left.

You only see the entries your account is allowed to open, so your sidebar may be shorter than a colleague's.

The New button#

What it is for. Starting the common jobs without hunting for the page first.

It lists only the things you are allowed to do — adding an employee, preparing a hire request, recording attendance, granting a vacation, issuing equipment, writing an official letter, and the three employee-money requests. The same menu appears on an employee's own page, where it is called Actions and acts on that person.

The bell#

What it is for. A quick look at the tasks waiting for you, without leaving the page.

It shows the newest items, View all notifications opens the full page, and Preferences goes to the settings for which messages you receive.

The yellow line "Live updates are off right now" appears when the live-update service is not running. The list still refreshes every few minutes and whenever you open a page — you are not missing anything, it just arrives a little later.

Light and dark, and the language#

The moon button switches between light and dark. The Language chooser switches the whole interface between English, French and Arabic. Arabic also flips the layout right to left, including the sidebar. Your choice is remembered.

Dashboard · /dashboard#

What it is for. One screen that answers "where does attendance stand today, and what needs me?"

Who can open it. Everyone who can see attendance figures. It is the page you land on after signing in.

The journey

1. Read the four numbers at the top: In today, Away today, Not recorded (people who still need a status) and Recorded (how much of today is done).
2. Use the row of shortcuts under them to jump to the page you actually need.
3. Attendance over the last 7 days shows each day as a bar: green for in, orange for away, yellow for not recorded.
4. Quick queries are counts that are also links. Clicking "Not recorded today" opens the daily overview already filtered to those people — you never have to rebuild the filter yourself.
5. Teams to follow up names the teams with the most missing records.
6. Needs your attention lists the real jobs: days with odd punches, people with no status. Each one has a Review link.
7. Away today lists who is off and under which status; Earlier days to catch up on looks back over the last week for days nobody finished.
8. Record today's attendance (top right) opens today's list ready to fill in. Export today downloads today's overview as an Excel file.

Rules

• Days in the future are never counted as missing. Only today and earlier days can need a status, so a half-finished month never looks broken.
• The numbers count only the employees of the companies you may see.
• The System setup line appears while some area of the workspace is not finished; it is advice, not a blocker.

What it changes

• Nothing. The dashboard only reads. Every button on it takes you to the page that does the work.

On the first day#

A workspace with no employees yet shows the same page with the counts empty and one green line, "Nothing needs your attention right now", plus the System setup card telling you how many areas still need preparing. That card is your way into the Setup Center below.

Setup Center · /settings/setup#

What it is for. A guide to preparing the workspace: it shows which areas are ready and which still need something, and links straight to the page that fixes each one.

Who can open it. Anyone who can open at least one settings page. What you see inside is filtered to the settings you may actually change.

The journey

1. The top of the page says whether the workspace is unlocked and what the recommended next action is.
2. What do you want to prepare? is a row of journeys — all setup areas, add employees, record attendance, run payroll, generate contracts, assign monthly bonuses, issue equipment, use employee finance, manage access. Picking one filters the page to the settings behind that job, so you are not reading about payroll while you are trying to add your first employee.
3. Below that, four counters: needs attention, not configured, partially configured, configured. The State filter narrows the page to one of them.
4. Then come the cards themselves, grouped into Workspace & Companies, Organization & catalogs, Attendance & leave, Payroll configuration, Employee finance, and Users & access.

Each card carries:

• a Required or Optional tag — required means some operation will stop without it, optional means it is only advice;
• a state: configured, partially configured, not configured, needs attention, or not applicable;
• the reason in plain words ("No payroll policy applies today, so payroll runs cannot be created");
• a Fix this link and a button that opens the page where you fix it.

Rules

• This page never blocks anything and never saves anything. It is a guide. Every form lives on its own settings page.
• A card never offers you a link to a page you are not allowed to open. If you cannot fix something yourself, the card says configuration is required without naming the page.
• Cards for a company only appear for companies you may see.
• Seeing a card gives you no extra rights: the destination page still checks what you may do.

What it changes

• Nothing directly. The count of areas needing attention is what the dashboard's System setup line shows.

Settings home · /settings#

What it is for. The map of every configuration page, in nine cards.

Search at the top, then pick: Organization, People & access, Catalogs & labels, Attendance, Payroll, Finance, Documents & letters, Equipment & EPI, System. Once you are inside any settings page, a second menu appears beside it so you can move between them without coming back here.

Chapters 8 to 11 of this guide describe each of these pages.

Notifications · /notifications#

What it is for. The full list of tasks waiting for you and updates about work you are involved in.

Who can open it. Everyone, for their own messages. You never see another person's list.

The journey

1. Active holds what is still open, History what has been resolved, Archived what you put away.
2. All / Unread and the category chooser narrow the list.
3. Open an item to go straight to the thing it is about — the contract, the approval, the payroll run.

Rules

• Reading a notification does not complete it. A task stays in Active until the work behind it is actually done; the page says so under its title. That is why a reminder about an expiring contract does not disappear just because you looked at it.
• Items are produced by the system, not by people. You cannot write one.

What it changes

• Opening or archiving an item only changes your own list. It never changes the record behind it.

Notification preferences · /notifications/preferences#

What it is for. Choosing which optional messages you get.

The journey

1. Tick or untick a category: My requests, Approvals, Disbursements, Payroll, Contracts, Insurance, Employee documents.
2. Press Save preferences.

Rules

• Categories marked Always on cannot be switched off, because everything in them needs a decision from you — an approval that is yours to make, insurance about to lapse, an employee document that has expired.
• For the categories you can switch off, the page lists underneath exactly which messages will still reach you. Switching Payroll off stops the updates, not the exceptions.
• Turning a message off never hides an approval, a payroll exception or a dashboard task. It only stops the notification.
• A category you have never touched is on. You only have to come here to turn something off.
• Following a notification rechecks your permission and your company access at that moment. A message about something you may no longer open will not open it.

What it changes

• Only what arrives in your own list and bell. Nobody else's messages change.

Your profile · /profile#

What it is for. Your own name, your email and your password.

Who can open it. Everyone, for their own account.

The journey

1. Your details — your name (it appears in the sidebar and on every attendance entry you save) and your email (what you sign in with). Save details.
2. Password — your current password, then the new one twice, at least 8 characters. Change password.

Rules

• You cannot delete your own account here. Accounts are never deleted, because years of records point at them; an administrator deactivates them instead. The page tells you whom to ask.
• Changing your email changes how you sign in from that moment on.
• If you were asked to choose a new password at sign-in, doing it here is what unlocks the rest of the app for you.

What it changes

• Your name on entries you save from now on. Entries you saved earlier keep showing the name as it was recorded.

When something goes wrong#

The app is careful about telling you the truth when a save does not go through. Three things are worth knowing.

"Your session has expired." If you have been away for a long time, a small window says so instead of throwing away the page you are on. Sign in again in another tab, come back, press I've signed in, and repeat your action. Nothing is sent again behind your back, so you never save something twice by accident.

"We could not confirm this action." If the app sends a change and gets no answer — the network dropped, the server took too long — it will not claim the change was saved or lost, because it genuinely does not know. The action is listed at the top of the page with a Check status button, which reloads the real state. Then you either see it was saved, or you are allowed to try again.

A refusal is not a failure. When the app says it cannot do something — the day belongs to a closed payroll run, the employee is in another company, the form is out of date — that is a rule protecting figures somebody has already approved. The message always names the reason. The chapters that follow list those rules page by page, so you can see them coming.

Three pages show the same day from three angles, and they all write to the same place:

• Tracking (/tracking) — what is happening right now, shift by shift.
• Daily overview (/attendance/overview) — one day, everybody, across all teams.
• Calendar (/attendance) — one team, a whole month or week.

Who can open them. Anyone allowed to see attendance can read all three. Changing a status, a punch or a note needs the right to record attendance. Importing a punch file is a third, separate right. Tracking has its own. You only ever see employees of the companies you have access to.

First, how a day gets its status#

You will understand every screen faster if you know this. For each person and each date the app asks, in this order, and stops at the first answer:

1. Did somebody record something? A status saved by a person always wins.
2. Is it a public holiday for that team's site? Then the day shows as the rest status.
3. Does the person's schedule say it is a rest day? Then the day shows as rest.
4. Are there punches? Then the day shows as present.
5. Has every shift that applied ended, grace time included, with no punches at all? Then the day shows as absent.
6. Otherwise the day is Not recorded.

Numbers 2 to 5 are automatic: the app is reading the schedule and the punches, nothing is stored. The screens mark those cells with a grey "Automatic" dot and tell you the reason — "Rest day", "From punches", "Automatically marked after the shift ended with no punches". The moment you save a status yourself the cell becomes manual and keeps whatever you chose.

Two things follow from this:

• A day with no record is not necessarily a problem. A rest day, a holiday and a day with punches are all answered without anyone typing.
• "Not recorded" only matters for today and earlier. Future days are never counted as missing.

An odd punch sequence — two "in" punches in a row, an "in" with no "out" — never produces an automatic Present or Absent. The app flags it for a human instead.

Live tracking · /tracking#

What it is for. Watching the day as it happens: who is working, who has not arrived, whose shift needs looking at.

The journey

1. The page opens on today. The green Live · updated hh:mm badge shows it refreshes by itself about once a minute; Refresh now forces it.
2. Narrow the list: date, Search employee (name or fingerprint ID), and More filters for site, team and shift status.

3. The row of chips is a summary and a filter in one: All states, Working, Away, Not checked in, Completed, Need attention. The counts follow the date, site, team and search — only the state chip narrows the list below.
4. Needs attention at the top is the queue: missed shifts, punches that do not add up. Inspect shift opens that person's day.
5. Below, people are grouped by site → department → team. Somebody who belongs to two teams appears once per team, because their expected shift can differ.

6. Each row shows the shift status, the expected shift, the punch activity, and paid vs scheduled as a bar with the difference ("4h 3m of 3h 45m, +0h 18m").
7. Punch in / Punch out records a punch at the current time for that person. The button tells you which one is next.
8. The chevron opens Details (expected shift, where the schedule came from, the grace minutes, punch list). Inspect opens the full day editor described below.

What the states mean

Rules

• "Punch now" uses the server's clock, never your computer's.
• Two punches for the same person less than a minute apart are treated as one. The second does not create a second punch — the page tells you the person has already punched.
• If the person's last punch is an open "in" from today or yesterday, pressing the button records the matching out on that same work date, so a night shift stays one shift.

What it changes

• Punching writes a real punch, exactly like a punch on the device. That can change the day's status (to Present) and the hours the day is paid for.

Daily overview · /attendance/overview#

What it is for. The record-keeping page: one date, everybody, with an Edit on every row.

The journey

1. Pick the date with the arrows, the date box or Today.
2. The bar at the top says how far the day has got: "Attendance recorded 8/11".
3. Filter with Search employee (name or fingerprint ID) and Team, then with the status chips. Each chip carries its own count. Not recorded is a chip like any other — click it to see only the people still missing a status.
4. The table lists each person, their teams, their status with the reason behind it, and the first in / last out times.
5. Edit opens that person's day.
6. Export to Excel downloads exactly what the filters show. Bulk import punches opens the import dialog.

Rules

• The status counts are worked out before the status filter is applied, so the chips keep showing the whole day's shape while you are looking at one slice of it.
• Somebody who belongs to several teams gets a rest or holiday day only when every team they are on says so. Likewise they are only marked absent once every shift that applied has ended.
• People on no team at all can still be marked present from punches, or covered by a holiday that applies to all teams, but never marked absent automatically — there is no schedule to end.
• The list shows active employees only.

What it changes

• Nothing by itself. Everything is saved from the Edit dialog, row by row.

Dialog: edit a day#

The same dialog opens from the Daily overview, the Calendar's week view, Tracking's Inspect, and an employee's own history page. It always works on one person and one date.

• Status — the chips are your statuses; press one to set it. Under them, the app explains where the current value came from ("Automatically marked from punches").
• Punches — the day's punches with In/Out badges and Remove. To add one, type the time and press + Add punch. You never choose In or Out: the app works them out from the order of the day's punches.
• Set worked hours — the shortcut for "she worked 08:00 to 17:00": type a start and an end and press Set hours, and the punches are created for you. + Add another period covers a day split into several stretches. An end earlier than the start counts as an overnight shift.

• Note — free text. When the status you picked is one that should carry an explanation, the note turns amber and is labelled Reason; if you save it empty the app asks once, then lets you through. It is a reminder, never a block.
• Save stores status and note. Cancel closes without saving. There is also a way to clear the entry entirely, which hands the day back to the automatic rules.

Rules

• Saving always records the entry as manual, with your name and the time.
• If the day belongs to a vacation grant, the dialog warns you before saving: editing it here detaches the day from that grant.
• If the day is already paid and approved, or sits inside an approved or closed payroll run, the save is refused and the message says so. Nothing is half-saved — the whole change is dropped.
• Removing a punch re-pairs the rest of that day automatically.

What it changes

• The day's status, note, punches and worked time.
• The day's pay. If an open payroll run covers that date, it is marked for recalculation.

Dialog: bulk import punches#

The journey

1. Download template gives you the shape of the file: fingerprint ID, punch date and time. A Direction column is allowed but optional.
2. Choose an Excel or CSV file and press Preview import. Nothing is saved yet.
3. The preview lists every row with what will happen to it, and counts the problems: unknown fingerprint ID, unreadable time, duplicate, a row whose day is already paid.
4. Import N punches commits only the good rows.

Rules

• Employees are matched on fingerprint ID, not on name. A badge that belongs to nobody you can see is "unknown".
• In and Out are decided by the app, from the order of each day's punches. If your file has a Direction column that disagrees, the file's value is ignored and the row is flagged for information.
• A punch within a minute of one already stored, or of another row in the same file, is a duplicate and is skipped.
• A punch after midnight that closes a shift started the day before counts towards the day the shift started.
• Rows on days that are already paid are rejected in the preview, and checked again when you commit.

What it changes

• Adds punches, which can change those days' statuses and hours, and marks any open payroll run covering them for recalculation.

Attendance calendar · /attendance#

What it is for. One team at a time, a month or a week at a glance.

The journey

1. Choose the Team and the Calendar view (Month or Week). The status key underneath spells out every code.
2. The month header says what still needs doing — "Nothing to catch up on", or how many days have gaps, with a Review first shortcut — plus the number of holidays and rest days.
3. Each day cell carries a slim bar: one coloured segment per status, sized by how many people have it, and a hatched amber segment for people with no record.

4. Holidays get a diagonal stripe and a label; rest days are tinted and say "Rest day".
5. Click any day to open the roster for that day.
6. Week turns the page into one row per employee and one column per day, with the days worked at the end. A small dot marks whether a cell was recorded by a person or by the rules; a coloured dot at the bottom-left means the day carries a flag (late, left early, long break, punches to check).

7. In the week view, clicking a cell opens the same single-day editor as everywhere else.

Rules

• The calendar always shows one team. Use the Daily overview when you want everybody.
• The gap counter and the hatched "not recorded" marks only apply to days up to today.
• Saturday and Sunday are tinted using the workspace's own week, so a Monday-to-Saturday week looks right.

What it changes

• Nothing directly — the roster and the cell editor do the saving.

Dialog: the day roster#

Opening a day from the month view gives you the whole team for that date in one window.

The journey

1. Each person has their own row: status chips, punch list, a note box, and a line saying how the current status was decided.
2. Pressing a status chip saves that person's status immediately — there is no separate save button per row.
3. Set several at once — tick people (or use Select all / Select all not recorded), choose a status, press Preview, check what the change would do, then confirm.
4. Set hours for several people — tick people, type a start and an end (or press Use scheduled hours), press Review, then Confirm & Save hours.

Rules

• The bulk status change never overwrites a note that already exists. If you type one optional reason for the group, it is written only into empty notes.
• The bulk hours tool skips anyone who already has punches that day, and says so. It never replaces existing punches.
• The whole batch is all-or-nothing: if one of the chosen days is already paid and approved, the batch is refused rather than partly applied.
• Use scheduled hours is only offered when the people you ticked share the same scheduled hours. It records ordinary manual punches, marked with a note saying they came from the schedule.

What it changes

• The same as editing one day, for everybody you selected, plus a recalculation of any open payroll run covering those days.

How punches work, in one place#

• Nobody chooses In or Out. Within one person's work date, punches alternate in, out, in, out by time. Add one in the middle and the rest of the day is re-paired.
• A work date is not always a calendar date. An "out" after midnight belongs to the day the shift started.
• Taps are protected. Two punches less than a minute apart count as one.
• The limit is 16 hours. A punch more than 16 hours after an open "in" starts a new day and leaves the earlier one flagged as odd. This is also the one case the app cannot judge for you: a forgotten "out" followed by an early start the next morning is read as a very long shift. The day shows an unlikely worked time; open the editor and correct the punches.
• Worked time is never stored, it is derived from the punches every time a page is drawn. Break time is the gap between an "out" and the next "in".

What attendance changes further down the line#

• Daily pay is calculated from the status and the punches, so attendance is the input the whole pay chain depends on.
• Once a day has been approved in the daily pay register, or its month's payroll has been approved or closed, attendance for that day is locked: the app refuses the change and tells you why. This is deliberate — changing it silently would make somebody's approved pay wrong.
• While a payroll run is still open, changing attendance is allowed and simply marks the run to be recalculated.

Everything about a person lives in one record. This chapter covers the employee directory, the form that creates and edits a record, the profile with its tabs, and the five pages around it: hire requests, transfers, promotions, contract reviews and the letter register.

Who can open these pages. Seeing employees, creating them and editing them are three separate rights, and pay is a fourth: a person can be allowed to edit a record and still never see a salary. When that is so, amounts are simply absent from the page — not blanked out, not greyed, absent. If you try to send a pay value without the right to change pay, the save is refused rather than quietly dropped. Moving somebody between teams or companies is its own right again.

You only see employees of the companies you have access to. An employee who belongs to no company is visible to system administrators only.

Employees · /employees#

What it is for. The directory: find a person, open their record, add somebody new.

The journey

1. The four counts at the top are also filters: Active employees, Without a team, New hires (last 30 days), Leaving soon (finish date in the next 30 days).
2. Find employees narrows by name, employee number or fingerprint ID, by team, and by status (active only by default — archived people are hidden until you ask for them).
3. Quick queries jump to a prepared slice: scheduled change, documents expiring, contract ending, no company.
4. The directory itself is a Grid of cards or a Table; the toggle is on the right.

5. Each row or card offers History (the full profile), Edit, and More — salary history, attachments, employee finance, financial statement, termination review, transfer, archive or restore. Only the entries you are allowed to use appear.
6. Add employee opens the wizard.

Rules

• The list is filtered to your companies before anything else, so counts and searches are already scoped to what you may see.
• Job title and classification shown here are the ones in force today. If a change is scheduled for a later date, the row says "Assignment change scheduled for …" instead of pretending it has happened.
• Archiving never deletes anything: Archive this employee? says so plainly — the history, attendance and pay stay exactly as they were, and Restore brings the person back.

Dialog: Add employee#

A seven-step wizard. Nothing is saved until the last step.

1. Personal details — name and employee number are required; the number is pre-filled with the next free one and you can overwrite it. Fingerprint ID, job title, classification, hire date, contact details, date of birth, nationality, ID number, blood type, driving licence and professional card all live here.
2. Compensation — base pay and the extra hourly rates. Only shown to people who may see pay.
3. Contract & probation — optional. Recording it here saves it with the employee.
4. Insurance — optional, up to five coverages.
5. Attachments — documents, each with a type, an expiry date and a note.
6. Teams — where the person works. At least one team.
7. Schedule — optional personal hours that override the team's.
8. Review — everything in one place before saving.

Rules

• Each identifier must be unique. While you type, the app checks the employee number, fingerprint ID and email against the ones already in use and blocks Continue if one clashes. It only ever says "already in use" — never who has it.
• Possible duplicates are a warning, not a block. If somebody with the same ID number, or the same name and date of birth, already exists, an amber note lists up to five matches you are allowed to see.
• A missing required field stops you at that step and the field says what it needs.

• The employee needs a schedule that works. Before saving, the app checks that every weekday has a schedule for the chosen company and teams — from the team's own shifts or from the company's global shift. If a weekday has nothing, the save is refused with a message on the Teams step. An explicit rest day counts as configured.
• Closing the form with unsaved typing asks first. So does following a link out of the page.
• Save and add another keeps the team and hire date for the next person.
• Preview contract document on the review step opens Contract preview, a dry run: it builds what the employee and the contract would be, lets the real contract code read it, shows you the fields with their Ready or Missing state and a provisional PDF — and then rolls everything back. Nothing is saved and no file is stored.
• A tick on the review step, Prepare as a hire request, saves the person as a draft instead of hiring them outright. See Hire requests below.

What it changes

• Creates the record, the company assignment, the team membership, the first job-title / classification period and the first pay period. The first periods start on the hire date, not today, so a back-dated hire is paid from the day they started.
• After saving, a Next steps panel offers the obvious follow-ups — record a contract, add insurance, upload documents, issue equipment — with only the ones you may do.

Dialog: Edit employee#

The same wizard with one more step (Schedule) and two important differences.

Rules

• Teams are read-only here. The step shows today's teams and a Transfer teams button, because moving somebody is a transfer with a date, a reason and a review of the pay it affects — not a quiet edit. (The one exception is a legacy record that belongs to no company at all, which can still be placed from here.)
• Pay is only editable with the right to change pay. Saving a profile without touching pay leaves every stored pay value untouched.
• An archived job title or classification stays on the people who already have it, and is refused for anyone else.

The employee profile · /employees/{id}/history#

One person, everything about them, in tabs. The header carries the name, status, fingerprint ID, job title, classification, hire date and current teams, plus an Actions menu with the same entries as the directory's More.

Attendance#

One month at a time: every day with its status and how it was decided, the totals (worked days, days off, neutral days, days still not recorded), the list of entries somebody actually saved with who saved them and when, and the person's team history. Clicking a day opens the same editor as the attendance pages. Days in the future are never counted as missing.

Personal & documents#

Personal details (date and place of birth, nationality, ID number, sex, marital status, blood type, address, contact details, driving licence, professional card), emergency contacts, and the documents on file with their type, expiry and a download link.

Preview attachments opens the documents in the page itself — a PDF or an image at a glance, without downloading it first. Every opening, preview or download alike, is recorded.

Rules

• Removing a document keeps the record of it. The row stays, marked as removed, with who removed it and when; the file itself is deleted. A removed document cannot be downloaded any more.
• A document type that has been archived stays on the documents that already use it, but cannot be chosen for a new one.
• A document with an expiry date raises a reminder 15 days before, and keeps reminding after it has passed.
• Contract copies (drafts and signed contracts) only appear to people who may see pay, and every opening of any document here is recorded.

Contracts & probation#

The journey

1. Add contract records the agreement: type (fixed-term, indefinite, trial contract, other), start, end, reference, notes, the document, and optionally the probation period.

2. The card then shows the contract's state — upcoming, current, expired, superseded, voided — and a three-stage strip across the top: Recorded, Review, Signatures, so you can see at a glance how far the paper has got.
3. Where the contract document is turned on, this is also where the French contract is generated, reviewed, approved and signed in the browser.

The contract's dialogs#

Every button under the card opens one small window, and each one asks only for what it needs:

Renew contract keeps the point in its own banner — "the earlier agreement stays in the history exactly as signed" — and takes the new type, dates, reference, document and probation in one go.

Correct contract details is the deliberate path for a date typed wrongly, and asks for the reason that goes into the history.

Void asks for a reason and warns what it affects. Nothing is deleted.

Change probation edits the probation term agreed with the contract — not a later decision.

Contract documents keeps the papers together, and is careful about what each one is: "A signed copy is a scan of a paper that was signed. It is kept as evidence; it is not a verified electronic signature."

Dialog: prepare the document#

This is where the French contract is built. Two things are worth reading on it:

• "A preview saves nothing and creates no document. Finalizing is a separate, confirmed step and needs a recorded legal approval or a published template for the company."
• To complete before this document can be finalized — a plain list of everything still missing, in a person's words: the company's registered address, commercial registration number (RCCM), tax number (NIF) and authorized representative; the employee's number, date and place of birth, nationality, address and marital status; and whether a job title and classification cover the contract's start date.

Preview PDF produces the provisional paper anyway, watermarked, so you can read what is there while you collect the rest. Refresh information re-reads the record after you have filled a gap.

Dialog: a probation decision#

Extending probation, or recording how it ended, is not a field you change. It opens a small form — the new end date (or the outcome), the date it was decided and any notes — and Prepare turns it into a paper that goes round for signature. The contract does not move until the last signature is in. Withdrawing a prepared decision cancels its round.

Recording how probation ended uses the same shape, asking for the outcome instead of a new date:

The signatures panel#

Under the card, Signatures explains the order in its own words: "The employee signs first, then each post on the company's chain in order. No signature image is stored: each signature is recorded against this exact document." Send round for signature opens the round; until then it says the contract has not been sent.

A round cannot be opened while the document still has a blocker — including the recorded legal approval of the wording. Signatures are gathered on wording somebody approved, or not at all.

Rules

• A contract is a record for HR. It changes nothing else — not the hire date, not the finish date, not the status, not the salary, not attendance, not payroll. The tab says so in its first line.
• Contract dates are never rewritten. An early renewal does not move the old contract's dates; it marks it as superseded by the new one. Correcting a date is a separate, reasoned act.
• Two contracts of the same person can never be in force on the same day. A renewal that starts while the old one is still running asks you to confirm that it supersedes it.
• Probation sits inside the contract's term. Extending it keeps the previous end date in the history. Extending probation, or recording how it ended, becomes a paper that is signed before it takes effect: nothing moves until the signature round is complete.
• A contract end or a probation end raises a reminder 15 days before, and keeps reminding after.
• Signatures are gathered only on wording that has been approved. The employee signs first, then each post on the company's signature chain, in order. Sending a contract back for correction cancels the round and voids the signatures already given — the people who signed agreed to wording that is about to change.

Insurance & benefits#

Coverage by type, with provider, policy number, dates, the document, and the monthly amount where the type pays one.

Rules

• Several different insurance types may overlap. The same type cannot overlap itself for one person.
• A renewal that starts while the previous coverage is still running must say so, and ends it the day before.
• A monthly insurance allowance is an extra earning, not part of the salary: it raises gross pay and never touches base pay, overtime or holiday rates.
• Amounts are only shown to people who may see pay, and setting a custom amount for one person needs the right to change pay.
• Coverage ending raises a reminder, using the notice period set on that insurance type.

Leave#

Days available, how they were earned, each leave year, and every movement — days taken, days given back, expiry, corrections. A card per kind of absence sits at the top: a quota kind shows the current period (15 left of 15 · 2026-01-01 → 2026-12-31), annual leave shows the balance with earned and taken underneath.

When it is out of date it says so. After a grant is saved, or after the rules change, the tab shows the balance as it stands — which may be negative — with the line the rules or this employee's file have changed since the leave years were last worked out, and a Work them out again button.

Pressing it rebuilds the leave years from the hire date and the rules in force: a balance showing -5 (earned 0 · taken 5) became 25 (earned 30 · taken 5), with one leave year per employment year — 12 months → 24 days expiring in 2028, 3 months → 6 days expiring in 2029. Nothing about the days taken changed; only the earning side was filled in.

Two dialogs correct it, and both are deliberate acts rather than edits:

• Correct the balance records a movement — so many days, in which direction, with a reason. The figures it corrects stay visible underneath.
• Expire what is out of date? applies expiry to days whose leave year has run out. Nothing expires on its own, which is why this exists: a balance never shrinks quietly between two times somebody looked at it.

Rules

• The balance is never stored. It is the leave years plus the movements, worked out when you look at it, so it cannot drift from the rows that explain it.
• Days are consumed oldest year first, which is what makes expiry honest.
• Nothing expires by itself. Expiry is an action somebody takes, so a balance never shrinks quietly between two times you looked at it.
• The rules themselves (how many days a month, the ceiling, the qualifying period, when days expire, the bonus for children) are company settings. Changing them does not rewrite past leave years; Work them out again does, and says so.
• A correction is a recorded movement with a reason, never an edit of the figures.

Equipment & EPI#

What the person is holding: items issued, when, their condition, and anything outstanding. Returns, losses and damage are handled from the issuance register (chapter 4).

Compensation#

Current pay, the additional hourly rates (overtime, holiday, weekend), the current assignment (job title, classification, grade and échelon), the seniority allowance, and the full history of both pay and assignment.

The seniority allowance sits at the top and says plainly whether it applies. Apply seniority opens a small form for the percentage and the date it starts; while it is off, the line reads "Not applied. This employee receives no seniority allowance."

Rules

• This tab, and everything in it, needs the right to see pay.
• Pay is effective-dated: a change creates a new period from a date and closes the previous one. Nothing is overwritten.
• If the change reaches pay that has already been approved, the app shows what it would affect and asks you to choose how to handle it before it saves anything.

Payroll#

The person's payroll records month by month, with the amounts and the state of each run. Also needs the right to see pay.

Hire requests · /employees/hire-requests#

What it is for. Hiring as a chain of papers: a prepared person, a request that is signed, and a contract that is signed, before anybody becomes a member of staff.

The journey

1. On Add employee, tick Prepare as a hire request on the review step. The person is saved as a draft.
2. The register lists one row per prepared hire: the stage, the state of the contract, and the one next step the server says is available.
3. Record the contract on the person's Contracts tab, then send the request round for signature.
4. Each post on the company's signature chain signs in turn, from this page.
5. When the request and the contract are both signed, activate the hire. The person becomes an ordinary active employee.

Rules

• A draft is invisible everywhere else. Not in the employee list, not in attendance, not in reports, not in payroll. That is deliberate: a prepared hire carries full company, team and pay rows, because the contract cannot be written without them, so the safety is that every other page ignores them.
• Preparing and approving are two different rights. Whoever prepares a request cannot necessarily decide it.
• "Send round for signature" is withheld until a contract exists, because the paper prints the nature of the contract: a contract recorded afterwards would invalidate the signatures.
• Changing the request after it has been signed invalidates those signatures; the page tells you to reopen it instead.
• Activation is a status change, not a new record, so the contract signed while the person was a draft keeps its signatures.
• Adding somebody directly with Add employee is still the normal path for an import or a repair — a hire request is for the cases that need the chain.

The register's dialogs. Each stage has one: a plain confirmation for the steps that only move the paper forward (submit, send round, activate), and a short form that asks for the reason where one is owed — refusing a request, and reopening one. Sign the hire request opens the real PDF with a signature pad, and only for the account whose turn it is.

Transfers · /employees/transfers#

What it is for. Every move between teams, departments, sites and companies, with who made it, when it starts and why.

The journey

1. New transfer opens Transfer employee, a two-step dialog: the details, then a review of what it affects.

2. Pick the employee, the type of move, the destination, the effective date and a reason.
3. The review shows the change and, when it reaches pay that has already been approved, asks you to choose how to handle it before anything is saved.
4. The register lists past and scheduled transfers, with filters by employee, type, status and date.

Rules

• A transfer effective on a date ends the old membership the day before and starts the new one that day, so there is never an overlapping day.
• Past, today and future dates are all allowed. A later transfer or membership already on file blocks an earlier-dated one, and the message names it.
• A scheduled transfer can be cancelled from Cancel scheduled transfer, with a mandatory reason, as long as nothing depends on it. The dialog refuses a transfer that has already taken effect and says to correct it with a new one instead. A transfer that has already taken effect is never cancelled — it is corrected with a new transfer with its own date, reason and review.
• A company transfer that would leave somebody out of an open payroll run with no cover is refused, and the message names the run.
• Archived employees can be moved between teams (so somebody stuck on an archived team can be rescued) but not between companies.

What it changes

• Team membership and, for a company move, the company assignment. Open payroll is marked for recalculation; approved payroll is only touched through the review you were shown.

Promotions · /employees/promotions#

What it is for. Role and level changes — classification, grade, échelon — planned, reviewed and recorded without rewriting history.

The journey

1. Requests lists promotion requests with their state. New promotion request starts one: the employee, the new level, the effective date and the reason.
2. Promotions due is the other half: people the rules say are due a step, grouped into overdue, due now, a twelve-month forecast, blocked, and "not on a ladder". With no rules set, the tab says Nothing is due and explains why, with a link to the rules.

Each due person has three answers, each with its own small window:

Rules

• A rule only ever produces a suggestion. Nothing is applied automatically, no pay moves and no approval is skipped.
• A suggestion that is blocked says why: the person is at the top of the ladder, the next level is archived, or no salary exists for the target level on that date. A blocked next level is reported, never skipped — stepping over it would promote somebody two levels at once.
• The effective date defaults to the date the promotion fell due, so a promotion handled late is still owed from when it was due.
• Declining a suggestion keeps the person's seniority and simply pushes the next one out by one interval.

Contract reviews · /contract-reviews#

What it is for. The queue for whoever checks contract documents before they are finalized, and the band of contracts waiting for your signature.

The tabs are the states: review required, changes requested, finalized, needs resubmission, cancelled. Search by employee, ID or contract reference, and filter by company.

Rules

• Returning a contract for changes sends it back with your comment; it does not alter the contract record.
• The employee signs from a single-use link (/sign/...) that needs no account; every miss — unknown, spent, revoked, expired, not their turn — answers the same way, so a link tells a stranger nothing.
• The waiting for your signature band only lists steps whose turn it genuinely is — you are never shown a signature you cannot give yet.
• Only the account that holds a signing post may sign for it. A system administrator may sign on their behalf, and the document records that it was signed on behalf.

Letter register · /letters#

What it is for. Every official letter reference the workspace has handed out, and the letters written against them.

The journey

1. The three cards are the three counters: cabinet letter, absence permit, explanation request. Each shows what the next number will be.
2. Take a reference only reserves the next number. Write a letter reserves it and goes straight to the letter.

The dialog asks four things: what the paper is, who it goes to, the wording to start from, and — the one that cannot be changed afterwards — who signs this paper. Ticking RH, DA and DG puts their codes into the reference and gives the printed paper a signature space for each. As the dialog says: "This cannot be changed afterwards: the number records the circuit." A service note the Director General alone signs is a different circuit, and therefore a different number, from a sanction that goes round all three. 3. Choose the employee and, if you like, a ready-made wording (a letter model). The letter itself lives at /letters/{id}/letter: fill in the body, save it as a draft, then have it approved. 4. The register below lists every reference with its subject, kind, status and year.

The letter itself · /letters/{id}/letter#

The page is split: the form on the left, How it will print on the right, updating as you type. A draft prints with a visible PROJET — EN ATTENTE D'APPROBATION band and watermark, and the page says so.

• Who it goes to — an employee, or somebody else by name, with their position if it should print.
• The letter — written in French, "because the official print language is always French". Pick a model with Use this wording: the employee's name, position and number and the company's details are filled in, and four dots mark what is left for you.
• Written from is the town printed before the date; Subject is what prints after "OBJET :".
• Text is plain: a blank line between paragraphs, and nothing else is formatting.
• Who signs it was set when the number was taken and is printed inside the reference — "a different signer means a new reference".

Dialog: approve the letter#

Two sentences that matter: "The wording is frozen from here. Approving is not a signature: the letter is signed afterwards." A note can be added. Reopen the letter is the way back, and needs a reason.

The letter's other dialogs#

Rules

• Nobody types a reference. The app composes it from the posts you ticked and the counter — 01/10/26/RH/DA/DG/CAB — and freezes the printed string.
• A cancelled number keeps its hole. The cancelled row stays forever with its reason, and the next letter still takes the next number. That is the point of a register.
• A company with no signature chain configured cannot number a cabinet letter at all; the card says so and links to the setting.
• The numbering basis (per month or per year) can only be changed before the first letter of a year, or two papers could print the same reference.
• A letter is a draft until it is approved: it prints with a visible PROJET banner and watermark. Approving freezes the wording; after that it can only be reopened with a reason.
• Writing and approving are separate rights, so an office that separates them can, and a one-person office is not blocked.
• The letterhead and the signing post are frozen into the letter when it is first saved, so renaming the company later never rewrites a paper already filed.
• The signature stays wet: there is no signature image anywhere in the letter.

What the company owns, who is holding it, and what happened to it. The catalog (what an item is) is shared across companies; the stock belongs to one company and is shared by all of its sites.

Who can open these pages. Seeing stock, issuing equipment, managing stock and handling damage incidents are four separate rights, and two of them are on no built-in role at all — they are given deliberately. Everything you see is limited to the companies you may access.

Inventory · /equipment/inventory#

What it is for. How much of each item the company has, how much is out, and how much is damaged.

The journey

1. The four counts — available units, issued and still to be returned, damaged units, low-stock equipment — are also filters: clicking one narrows the table.
2. Search by name or code, filter by category, availability and tracking, or show archived items.
3. The table lists each item with its code, category, how it is tracked, and the three stock numbers.
4. Receive stock brings new units in. Issue equipment hands one to a person. Opening a row shows everything about that item.

Dialog: receive stock#

Quantity (or the serial numbers, for serialized items), the date, a reference such as a delivery note, and a note.

Dialog: issue equipment#

The employee first, then the date — because the equipment comes from the stock of their company, as the dialog says. Only then does it offer what can be issued.

The item drawer#

Stock split into available, issued and damaged, the registered total and the exits so far (consumed, lost, written off), the low-stock threshold, the damage policy, who is currently holding it, and the movements that explain every number. Adjust stock, Issue and Receive act on this item.

Dialog: adjust stock#

A correction with a reason — a stock count that disagrees, a unit written off. It is a movement like any other, not an edit of the figure.

Rules

• Every number here is derived from movements. Nothing is typed into a balance, which is why the drawer can always show you what produced it.
• Stock can never go negative, and the figures are checked against the movements, the serialized assets and the open custody by a verification report.
• All the sites of a company share its stock. There is no site-level stock and no automatic transfer between companies.
• Receiving, adjusting and issuing need the company to be active; returns, loss and write-offs keep working for an archived company, because they are cleanup.
• Repeating a request (a double click, a retry) returns the first result instead of recording the movement twice.

Issuance register · /equipment/issuances#

What it is for. Who holds which equipment, what is still to be returned, and the damage reports under review.

The journey

1. Three tabs: Currently issued, History, Damage & reviews.
2. Filter by employee, equipment or serial, by condition, and with two telling switches — employee now in another company and employee has left, which is how you find equipment that needs chasing.
3. Opening a row shows the custody.

The issuance drawer#

The employee, the owning company, the quantity issued and still outstanding, the dates, who issued it, the condition at issue, and the custody history. Four actions: Return, Report lost, Replace, Report damage.

Dialog: return equipment#

How many units come back, the date, and the condition — usable or damaged. Returning damaged units is what starts a damage review.

Dialog: report damage#

The dialog says what it does, in its own words: recording damage does not return the item and does not charge anyone. It starts a review. You give the number of damaged units, the date, how bad it is, and what is damaged; photos and documents can be attached afterwards.

Dialog: report lost equipment#

How many units, the date, what happened, and a tick you have to make yourself: "I confirm this equipment is lost. It will not return to stock." The Record loss button stays disabled until you do — losing a company asset is not a click you make by accident.

Dialog: replace equipment#

One action, three movements: the old unit comes out of custody, a new one goes out, and the stock moves to match. They are recorded as one group, so the history reads as a replacement rather than as an unexplained return and issue.

Dialog: damage policy history#

Every version of the item's damage policy, with the dates each was in force. It is here because an issuance keeps the policy version it was issued under: this is how you check what a particular person is actually liable for.

Other dialogs#

Rules

• An issuance belongs to the company the employee was in on the issue date, and never moves. If they transfer later, the row is flagged rather than reassigned.
• A unit can only be reported damaged once. Overlapping reports, partial returns and retries cannot charge the same unit twice.
• A consumable is not expected back; a returnable item creates a custody that stays open until it comes back, is lost, or is written off.
• A serialized item is always returnable, and each piece is tracked by its own serial number.

Damage & reviews#

Every incident with its state: reported → under review → resolved. A resolution is one of: normal wear with no charge, a charge requested, the charge waived, or the report invalidated.

Rules about charging

• Equipment never deducts anything from pay by itself. The most it can do is create a draft deduction in Employee Finance, which somebody still has to submit and approve (chapter 6).
• A charge is only possible when the item's damage policy allows it, the evidence is there, the company matches and the finance side is configured. When it is not, the screen names the exact blocker instead of hiding the button.
• The charge uses the damage policy recorded on the issuance, not today's policy, so changing the catalog later never changes what somebody already owes.
• Waiving or invalidating cancels a draft deduction; once the deduction has been submitted or approved, Equipment refuses and tells you to cancel it in Employee Finance.

EPI requirements · /equipment/requirements#

What it is for. What each employee should receive as protective equipment, what they already have, and what can be issued from their company's stock.

The page explains its own order:

1. Choose the working date — it controls the company, the active profile, the stock and the renewal status you see.
2. Assign the employee profile — the profile that matches their role, and the date it starts.
3. Review and issue what is due — open the requirements, check the shortages, then issue the available items from that employee's company stock.

Rules

• A profile is a requirement, not proof of a handover. Assigning one reduces no stock and creates no issuance history; only the issue action does that — the page says so.
• Equipment has to be received into the right company's inventory first; a profile cannot issue what the company does not have.
• Profiles are effective-dated (chapter 11), so changing one later leaves existing assignments and issuances exactly as they were.

What equipment changes elsewhere#

• Payroll: nothing, ever. Equipment writes no payroll line and no accounting entry. Its only path to money is a draft deduction that follows the ordinary approval route.
• The employee profile gains an Equipment & EPI tab showing what that person holds.
• The termination review lists outstanding custody as a warning, so nobody leaves with the company's boots by accident.
• Archiving a company warns about custody and stock; stock rows stop that company being deleted outright.

Pay is a chain, and each link only accepts what the one before it has settled:

attendance → the daily pay register → the monthly payroll run → pay statements → salary payments

Nothing in this chapter invents a figure. Every amount comes from the schedule, the attendance and the compensation already recorded, which is why the settings in chapters 9 and 10 have to exist before any of it works.

Who can open these pages. Seeing daily pay, approving it, seeing payroll, approving payroll and recording salary payments are five separate rights. The pages only draw the buttons you may use.

Daily pay register · /pay-register#

What it is for. What one day is worth for each person, before anybody approves anything.

The journey

1. Pick the work date. The banner tells you when the date is a holiday, and how that holiday is configured.
2. The six figures at the top are the day in summary: employees on the page, ready to approve, needs correction, approved, the daily pay total (the money that will actually be paid for this day) and the monthly allocations (display only — see below).
3. What is blocking this date lists anything that stops the day being priced, with a link to the page that fixes it.
4. Below, one row per person: the resolved shift and punches, the worked time split into regular and overtime, the amount, and the review status.

5. Approve fixes that day's figures for that person. Rows can also be ticked and approved together.

The two kinds of row

• Ready to approve — an hourly employee. The amount is real money for that day, and approving it freezes it.
• Monthly allocation — a monthly employee. The figure shown is explanatory only: it is the slice of the monthly salary that falls on this day, and it is approved in the monthly payroll run, not here. The row says so.

A monthly employee can still have a payable line here — holiday work, for example — and then the row becomes approvable for that part alone, while the salary allocation stays display-only. That is how holiday work is paid without paying the salary twice.

Rules

• Only approved days reach monthly payroll. An hourly day left unapproved is simply not in the run.
• A day cannot be approved when its payroll is already settled: the covering payroll record or run is approved, or the run is closed. The messages are different, and a closed run never suggests reopening.
• Approving a day resets the open payroll record that covers it, so the run recalculates with the approved figure.
• A day outside every company assignment cannot be approved at all.

The holiday case#

On a holiday the banner names the holiday, its scope, its type and whether it is paid. The pay follows the holiday rules from chapter 9: a paid day off plus, for hours actually worked, the holiday rate.

Holiday pay paid outside payroll. When the holiday lines of an approved day were handed over in cash, you record that here with settle. Payroll then keeps the earnings and offsets the cash, so the figures still add up and nothing is paid twice. A settlement can be reversed only before payroll approves it; money the employee kept is recovered through a deduction instead. Settling or reversing is its own right, held by finance rather than HR.

Payroll · /payroll/runs#

What it is for. The monthly run: one company, one month, every employee.

Each row is a run with its period, company, status, how many employees it holds (and how many are blocked) and the approved total.

Dialog: Create payroll run#

• Company and Month.
• Manual protected net — only when the company's recovery policy asks payroll to enter it.
• Late-processing reason — left empty during the normal window; after the cutoff an authorized override and a reason are required.

Rules

• A run cannot be created without a payroll policy for that company and month (chapter 10).
• A run needs the company's shared finance rules to exist, because recovery is part of closing it.
• One run per company and month.

The run page · /payroll/runs/{id}#

What it is for. Reviewing, approving and closing one month.

The columns are the money in order: net before (gross minus anything paid outside payroll), protected net (what the policy says must reach the employee), applied (what recovery actually took) and final net.

The journey

1. Calculate produces every employee's figures from the schedules, attendance and compensation of that month.
2. Review row by row. Details opens the segments behind a figure — the dated periods, the scheduled hours and the eligible hours.

3. Statement opens that employee's pay statement.
4. Approve freezes one employee's figures. Reopen unfreezes them, with a reason.
5. When every record is approved the run itself becomes Approved, and Close run appears.

6. Close run settles the month: recoveries are posted, and the figures become final.

7. Reverse settlement undoes the closing, with a reason and a date.

Dialog: reopen payroll#

Unfreezing one employee's month needs a reason, which stays in the record. Reopening also releases anything the approval had recognised — a settled holiday payment, for example — so the figures stay consistent.

Dialog: Reverse complete payroll settlement#

It states what it will do before you type anything: "This posts exact inverse financial transactions for the whole run. Individual settlement items cannot be reversed." It takes the reversal date and a reason, and the button is deliberately red. It is refused while any salary payment recorded on that run has not itself been reversed.

Other dialogs on the pay pages#

What the statuses mean

A record is blocked, rather than wrong, when a day in the month has no schedule, when a graded employee has no salary for their level on that date, when an attendance status has no payroll treatment, or when a currency conversion has no rate. Every one of those is a setting somebody has to decide — guessing would be inventing somebody's pay.

Rules

• Approving freezes the inputs. From then on, attendance and daily pay for that employee and month are locked, and the app refuses changes with the reason.
• Changing something that affects an open run does not corrupt it: the run is marked for recalculation, and you press Calculate again.
• A change that reaches an approved or closed record cannot simply be applied. It opens an impact case (below), and you choose how to handle it.
• Closing posts the recoveries — advances, loans, deductions — according to the company's recovery rules, respecting protected net pay.
• Reversing a settlement is refused while any salary payment on the run has not been reversed.

How a recovery is worked out, in order

1. Which obligations are genuinely due — an approved advance that was never paid out, an undisbursed loan, a future instalment are not.
2. Currency conversion, and only then, only for what is due. A due obligation in another currency with no usable rate blocks the record rather than guessing.
3. What each one asks for, then the company's order, then each cap, then the overall limit, then protected net pay.
4. The result per obligation: requested, applied and unapplied, which always add up. Each line also records which rule decided it — the order, a cap, or the protected net.

• Nothing is reserved while a run is a draft. No balance moves, no transaction is posted, and recalculating safely replaces the prepared lines.
• The same obligation cannot be prepared in two open runs at once. The second run says so, and recalculates against the real balance once the first one closes or lets it go.
• A reversed run keeps its original rows on display, with the effective recovery shown as nothing.

Pay statement · /payroll/statements/{record}#

What it is for. One employee, one month, on one page — and the paper you can print.

Gross earnings, net before recoveries, final net, every financial application (advance, loan, deduction) with what was requested, applied and left unapplied, and the salary payment block.

Rules

• The statement presents certified payroll facts and does not recalculate anything; it says so at the bottom.
• It needs the right to see payroll; seeing attendance is not enough.

Salary payments#

What it is for. Recording that an employee actually received the money for a closed run. It never changes payroll — payments sit on top of closed runs.

Tracking has to be switched on deliberately. A run that was closed before you started tracking is Not tracked — not "unpaid". Two ways to start:

• Start tracking payroll closed from now on — every run closed after this moment is tracked.
• Track this historical run — adopt one older run on purpose.

The dialog is explicit: every employee starts as not paid, nothing is recorded as paid, and the act is logged with your name and reason.

Once tracked, each employee shows what is owed and what has been paid, and you record payments one at a time or in bulk. The status comes from the arithmetic, never from a flag: not paid, partly paid, paid, nothing due.

Rules

• The amount owed is the record's final net — already net of recoveries, so an advance is never deducted twice.
• A payment cannot exceed what is outstanding, cannot be in another currency, and must be dated between the closure date and today. Two controlled exceptions exist (an archived company, or a historical date on an adopted run); both need a reason and the elevated rights.
• Payments are append-only. A mistake is corrected with a reversal, not an edit. A reversal for "never disbursed" must be recorded by somebody other than the person who recorded the payment.
• Bulk recording previews every employee first, then re-checks each one when you commit and skips any row that changed in the meantime.
• The export is a preparation list: it is not a bank file and not evidence of payment, and every file produced is logged.

Impact cases · /payroll/impact-cases#

What it is for. The queue of retroactive changes that overlap pay somebody has already approved.

The journey

1. A case appears whenever a dated change — compensation, schedule, transfer, holiday, insurance — reaches a month that is already approved or closed.
2. Open one (/payroll/impact-cases/{id}). It shows the source change — what, when, by whom and why — the amounts it affects by currency with the employee and period behind each, the event timeline, and the resolutions down the right-hand side.

3. Choose how it is resolved.

The five resolutions#

Each one confirms before it acts, and says plainly that it cannot be undone.

Dialog: retroactive payroll impact#

The same review appears before you save a change that would reach approved pay — on a compensation change, a schedule change, a transfer, a holiday or an insurance change. It lists who and which months are affected and makes you choose the strategy there and then; the case you see here is the record of that decision.

Rules

• Approved and closed payroll is never silently rewritten. The case is the deliberate step between a change and somebody's pay.
• The strategy is chosen when the change is saved — the preview you are shown is the same code that will run — and the case records it.
• Open runs do not need a case: they are simply marked for recalculation.

Bonuses · /employees/bonuses#

What it is for. Assigning the bonus types from chapter 10 to people for a given payroll month.

The journey

1. Choose the payroll month. The counts show how many employees match, how many have a bonus and how many do not.
2. Filter by employee, status, organization and job level.
3. Assign bonus gives one to a person for that month.

Rules

• Assignments do not renew. A bonus is for the month you assigned it to; next month starts empty. The page says so in its first line.
• Eligibility comes from the bonus type: an entire classification, a classification and grade, or one exact level. Somebody outside the scope cannot be given that bonus.
• The row shows the employee's organization and level during that month, with a "changed during month" marker when they moved, so you can see what they were when the bonus applies.

Three things an employee can owe the company — a salary advance, an employee loan, an employee deduction — plus the approvals behind them and the pages that show where somebody stands.

Who can open these pages. Each product has its own set of rights: view, create, submit, approve, disburse, record a repayment, cancel. They are deliberately spread across people, and none of them is on the HR administrator role by default. You also only ever see the companies you have access to.

How a financial request works#

All three products follow the same path, and the words on the pages are the same:

1. Draft — somebody writes the request. Nothing is committed.
2. Submitted — it enters the approval workflow configured for that company (chapter 10).
3. Approved or rejected — by whoever the workflow's step assigns it to, and who holds the permission to approve that product.
4. Waiting for payment — approved, but the money has not left yet.
5. Confirmed payment — finance records that it was actually paid. Only now is anything owed.
6. Recovery — payroll takes it back according to the recovery rules, or finance records a direct repayment.
7. Settled — nothing left outstanding.

Two rules hold throughout:

• Nothing is owed until payment is confirmed. An approved advance that was never paid out owes nothing, and the page says so.
• Nothing is edited after the fact. A mistake is corrected by a reversal or a cancellation, both of which stay visible in the activity log.

Finance overview · /finance/overview#

What it is for. What needs attention now, across the products you can see.

Four counts: waiting for your decision, pending approvals, due this month, not yet in payroll, and payroll exceptions. Below them: recoveries due by the end of the month, outstanding balances per product, pending approvals per product and payroll exceptions per product.

Rules

• Only the products and companies you may view are counted.
• Amounts are never added across currencies. Each currency keeps its own line — the page says so under the title.

Financial approvals · /financial-approvals#

What it is for. Your approval queue: only the decisions assigned to you and actionable now.

Filter by employee or reference, company, product, purpose, workflow, step, status, currency and submission date. Actionable now lists what you can decide; opening one (/financial-approvals/{id}) shows the request, its terms and the comment box.

Rules

• The list shows only steps that are genuinely yours and genuinely next. A later step in the same workflow does not appear until the earlier one is decided.
• The service rechecks everything when you decide — eligibility, the policy snapshot, whether the request changed since you looked. The page says so above the list.
• New actionable steps appear here on their own; you do not depend on a notification arriving.
• An approver who is also the requester is blocked when the company's rules separate those roles.
• There is no bulk approval. Each decision goes to the product's own workflow, one at a time.
• The context beside a request is filtered before it is totalled, so somebody who may not see loans cannot learn a loan balance from a deduction they are approving.
• A task that vanishes, or a decision refused as stale, means somebody else acted, the request changed, or your access changed. Reload the queue rather than sending the decision again.
• Seeing Financial approvals in the menu grants nothing by itself: the list is still only what is yours.

Salary advances · /salary-advances#

What it is for. Part of a salary paid before the normal pay date, recovered from a later payroll.

The journey

1. The summary card per currency: how much is still owed, how much is approved, how many are waiting for payment.
2. The status chips are both counts and filters: draft, waiting for approval, rejected, cancelled, waiting for payment, outstanding, partly repaid, settled, payment reversed.
3. New advance opens the request.

Choosing the employee runs the eligibility check on the spot: a panel beside the form that shows the salary reference, how it was worked out, the maximum this company's policy allows and whether the amount you have typed is within it. If the person is not eligible — no usable schedule, an advance already open, the product switched off — it says which, instead of failing at submission. 4. Save the draft, then submit it. The approver decides. Finance then confirms the payment.

The advance page · /salary-advances/{id}#

Requested, approved, still owed and the recovery month, then the request itself (payment wanted on, the salary reference frozen at submission, the maximum allowed and why, the reason), the approval steps with who decided and when, the payment, the documents and the full activity log.

Dialog: confirm payment#

The date paid, the method, a reference and a note. The dialog states plainly what it is about to do: this amount will be recorded as paid to the employee and becomes owed.

Dialog: cancel request#

Cancelling needs a reason and stays in the history. It is not a delete.

Once it is paid#

The payment block now carries the date, the method, the reference and who confirmed it, and the amount is genuinely owed. Two more actions appear.

Record repayment is for money the employee hands back directly, outside payroll. It opens with the outstanding amount in its title and pre-fills it, and takes the date, the method, a reference and a note.

Reverse transaction undoes a payment or a repayment that should not have been recorded. It asks for the reason, and the reversal is posted as its own entry — nothing is edited away.

What you see when the decision is not yours#

The same request, opened by somebody who cannot approve it, simply has no Approve or Reject button — only Cancel request. The approval step shows as Waiting, and the activity log shows who submitted it and when. Approving is not hidden behind an error message; the action is not offered at all.

The other dialogs of a request#

Rules

• The limit is the policy's, applied to that employee's salary on the request date — a percentage of base salary or a fixed amount, whichever the company published.
• The salary reference is frozen at submission, so a later pay rise does not change a decision already taken.
• For monthly employees the reference is the base salary; for hourly employees it is the base rate times the scheduled paid hours of the reference month. An employee with no usable schedule is ineligible rather than estimated.
• The recovery month is the earliest month payroll may take it back, not a deduction in itself: nothing is taken until payroll runs and the recovery rules apply. If finance pays the money out later than that month, no closed payroll is rewritten — the first open run on or after both dates picks it up.
• A payment or a repayment is never edited or deleted; a reversal posts the exact opposite. A payment cannot be reversed while a repayment that depends on it still stands, and a recovery that payroll made can only be undone by reversing the whole run.
• A direct repayment cannot race a recovery payroll has already prepared: that run has to recalculate first.
• An approver may approve a smaller amount than requested, with a comment; never a larger one.
• How many advances somebody may have open at once is a company rule.

Why an advance you expected is not in the payroll run

• it is approved but was never actually paid out;
• its recovery month is still in the future;
• the money was paid after that payroll period had ended;
• there is nothing left outstanding;
• another open run already has it prepared;
• it is in another currency and the rate is missing or ambiguous — checked only once it is genuinely due;
• the payroll record needs recalculating because something it depends on changed.

Employee loans · /employee-loans#

What it is for. A larger amount, repaid over several months on a schedule.

New loan opens a wide, step-by-step window — New Employee Loan — which walks you through the employee, the loan type, the amount, the repayment schedule and a review of the whole agreement before it is saved as a draft. Reopening a draft shows the same window titled Edit Employee Loan; once the loan is submitted it can no longer be edited this way, only revised through the approval workflow.

Opening a row (/employee-loans/{id}) shows the agreement. The shape is the advance's, with two additions: the loan type (defined per company in chapter 10) and the repayment schedule. The status chips add schedule change pending, overdue and disbursement reversed.

The schedule. A loan is interest-free, and repayment is monthly because that is payroll's cadence — the field is shown but cannot be changed. You set the schedule in one of two ways, and the request previews it before you submit:

The schedule always adds up to exactly the approved amount.

Rules

• The schedule is part of the agreement: changing it after approval is itself a request that has to be approved, which is what schedule change pending means.
• Approval creates the schedule, not the debt. Nothing is owed until finance records the payment, as with an advance.
• The first repayment month must be later than the month the money was actually paid. If an approved loan is paid out so late that its first repayment month has passed, finance cannot shift the schedule while paying it — the schedule is corrected through its own approval, or the unpaid agreement is cancelled and made again.
• Repayments, from payroll or handed back directly, always fill the oldest due instalment first; the last one touched may be partly filled.
• Instalments are recovered by payroll under the same recovery rules and protected net pay as everything else, so a month where the salary cannot carry the instalment carries it forward instead of forcing it through.
• Early repayment is allowed or not by the company's shared finance rules.

Employee deductions · /employee-deductions#

What it is for. Money to be taken from pay that is not a loan or an advance — damaged equipment, an overpayment, a contribution.

A deduction is a fixed amount or a percentage, with its own type, schedule, evidence and approval workflow; opening a row (/employee-deductions/{id}) shows all of it.

New deduction opens the step-by-step window New Employee Deduction: the employee and type, how it is calculated (a fixed amount or a percentage), how it is structured (one instalment or several), where it came from, the evidence, then a review of the agreement before it is saved as a draft. Reopening a draft shows the same window titled Revise Employee Deduction. A draft created for you by another part of the app — an equipment-damage incident, for example — opens here too, and you still have to submit it yourself.

Rules

• A deduction is never generated automatically. Even the equipment-damage flow only creates a draft here, which somebody must still submit and approve.
• Evidence requirements come from the deduction type's configuration.
• The same recovery rules apply: order, caps and protected net pay decide what payroll actually takes in a given month.

An employee's own finance pages#

Employee Finance · /employees/{id}/finance#

What it is for. The operational view of one person: what they owe now and what payroll has prepared.

Open obligations per currency, what is prepared in open payroll, and recent ledger activity. Complete financial statement opens the full statement.

Rules

• Amounts stay separated by currency, and each case keeps the company that owned it at the time — moving somebody to another company does not move their history.
• A balance is worked out, not stored. Waiting for payment, outstanding, partly repaid and settled are read from the agreement and the entries behind it; there is no balance field anybody can edit.
• Anything you may not see is left out before the totals are added up, and the page does not hint that it exists. So two people can see different totals here, both correctly.
• A section missing altogether means you cannot view that product; a missing link through to a case means you may read the payroll fact but not browse the product itself.
• For a complete, exportable history use the financial statement instead: it refuses to show a partial picture, where this page is an operational summary.

Employee financial statement · /employees/{id}/financial-statement#

The complete record: every case, every transaction, every recovery, with balances. It is a read-only view with its own permission — it is possible to be allowed to run payroll and not to read this.

Termination financial review · /employees/{id}/termination-review#

When somebody leaves, this page gathers what is still outstanding so it can be settled before the final pay: open advances and loans, deductions in progress, and a checklist of equipment still in their hands (a warning, not a blocker). It opens from the employee's More menu.

The journey. You record the separation date and, for each open obligation, what is to happen to it. The employee's finish date is only written once the figures have been re-read and confirmed to be unchanged.

(No screenshot: the demo workspace has nobody with a finish date.)

Rules

• The review itself takes no money and forgives none. It does not deduct a balance, write anything off, waive anything or change a schedule. It records the decision; each action is then carried out through its own workflow.
• You need access to every company involved — the one that employs them now and every one that owns an open obligation. If one of them is outside your access the page refuses and says only that more company access is needed: it never reveals which company, product, reference or amount is hidden.
• Being allowed to run this review does not let you browse advances, loans or deductions. A link through to a case needs that case's own right.
• If anything changed while you had the page open, the save is refused and nothing is written — reload and look again.
• Cancelling a separation clears the finish date and keeps every earlier review in the history.

What finance changes in payroll#

• Approved and paid obligations become recoveries when a payroll run is calculated, in the order and up to the caps the company published.
• Protected net pay always wins. What cannot be recovered this month is carried forward, not forced.
• Recoveries are only posted when the run closes. Before that they are a preparation you can still influence by changing the run.
• Reversing a payroll settlement is refused while any salary payment on that run stands, so money already handed over is never quietly undone.

Two reporting pages: one for attendance and hours, one for money. Both read what has already been recorded — neither recalculates anything, and neither can change a figure.

Attendance reports · /reports#

What it is for. A month of attendance, working hours and approved daily earnings, for a site, a department, a team or one person.

Who can open it. Anyone who may view reports. Earnings are a separate right: somebody can see attendance and hours here and no money at all — the amounts are simply absent for them.

The journey

1. Choose the month, then narrow by site, department, team or employee. The filters apply as you change them.
2. The six figures are the month in summary: employees in the period, worked hours, approved overtime, approved pay records, reopened pay records and approved earnings.
3. Status distribution shows how the recorded days were spread across your statuses, with the count and the percentage for each.
4. Approved earnings by currency totals the money, per currency, from approved daily pay snapshots only.
5. Three views of the same month: Overview, Attendance matrix (one row per employee, one column per day) and Hours & earnings.

6. Export to Excel downloads exactly what the filters show.

Rules

• Earnings include approved daily pay snapshots only. Pending and reopened calculations are deliberately left out, and the page says so under the title — a figure here is one somebody signed off.
• Reopened pay records are counted separately rather than hidden, so a month that looks finished but is being reworked cannot pass unnoticed.
• With no site, department or team filter, the report also lists active employees who are on no team, so nobody falls out of the month by accident. Pick a team and you see only that team.
• Everything is limited to the companies you may see.

Financial reports · /reports/financial#

What it is for. Balances and statuses across the finance modules, built from the agreements, schedules and ledger entries that already exist.

Who can open it. Viewing financial reports is its own right, and exporting is another.

The reports

Below the cards, read-only financial projections give the record counts and outstanding totals per product without opening a report.

Rules

• Currencies are never combined. Each one keeps its own line — the page says so under the title.
• Balances are derived from immutable agreements, schedules and ledger facts. A report cannot disagree with the record it is built from, and nothing here can be edited.
• Each report is filtered to the companies and products you may see, so two people can legitimately get different totals from the same report.
• Exports are generated files, not live links: what you download is the state at that moment.
• Exporting obeys the same rules as the page. It is not a way round an authorization: the file contains what you could already see, for the companies and products you may see.
• For a recovery in another currency, the report keeps both figures — the amount in the obligation's own currency and what payroll settled, with the rate used — instead of adding unlike currencies together.
• A reversal never rewrites the original figure. Both the original entry and its exact opposite stay visible, and the status you read is reconstructed from them.
• A link through to a case appears only if you independently hold the right to open that case. Being allowed to read payroll does not open finance.

Where else figures come from#

Reports are not the only place to read numbers, and the others answer different questions:

• The dashboard — today, and the last seven days.
• The daily overview export — one day, everybody, exactly as the page shows it.
• A pay statement — one employee, one month, the certified payroll facts.
• The employee financial statement — one employee, everything they owe or have repaid.
• The salary payments export — a preparation list for whoever makes the transfers. It is explicitly not a bank file and not evidence of payment, and every file produced is logged.

This is where the workspace is shaped: the companies you run, the places people work, the accounts that sign in, and the labels you put on employee records. Almost everything else in the app depends on these pages, so this is the chapter to read first when you are setting a workspace up.

Every settings page carries the same second menu on the left, so you can move between settings without going back to the settings home.

Companies · /settings/companies#

What it is for. The legal and payroll entities you run. A company owns its sites, its payroll rules, its money and its signature chain.

Who can open it. Viewing needs the right to see companies; creating, editing, archiving and deleting is reserved for system administrators.

The journey

1. The three counts — all, active, archived — are also filters, alongside search and base currency.
2. Each row offers View, Edit, Archive (or Restore) and Delete.
3. Add Company asks for a code, a name, a base currency and a timezone.

Rules

• The code can never be changed. It is printed on references and used to identify the company everywhere; the name and the timezone can always be changed.
• The base currency locks as soon as anything financial exists for that company — a payroll or daily-pay record, a policy version, an approval workflow, a financial case. The page says whether it is still unlocked and why.
• Archive is the normal way to retire a company, and it is refused while it is the last active one, while it still has active sites, while an employee is still assigned to it today or later, or while a financial case is still actionable.
• Delete is only for a company that was never used. Anything with history is archived instead. Delete this Company? becomes This Company cannot be deleted and lists the exact reasons.

Dialog: archive a company#

Like the delete dialog, Archive this Company? has two faces. When archiving is possible it says what archiving means and asks you to confirm; when it is not, the title changes to This Company cannot be archived yet and it lists every blocker — the last active company, active sites, employees still assigned today or later, financial cases still waiting for a decision — so you know exactly what to clear first. Restoring an archived company is the same dialog in reverse and has no blockers.

What it changes

• Archiving a company stops new work for it; it does not touch the history, the payroll that was already run, or the money already recorded.

The company page · /settings/companies/{id}#

Identity, whether the currency is still unlocked, how many employees it has now and in the past, and a Configuration panel with a line per financial policy — salary advances, employee loans, the shared financial policy, approval workflows — each with a Configure link.

Below that are the legal details (legal name, registered address, commercial registration number, tax number, the representative who signs contracts), the letterhead (operating address, phone, the footer line) and the company logo. These are what contracts and letters print; a contract document will not finalize while they are missing, and the message names the missing field.

Dialog: add a signature#

The signature chain is who signs this company's official papers, in order. Each post has:

• a code — the short token printed inside a letter reference (RH, DA, DG);
• a printed line — exactly the words above the signature space, for example "Le Directeur Général";
• a holder — either an account in the system (the printed name then follows the account, and that account is the one who can sign electronically) or a name typed here for a holder who has no account.

Rules

• The code can never be changed, because references already issued quote it.
• Posts are kept in order and can be moved; they are archived, never deleted.
• A post with no linked account cannot sign electronically — it is reported rather than guessed.
• A company with no chain cannot number a cabinet letter at all.

Sites, departments & teams · /settings/organization#

What it is for. Where people work. A site holds departments; a department holds the teams you take attendance for.

The journey

1. The counts show sites, departments, teams and how many employees are assigned.
2. Search the tree, filter by company, by type and by status, expand or collapse everything.
3. Add site, then a department inside it, then a team inside that. Each is a small form.

4. Rename, archive and restore from the row itself. Import organization loads a whole structure at once.

Dialog: import organization from Excel#

For a workspace that already has its structure in a spreadsheet: download the template, fill in the sites, departments and teams, upload it, and review what will be created before anything is saved. Existing units are matched rather than duplicated.

Dialog: archive, and the people it would strand#

Archiving a site, a department or a team opens one of two things. If nobody's only current team is inside what you are archiving, it is a plain confirmation. If somebody would be left with no team, you get Reassign before archiving instead: it names each affected person and asks where they go, and the team picker only offers usable teams in that person's own company.

Confirming performs a real transfer for each of them — dated, logged and with its effect on pay recorded — rather than quietly cutting them loose. If one of those moves would reach pay that is already approved, the whole archive is refused and the message names the person, so you can make that transfer deliberately from the Transfers page first.

Rules

• Names must be unique among siblings — two sites in a company, two departments in a site, two teams in a department. Case and surrounding spaces are ignored, archived units count, and the message tells you to restore the archived one instead.
• A team can only be used when the team, its department and its site are all active. That is what the employee form, the attendance calendar and the shift pages mean by a usable team.
• A team cannot be moved to another department, and a department cannot be moved to another site. The structure is history, not a filing cabinet.
• Archiving is guarded. If anybody's only current team is inside what you are archiving, the app asks you to choose where they go, and performs that move as a proper transfer — dated, logged, with its effect on pay recorded. The destination must be in the same company.
• The archive is refused outright, naming the person, if such a move would reach pay that has already been approved; you do that transfer yourself first, from the Transfers page.
• Archiving does not cascade. Archiving a site does not archive its departments, and restoring does not bring anybody back to their old team.

What it changes

• Teams decide schedules and attendance rosters, so archiving one ends its members' memberships the day before and moves them where you chose, which is also recorded against any open payroll.

Users · /settings/users#

What it is for. The accounts that sign in, their roles, and whether they are still allowed to.

Who can open it. Only system administrators. These rights are on no ordinary role.

The journey

1. The counts — all, active, deactivated — plus a search and filters by status and role.
2. Add user takes a name, an email, an initial password and the roles to give.

3. View opens the account (/settings/users/{id}): its details, its roles, its effective access (what the roles actually allow, grouped by module, with the role that grants each), and the pages it can open. From there you can change the identity, change roles, reset the password, deactivate or reactivate.

Dialog: manage roles#

Tick the roles this person should hold. Roles you cannot give are disabled, not hidden, so you can see what exists and ask somebody who can. The permission count on the page updates once you save.

Dialog: edit identity#

The name and the email — which is also what the person signs in with. Changing it takes effect at their next sign-in.

The More menu: reset password, deactivate#

• Reset password sets a new administrator-chosen password (at least 14 characters) and marks the account so the person must change it the first time they sign in. The page shows a Password change required badge until they do.
• Deactivate this account? asks for a reason and then blocks sign-in, ends open sessions at the next page and makes every permission answer no. Reactivate this account? is the same dialog in reverse.

Your own account is deliberately limited#

On your own account the page says "Some account actions are unavailable — you cannot do this to your own account. Ask another administrator." Nobody can change their own roles, reset their own password from here or deactivate themselves, however senior they are. That is what stops an administrator locking everyone out, themselves included.

Rules

• Accounts are never deleted. Years of records point at them, so an account is deactivated instead: sign-in is blocked, open sessions end at the next page, and every permission answers no.
• An administrator-set password must be at least 14 characters, and the person must change it the first time they sign in. Until they do, only their profile page works.
• Nobody can deactivate, reset or change the roles of their own account.
• You cannot give a role you do not hold yourself — granting a role needs you to hold at least everything that role allows. Granting or removing the system administrator role needs an active system administrator.
• The last system administrator cannot be removed or deactivated. The check runs under a lock, so two people doing it at once cannot both succeed.
• Every change is written to an append-only log — who, when, what changed and why. Passwords never appear in it.
• An account is not an employee. There is no link between the two.

Roles & permissions · /settings/roles#

What it is for. Composing custom roles out of permissions, and reading what the built-in roles allow.

The journey

1. The list shows every role with its key, whether it is built-in or custom, how many permissions it carries and how many people hold it.
2. Add role asks for a key (always starting custom_), a display name, a description, optionally a role to start from, and then the permissions themselves.

3. The permission picker groups permissions by module, with search, a "selected only" view, and select-all per group. Opening a role (/settings/roles/{id}) shows What does this allow? — the pages and capabilities that role opens, as plain labels.

A built-in role opens read-only: you can read every permission it carries and what each one allows, but the editor is closed. Use Start from role when creating a custom role to copy one as a starting point.

Rules

• Only custom roles can be edited. The built-in roles are certified and read-only, and the system administrator role (which bypasses every check) can never be copied.
• The key is permanent. Display names may repeat, but cannot imitate a protected role.
• You can only give permissions you hold yourself, measured before your change, and you cannot edit a role that outranks you.
• You cannot lock yourself out: a change that would remove your own ability to manage roles is refused.
• A permission that an approval workflow depends on cannot be removed while that dependency exists.
• A handful of permissions can never sit on any role at all; they belong to system administrators only.
• A permission is a capability, not a key to every record. Company visibility and the record rules still apply on top — the dialog says so.
• Roles are not archived or deleted here; that is deliberately not built yet.

Catalogs & labels#

Four small pages share one shape: a list, a search, a status filter, Add, rename, archive and restore. Nothing here is ever deleted, because employee records point at these labels.

Rules that apply to all four

• A name must be unique, ignoring case.
• Archiving keeps the label on the records that already use it and stops anyone choosing it for something new; the dialog — Archive this {item}?, with the catalog's own word in place of {item} — says as much. Restoring puts it back on the list.
• Archiving the last active one is possible, but then nobody can pick one — the Setup Center will tell you the area needs attention.

Job titles · /settings/job-titles#

The titles you can give an employee. Each has one extra switch: mandatory driving licence. Turn it on for a driver's title and the employee form then requires a licence number and expiry for anybody holding it.

Classifications · /settings/classifications#

The category an employee belongs to — the one pay structures, grade ladders and holiday rates are written against. This is the label that connects an employee to their salary scale, so it is worth getting the names right before you add people.

Document types · /settings/document-types#

The kinds of document you can attach to an employee: identity document, contract, certificate or diploma, medical, insurance, other. Five are there from the start; add your own.

Insurance types · /settings/insurance-types#

The kinds of insurance and benefit you can give an employee, and how payroll treats each one. Each type is configured in dated versions, so a change never rewrites the past.

• Monthly earning — payroll pays it as its own line, on top of the salary.
• Employer cost — recorded as a fact only. No payroll line, no accounting entry.
• Informational — coverage only.
• Employee deduction is deliberately not available here: a deduction is a case that goes through approval, and must never be generated automatically from a coverage.

Two ways of spreading the amount across a month: prorated by calendar days (the amount × covered days ÷ days in the month, each day at the rate in force that day) or full month if covered on the last day (one full amount, only if the person is employed and covered on the last day; a change earlier in the month never adds a second payment).

Each type also carries its own notice period for the reminder before coverage ends (15 days by default).

On the page, each type is a card headed by its name and code (Medical cover · MED) with its treatment, its default amount and the date its current configuration has applied from. The actions are Edit for the name and description, New configuration for the dated settings, Configuration history with the number of versions behind it, and Archive.

Its dialogs.

The first setup and every later change open New configuration, which takes the treatment, the default amount and currency, how it is spread across a month, and the date it applies from.

Archive this insurance type? stops it being chosen for a new coverage; people already covered keep theirs.

Rules

• Changing the configuration creates a new version from a date. Old versions are kept, and a change that reaches approved payroll has to be reviewed before it is saved.
• The first configuration, and every new version, also needs the right to change pay — not just the right to manage catalogs.

These pages decide what a working day looks like, what each status means, which days are holidays, and how leave is earned and spent. The attendance pages in chapter 2 only record what these settings define.

Global shift · /settings/global-shift#

What it is for. Each company's fallback schedule — the one used when an employee has no personal schedule and no team schedule in that company.

The journey

1. Choose the company at the top; each company has its own global shift.
2. Create new version opens the week: for each day, Working day or Rest day, and for a working day the shift name, start, end, grace minutes, the break allowed and how the break is paid.

3. Give the version a date it takes effect from and a reason, then Save version.
4. Below the current schedule, the page keeps the whole history.

Rules

• Schedules are versioned, never edited in place. A new version closes the previous one the day before it starts, so every past date still resolves to the schedule that was really in force.
• The order of precedence is: the employee's own schedule, then the team's, then this. Changing the global shift never modifies a team's or a person's schedule — it only changes the fallback.
• An end time at or before the start is an overnight shift and belongs to the day it started.
• The figures underneath each day do the arithmetic for you: shift span, break allowed, paid break and scheduled paid hours.
• Until a company has a global shift, employees with no team or personal schedule have no schedule at all — which is why adding an employee is refused when a weekday has no source.
• A change that reaches pay that has already been approved is reviewed first, like any other dated change.
• A team's schedule only counts while that team belongs to the employee's company for that date. A leftover membership in a company they have left is ignored, never borrowed.
• A missing schedule is never filled in by guesswork. Payroll blocks the employee and says the schedule is missing rather than using the previous company, another team or an old workspace default. Fix the schedule and recalculate.
• An archived company keeps its schedule history but takes no new schedule work.

What the readiness line means

Team shifts · /settings/shifts#

What it is for. The weekly plan each team works, when it differs from the company's global shift.

The journey

1. Pick a department and a team. The page shows that team's week, one card per day.

2. A day can hold more than one shift — a morning and an afternoon session, each with its own times, break and grace.
3. A team either follows the global shift or has its own plan. A team that follows it is marked Inheriting global shift, and the banner says "Global changes flow to this team automatically. Customize the team only when it needs different hours." Customize this team detaches it and copies the current hours as a starting point; the opposite control puts it back on the global shift.
4. On a customized team, each day card takes its own shifts — a day can hold more than one session (a morning and an afternoon), each with its own start, end, break and grace.
5. Manage global shift jumps to the page above.

Rules

• A team with no plan of its own simply follows the company's global shift, so you only configure the teams that are different.
• Changes apply from today onwards. The page says so, and warns that for monthly-paid people they can still change approved pay earlier in the same month — because a monthly salary is spread over the month's scheduled hours.
• Changing a team's week goes through the same review as any dated change when it reaches approved pay, and you choose how to handle it before anything is saved.
• The banner tells you when the company has no global shift yet, because then there is no fallback behind the team.

Attendance statuses · /settings/statuses#

What it is for. The statuses you can record on a day — present, absent, leave, and whatever else your office uses — and how each one counts.

The page starts by explaining how the automatic choice works, which is the same order described in chapter 2: a manual entry always wins, then holidays and rest days, then punches, then a missed shift after the scheduled end and grace. Late arrivals, early departures, long breaks and odd punch sequences stay separate flags, so they never muddle the status itself.

Dialog: add or edit a status#

• Code — one to four capital letters, for example PNI. It can never be changed.
• Label and colour — what people see on the calendar.
• Counts as — Worked, Not worked or Neutral. This drives the totals on every summary.
• Automation role — whether this status is the one the app picks automatically for present, absent or rest. Each role can belong to only one status, and a status with a role cannot be granted as leave or used as an absence type.
• Needs a reason — a reminder, never a block: the note is highlighted when this status is recorded, and saving without one is still allowed.

Dialog: delete a status#

The dialog is called Delete this status?. This is the one catalog in the app with a real delete, so it spells out the consequences: the status is gone for good, any day that used it will show as not recorded, and its automatic role stops working until you give that role to another status.

Rules

• Statuses can be deleted here, unlike most catalogs. Deleting one leaves the days that used it without a status and switches off its automatic role until you give that role to another status.
• Seven statuses exist from the start: presence, absence, chargeable leave, non-chargeable leave, suspension, rest and technical layoff.

Payroll treatment#

A second, separate setting: how each status counts towards monthly base pay. It is dated, like every pay setting, and it is what monthly payroll blocks on when it is missing.

The dialog is called Change payroll treatment. It takes the new treatment, the date it applies from and a reason, and leaves the previous treatment in the history.

• Paid work — the day counts as worked and is paid.
• Paid leave — not worked, but still paid.
• Unpaid — deducted from the monthly salary.
• Excluded — left out of the calculation.

Each change takes a date and a reason, and the previous treatment stays in the history.

Rules

• Monthly payroll will not calculate a day whose status has no treatment. The page offers suggested defaults for the statuses that obviously have one, which you can apply in one click and adjust afterwards.
• Changing a treatment is a dated change like any other: where it reaches approved pay, it is reviewed first.

Holidays · /settings/holidays#

What it is for. Public and company days off, and how work on them is paid.

The journey

1. Browse by year, as a calendar or a list, filtered by scope and site.
2. Add holiday asks for the date, the label, who it applies to, the type and the pay.

3. Applies to is either all teams or a specific site.
4. Type is mandatory (a day off for everyone; work on it is flagged for review) or workable (people may work, and the hours earn the extra you set).
5. Pay has a paid day off switch and an optional extra for hours worked, as a percentage.
6. Deeper settings let you set the extra percentage per classification, and exceptions for individual employees.

Dialog: delete a holiday#

The dialog is called Delete this holiday?. Holidays are deleted rather than archived, so it names the holiday and its date and says plainly that it cannot be undone. If the holiday touches pay that has already been calculated, the impact review opens first and you choose how to handle it before anything is removed.

The employee exceptions panel#

Opening a holiday's exceptions shows the employees it covers, each with their own paid/unpaid override and their own extra rate. People who already have a Holiday / hour rate of their own are listed first with that rate shown, so you can see what will apply before you override anything. Amounts only appear to somebody who may see daily pay.

Rules

• Holidays are marked as rest in the attendance views, which is why nobody shows up as missing on them.
• A site-specific holiday beats an all-teams one on the same date.
• The extra for working a holiday is chosen in this order: an exception for that employee, then the employee's own holiday rate, then the classification percentage, then the holiday's own percentage, then nothing.
• Each extra rate is the complete hourly rate, never an addition to it, so there is no doubling up. Overtime on a holiday keeps the overtime rate without a holiday premium on top.
• Unpaid plus worked means the day is deducted and the hours worked are paid at the holiday rate.
• Changing or deleting a holiday that touches pay already calculated shows you exactly who and which days are affected, and asks how to handle it before saving.
• Administering a holiday and setting its pay are two different rights. Creating one with the default pay settings is administration; changing the paid-day-off switch, the percentages or the per-employee exceptions needs the right to change pay as well.

Vacations · /settings/vacations#

What it is for. Giving a chosen group of people the same leave status over a range of dates.

The journey

1. Grant vacation opens the form: pick the people (filter by department and team, or search), choose the dates and the status, then Preview.

2. Review vacation shows exactly what will be written, what will be skipped, and — when the status is annual leave — how many days it costs each person.

A real one reads: 5 days will be set to CA, then 5 days come off the Annual leave balance, then, where somebody does not have the days, This employee would go over their balance: Elias Saad (-5) with the line the grant is still saved — correct the balance on the Leave tab of their record. 3. Confirm & Save writes the days. The grant then appears on the page with its dates, its status and the people it covers. Editing it later re-reconciles it; deleting it removes the days it wrote.

Rules

• A vacation targets named people, not a live team. Picking "whole team" only ticks the boxes; somebody joining that team later is not added.
• Rest days and holidays inside the range are skipped and cost nobody a day of their balance.
• A day that already has a real entry is a conflict and is left alone — the preview lists it.
• The status list excludes the automatic ones (present, absent, rest): only recorded statuses such as leave can be granted.
• When the status is annual leave, the days come off the balance, oldest leave year first. An overdraw is flagged, never refused — attendance records what the office actually did, and the message names the people whose balance needs correcting.
• A day edited later through the attendance pages quietly leaves the grant, because a direct edit is no longer what the grant set. The cell editor warns you before that happens.
• Removing somebody from the grant gives their days back.
• Delete this vacation? removes the grant and every day it wrote, and hands the leave days back to the people who were covered.

Leave rules · /settings/leave#

What it is for. How each company earns annual leave.

The journey

1. Until rules exist, the page offers a recommended set — 2 days a month, a 30-day ceiling, leave after 12 months of service, unused days expiring after 24 months, 1 extra day per child under 14, leave starting on the 27th. Use these rules adopts them; Set them myself opens the form.

2. Every figure is editable, and the version takes a start date and a reason.

Once rules exist the page shows the version in force as six plain figures — earned each month, most a year can give, leave can be taken after, unused days expire after, extra per child, and the day of the month leave starts on — with the date it has applied since. The line underneath says which attendance status the balance is spent on (Days marked CA · Annual leave come off the balance) and links to Absence types, which is where that is decided.

Dialog: Change the leave rules#

Each field explains itself as you type: the monthly rate shows what a full year at this rate comes to, the ceiling says whether the rate ever reaches it, children are judged at the end of each leave year, and the start day is "of the month, so it exists in February too". Why is kept with the version, so the history explains itself.

The dialog ends with the sentence that matters most: saving these rules changes nobody's balance on its own. A leave year is worked out again from the employee's own Leave tab, so a change is always visible before it counts.

Rules

• The recommended figures are a suggestion, not something the system applies on its own. Nothing is recorded until you choose.
• Changing the rules never moves anybody's balance by itself. The leave years are worked out again from the employee's own page, deliberately, so a balance never changes behind somebody's back.
• Rules are versioned: the earlier ones are kept, so every leave year can say which rules produced it. A new version must start after the current one.
• Children are judged at the end of each leave year, so a child born mid-year counts for the whole of it.
• Days expire the configured number of months after the leave year ends.
• The qualifying period gates taking leave, not earning it: days accrue from the first month.

Absence types · /settings/absence-types#

What it is for. What each attendance status means: which one is annual leave and comes off the balance, which is sickness with its own allowance, and which is simply recorded.

The journey

1. Annual leave is there from the start, marked built-in. Point it at the attendance status your office uses for congé annuel.
2. Add an absence type for the others, or adopt one of the suggestions — sick leave, maternity, bereavement, unpaid permit.

A starter opens the same form with the code and name already filled in — offered, never applied: nothing exists until you save it, and you still choose which attendance status it means.

3. Each type has a code (permanent), a name, the attendance status it corresponds to, and how it is counted: - Recorded only — named and reported, no balance moves. - A fixed allowance per period — so many days each period, starting again at the next one. The allowance itself is recorded per company, from this page. - Draws on the annual-leave balance — days come off what the leave rules earned.

4. Each row then says in one line what it means and what it does — Days marked CA · Annual leave · Draws on the annual-leave balance, or Days marked MAL · Sick leave · A fixed allowance per period with the bands summarised underneath (Pays: 1–3: 100% · 4–15: 50% · 16+: 0% · since 2026-01-01). The actions on a row are Edit, What it pays, Allowance for a quota type, and Archive.

Dialog: Allowance#

Days each period, whether the period runs by calendar year or by employment year, how many months of service it takes before it can be used, the date this allowance starts on, and an optional reason. The note at the top is the rule in a sentence: earlier allowances are kept, so a period always says which allowance worked it out, and recording one never moves a balance by itself — the periods are worked out again from the employee's own page.

A day is counted against the period it falls in, so an absence over the turn of the year is shared between both periods. The dialog says so under the period field.

Rules

• One active type per status, so a recorded day can never mean two things.
• Only one type can draw on the annual-leave balance, because there is one accrual engine behind it.
• A status with an automatic role (present, absent, rest) cannot be an absence type — that is the schedule's answer, not somebody's recorded absence.
• The workspace has no annual-leave status out of the box. Until you create one on Statuses and name it here, nothing comes off a balance; the yellow banner says exactly that.
• The annual-leave row can be renamed and re-pointed, but never archived and never made to stop drawing on the balance.
• A fixed allowance is spent in the period the day falls in — a sick day in March comes off this year's allowance, never an older one, and an absence spanning New Year splits across two.
• Types are archived, never deleted. Archive this absence type? stops it being chosen for something new; the days already recorded keep their meaning.
• There are no recommended figures for an allowance, unlike annual leave: how many sick or maternity days somebody gets is a legal and contractual matter, so the system will not invent a number nobody chose.

Dialog: What it pays#

Each absence type can also carry pay bands — "the first three days in full, the next twelve at half, nothing after that". You give each band a first day, an optional last day and a percentage, in order, with a date the rules take effect from and a reason. Add a band adds a row and Remove takes one away; leaving the last band's to day empty makes it run to the end of an absence, and the dialog warns that if it does not, days after it pay nothing.

The yellow note at the top states the two rules you cannot work around: bands replace the flat payroll treatment rather than adding to it, so the status must be Unpaid or the day would be paid twice; and the day numbers count the recorded days of one absence, so a rest day inside it does not start the count again.

Rules

• Bands replace the flat treatment; they never stack with it. A monthly salary already covers every scheduled day, so a day that was both paid leave and banded would be paid twice. The app refuses to record bands while the status is paid in full, and if the treatment is changed afterwards the day is blocked rather than paid twice.
• The position inside the absence is counted in recorded days, and a rest day or a holiday in the middle does not break the run — so a sickness that spans a weekend keeps counting.
• Only recorded days count, so the band position and the leave balance always agree.
• Bands never reach backwards: a date before your first version is paid by the flat treatment exactly as it was. Like every pay rule, a change that reaches approved pay is reviewed first.
• There are no suggested figures here either, for the same reason as the allowance.

These pages decide what people are paid, how a partial month is worked out, what bonuses exist, which currency amounts are in, and the rules behind advances, loans and deductions.

A payroll run cannot be created until the company has a monthly salary calculation rule, and no money can be recovered until it has finance rules. Those two pages are the ones to do first.

Salary structures · /settings/salary-structures#

What it is for. The monthly or hourly salary attached to a classification — as a default, or overridden per job title, or set per grade and échelon.

The page opens by explaining the order the app uses. For an employee whose base pay is inherited (rather than set personally), it checks, in order:

1. an override on the employee themselves;
2. the structure for their grade and échelon — and a graded employee is paid by that and by nothing else;
3. a job title + classification structure;
4. the classification default.

The last two only apply to employees without a grade.

The journey

1. Add grade builds the ladder: grades inside a classification, échelons inside a grade, each with a position that sets the order.

3. Choose the scope, the pay type (monthly or hourly), the currency and the amount, and optionally the additional hourly rates — overtime, holiday, weekend — that employees inherit unless they have their own.
4. The hierarchy browser lets you open a classification, then a grade, and compare the salary attached to each échelon. Expand all opens the whole ladder at once.

Read the status column carefully. A classification whose salaries live on its échelons still says Salary not set · No classification default, and each grade says Salary is set per échelon · Salary not set · Action required beside Configured per échelon. That is not a mistake and it is not a gap: it means exactly what it says — the classification itself has no default, because the money is on the levels underneath. A graded employee is paid from their échelon and never from the default, so the only people a missing default would affect are ungraded ones in that classification. Set it only if you have any.

Dialogs: new salary version, and the seniority percentage#

• New salary version changes the amount from a date. The previous version is closed the day before, never overwritten, and the dialog asks for the reason that goes into the history.
• Seniority percentage sets the extra a long-serving employee earns on a level, as a percentage with its own dates.
• Each level in the ladder has its own small form for its label and its position; archiving a grade or an échelon asks for confirmation and explains that nobody's pay or assignment changes.

Rules

• A structure is versioned by date, like every pay setting. A new version closes the previous one; the history stays.
• A graded employee whose échelon has no salary on that date blocks payroll rather than falling back to a classification default. That is deliberate: a silent fallback would pay a wrong amount.
• Creating a structure, and every new version, is reviewed when it reaches pay that has already been approved — you choose how to handle it before anything is saved.
• Archiving a grade or an échelon never changes anybody's pay or assignment; it only stops it being chosen for a new one.

Payroll policies · /settings/payroll-policies#

What it is for. How monthly base salary is reduced when somebody is not entitled to the whole month — a new hire, a leaver, unpaid days.

The journey

1. Choose the company. Each company has its own rule.
2. Set calculation rule opens Change monthly salary calculation, a two-step chooser.

3. The options, in the app's own words: - Use scheduled paid time — pay follows the employee's scheduled paid minutes. Best when hours differ by person or shift. - Use the actual days in each month — eligible calendar days ÷ the real length of that month, so the daily value changes between 28, 29, 30 and 31-day months. - Always divide the month by 30 — a fixed 30-day divisor whatever the month. - Use a fixed payroll month you set — you choose the divisor, counting working days. On a six-day week that is 26 non-Sunday days in most months, so a day not worked costs one twenty-sixth. - Use scheduled working days — each scheduled working day carries equal weight.
4. The second step takes the date it applies from, and you publish it.

Once a rule is active the page shows it with the date it took effect, the payroll frequency, the cutoff, an explanation in words and a worked example — plus whether a later change is already scheduled.

Dialog: payroll month length#

Only for the fixed payroll month choice: it sets the divisor, and lets you give one particular month a different length when it differs from the rest. Months you do not list use the standard figure.

Rules

• A fully eligible employee always receives the full monthly salary, whichever rule you choose. The rule only decides how a partial month is reduced.
• No payroll run can be created for a company with no rule. The page says so plainly.
• Every dated change stays in the history, so an old payroll run can still be explained.
• A scheduled change is shown separately: the active rule continues until the new one starts.

Bonus types · /settings/bonus-types#

What it is for. The monthly bonuses you can assign to employees, and how each one is worked out.

The journey

1. Add bonus type is a three-step form: basic information, calculation, preview.

2. Eligibility scope decides who may receive it: an entire classification, a classification and grade, or an exact level (classification + grade + échelon).
3. The calculation step sets how the amount is worked out, and the preview shows the result before you save.

Dialogs: new rule version, archive a bonus type#

• New rule version changes how the bonus is worked out from a date, keeping the previous version for the months it governed.
• Archive bonus type stops it being assigned from now on; bonuses already given keep their figures.

Rules

• A bonus type is a definition, not an assignment. Giving it to somebody happens on the Bonuses page (chapter 5) or the employee's own record.
• Types are archived, never deleted, so a bonus already paid keeps its meaning.

Promotion rules · /settings/promotion-rules#

What it is for. How often somebody is due to move up a step, per company and classification.

The journey

1. Pick the company and the classification. A classification needs a grade ladder before a rule can do anything — the page links to where you build it.
2. Set the interval between échelons, optionally a different interval when the step crosses into a new grade, the notice period, and whether suggestions are produced at all.
3. Per-step overrides let one grade or one échelon take a different interval.

A classification with no ladder yet shows Add levels first instead of a rule, and the page links to Salary structures where the grades and échelons are built. Once a rule exists the row offers Edit and Turn off.

Dialogs: change the rule, add an interval, archive#

• Change the promotion rule writes a new version from a date and says so in its own words: a rule is never edited in place — saving records a new version from the date you choose, and the previous one stays as history. The fields are Months at one échelon, Months before a new grade, Warn this many days ahead, and Do not promote past, which lists the real ladder (Grade A · Echelon 1, Grade A · Echelon 2, …) with No limit as the default.
• Add an interval records one of the per-step overrides.
• Archive stops the rule producing suggestions and retires the live ones; the history stays.

Rules

• A rule only ever produces a suggestion. Nothing is applied, no pay moves, no approval is skipped. The suggestion appears on the Promotions page and in the notifications.
• Rules are versioned and immutable: a new version supersedes the previous one from a date, and the change never rewrites a promotion that has already happened.
• Turning suggestions off, or archiving the rule, retires the live suggestions.
• Which interval applies is decided in this order: an échelon override, a grade override, the cross-grade interval when the step changes grade, then the ordinary échelon interval.

Payroll adjustments · /settings/payroll-adjustments#

What it is for. One starting point for everything about payroll rules, employee obligations, recovery controls and approvals. It is a hub of links, not a page that saves anything.

Tabs across the top — General, Salary advances, Loans, Deductions, Payroll recovery, Approvals, Notifications — and each row opens the page that owns that setting. The right-hand panel explains the shape of the whole thing: configure once per company and publish, employee agreements keep the terms they were approved with, and payroll prepares recoveries and only posts them when the run closes.

Rules

• Links only appear when your role can open the destination, and every destination keeps its own checks. A destination you may not open is left out entirely, not shown greyed — the page does not advertise settings you cannot reach.
• It copies nothing. Every row is a link to the page that genuinely owns that setting, and that page's own rules decide what is allowed. Always check which company and which effective date you are working on before you publish.

Currency & exchange rates · /settings/currency#

What it is for. The currency amounts are displayed in, and the dated rates used to convert between currencies.

The journey

1. Change workspace currency sets the display currency and its decimal places.

2. Add a supported currency adds one to the list the workspace can use at all, with its code, name, symbol and number of decimals.
3. Add exchange rate records a rate between two currencies, starting on a date.

Three counts sit under the workspace currency — supported currencies, current rate pairs and historical rate records — and each live pair is shown the way you would say it out loud: 1 LBP = 0.0000111 USD, effective from Jan 1, 2026, with the reason it was recorded with. Rate audit history opens every rate ever saved, including the superseded ones.

Rules

• Each rate starts on its effective date, and saving a new one never replaces the history. Conversions on past dates keep using the rate that was in force then.
• A company's own base currency is set on the company, not here, and locks once it has financial records.
• A missing rate blocks the calculation that needs it rather than guessing — payroll will tell you which pair and which date is missing.

Employee Finance · /settings/employee-finance#

What it is for. The hub for the three employee money products.

Three cards: salary advance settings, employee loan settings, employee deduction settings. The panel underneath lists the configuration authority you hold — financial policies, approval workflows.

Salary advance settings · /settings/salary-advances#

What it is for. Who can ask for an advance, how much, and who approves it.

The journey

Fix in guide opens a five-step wizard: how much can be advanced, recovery, approvals, documents and conditions, then review and publish.

1. How much can be advanced — switch the product on, limit by a share of base salary or by a fixed amount, and decide whether somebody may have more than one open advance.
2. Recovery — how the money comes back through payroll.
3. Approvals — the steps, and who decides each.
4. Documents and conditions — what must be attached, and any conditions.
5. Review and publish — the whole rule set, published from a date.

The worked example on the right translates the rule into money for a salary you type, so you can see what you are about to publish.

The last step: review before saving#

Every one of these wizards — advances, loans, deductions and payroll recovery — ends on a review step that lists exactly what will change, what is being carried forward untouched, and the date it starts from. Where the company has no shared finance rules yet, it also asks you to confirm that creating them with the listed defaults is intended. Nothing is written until you confirm there.

Rules

• Changes apply to new requests only. An advance already approved keeps the terms it was approved under — the page says so in its first line.
• Some switches are marked shared rule: they belong to the company's shared finance policy and therefore also affect loans and deductions.
• Nothing is published until the last step.

Employee loan settings · /settings/employee-loans#

The same shape for loans: loan types, limits, instalment schedules and approval workflows.

The page states the test a type has to pass: a loan type is ready when its rules are published, it is turned on, and every approval it needs is set up. Each type then carries that verdict — Ready: employees can request this loan — with Change to run the wizard again and Advanced view for the raw published values.

Dialog: Set up loans#

Six steps, named on the left so you can see where you are: Loan type, How much can be borrowed, Repayment, Approvals, Documents and controls, Review and publish. The first step either picks an existing type or creates one ("for example Emergency loan or Housing loan. Each type has its own limits and repayment rules"), and the company and its currency are shown in the header throughout — these rules belong to one company.

Advanced view drops the wizard and shows the published values as they are stored — every limit, every workflow key, every date — for checking a rule set rather than changing it.

Employee deduction settings · /settings/employee-deductions#

The same shape for deductions: deduction types, fixed or percentage amounts, schedules, the evidence required and the approval workflow.

Several types live side by side, each with its own rules and its own readiness line — a general deduction anybody may agree to, and the equipment damage type the Equipment module drafts against (chapter 4). Set up a new deduction type starts another; Change reopens the wizard on one that exists.

What a deduction type decides. Which calculation methods it allows (a fixed amount, a percentage), which bases a percentage may use, where a deduction of that type may come from, whether somebody may enter one by hand, the label that appears on the pay statement, and what evidence is required.

A percentage is taken either from the basic earnings or from the gross earnings of that employee's payroll record. Those two figures are payroll's own certified results, so overtime, holiday or leave value counts only where payroll already counted it — a deduction never works out earnings of its own.

A deduction type is not a tax. There is no tax engine here and nothing is labelled pre-tax or post-tax. Deduction agreements are always in the company's payroll currency.

The agreement structures are one-time (a single approved month), recurring with a fixed amount for a set number of months, and recurring until a total is reached.

The wizards themselves. Each page opens its own guided set-up — Set up salary advances, Set up loans, Set up deductions — with a worked example beside each choice and a review before anything is published. Closing one with unsaved changes asks Discard your changes? first, so a half-finished rule set is never published by accident.

Rules for all three

• Each product is configured per company, in dated versions that are published, not edited.
• An approval workflow has to exist before a request can be approved; a product with no workflow will block at submission.
• Deduction types used by other parts of the app — equipment damage, for example — are ordinary deduction types that must exist here before the other module can draft anything.

Payroll recovery · /settings/payroll-recovery#

What it is for. How much payroll may take back each month for advances, loans and deductions, and what happens when the salary is not enough.

This is also where a company's shared finance rules are created — until they exist, payroll cannot recover anything at all, and the salary advance, loan and deduction pages all point here.

The journey

Change in guide opens a five-step wizard with a worked example beside every choice.

1. Protected net pay — how much of each payroll must always reach the employee: no minimum, a fixed amount, a share of pay, or a figure payroll enters per run. A tick allows payroll to raise one employee's protection for a hardship case — it can never lower the company rule.
2. Total recovery limit — the ceiling across everything.
3. Order and caps — which obligation is recovered first, and the cap on each.
4. When salary is not enough — what happens to the shortfall. Three choices:

5. Review and publish.

The example panel takes a salary you type plus sample advances, loans and deductions, and shows exactly what would be kept, what would be recovered and what net pay would remain.

Rules

• The rules are published per company, in dated versions.
• Protected net pay wins over every recovery. If the protection leaves no room, the recovery is carried forward rather than forced through.
• Zero is always the floor, whatever the rules say. A run whose net is negative before any recovery is blocked outright. A run that already starts below a protected minimum recovers nothing — the shortfall is never made worse.
• An employee-specific protection may only ever be higher than the company rule, never lower.
• Recoveries are prepared when a run is calculated and only posted when it closes.
• A run keeps the rules it was calculated with. Publishing new rules does not change an open run until payroll refreshes its financial inputs, and a record that is already approved has to be reopened first. Approved and closed payroll never changes by itself.

The last group: the wording official papers are written from, the equipment your companies hand out, and the workspace's own identity.

Contract templates · /settings/contract-templates#

What it is for. The wording of each company's employment-contract articles: drafts, sealed versions and previews.

Who can open it. Reading needs the contract-template right. Editing and publishing is restricted to the system administrator, on purpose.

The banner at the top says the two things that matter most:

• Wording only. Changing contract wording never changes payroll, attendance, shifts, compensation, leave or any other rule. It only changes the text of contract documents.
• Freezing a version seals its wording. Publishing a frozen version is the system administrator's internal authorization to use it for contracts starting from a date — it is not a legal certification.

The journey

1. Pick the contract family: trial contracts, fixed-term (CDD), permanent (CDI). Each has a version with and without a probation period.
2. A company that has never edited its wording uses the reference wording shipped with the app. View the reference wording shows it read-only, labelled not published, with no compare, no preview and no history — it writes nothing and creates no draft.

Start editing creates that company's first draft from it. 3. In the editor: save, check, compare against another version, preview as a PDF, then Freeze to seal it, and Publish with an effective date. Withdraw takes a publication back, with a reason.

The editor, in order (/settings/contract-templates/{id}). The title says which contract type and which company, with a Draft pill beside it. Under the wording-only banner sits the Publication panel, which answers the only question that matters operationally — In force today: nothing is published for this contract type yet — and carries the Used for contract generation badge so publishing is never confused with being in use. Then five tabs: Wording, Legal references, Compare, Preview, History. The wording tab takes an optional note of what you are changing, then one article at a time from a dropdown (Article 1ER · Engagement, and so on), each with its title in capitals and its paragraphs.

The bar across the bottom never moves: the save state in words (All changes saved, with the time), then Discard draft, Save draft, Freeze version and Publish.

A contract type a company has never edited says so plainly on the index — Not edited yet for this Company. The reference wording is used as the starting point — along with Reference wording · Not published and a count of paragraphs still to be confirmed by legal.

Dialog: start a draft#

It says what a draft is before you make one: "A draft is a copy you can edit. The wording already frozen is never changed, and nothing you do here affects contracts." You choose what to start from — the reference wording, or any frozen version of that template — and may note what you intend to change.

The compare panel#

Opened from the editor, it puts two versions side by side and marks what differs: titles, paragraphs, the order of them, conditions, anything still flagged as pending, and the legal references. It is also what you reach for after a save conflict, to see your wording against the one already stored before deciding which to keep.

Dialogs: publish, withdraw, discard#

• Publish takes the effective date and an optional note, and asks you to confirm a date that needs it (the very first publication, or a renewal of the latest version at its own date). A draft is frozen in the same step.
• Withdraw needs a reason. Before the effective date it cancels the schedule and frees that date; after it, the slot stays taken.
• Discard throws an open draft away. Frozen versions and publications are untouched.

Rules

• One open draft per template. No autosave: you save deliberately.
• If somebody else saved while you were editing, the save is refused and you are shown the server's current wording, so your typing is never thrown away silently.
• Wording is written in a small, closed grammar: fixed text, a known list of variables, simple conditions, bold and italic. Anything else is rejected when you save — so a contract can never print a word the system cannot fill.
• Freezing is disabled while the editor has unsaved changes.
• Publishing never reaches back. A contract uses the version in force on its own start date; if none was in force, the document is blocked rather than falling back to an older one.
• A publication must be dated after the previous one and not in the past; the only exceptions are the very first one and a renewal of the latest version at its own date, which you confirm explicitly.
• Withdrawing before the effective date cancels the schedule and frees the date; withdrawing after it keeps the slot taken.
• Using database templates for real contract generation is a switch that is off by default; the page always separates "published" from "used for contract generation".

Letter models · /settings/letter-models#

What it is for. The wording your official letters are written from, so nobody starts an official paper from an empty page.

The journey

1. The models are grouped by the kind of paper: absence permit, explanation request, sanction letter, service note, warning.
2. Add a model writes a new one; Edit changes the wording; Archive retires it.

3. Five ready-made French papers can be adopted and then edited.

Dialog: archive a model#

The dialog is called Archive this model?, and it is short and exact: "It will no longer be offered when writing a letter. Letters already written keep their wording." That is the whole point of copying the wording into the letter at the moment it is written.

Rules

• A model is never read while a letter is printed. Its wording is copied into the letter when the writer asks for it, so editing or archiving a model never changes a paper already written.
• Wording may use a closed set of variables — the employee, their job title, their number, their hire date, the company, the place, the date, the reference, the signatory. An unknown token is refused when you save the model.
• A variable with nothing behind it prints as four dots rather than disappearing, so a gap is visible on the paper.
• {blank} inside a starter is not a variable; it is the visible blank the writer fills in.
• Models are per company and per kind of paper, and are archived, never deleted.

Equipment catalog · /settings/equipment#

What it is for. The definitions of the equipment and protective gear your companies can stock. The definition is shared; the stock belongs to each company.

The journey

Add equipment describes one item.

• Name, code and category.
• Size or variant — one entry per size, for example "Safety boots – 42".
• Unit cost, for information only.
• How is it tracked? — by quantity (units of the same thing) or by serial number (each piece identified individually).
• Must it be returned? — returnable (issuing creates a custody the employee must return), non-returnable, or consumable.

Rules

• A serialized item is always returnable.
• Once an item has movements, assets or issuances, its code, tracking and return policy lock. Everything else can still be edited.
• Items are archived, never deleted. Archive this equipment? keeps the stock figures and the history, and only stops the item being received or issued again.
• All the sites of a company share that company's stock. There is no per-site stock and no automatic transfer between companies.

Equipment categories · /settings/equipment/categories#

A simple catalog — add, rename, archive, restore — used to group the items above.

EPI profiles · /settings/epi-profiles#

What it is for. The protective equipment each type of employee should receive.

The page explains its own order: set the replacement cycles first (when each item becomes due again, or mark it as manual replacement only), then create the profile — the items and quantities one type of employee should receive — and publish later changes as new effective versions.

Dialog: Add EPI profile#

A short code that cannot be reused, a name such as Workshop operator, an optional description, the date the profile takes effect, a reason, and then the lines themselves: an equipment item from the catalog and the quantity one person should hold. An item can appear only once in a profile.

Rules

• A profile is the requirement, not proof that equipment was handed over. The actual handover is recorded on the EPI requirements page (chapter 4).
• Changes are effective-dated: existing assignments and issuances stay exactly as they were.
• Profiles are archived, never deleted.

Global settings · /settings/global#

What it is for. The workspace's own identity: its logo, its time zone, its default language and its appearance.

• Workspace logo — shown in the navigation and as the browser tab icon. PNG, JPG or WebP, up to 2 MB.
• Workspace time zone — used to interpret punch times, work dates and overnight shifts.
• Workspace language — the default language for everybody; each person can still choose their own from the top bar.

Rules

• The time zone is not cosmetic. Punches are stored in universal time and turned into work dates with this setting, so changing it changes which day a punch near midnight belongs to. Set it once, at the start.
• The workspace language is a default, not a restriction: a person's own choice wins for them.
• A company has its own timezone as well, for its own papers; this one is the workspace's.