About this manual

This manual walks through the tasks you do in the practice app, step by step. Button and field names are written in bold, exactly as they appear on screen.

For a full description of what each module does and the rules behind it, see the companion Handbook. Both are kept up to date with the software; see What’s new at the end of the Handbook for the latest changes.

Before anything else: almost every screen works on one company at a time — the one shown in the switcher at the top right. If you cannot find a client or an invoice, check you are in the right company first.

One convention worth knowing. A path written with arrows — Settings → Company details → Closed up to — is a path through this app, and every name in it is a name on the screen. Where another program’s menus are meant, the separator is a chevron (iPhone: Settings › General › Date & Time), so the two can never be confused. A test reads every arrow path in both documents and fails if any of them names a screen this app does not have.

Part 1 — Getting started

1.1 Signing in

The very first time, if you were sent an invitation, open the Set your password link in it, choose a password and type it twice, then sign in with it below. The link works once and lasts three days; if it has run out, ask whoever set up your account for another. A password the app refuses — too short, or made out of your own name — does not use the link up, so you can simply try a different one.

1. Go to invoicing.kppanagi.com.
2. Enter your email and password and click Sign in.
3. Prove it is you with your second factor:
   • type the 6-digit Code from your authenticator app and click Continue; or
   • click Use this device instead and use your fingerprint, face or PIN; or
   • click I have lost my phone and enter one of your recovery codes.

You can also sign in with Use a passkey, fingerprint or face straight from the first screen if you have registered this device.

If the code is refused: check that your phone’s clock is set automatically (iPhone: Settings › General › Date & Time › Set Automatically) and use a fresh code.

If a passkey is not found in Chrome: the passkey may be saved in Safari or on your phone. Sign in with Safari, choose Use a phone or tablet and scan the QR code, or use the authenticator code instead.

If you are told “Too many attempts”: four wrong passwords on one address are free; the fifth shuts that address out for a minute, then five minutes, then fifteen if it keeps happening. The message says how long is left. Nothing is broken and nobody has to be telephoned — wait it out, or ask an administrator for a link (below). An address with no failed attempt for an hour is forgotten entirely. Wrong codes are counted separately, and giving the right password does not clear them.

Two things changed on 11 October 2026:

• A lockout now lasts through a restart of the server. It used to be forgotten the moment the app was updated, which meant somebody guessing at your addresses got a fresh start every time it was. If you are waiting out a lockout, an update no longer ends it early.
• The app also counts wrong sign-ins per place. Twenty wrong in an hour from one place — across any accounts, which is what somebody working through a list looks like — and every further attempt from there is held back for a few seconds, and you get an email about it. Nobody is shut out by this. Your office shares one address with everybody in it, so locking it would shut out the whole office; somebody at the next desk with the right password still signs in normally.

If you have forgotten your password: ask an administrator to send you a link. There is no forgotten my password box on this screen, deliberately — it would let anybody make the app send mail to your address, and it would tell them that your address is an account. A link they send you lasts a day, works once, and still asks for your second factor afterwards. If you can still sign in, change it yourself under Settings → Your sign-in → Your password instead.

1.2 Setting up your second factor (first time)

This happens on your very first sign-in, before the app opens. Your password alone gets you to one screen and no further: Set up an authenticator app. There is no way round it and nothing to put off — an account without a second way of proving it is you cannot be used for anything at all.

1. Click Set up an authenticator app.

2. Scan the QR code with your authenticator app — Google Authenticator, Microsoft Authenticator, 1Password, whichever you use. Open the app, choose to add an account, point the camera at the square, and it fills itself in. If the camera will not oblige, the key is printed underneath the square: choose enter a setup key in your app instead and type it in. Both routes end in the same place.

   Until 14 October 2026 this step read “there is no QR code to scan”, and everybody typed thirty-two characters by hand. There is one now.

3. Type the 6-digit code the app shows, and your password, and click Confirm it. (The password is asked for because this is your first factor: without it, anybody who found your machine signed in could put their own authenticator on your account.)

4. Write down the recovery codes that appear — each one gets you in once if you lose your phone, and they are shown this once only — then click I have kept them.

The app opens, and from then on signing in is your password and a 6-digit code.

Later, from inside the app, the same things live under Settings → Your sign-in → Proving it is you: a fresh set of recovery codes, a second authenticator, or a device registered as a passkey.

Adding a passkey instead or as well: click Register this device, and the browser asks for your fingerprint, face or device PIN. It also asks “What should this device be called?” — name it for the machine, not for you, since the list is how you tell one from another later. If the button is greyed out, the note beside it says “Passkeys are not configured on this server (APP_ORIGIN is not set)” — the server is missing a setting and somebody has to fix that first.

Later, on the same card: Remove the authenticator app and Remove beside a passkey take one away, and Give me a fresh set issues ten new recovery codes — the old ten stop working the moment it does, so write the new ones down before you close the box.

Each of these either happens completely or not at all, from 13 October 2026. Setting up or removing a second factor does several things at once — the factor itself, your recovery codes, and signing you out everywhere else. That last one is the point of it: if you are setting two-factor up because something went wrong, a session somebody else opened before that moment is exactly what must not survive it. They now stand or fall together, so you can never be told it is done while one of them quietly did not happen. If something goes wrong you are told, and nothing has changed — try again.

These are the only way back into your own account. An administrator can reset anybody’s password, but nobody — administrator or not — can take a lost authenticator off somebody else’s account. If you lose the phone and the codes, no one who can sign in can let you back in; it would take somebody with direct access to the database on the server.

So keep them somewhere that is neither this app nor the machine you sign in from — with the company seal, or in a safe. Each one works once, and one is spent whether or not it turns out to be the one you needed.

If you are the practice’s only administrator, consider making a second one. It costs nothing until the day it is the difference between a phone call and a server job. 4. Optionally click Register this device to add a passkey (fingerprint, face or PIN) for this computer.

1.3 Moving around

• Top-left is the practice’s own mark — the KP monogram and K.P. Panagi & Co (from 13 October 2026; it used to say InvoicePro). On a narrower window the name is dropped and the monogram stays. The browser tab reads Invoicing — K.P. Panagi & Co, so it can be told apart from the payroll and accounting tabs.

• The bar across the top holds the seven parts of the app: Dashboard, Invoices, Clients, Tools, Reports, Timesheet and Settings.

• Click a name and its sections drop down beneath it. Clients offers Client list and Deadlines; Invoices offers All documents, New invoice, New credit note and New pro-forma, all four in one list (from 13 October 2026 — they were behind a New › line before, and are not any more); Tools offers Quotations, Email and Currency, the first two with their own screens under them. A line with an arrow at its end opens a second list beside it — point at the line or click it. Escape closes the menu, and the arrow keys walk it.

• Choose the company in the switcher at the top right. One company is open at a time — see One company at a time just below.

• Back (browser button or the ← in the row beneath the names) returns to the previous screen. That row also says which screen you are on, which the menu cannot do while it is shut. ### One company at a time

Since 9 October 2026 each sign-in has one company open, and the app will not quietly work on another in the background.

Switching is the switcher, and it is immediate. Pick a company at the top right and you are in it. Nothing about this makes switching slower.

Two boxes may appear, and neither means anything is wrong with your account.

“Switch to … ?” — a screen has asked for a company this window is not on. Almost always a tab left open on yesterday’s company, or a bookmark. The box names the company that is open and the one being asked for. Press Switch and the app finishes what it was doing; press Stay in … and nothing moves. The only thing switching costs you is a half-written invoice, which belongs to the company it was started in — and the box says so before you decide.

“Open … again” — nothing has happened in this window for half an hour, so the company has been closed. You are not signed out. One button, nothing to type, and you are back where you were. This is for the window left open on a desk somebody else walks past.

What is never affected: Settings → People & access, the audit log and the other registers, the reference data, and the list of companies in the switcher itself — none of those is about one company.

Each window is its own. The company open on your desktop and the one on your laptop are separate, and the half hour is counted separately for each. A window you are using never closes while another sits idle.

• Refreshing keeps your place, and screens can be bookmarked. Every screen has its own address, so pressing refresh brings back the screen you were on, a bookmark opens the screen it was made on, and an address pasted to a colleague takes them to the same screen (what they may see there is still decided by the companies they hold). Signing in always opens the Dashboard, whatever address is in the bar.
• Search is the magnifying glass on the bar, or Ctrl+K (⌘K on a Mac) from anywhere. It looks in the company you are in.
• Help is the ? on the bar; it opens this manual and the handbook in a new tab. Use the search box at the top of any Help page to look through both.
• On a phone the names sit on their own line under the company switcher and slide sideways with a finger. Tapping a name opens its menu the same way; a line with its own screens opens them inside the menu, indented under the line you tapped, so nothing is ever off the side of the screen. There is no burger button to find.

1.3a Favourites — the column down the left

The bar holds seven names and everything else is a section under one of them. That is fine for a screen you open now and then and tiresome for the four or five you open every day, so those go in a column of their own:

• The ★ at the right of the row beneath the module names keeps the screen you are on. Press it again to take it off. Filled means it is on your list.
• The screens you keep appear down the left, in the order you added them. Click one to go straight there; the one you are on is highlighted.
• The × on a row takes it off without going to that screen first.
• The list is yours — staff have their own — and it is per company, so switching company in the switcher shows that company’s shortcuts.
• It is kept on the server, not in this browser, so the same list is there on your laptop at home.
• A screen that stops being offered — Deadlines, if a company is set to a services or trading company — drops off the list. Setting it back brings the shortcut back; nothing was thrown away.
• On a phone the column becomes a row of chips under the module names, scrolling sideways like the names above it.

If you kept a link to a screen from before the bar changed, it still works: Compliance takes you to Clients → Deadlines, and Quotations, Email and Currency take you to their section of Tools. The address in your browser is corrected as you arrive, so a link you saved again afterwards is the new one.

1.3b The Dashboard — what needs attention

Renumbered from 1.3a on 14 October 2026. Two different sections carried that number — this one and Favourites above it — so “see §1.3a” picked whichever a reader found first, and the Help page’s own index listed the number twice. Nothing in either section changed.

This is the screen you land on after signing in, and it is the only one that tells you what to do next rather than waiting to be asked.

Across the top, four figures for the company in the switcher, over the period chosen at the top right — This year, Last 12 months or Last year. Below them: Fees by month, Income by client, Income by service, VAT on your sales, Not yet invoiced this month, and What needs attention.

What needs attention is the working list — overdue and unpaid invoices, filings coming up, and anything else the app has noticed. Every row is a link: click it and you are taken to the thing itself, rather than having to go and find it. On Not yet invoiced this month, each client carries an Invoice button that starts the invoice for you.

To-dos live here too.

• ＋ Add a to-do asks What needs doing?, and optionally By when and For a client. Only the first is required.
• Tick the circle at the left of a row to mark it done. The row is replaced by “Ticked off: title · Undo” — and that notice lasts exactly one redraw, so if you tick the wrong one, use Undo straight away rather than after going elsewhere.
• Click the row itself (not the circle) to change or delete it. The delete confirm is worth reading: “Delete this to-do? Ticking it off keeps it; deleting does not.” Ticked-off to-dos stay on the record; deleted ones are gone.

Two things the VAT card may say instead of a figure. Where the company has no VAT quarter ends set, it works on calendar quarters and tells you so — “Calendar quarters assumed (Mar, Jun, Sep, Dec). If yours end in other months, set them under Settings → Company details.” Where the company has no VAT number at all it says “This company is not VAT registered — it charges no VAT.” Neither is an error.

1.4 If you leave something half-written

Click away from an unsaved invoice, credit note, pro-forma or quotation — to another screen, to another company, or to sign out — and a box appears before anything is lost:

• Save as a draft — keeps it under Invoices (or Tools → Quotations) with a number already allocated, to finish later;
• Discard it — throws the changes away. For something you had already saved once, this throws away this round of changes, not the document;
• Stay here — goes back to what you were doing, with everything still typed in.

It only appears where there is something to lose. Looking at a document, or opening a form and changing nothing, moves you on without a question — a box that appeared every time would be one everybody learns to click through without reading.

A draft is not an invoice. It has a number but it has not been issued: it is not in the revenue figures, not on the client’s statement, and nothing on the VAT return reflects it. That is why saving a draft is always safe.

The browser’s own warning is a different thing. Closing the tab or pressing refresh gets the browser’s “Leave site?” box instead, which the app cannot word. Say leave and whatever was typed is gone — so where you have a choice, use the app’s own back-and-forth rather than the tab’s ✕.

1.5 Changing your password

Settings → Your sign-in → Your password: enter your current password, the new one (at least 12 characters) twice, and click Change my password. You are signed out everywhere else.

Where you are signed in — the card below it lists every browser and machine you are still signed in on, newest first. Sign out everywhere else closes all of them but the one you are using. It does not ask for your password, because it can only ever take access away — so if you have left yourself signed in on a client’s laptop or a borrowed machine, this is how you close it without having to go back to it.

1.5a Light or dark

Press the round button at the top right, beside the company switcher. It moves through three settings, and the third is the one people miss:

1. Follow my computer — light by day and dark at night if your machine is set that way. This is where every account starts.
2. Always light.
3. Always dark.

Hover over the button and it says what it is on now and what the next press will do. That tooltip is the reliable guide; there is no sequence worth memorising.

The choice is kept against your sign-in, not against the browser, so it follows you to another machine and survives signing out. It is yours alone — changing it changes nothing for anybody else in the practice.

Invoices, quotations and statements stay on white paper whatever you choose — on screen, in the PDF and on the printer. A document is a document: it has to look the same to you and to the client who receives it, and nobody wants a dark-grey invoice coming out of the printer.

1.5b How big the screens are drawn

Beside the light/dark button there is an Aa with a short list: 90%, 100%, 110%, 125%, 150%. Pick one and the screens are drawn at that size straight away.

It is kept on your account, not in the browser. Sit at a different desk, sign in on a laptop, or open the app in a fresh window, and the screens come up at your size without your setting it again. On a machine you have used before it is right from the moment the page appears, with no resize a second later.

Two things to know:

• Invoices, statements and everything you print are unaffected. The size is for the screens you work on. A PDF and a printed page come out the same at 150% as at 100%, so nothing you send a client changes.
• 100% is the ordinary size, and choosing it takes the setting off rather than storing it.

This is separate from your browser’s own zoom (Ctrl and +), which you can still use on top of it. The difference is that the browser’s belongs to that browser on that machine, and this one belongs to you.

1.5c Using the app from the keyboard

• Skip to the screen. Press Tab once on a fresh page and the first thing you reach is a Skip to the screen link; Enter puts you straight into the work, past the module names, the search, the buttons and the row that says where you are. Without it, reaching the screen from the keyboard means tabbing through the whole bar every time.
• The bar from the keyboard. Tab reaches the seven module names; Enter or the space bar opens a module’s menu, the arrow keys walk its lines, → opens a line that has its own screens and ← comes back out, and Escape closes the menu and leaves you on the name.
• Less movement. If you have turned on Reduce motion (macOS: System Settings › Accessibility › Display; Windows: Settings › Accessibility › Visual effects), the app stops fading and sliding: things appear where they are going instead of travelling there. Nothing is hidden and nothing moves to a different place — only the movement goes.

1.5d Messages the app sends you about your own account

You will get an email from the app itself when any of these happens to your account:

• somebody signs in from a browser it has not been used from before — the message names the browser (“Firefox on Windows”) so you can tell your own machine from a stranger’s;
• your password changes — and the message says whether you changed it or an administrator did;
• a second way of signing in is added to your account, or removed from it, or cleared for you by an administrator;
• four wrong passwords are followed by a fifth and the account is shut for a minute;
• your email address is changed — this one goes to your old address, because that is the one you still read;
• what you can do in the app changes — you are made an administrator, or made staff again. New on 12 October 2026. The message says what it became and what it was, and that your sessions have ended so you will be asked to sign in again. If you were not expecting it, and especially if it gave you more than you had, telephone whoever looks after the app today rather than replying;
• your sign-in is switched off — also new on 12 October 2026. It says that nothing you did has been deleted, that any password link in your mailbox has stopped working, and to telephone rather than reply, because the address it was sent to can no longer sign in.

Two of those send nothing, on purpose: being let back in after a switch-off, and a change that ends your sessions without changing your role — being marked as a client’s own person, say. A message about something that did not change is how these come to be ignored.

Each one ends the same way: if it was you, there is nothing to do. If it was not, tell whoever looks after the app straight away — your password should be changed and your sessions ended. There is no button in the app for locking your own account, which is why the message asks you to tell somebody rather than pointing you at one.

Three things that are worth knowing so the messages do not become noise you ignore:

• The first sign-in from each browser is mentioned once, and never again from that browser.
• The very first browser you use raises nothing — your first sign-in is not news.
• Clearing your cookies, or using a private window, makes a browser look new again, so a message after doing either is expected and is not a sign that anything is wrong.

If your practice has not set up the app’s own mail server (Part 10), none of these arrive — and nothing about signing in is affected either way.

1.6 Finding anything quickly

1. Click the magnifying glass on the top bar, or press Ctrl+K (⌘K on a Mac). The box opens over the bar — there is no box sitting there waiting.
2. Type at least two characters: a client’s name, a VAT or registration number, an invoice or quotation number, or an amount.
3. Use ↑ ↓ to move through the results and Enter to open one (or click it). Esc closes the list.

It opens the client, the document or the quotation.

What it looks through. Clients (by name, legal name, email, contact, VAT number, registration number or tax ID), documents (by number, reference, client name or amount) and quotations (by number, prospect or client name). Numbers are matched however they are spaced or punctuated, so inv045 finds INV-045-2026 and a VAT number typed without its spaces still finds the client.

Example. A client telephones about “the invoice for about eleven hundred euro”. Type 1190 and the invoice comes up by its amount.

It searches the company in the switcher, and nothing else. If what you are looking for belongs to another of the practice’s companies it will not be here — switch company and search again. Where nothing matches, the box names the company it looked in, so you can see at a glance whether you are in the right one. (Until 5 October it searched every company you hold and switched for you; see the Handbook’s What’s new.)

Part 2 — Invoicing

2.1 Raising an invoice

1. Check the company in the switcher.
2. Go to Invoices → New invoice.
3. Choose the Client. Their address, VAT number, terms and usual fee fill in. (For someone not on the list choose Other (type manually)….)
4. Check Issue Date and Due Date.
5. For each line:
   • choose the service (or ＋ New service… to add one to the company’s list);
   • choose the period — Month, Period (a range) or Year — and pick it;
   • add any extra wording in Anything to add after the period;
   • enter the Fee and any Reimb. (reimbursement). The preview line shows the wording the client will see, e.g. “Preparation of VAT return for March 2026”.
6. Click + Add Line for more lines.
7. Check the VAT note under the totals (see 2.9).

The Details card, which decides more than it looks.

• Status — Draft, Sent or Paid, and it opens on Draft. This is what decides whether the invoice counts: a draft is out of every figure and every report. Save Invoice saves whatever Status says, so change it to Sent when you mean to issue it.
• Number — filled in for you, but you can type over it. Two documents of the same company can never share a number; if you type one that is taken, the app refuses and names the document already using it. The number offered is always one past the highest number already in use for this company, this kind of document and this year — so if you deleted the last one, the number you see is the one it had (see 2.10).
• Template — the four layout buttons (classic, bold header, minimal accent, centred header) sit at the top of the card.
• Currency and Reference are here too. The currency list is fixed (€, £, $, AED, AUD $, CAD $).

The From card carries Business, Email, Address, Phone, VAT and Tax Number, filled in from the company. You can overwrite any of them for this one document without changing the company.

Notes & Payment. Notes to Client prints at the foot. Payment Details is filled in from the payment account you chose — but anything you type there is what the client sees instead. A document already saved keeps the wording it printed, so changing the company’s bank details later never rewrites an invoice somebody is already holding.

If the account you picked is held in a different currency from the invoice, a Check flag says so. That is often exactly right — it is asking you to confirm, not refusing. 8. Under Notes & Payment, check Where the client should pay is the right bank account. 9. Set Status. In the Details card at the top there is a Status box — Draft, Sent or Paid — and it starts on Draft. This is the field that decides whether the invoice counts, not which button you press. Leave it on Draft while you are still working; set it to Sent when the invoice is real. 10. Click 👁 Preview to see it, then Save Invoice.

Save Invoice saves whatever Status says. Press it with Status still on Draft and you get a draft — the message says “Saved as a draft”. Save Draft is a shortcut that saves as a draft whatever Status says, for when you want to put something down mid-sentence.

If an invoice does not appear in your figures, this is almost always why: open it and look at Status. A draft is also the only state that tolerates a missing payment account or a fee left half worked out — set Status to Sent and the app will tell you what is unfinished.

“⚠️ Already billed”: if the same service and period were already invoiced to this client, the app names the earlier invoice. Choose Discard this line / Remove these lines if it was a mistake, or Add it again / Bill again anyway if it is intentional.

2.2 An invoice for goods (products)

For a goods company (e.g. The Fat Bull):

1. Invoices → New invoice, choose the client.
2. The first box on a goods line is the category, not the product: Products, Royalty fees for sales, Royalty fees for Marketing and advertising or Other…. The product picker only appears once you choose Products; Other… replaces it with a free-text Description box.
3. On each line choose the product (price, unit and VAT fill in), and add Qty, Period (optional) and Waybill (optional).
4. Adjust the VAT % per line if needed (0, 5, 9 or 19).
5. Save as above.

2.3 A fee worked out from the period’s numbers (variable fee)

Some fees are not a round number agreed once — they depend on what the month actually contained. A service set up as worked out each period is priced on the invoice, from the period’s figures, and the client is shown the sum.

1. Add the line as usual. The fee shows not worked out instead of an amount.

2. Click Work it out….

3. The box opens on the way this service is charged. There are five:

   How it is charged	What you type in
   Transactions over an included number	how many transactions the period had. A number is included in the fee; anything above is charged at a rate each
   Per employee	how many employees were on the payroll that month
   Hours	how many hours were worked, at the agreed hourly rate
   A percentage	the figure it is a percentage of — turnover, a transaction value, a commission
   Typed line by line	your own wording and amounts, for anything the other four do not describe

4. The terms it works from are the client’s own if any were agreed with them, otherwise the standard ones for that service. The box says which it is using.

5. Tick Keep these terms for where these terms were agreed with that client rather than being a one-off. From then on their invoices open on these terms and you only type the period’s figures.

6. Read What the client will see — the sum in words, as it will print — and click Use this figure.

Example. Bookkeeping includes 100 transactions for €150, then €0.80 each above that. March had 143. Type 143; the box shows 100 included, 43 at €0.80 = €34.40, total €184.40; click Use this figure. The invoice line reads €184.40 and the appendix shows the client the arithmetic.

The working prints as an appendix after the invoice, on its own page. The invoice pages show the amounts; the appendix shows how each was reached. One invoice covering three months carries three workings.

A line left at not worked out holds the whole invoice as a draft. Saving it as Sent is refused — the message names the line — and so is emailing it: “…has not been worked out. Open the invoice, finish the working, and send it again.” If an invoice will not leave draft and you cannot see why, this is the usual reason.

2.4 A credit note

A credit note cancels an invoice, or part of one. You never edit an invoice a client is holding — you issue a credit note against it, so both documents exist and the pair explains itself a year later.

1. In Invoices → All documents, click Credit on the invoice. (Or go to New credit note and choose the client and the Original Invoice — the same thing, two more clicks.)
2. The lines of the original come across already filled in. Untick any service that is not being credited.
3. For a part credit, change the amount on the line you are crediting.
4. Click Save Credit Note.

Example. INV-031-2026 was €800: €500 for the annual accounts and €300 for the VAT returns. The client was charged for VAT returns they do not use. Click Credit, untick Annual accounts, leave VAT returns at €300, save. The credit note is €300, the invoice still shows €800, and the client owes €500.

The VAT rate is fixed at the rate the invoice was charged at and cannot be changed on the credit note. This is deliberate and it is not a limitation: a credit note takes back a supply that has already been made, so it has to take back the VAT that was charged on it. Crediting at today’s rate an invoice raised at last year’s would leave VAT on the return that was never paid and never refunded.

What it does to the invoice. The invoice’s balance drops by the credit. Credit the whole of it and the balance reaches nil and the invoice reads as settled; credit part and the rest is still owed and still appears on the statement and in Aged Receivables.

2.5 A pro-forma, and turning it into an invoice

A pro-forma is a request for payment that is not yet an invoice. Nothing about it reaches the VAT return, because no supply has been made — which is exactly why you use one for a client who pays in advance.

1. Invoices → New pro-forma, fill it in like an invoice, and click Save Pro-forma. It takes a number from its own counter (PRO-), separate from the invoice numbers.
2. To change one before it is converted, click Edit on its row. The screen says Edit Pro-forma throughout, and saving leaves it a pro-forma — it does not become an invoice by being edited. That is the point: there is one way to turn a pro-forma into an invoice, and it is step 3.
3. When the client pays or confirms, click Convert on its row in All documents and confirm.

What Convert does. It creates a real invoice, with the next invoice number and today’s date — not the pro-forma’s date. The pro-forma stays on the list, marked as converted, so the trail from quote to money is unbroken.

Example. PRO-004-2026 was raised on 3 March and the client paid on 19 April. Convert it on 19 April and you get INV-046-2026 dated 19 April. The supply is in April’s VAT quarter, which is where it belongs — the pro-forma in March moved nothing.

A closed period refuses the conversion, because what comes out of it is an invoice dated today, and that is the date that has to be open (see 3.2).

2.6 Emailing an invoice

1. In All documents, click ✉ on the row.
2. Check the To address. It is filled in from the client’s record — the Invoice email if they have one, otherwise their main Email.
3. Optionally add A line of your own. It goes above the standard wording, so use it for “as discussed on the phone this morning” rather than for anything the client needs to keep.
4. Click Send.

The PDF goes with it, exactly as the client would get it from PDF as the client gets it — the appendix included, where the invoice has one (see 2.3).

It leaves through the company’s own mail server, not a shared one, so an invoice from K.P. Panagi & Co leaves as K.P. Panagi & Co. If that company has no mail server set up, nothing is sent and the app says so rather than appearing to work — ask an administrator (see 10.7).

Typing an address that is not on the client’s record raises a question before anything goes. That is on purpose: an invoice carries what the client owes and what they were charged for, and one keystroke in an address field is all it takes to send that to somebody else. Answer it and the message goes; it is asked once per send, not once per session.

It is recorded. Every message, sent or refused, is on Tools → What has been sent with the date, the address and whether it actually left (see 7).

2.7 Recording a payment

1. In All documents, click Pay on the invoice.
2. Enter the Date the money arrived, the Method, the Amount and any Reference (the bank’s reference, so the receipt can be tied back to the statement later).
3. Choose Into which account the money came — the same accounts an invoice prints from (see 3.1). It opens on the default, which is where you asked them to pay, so check it if the company has more than one account. For method Cash the question disappears and the receipt is recorded against no account.
4. Click Save Receipt.

A receipt document is created with its own number (RCP-) and the invoice’s balance drops by the amount.

Part payments are normal and nothing special is needed. Enter what actually arrived.

Example. INV-052-2026 is €1,190. The client pays €700 on 12 May and €490 on 3 June. Record two payments. After the first the invoice still reads Sent with €490 owing and still appears in Aged Receivables; after the second the balance reaches nil and it reads Paid.

An invoice is never marked paid by hand. Paid is worked out from what stands against it — receipts and credit notes together — so the status and the figures can never disagree. Delete a receipt by mistake and the invoice goes back to Sent with the money owing again, not to Draft: it was sent, and a document the client is holding does not become a draft because a receipt was cancelled.

The bank often pays a little short, a charge having been taken on the way in. Record what arrived; if the few cents left are not worth chasing, a small credit note clears them.

Every payment is entered this way. It used to be possible to raise receipts automatically from an imported bank statement; the statement import is in the accounting application now.

Receipts for a whole company’s invoices at once

On the Dashboard there is ⚡ Bulk Receipts. It creates a bank-transfer receipt for every invoice of the company in the switcher except the latest, and marks them paid.

It exists for one job: a company that invoices on standing order, where everything up to last month is known to have been paid and entering forty receipts by hand is an afternoon. It is not a shortcut for ordinary work.

• It asks you to confirm first, naming the company.
• It skips anything it cannot properly receipt — a draft, or an invoice in a closed period — and the message afterwards says how many were skipped and which, so a skipped invoice is something you go and look at rather than a number.
• There is no undo. The receipts are ordinary documents and have to be deleted one at a time. Check the company in the switcher is the one you mean before you press it.

2.8 Finding, printing and exporting documents

• Use the filters at the top of All documents: client, type, status, period (or Other — choose dates…) and sort order.
• View opens a document; ⬇ Download / Print prints it, PDF as the client gets it downloads the PDF.
• ⬇ Excel / ⬇ PDF export everything matching the filters.

The downloaded file names itself after the document. Invoice INV-034-2026 for Simallin Ltd lands in your Downloads folder as Invoice INV-034-2026 - Simallin Ltd.pdf — so a folder of them reads as a list of invoices rather than a list of numbers, and you can attach one to an email without renaming it first. A credit note says Credit note, a receipt says Receipt, and a quotation uses its own reference.

A client named in Greek keeps their Greek name: Invoice INV-035-2026 - Αντρέας Γεωργίου Ltd.pdf. Characters that Windows or macOS will not accept in a file name — a slash, a colon, a quote mark — are left out, so A/B Ltd comes out as AB Ltd.

If a file ever downloads with %20 in its name, or 20 where each space should be, something is wrong — tell whoever looks after the software. That was a real fault until 13 October 2026 and it is fixed; it should not come back, and there is a test watching for it. Handbook §3.7a.

The period opens on This Year, and the list shows at most 500 documents. Both catch people out. Looking for an invoice from two years ago and finding nothing usually means the period, not a missing invoice. Where the cap bites, the list says so itself — “Showing the first N of M documents. The totals above cover all M; only the list is shortened.” — so the figures are never the part that is short. Narrow the period, the client or the type, or take an export, which gives you every one.

2.9 What the VAT note means

There is no note at all for an ordinary Cyprus client charged 19% — the box stays empty, and nothing is printed on the document. A note appears only where something needs explaining, and there are exactly three of them. They are printed word for word: an invoice citing the wrong article is worse than one citing none, so nothing below is paraphrased.

An EU client who has given no VAT number gets no note at all. They are charged Cyprus VAT as a consumer would be, and there is nothing to explain — so nothing is printed. The same goes for any document that is charging VAT: a note saying the customer accounts for the VAT, on a document that adds 19% to the total, would contradict itself on its own face, so it is withheld.

There is also a warning, which is not a note. Where the client qualifies for zero-rating but a goods line still carries a VAT rate, the box turns amber and is flagged check this — a goods line keeps its own rate whatever the customer’s country, and a hand-typed override does the same. Nothing is changed underneath you: the wording is withheld and the decision left to a person. Set those lines to 0% if the exemption applies, and the wording is added for you.

2.10 Deleting a document

Click ✕ on the row and confirm.

Three things will stop you, and each is worth knowing before you need it:

• An invoice with receipts or credit notes against it cannot be deleted until those are deleted first. Otherwise a receipt would be left standing against nothing.
• Nothing in a closed period can be deleted — unless your account may re-open the books, in which case the app asks for a written reason and lets that one deletion through, keeping the reason with the record (see 3.2).
• A document that has been emailed is not protected, and that is the case to think about. The app will delete it; the client still has the copy in their inbox.

Prefer a credit note to a deletion for anything the client has seen. A credit note leaves both documents and a reason; a deletion leaves neither. Deleting is for a draft typed in error, or an invoice raised by mistake and not yet sent.

What happens to the number

Deleting the last document in a series gives its number back. Issue INV-029-2026, delete it, and the next invoice you raise is INV-029-2026 again. The app works the next number out as one past the highest number actually in use — so nothing is skipped because something was deleted, and the series runs on without a gap.

A gap in the middle is a different matter, and stays. If you delete 027 while 028 and 029 exist, the next invoice is 030: 027 stays missing. A number that is already on a document somebody is holding is never handed out again, and invoices that do not run in number and date order together are the thing an auditor asks about.

So, deleting a document that is marked Sent or Paid and carries the highest number in its series, the confirmation box tells you one extra thing: that the number will be given to the next document you issue, and that a copy of this one may already be with the client. Nothing is blocked — you are just told before you press. Deleting a draft, or a document with others after it, says nothing extra, because in neither case is there anything to warn about.

Each of the four kinds counts separately — invoices, credit notes, receipts and pro-formas each have their own series per company and per year — and all four behave the same way. So does a quotation, where only a draft can be deleted at all.

What survives a deletion. The audit log keeps the document’s number and who removed it — “INV-020-2026 was deleted” is a sentence somebody can act on a year later, when the client is asking why their statement does not add up. That line is what tells you a number was used twice, if it ever matters.

Part 3 — Where clients pay, and closing a period

3.1 The accounts a client pays into

Settings → Company details → Where clients send the money → ＋ Add an account. Give it a label you will recognise when picking it (Bank of Cyprus €, Revolut £), the bank, the account name and number, the IBAN, the SWIFT code and the currency. Mark one as the default — that is the one a new invoice starts on.

This one list does everything to do with an account:

• it is printed on the invoice, under Notes & Payment, so the client knows where to send the money — and an invoice cannot be issued until the company has one, only saved as a draft;
• it is what Record payment offers when you say which account the money arrived in (see 2.7).

If you only have a company to look at, you see which accounts it holds and the last four digits, and not the full details. The label, the bank’s name and the currency are there, so you can tell which account an invoice was paid into; the IBAN, the account number, the SWIFT code and the account name are not. A line on the card says so, so a row that looks short is not mistaken for one somebody forgot to finish.

This is the same tick-box that decides the hourly rates on the Timesheet: and the figures, beside Viewer — to look at on Settings → People & access. Tick it for somebody and they see the accounts whole. Anybody who may change things in the company — a preparer or an approver — sees them whole anyway; withholding a figure from somebody who can change it would be for show.

An invoice is unaffected. It prints the account it names, in the words it was printed with, and anyone who can open the invoice reads it as the client received it. What is held back is the list of every account the company holds, including ones no invoice has named.

There was briefly a second list, Money → Bank accounts, with an opening balance. It was left over from when this app kept the books: the ledger coded against it, the bank statement was imported for it and the reconciliation was measured against it. All three are in the accounting application now, so that list was the same bank typed a second time and it has gone. Nothing was lost — payments recorded before the change still show the account they named.

Tools → Currency

What remains of that module: European Central Bank euro reference rates, kept in case an invoice is ever raised in a foreign currency. Three things on the screen.

Convert — type the Amount, choose From and To, set On the date, and click Convert. The date matters: a conversion is only as good as the day it is quoted for. The answer shows the rate used and the working (1 EUR = … = …), and says which day the rate was published.

Look up a rate — set Rates as at, optionally narrow with Find a currency (type USD, yen or sterling), and click Show the rates. Each row has Recent days, which draws that currency’s recent movement against the euro with its low and high.

Fetch the latest rates (administrators only) — asks the Bank now instead of waiting for the nightly job.

There is no rate for a weekend or a public holiday, because the Bank publishes none. Ask for a Sunday and you are given the last published day, and told so: “Rate published 29/09/2026 — there is no rate for 04/10/2026, so the most recent published day was used.” Quote the published date, not the one you asked for.

Read the line at the top before you quote anything. It is there every time — “Rates published yesterday (01/10/2026)” when all is well — and it turns into a warning when it is not: the download failed (with what the server got back), nothing has tried for over a day, the newest rate is more than four days old, or nothing has ever been downloaded.

The first of those is the one to watch, because it does not look wrong anywhere else: the Bank publishes at about four in the afternoon, so a download that broke this morning leaves yesterday’s rates sitting there looking perfectly ordinary. If the line is a warning and the figure matters, check it against ecb.europa.eu before you use it.

Money laid out for a client

That is on the client’s record, not here: Clients → the client → Details → Paid on their behalf (see 4.2).

3.2 Closing the books for a period

(The owner, and whoever was given this company to close months for — see below.)

Settings → Company details → Closed up to: choose the date and click Close the books. Nothing dated up to then can be added, changed or deleted afterwards — invoices, credit notes, receipts, money laid out for a client, recorded hours, and an invoice raised from an accepted quotation.

If you cannot see that card, it is not a permission you can grant yourself. Since 5 October it is given two ways: the owner sees it in every company, and anybody given this company as Approver — to change, and to close months on Settings → People & access sees it for this company. Being an administrator is not enough on its own. Ask the owner.

Before 5 October it was one email address set on the server, which is why it used to say “ask whoever keeps the server”. It no longer involves the server at all.

To make one change inside a closed period, just make it. If your account may re-open, the app asks why rather than refusing. A window headed Reopen a closed period comes up, wherever you were:

1. It names the date the books are closed up to, and says that the reason is kept on the audit log with the record.
2. Type a sentence in Why are you reopening it? — “The client sent a corrected invoice for the March quarter”. While it is too short, a line underneath counts down the characters still needed.
3. Press Reopen and save. The thing you were in the middle of goes through; you do not have to fill the screen in again.

If the sentence is too short the window stays open and says so in the box. Nothing you typed on the screen behind it is lost. Leave it closed (or the Escape key) abandons the change, and the app then tells you the period is closed, which is where you started.

The reason is kept in the audit log beside the record, and the lock date does not move — everything else stays shut.

To open a period back up for good, press Reopen everything on the same card, or set Closed up to to an earlier date. Moving the line backwards reopens everything between, so it asks the same way, in the same window — one question, asked the same way wherever it comes up.

Part 4 — Clients

4.1 Adding a client

1. Clients → ＋ Add Client.
2. Enter the Name — what you want to see on the invoice and on every list.
3. Choose the Location: Cyprus, EU or Outside the EU. This is the field that decides the VAT on everything you ever invoice them, so it is worth a moment now rather than a credit note later (see 2.9).
4. Choose the Country where it is not Cyprus. The location decides the VAT rate; the country is the finer answer underneath it, so the record says Germany rather than EU and a German VAT number on a client filed as Italian can be queried.
5. Add the email, phone, address and VAT number if you have them. None is required to create the client; all of them can be filled in afterwards.
6. Click Create Client. The record opens at once so you can finish it (see 4.2).

The client is added to the company in the switcher. If the practice bills the same client from two companies, open the client and tick the second company on its record — the client is one record shared between them, not two records with the same name.

A name already used in this company is refused, naming the one that exists, so two people cannot create Kweller Ltd twice on the same afternoon. The same name in a different company is allowed, because they may genuinely be different businesses.

4.2 Completing the client record

The Details pane is divided into named sections, and it is quicker to find a field by its section than by reading down: Identity, Contact, Billing terms, Fees worked out each period, Paid on their behalf, Quotation provided for the services, Compliance & deadlines, Status & notes. Two of them are easy to miss — Fees worked out each period is where variable-fee terms agreed with this client are kept. Client since is under Status & notes.

Paid on their behalf is where money laid out for this client is recorded — a filing fee, a levy, anything settled for them and to be recovered. Fill in the date, who it was paid to, what it was for and the amount, then Add. It is not a cost of the practice and no VAT is reclaimed on it: the charge belongs to the client. The section shows what has been laid out, what has come back, and the difference — which is what to put on their next invoice. Say what it was for in words you would be happy to see on that invoice, because that is where it ends up.

Older entries made while this app kept the books still appear in the list, and can still be corrected. On one of those that carries VAT, changing the amount is refused — the VAT on it is what was actually charged, and the total and the VAT would stop agreeing. The date, who it was paid to and what it was for can still be edited. If the figures themselves are wrong, take that one out and record a correct one.

Fill in what applies: legal name, group, entity status, registration number (HE), tax ID, contact person, invoice email, payment terms, default fee, currency, and under Compliance & deadlines:

• Is this an accounting client? — No if you only invoice them.
• Financial year end, VAT quarters and Annual return made-up date — these drive the deadlines.
• Audited by — their auditors, chosen from the list of audit firms. Leave it at — Not said — where the accounts are not audited. To add a firm to the list, go to Timesheet → Staff, tasks & rates.

Click Save Client.

For EU clients, click Check with VIES to check their VAT number.

4.3 Portal credentials

(Administrators only; practices only.)

This is where the client’s logins for the government portals are kept — TAXISnet, TaxForAll, the Registrar’s RoC code, CyLogin, SISWEB and Ergani — so that the person doing the filing does not have to ask for them every quarter.

1. Open the client and choose Credentials down the left of the window.
2. Confirm it is you. Reading a client’s portal passwords is one of the acts that asks for your second factor, and since 8 October it asks even if you signed in a moment ago — signing in and confirming it is you are two separate questions now (10.3). A confirmation then lasts five minutes, so going through several clients asks once. The code on your phone will be the one you just used to sign in, and each code works once, so the box will say so and ask you to wait a few seconds for the next. That costs you nothing.
3. Fill in the usernames and passwords.
4. Click Save Client.

👁 shows a password, ⧉ copies it to the clipboard without ever showing it.

They are encrypted before they are stored, under a key the server holds, so a copy of the database on its own does not open them. They are never in the client list and never in an export — they are read one client at a time, from this pane.

Every read is recorded, naming the client and which portal was opened, and that is the point of the record rather than a formality: it is the one table that answers who looked at this client’s TAXISnet login, and when.

4.4 Statutory registers

1. Open the client and choose Directors, Shareholders, Registered office or Share capital.
2. ＋ Add … to add an entry, with its Effective from date.
3. When something changes (a director resigns), click Record a change… on the entry, give the date, and then add the new entry. Do not delete — deleting removes it from the history.
4. To keep a certificate or filing, click ＋ Record a document, fill in the title and date, and Upload the file.

Each register is headed for what it holds — Current directors, and so on — with ＋ Add director to add one. Anyone who has left is kept: ▸ Show past entries (n) at the foot of the pane opens them, and the toggle says how many there are.

Below the people sits Documents & certificates, with ＋ Record a document. A row can be either — a certificate you have the file for, or one you only know exists — and it says which with a File attached or Recorded only badge. Open, Upload and Replace work on the file itself. A single file may be up to 25 MB.

4.5 Making a client inactive or removing them

• To stop a client appearing on new invoices, set Status to Inactive and save.

• 🗑 Remove client normally takes them off this company’s list only; past invoices stay, and other companies keep their own list.

  Read the box before you press it. If this is the client’s only company and they have no invoices or other documents, this deletes the client altogether — their portal passwords and their entire statutory register go with them, and there is no undo. You will be asked to confirm it is you first; that prompt only ever appears in this case, so treat it as the warning it is.

  If what you want is to stop the client appearing on new invoices, set Status to Inactive — hidden from new invoices instead and press Save. Nothing is lost.

4.6 A client two of your companies both bill

Some clients are filed under more than one of the practice’s companies. When they are, there is only one record — both companies see the same name, address, VAT number, statutory register and filing dates.

If you hold every company that bills them, nothing is different: open the client and work as usual.

If you hold only one of them, you can read everything and change nothing. The client window tells you at the top:

You can read this client but not change them. They are also a client of another of the practice’s companies, so their record is shared — changing it would change what that company sees.

and the Save Client button is not there.

This covers everything that belongs to the client: the record itself, the statutory register, marking a filing done, and Check with VIES, which writes its answer onto the record.

What to do about it. Either ask an administrator to make the change, or ask to be given the other company as well. Both are decisions somebody takes who can see both sides, which is why the app asks for one rather than quietly letting the change through.

Example. Kweller Ltd is billed by K.P. Panagi & Co and by Risby Holdings. Maria holds K.P. Panagi & Co only. She can open Kweller, read the record, see the registers and the filing dates, and raise K.P. Panagi & Co’s invoices to them. She cannot change Kweller’s address — because Risby’s own people would see the new address without knowing who changed it or why.

You are not told which other company it is. The client’s record lists the companies you hold and no others. The app tells you that the record is shared — which is why the Save button is missing — and leaves it there. If you need to know, ask an administrator, who can see all of them.

Clients of one company are unchanged in every way, and that is most of them.

Part 5 — Compliance deadlines

(Practices only.)

5.1 Seeing what is due

Clients → Deadlines lists the filing dates for the company’s clients. (It was a module of its own, Compliance, until 27 September 2026; the page itself still carries that heading.) There are four filters, not three: the period (Next 30 days, Next 3 months, Next 6 months, Next 12 months), All types, All clients, and Outstanding only / Include completed. The screen opens on Next 3 months and on Outstanding only, so a filing you have already marked done will not be there until you ask for completed ones. Anything overdue is always shown whatever the period says. The badge beside Clients counts what is overdue or due within 30 days.

5.2 Marking a filing done

Click Mark done on the row — on Clients → Deadlines, or on the client’s own Deadlines pane, which are the same list seen two ways.

The row moves out of Outstanding only at once. To find it again, switch the last filter to Include completed; it comes back with the date it was marked and who marked it.

Undo puts it back to outstanding. Nothing is lost either way — marking done records that a filing was made, it does not file anything and it does not delete anything.

It is per period, not per client. Marking this quarter’s VAT return done says nothing about the next one, which appears on the list in its own right when its date comes round.

Example. A client’s VAT return for the Sep–Nov quarter is filed on 8 January. Find the row, click Mark done, and the Dashboard badge drops by one. The Dec–Feb return is still there, due in April, as it should be.

5.3 When the real deadline is different

• One client (annual return, VAT return): open the client → Deadlines, change the date. reset goes back to the calculated date.
• Everyone (TD4, Summary Information Table, UBO): Settings → Deadline rules → Deadline dates — the same for every client, change the year’s date. Reset goes back to the rule.

The client’s own pane is headed Statutory deadlines, and it shows the difference rather than explaining it. A date you can change is a box, and once changed it reads “Changed from dd/mm/yyyy · reset”. A date that belongs to every client is plain text reading “From the rule · Settings” — there is no box, and that is the screen telling you it is not yours to change here. Once that year’s shared date has been changed centrally it reads “Set for all clients · Settings” instead, which is the same message with the extra fact that somebody has moved it. On the Compliance list, any row whose date was changed by hand carries the word adjusted.

One more thing that is set once and then forgotten: Track deadlines from under Settings → Deadline rules. Left blank it means 1 January of this year, so deadlines before that date are simply not listed.

And there is a second floor, per client. A client’s own Client since date (on their Details pane) hides anything that fell due before you took them on, whichever of the two dates is later. That is right — you cannot have missed a filing for a client you did not have — but it is the commonest reason a deadline somebody expects to see is not on the list. Check Client since before deciding a rule is wrong.

Part 6 — Quotations

6.1 Writing a quotation

1. Tools → New quotation.
2. Quote for: an existing client, or Someone who is not a client yet and type their name, contact, email and address.
3. Check Date and Valid until.
4. Tick the services, adjust fees, choose how each category is Billed, and set the transactions allowed if asked.
5. Optionally set the Ad hoc hourly rate, Opening paragraph and Notes to the client.
6. Check the preview on the right and click Save. It gets its number (QT-…).

6.2 Sending it

Open the quotation and choose one of the two:

• Email with PDF… — check the address and the covering message, keep Mark this quotation as sent ticked, and click Send with PDF.
• Record a posted copy… — for one you printed, posted or handed over. Nothing is sent; the app simply records that a copy went out on that date, so the trail is complete.

Every copy is kept under Sent copies, exactly as it was sent — v1, v2, v3. This is not a log line: the PDF itself is kept, so you can open what the client is holding rather than what the quotation says today.

Example. You send v1 in March at €2,400. The client asks for the payroll line to come out, you change it and send again, and that is v2 at €1,900. In June they say “your quote was two thousand four hundred”. Open Sent copies → v1 and you are both looking at the same piece of paper.

Editing after sending is allowed and makes a new version, which is why the versions exist. What is not allowed is editing after the client has accepted (see 6.3).

6.3 When the client accepts

1. Open the quotation and click Mark accepted.
2. For a prospect, click the button to create the client.
3. Click the button to raise the first invoice — it is created as a draft under Invoices for you to review and issue.

Accepted quotations cannot be changed; use Copy on the list to start a new one. If the client declines, click Mark declined.

It can only be done once. A second attempt is refused with “An invoice has already been raised from this quotation.” Only lines that carry an amount are billed — if none do, nothing is raised and the app says so. Each billed line arrives as “service name (fee suffix)”, so a catalogue line of “€200 / month” becomes one draft line of €200 described “… (/ month)”. The invoice is dated today, on the client’s own payment terms, with the quotation’s number as its reference.

If the books are closed for today, the invoice is refused — it is a real invoice, so it obeys a closed period exactly as one raised under Invoices does. What counts is today’s date, not the quotation’s: a quotation you sent in March and the client accepts in May is billed as a May invoice. If your account may re-open a period the app asks you for a reason in the usual way (§3.2). The quotation itself is never affected by a closed period — only the invoice it becomes.

6.4 The fee list

Tools → Services & fees: Add a service or Edit one (name, category, default fee, fee suffix such as “/ month”, description, bullet points). Changes apply to new quotations only.

A new company’s fee list starts empty, and there is nothing to tick on a quotation until it is filled. The empty screen says so — “Nothing on this company’s fee list yet. Every company builds its own — no two sell the same things.” — and offers Copy the list from…, a picker of your other companies with a Copy button beside it. That is the quickest start; ＋ Add a service builds one from nothing.

Part 7 — Circulars (Email)

1. Tools → Email.
2. Fill in Name it (for your own list) and a Subject, and write the message. Use Insert a field… for merge fields such as the client’s name.
3. Attach any files. Attaching one saves the message first — the screen says so, “the message is saved first so the file has something to belong to” — so a circular you were only experimenting with appears under Saved messages, as Untitled if you had not named it yet. Nothing has been sent; delete it there if you do not want it.
4. Under Who gets it, narrow the list with the filters and tick or untick clients. Read any warnings: clients with no email are named and will be skipped.
5. Under Check it first, click Send test to me and read the test in your inbox.
6. Click Send to clients…, check the list, and click Send … messages.

Each client receives their own message. Tools → What has been sent shows the result for every recipient. Saved messages lets you reuse a circular (Use) or remove one (Delete).

Three things on these screens are easy to miss: Start from a saved message… at the top of the compose screen, which is how you begin from an old one rather than a blank page; the Fill in with the first recipient chooser beside Send test to me, which puts real merge values in the test instead of the field names; and the confirmation the app asks if you send that test anywhere other than your own address.

Part 8 — Timesheet

8.1 Before anyone can record an hour

(Super admin. Once, per practice — then nobody thinks about it again.)

The timesheet records time for a person, and a person is not the same thing as a sign-in. They are kept apart on purpose: a subcontractor or an outside auditor can have their hours recorded without ever being given an account, and an account can exist that never records time. So having a sign-in — even an administrator’s — does not by itself give the timesheet anybody to record against.

Until this is done, Timesheet → My time shows no form at all, only the sentence “Your sign-in is not linked to a staff record yet, so there is nobody to record time for.”

Both steps are on Timesheet → Staff, tasks & rates:

1. Add each person. Under People whose time is recorded, type the Name, choose their address under Sign-in (optional), and click Add person. That dropdown is the link: without it the person exists but their time is not yours. Leave it blank for somebody who will never sign in.
2. Add at least one kind of work. Under Kinds of work, name it and click Add task. The card says “None yet. Nobody can record time until there is at least one”, and it means it — with no task type the Task box on the record form is empty and nothing can be saved.

Two more cards on the same screen, neither of them required to start:

• Audit firms — the list offered under Audited by on a client record.
• What an hour is worth — hourly rates, per person, per service, or per client and service. With no rate, time still records; it records at zero value. So if you intend to turn time into fees rather than just keep a record, set the rates now. There can be only one rate for the same thing from the same date: setting a second is refused — “A rate for … already exists. Remove it first, or choose a different date for the new one.” Setting and removing rates is recorded under What has been done, and by whom, naming who the rate was for and from when (not the amount). A rate is copied onto an entry when the entry is recorded, so changing a rate changes what future hours are worth and leaves hours already booked exactly as they are.

8.2 Recording your time

1. Timesheet → My time.
2. Enter the Date and How long in minutes (or the from/to times).
3. Choose the Client, Service and Task.
4. Check Period this belongs to (the work on March’s VAT return belongs to March).
5. Tick or untick Bill this time, add a Note, and click Record.

A closed month refuses hours, in both directions: you cannot book new time into one, you cannot correct or delete time already in one, and a measured clock cannot be confirmed into one — which is the case you will actually meet, since a clock run a fortnight ago is confirmed today. The refusal says the period is closed; whoever holds the owner’s address can reopen it for the one save (see 3.2).

Use Edit / Delete on your entries in the list below. Change From/To and click Show to see other dates. An entry that has reached an invoice shows the word invoiced where those two buttons would be, and the app refuses to touch it: “This time has been invoiced, so it cannot be changed. Raise a credit note against the invoice instead.”

What the app will and will not accept:

• Period this belongs to is optional, despite step 4. It takes 2026-03, 2026-Q1 or 2026.
• An entry cannot cover more than one day — “Split it across the days it covers.”
• From and To are HH:MM, and the end must be after the start. For work that ran past midnight, type how long it took instead of the two times.

If nobody has set a rate, the hours are still recorded — at a value of zero, not refused. The What an hour is worth card says so itself: “No rates yet. Time will record at zero.” So time booked before rates are agreed is kept, and simply worth nothing until somebody sets them.

If you hold the company to change, Record time also carries Rate (leave blank for the agreed one). Typing in it overrides the agreed rate for that one entry and nothing else. If you hold the company only to look at, the box is not offered at all — typing a rate is a change, not a look.

Whether you see rates at all depends on a tick-box an administrator sets per company (§10.3). Holding a company to look at shows you everyone’s hours for it; the Rate and Value columns appear only if and the figures was ticked for you. If those columns are missing and you expected them, that is the setting to ask about — nothing is broken.

Whose hours you may change. Your own, always. Other people’s only if you hold the company to change. Holding it to look at lets you see everyone’s time for that company — which is the point of being given it to review — but Edit and Delete on somebody else’s line are refused with “That is somebody else’s time.”, and so is recording an hour in another person’s name. That is true whether or not you also have the timesheet grant: until 2 October the two together let it through, and they no longer do.

If you tick “Bill this time”, the Client and the Service stop being optional — chargeable time has to say who it is for and name a service, so it can reach an invoice line one day. Leave the tick off and you can record internal work, training or admin against no client at all.

8.3 Time measured for you while a client’s record is open

You do not have to start anything. Opening a client’s record starts a clock, and closing it — or switching company, or signing out — stops it. Nothing is recorded by this: what you get is a line to deal with when you are ready.

Where it appears. Timesheet → My time, at the top, under Time measured, not yet recorded. Each line says the client, the date, the times and how long. While a record is open, the line at the top says which client is being timed now; it moves down to be dealt with once you close the record.

To record it:

1. Press Record… beside the line.
2. The form below fills itself in. The Client, the Date and the two times are greyed out — they came from the measurement.
3. Correct How long if the figure is not right.
4. Choose the Service and the Task, and check Period this belongs to.
5. Press Record this time. It joins your list below like any other entry, and can be edited or deleted from there.

To throw it away: press Dismiss and confirm. It will not be recorded and cannot be brought back. The practice keeps a note that it was dismissed.

Two things worth knowing:

• A line marked a guess means the record was left open with nobody working in it, so the app stopped counting half an hour after the last thing you did. The figure is the longest it could have been, not a measurement — correct it before recording.
• Short visits are not offered at all. Opening a client to check a phone number leaves nothing, by design.

To record a different day, or time against a client the measurement does not name, dismiss it and use the form as in §8.2.

8.4 Time you spent in the payroll app

The payroll application times you too, while a client’s payroll is open. When you leave it, it asks what you were doing and you write a line — “September payroll and the new starter”. That is what sends it here.

It then turns up under Time measured, not yet recorded, marked payroll, with your line underneath the client’s name. Record it exactly as in §8.3: press Record…, choose the Service and the Task, and press Record this time. Your line is already in the Note box — change it or leave it.

You do not have to fetch anything. Opening My time checks for you.

If you are an administrator, you may see a panel under the strip headed From the payroll app, not yet filed. It means one of two things:

• An employer nobody has matched to a client. Pick the client from the box and press This is the client. Everything waiting on that employer is filed at once, and you will not be asked about it again.
• A payroll sign-in with no staff record here. Add that person under Timesheet → Staff, tasks & rates, choosing their address under Sign-in. Their time arrives on the next check.

Nothing is lost in the meantime. Time that cannot be filed stays in the payroll app and comes round every time the screen is opened, until the question is answered.

Part 9 — Reports

9.1 The fixed reports

Open Reports and choose the report. They are not all the same shape, and it is worth knowing which you are on:

The controls change with the report, and only the ones that apply are shown. The client box appears on the client statement alone — the two revenue reports cover every client of the company in the switcher and cannot be narrowed to one. For revenue for a single client, use Build a report on Invoices and credit notes with a filter on the client, which will also let you choose the columns. The grouping box belongs to Revenue by period only; Revenue by client is one row per client over the period you chose.

To email a client their statement: Reports → Client statement, choose the client and the period, then click ✉ Email it. The box opens with the address on their record; change it if you must, and click Send. The statement is in the message itself — nothing is attached. If the address is not the one on their record, the app asks you to confirm before it sends.

9.2 Building your own report

1. Reports → Build a report.
2. What it is about — choose the kind of record (e.g. Invoices and credit notes, Costs, Time recorded).
3. Period — e.g. This year.
4. Only include — the starting filters are shown; remove any with ✕ or add more with ＋ Add a filter. Read them before you run it, because they are not all “exclude the drafts”: invoices and invoice lines start at Status is not Draft and Type is not Pro-forma, but Clients starts at Active is Yes, so inactive clients are left out, and costs and receipts start at Status is Posted, which quietly drops anything voided.
5. Show:
   • A list of records — tick the columns and choose the sort; or
   • Totals, grouped — choose what to Group by (e.g. client, month), what to Add up, the sort and a chart.
6. Click Run the report.
7. ⬇ Excel or ⬇ PDF to export.
8. Save as… to keep it; open it again any time from Open a saved report….

Saved reports belong to the practice, not to a company. Anybody who can run a report can see and run them, whichever companies they hold — that means anybody with Can change on at least one company, plus an administrator. If you have only Can look at access, or only the timesheet, the list is not shown to you: a saved report carries the values you filtered on, which are usually a client’s name or an amount.

Running one always reports on the company in the switcher, so the same saved report gives a different answer to different people. Only the person who saved it, or an administrator, can change or delete it; anyone else is told “Only the person who saved this report can change it.” If the person who saved it has since left the practice, it is an administrator’s to change — you are told “The person who saved this report has left, so only an administrator can change it.” New starts a fresh one, Save overwrites the open one, Save as new… copies it, and Delete removes the definition only — nothing it reported on is touched.

The limits, which the screen mentions only once it hits them: at most 5,000 rows or groups (the result line then says “showing the first N; the totals cover them all”, so the totals stay right), two groupings, twelve filters and six totals. With two groupings the chart draws only the first — “The chart shows the first grouping; the table has both”. A report on Clients has no period control at all, because a client is not dated.

Examples:

• Fees by client this year: Invoices and credit notes → This year → Totals, grouped → Group by Client → Add up Total fees → Pie chart.
• Costs by category by month: Costs → This year → Totals, grouped → Group by Month, then by Category → Add up Total net.
• Hours per client: Time recorded → Last month → Totals, grouped → Group by Client → Add up Total hours.

Part 10 — Settings (for an administrator)

10.1 Setting up a company

Settings → Company details, then:

• the profile, VAT quarters end in, What kind of firm this is;
• Services this company provides — ＋ Add a service (fixed or worked out each period);
• Where clients send the money — ＋ Add an account; mark the default. Somebody who holds the company only to look at sees the labels and the last four digits here, not the full details (3.1);
• Logo — Upload logo (JPG or PNG, up to 3 MB);
• Sending mail as this company — the mail server details, then Send test and Save mail settings;
• Directors & shareholders — the statutory register of who runs the company;
• Save Company.

A new company is added from the company switcher: ＋ New company….

What each setting actually decides

Fill in the VAT number before the first invoice leaves. It prints on every document, and an invoice that went out without it is corrected by a credit note and a re-issue, not by editing.

10.2 The company’s logo

Settings → Company details → Logo. Choose a JPEG or PNG file and it is used at the head of that company’s invoices, credit notes, receipts, pro-formas and quotations, on screen and in the PDF.

• One logo per company. A company with none prints its name instead — deliberately, since an empty box at the head of an invoice looks like a fault.
• Only JPEG and PNG, because those are the two the PDF writer can draw. A PDF or an SVG is refused with a sentence saying so.
• Delete takes it off. Documents already issued keep the logo they were printed with (see below).

If a logo is missing

If Settings shows Logo file missing, click Upload it again and choose the logo file. For documents issued meanwhile, open each and click Use the current logo.

10.3 Giving someone access

Settings → People & access. Under Add somebody, there are two ways to do it.

Email them a link — the one to use for anybody who is not sitting in your office. Fill in the name and the email address, leave the password box empty, and click Email them a link. They get a message with a Set your password link, choose their own password, and you never know what it is. The link works once and lasts three days.

Add with this password — type one (at least 12 characters), click the button, and tell them what it is yourself. It is not emailed and cannot be read back off the screen afterwards. Use it when the app’s own mail is not working, or when they are next to you.

A password you type for somebody has to be changed by them before they can do anything. When they sign in they set up their authenticator as everybody does, and then the app shows them one more screen: the password you signed in with was typed for you by somebody at the practice, so two people know it — choose one of your own. They type the password you gave them, then their own twice, and the app opens. Until they do, every screen is closed to them; there is no “later” button, because there would be nothing to go on to.

Nothing is asked of you. You do not need to tell them about the screen, and you cannot skip it for them. The point of it is the one thing a typed password cannot avoid: for as long as it stands, the password exists in two heads — yours and theirs — and this is where that ends. Accounts created with Email them a link never see this screen: the person chose the password themselves and nobody else ever knew it.

Then, on their card, tick their companies, choose to change or to look at, and click Save access. Remove stops them signing in; nothing they entered is deleted.

If you choose “to look at”, one more box appears: “and the figures”. Leave it unticked and that person sees the company’s recorded hours but not the hourly rate or what the hours are worth. Tick it for somebody reviewing the company — a manager or a partner. Leave it for somebody who has been given the company only to see what has been invoiced to their own clients: an hourly rate is what your practice charges, and it is not part of what they were given the company for. Every grant starts with the box unticked, including ones you set up before 2 October. The box does not appear for to change, because somebody who can alter the figures gains nothing from being unable to see them.

If Email them a link refuses and mentions APP_ORIGIN, the server has not been told its own web address yet and the link would point nowhere — whoever looks after the server sets it once, and the same setting is what passkeys need. Set a password here in the meantime.

If somebody has forgotten their password, or has left

Two buttons on their card.

Email a password link sends them a link to set a new one. Pressing it changes nothing straight away: their current password keeps working until they use the link, which lasts one day and works once. Use this one normally — they pick their own password and you do not have to know it.

Set a password myself asks you for one twice and sets it. You then have to tell them — and, as when you add somebody this way, they have to change it before they can use the app again. They sign in with what you gave them and are shown the screen that asks for one of their own.

Either way they are signed out everywhere at once, which is the point when somebody has left. Neither touches their second factor: somebody who sets a new password through a link is still asked for their code when they sign in.

If somebody has lost the phone they prove themselves with

Clear their second factor, on their card. They are signed out everywhere and will set up a new authenticator the next time they sign in.

It does not change their password — losing a phone is not losing a password. If they have lost both, use this and Email a password link. There are two buttons because they are two different losses, and doing both when only one was needed hands somebody more than they asked for.

You cannot use it on your own account: yours is under Settings → Your sign-in, which asks for your password as well. If they have no second factor set up, the app says so rather than pretending it did something.

When somebody leaves

Switch off their sign-in, on their card. They are signed out everywhere at once and cannot sign in again — an attempt gets the same “Invalid email or password” as a wrong password, so nobody can learn from the sign-in screen which addresses are real accounts.

Any password link still in their mailbox is cancelled with it, from 8 October. If you had emailed them a link in the last few days, that link stops working the moment you switch the account off. Before this it went on working for its full life — the password it set would not have let them in, but it would have looked as though it had, and the record would show a password being set on an account you thought was closed. You do not have to do anything: switching off handles it, and the audit line says how many were cancelled.

The account stays on the list, with their name and the date it was switched off. That is deliberate and it is the change from before, when the account was deleted outright: the audit trail records the address that did each thing, and without the account there was nothing left to say which member of staff that address had been. Their companies stay ticked too — nothing is reachable through them while the account cannot sign in, and a year later it is how you answer “what did they have access to”.

If they come back, Let them sign in puts it back.

Both ask you to confirm it is you first.

Changing somebody’s email address

On their card. It asks you to confirm it is you, as it has since 2 October — an address is how somebody signs in and where a password link is sent, so it is a permission rather than a detail.

From 8 October two more things happen when you save it:

• The OLD address is emailed. It says the address was changed, names the new one, and says what to do if they did not ask for it. It goes to the old mailbox on purpose: that is the one the person still reads. Nothing is sent to the new address.
• Every session on the account ends, exactly as it does when you change somebody’s password. They sign in again with the new address.

Correcting a misspelt name still sends nothing and signs nobody out. A notice for every typo is a notice nobody reads.

“Confirm it is you” is now a separate question from signing in

From 8 October, typing your code at the sign-in screen no longer counts as confirming it is you. So the first sharp act of a sitting — reading a client’s portal passwords, adding or removing somebody, downloading a copy of the practice, making a key for the accounting application — asks for a code even though you typed one minutes ago. A confirmation then lasts five minutes as before.

It is the same change in the payroll and accounting applications, so the three now behave alike. The reason is that the two are different questions. The code at the door says who is at this machine, once, for a session that can last a fortnight. These ask whether the person at the keyboard is still that person and meant to do this particular thing — which is the question worth asking when a machine is left signed in.

One thing to expect the first time. The code on your phone at that moment is the one you signed in with, and each code works once — so the box will refuse it and tell you so: “You have just used that code. Each one works once, and that was the code you signed in with — your authenticator app will show a new one within thirty seconds.” Wait for the next one and type that. Nothing is held against you for it: it does not count towards the attempts that lock your codes and nothing goes on the audit log, because it is not somebody guessing. If you have lost your phone, the box still offers I have lost my phone and a recovery code.

Setting up your authenticator does still count, so somebody on their first morning is not asked for a third code a minute after their first two.

Changing somebody’s email address asks too, from 2 October. An address is not a detail like a spelling: it is how somebody signs in and where a password link is sent, so being able to change one unasked was being able to take the account. Correcting a misspelt name still asks for nothing.

Make an administrator / Make them staff changes the role. The app will not let you demote or remove the last administrator, and will not let you remove your own sign-in.

A new administrator reaches no company — that is two presses now, from 11 October 2026. Press Make an administrator and they run the practice: the people list, the register, adding an account, the reference data. They reach no company’s clients, invoices or timesheet until you either tick the companies they should have, or press Give them every company on their card. Their card says “They hold no companies yet” in bold until you do, so nobody is left wondering why the app looks empty to them.

It used to be one press, and the reason it is two is worth one sentence: saving a role used to set the reach along with it, so an administrator limited to two companies could save their own card with the role unchanged — still administrator, which they already were — and come out reaching all of them. Adding reach is now always a button of its own, and the button asks who is pressing it.

Limit to certain companies… / Give them every company sit on an administrator’s card, from 9 October 2026, and are the answer to “I want them to run the practice but not to see that client.”

Click Limit to certain companies…, confirm, and from that moment:

• the company ticks appear on their card, as they do for anybody else — tick the companies they should reach and save;
• a company they were not ticked into answers “You are an administrator of certain companies only, and that is not one of them.” That covers its clients, its invoices, its timesheet and the portal passwords you keep for its clients;
• everything that is not about one company — the people list, the register, adding an account, the reference data — is theirs as before. They are still an administrator;
• they cannot widen anybody’s reach. Giving themselves every company back is refused, and so is ticking anybody into a company they do not hold themselves. That is the owner’s, or an administrator who already reaches everything.

And five more things they cannot do, from 11 October 2026. Each one was a way round the limit until it was closed:

• give more than they hold. In their own companies they can give up to their own level and no further — a viewer hands out viewer, a preparer hands out preparer, an approver any of the three. Anything higher answers “one of the levels named is above your own in that company”;
• save their own card’s companies. Save access on their own card is refused: “your own companies are not yours to change.” Ask the owner. (On the owner’s card and on an administrator who reaches everything this makes no difference, because their reach comes from the role rather than from the ticks.);
• touch an account that reaches further than theirs. Setting a password, clearing a second factor, sending a reset link, changing an email, changing a role, switching somebody off — all refused on an account that reaches a company they do not, or holds a higher level in one they share. The sentence says which. An account holding less than they do is still theirs to manage, which is most of the staff;
• take themselves off a team, or clear their own assignments, when that is what holds them to part of a company’s book. Adding somebody alongside themselves is fine;
• make a linked-application key for every company, or for a company they do not hold — on making one and on re-pointing an existing one. A key goes on working long after the person who made it has gone, so it cannot reach further than they did.

It signs them out. Both buttons end that person’s sessions, and both say so before you confirm. Reach is part of what a sign-in carries, so a narrowing that waited for their next sign-in would not be a narrowing yet.

The buttons are not on the owner’s card. The owner reaches everything and that cannot be turned off.

What a limited administrator can no longer reach, for a company they were not given (all of this since 9 October): the client’s stored portal passwords; deleting the company; deleting one of its clients; its Teams — reading them as well as changing them, since a team’s screen says which clients each person looks after; Clients they look after; giving somebody its timesheet; and its outgoing-mail settings. Since 11 October, its timesheet itself too — reading it and keying time into it — which was the one screen that still let any administrator into any company.

Two things need an administrator who reaches every company. Adding a company to the practice, and changing the practice’s own mail server — the one that sends sign-in codes and password links. A company’s own mail settings are different: those a limited administrator may set for a company they hold.

One thing stays whole for everybody: the register. The audit log, the access log, the uploads log and the alerts are not narrowed, and their lines name clients and companies a limited administrator cannot otherwise open. This is a known limit, not a bug — narrowing it means filtering every line rather than closing a screen. If that matters for the person you are about to limit, do not limit them.

They are the client’s own person marks somebody who is not yours — a client’s director or auditor, given a sign-in to see what has been invoiced to their own clients. They keep the one company you give them and everything in it; what they lose is the practice’s own settings, Deadline rules and Defaults. They hold one company, so the tick is refused on somebody holding two and a second company is refused to somebody ticked — untick them first. An administrator cannot be one. Ticking it signs them out, so it takes effect at once. Press it again to mark them as your own staff.

One company means one, by every route. The box below their card — may record time for — cannot be ticked for a company that is not theirs while they are marked this way; the app refuses it and says why. Their own company’s timesheet can still be given to them, which is the usual reason a client’s bookkeeper has a sign-in at all. And on a client’s window, where everyone else reads the names and email addresses of the staff looking after that client, they are shown the names only — the practice’s addresses are not theirs to have.

Hand ownership to them appears only on the owner’s screen, and only on somebody else’s card. One person is the owner: they can close and reopen months in every company, they can hand the role on, and nobody else can touch their account — not their password, not their address, not their second factor. Handing it on asks you to type the person’s name, signs everybody involved out, and leaves you an administrator; only the new owner could give it back. It is refused to an account whose sign-in is switched off.

The three levels beside each company are to change, and to close months (approver), to change (preparer) and to look at (viewer). The first is the one that can close and reopen that company’s months — see 3.2.

Underneath each person is may record time for. Tick a company there and they get the Timesheet for that company’s clients and see nothing else of it — no invoices, no money, no rates. It is separate from the companies above: ticking it gives the timesheet and nothing more. Click Save access to apply both lists together.

Ticking both does not add up to more than each. Somebody given a company to look at and ticked under may record time for still records only their own hours. They will see everyone’s time for that company, because that is what being given the company to look at means, but they cannot change or delete anybody else’s. Until 2 October the pair did let that through, which is worth knowing if you set up such an account before then — there is nothing to undo, but it could have been done.

This is only half of what they need. The tick gives them the module; it does not create the staff record the timesheet books hours against, so on their first visit they will find no form and the message about a sign-in not being linked. Add them under Timesheet → Staff, tasks & rates as well, with their address chosen under Sign-in — see 8.1. Two lists, two places, and both are needed.

(Add with this password here and Add person on Staff, tasks & rates are a genuine trap: the one here creates a sign-in, the other creates a person whose time is recorded.)

10.4 Backups

These are the owner’s. Taking a backup and restoring one can be done by the owner and by nobody else — not even an administrator, who sees the card explaining so and no buttons. The reason is the restore: it does not merge with what is here, it replaces it, including the list of who may sign in and who the owner is. So whoever can restore a file can decide who runs the practice. The alert settings and the file check on the same screen are unaffected and stay an administrator’s.

• Settings → Backup & restore → 💾 Download a backup: choose a passphrase (at least 12 characters), type it twice, and click Download the backup. Keep the passphrase safe — without it the backup cannot be opened.

• The nightly backup is emailed automatically. Its panel is headed The backup nobody has to remember, and it shows when one last ran and how big it was. ✉️ Send one now sends one immediately.

• The emailed backup does not use the passphrase you typed above. It is encrypted with one kept on the server, so restoring last night’s email asks for a passphrase this screen never showed you. Whoever looks after the server has it.

• The card below, Being told when something happens, is the alerting: ✉ Send a test alert is the only way to prove it works, and it refuses with “Nothing is configured” if no address has been set on the server.

• If the backup and its warnings go to the same mailbox, the panel says so (from 13 October 2026). That is one line on the backup panel, and it is worth reading carefully, because it describes the one arrangement in which a failure hides itself: the backup bounces off a full mailbox, and the email telling you it bounced is refused by the same mailbox for the same reason. Nothing is broken while that line is showing — it is saying what would happen. The fix is for whoever looks after the server: ALERT_EMAIL_TO in the server’s .env, set to a different address, ideally at a different provider so one outage cannot take both.

• A full mailbox is now retried. Up to three times that day, and only for a mailbox that is full — never for a file the mail server refused for any other reason. So emptying the mailbox in the morning means that day still gets its backup. The panel says attempt 2 of 3 today when there has been more than one.

• ↺ Restore from a file… replaces all data with the backup’s. Use only when you mean it.

  A copy of the current state is saved first, on the server, so that restoring the wrong file can itself be undone. From 9 October that copy is locked with your BACKUP_PASSPHRASE — the same one that opens the nightly backups, and not the passphrase of the file you were restoring. To undo a restore, restore that copy back through this same button and give it that passphrase. The server keeps the last ten and deletes any that are over thirty days old.

  It used to be saved readable, so that undoing never depended on remembering anything — but that meant a complete readable copy of the practice sitting on the server, which is what the security review picked up. The passphrase chosen is deliberately not the one belonging to the file you were restoring: if a file or a passphrase is what went wrong, the undo must not be locked behind it.

  If BACKUP_PASSPHRASE has never been set on the server, the copy is still saved — and from 12 October it is still locked, with a key the server keeps for itself rather than one you type. You undo a restore exactly the same way: pick the file and press the button, and this server opens it without asking for a passphrase. The one thing to know is that such a copy only opens on this server, so it is an undo and not a copy to keep elsewhere. The server says which of the two you have when it starts, and setting BACKUP_PASSPHRASE — the same one line that switches the nightly backup on — is still the better arrangement.

• If the backup fails, you will see it. The next time the owner signs in there is a banner across the top saying so, with the reason — and, if the email about it could not be sent either, it says that too. That matters, because the notice goes out through the same mail server the backup uses: when that is what has broken, the banner is the only word you will get. Not now puts it away until you sign in again.

10.4a Checking the uploaded files

Settings → Backup & restore → Uploaded files against the records → Check the files.

A backup holds what the database holds, which is file names. The logos, certificates, circular attachments, archived quotations and supplier invoice scans live in a folder on the server, and that folder has to be copied separately. When the two come apart you find out as a blank logo or a certificate that will not open.

Press Check the files and read the sentence at the top:

• Records naming a file that is not there — upload the file again on the record, or ask whoever looks after the server to copy the uploads folder across.
• If any of them are letterheads on issued documents, a Put the letterheads right button appears. One press stamps the company’s current logo on all of them. Invoices carrying an older logo that is still on the server are not touched. There is no undo: the press replaces the name of the old letterhead file, so once it is done those documents print with today’s logo for good. It has been used once on this practice, on twelve invoices in September 2026, and on 11 October 2026 it was decided to leave them that way.
• Files no record names — usually nothing to do. The screen never deletes them. A logo you have replaced will not appear here: its file stays because every invoice issued under it still uses it.

If you restore a backup, tell whoever looks after the server which date you restored to, so they can put the uploads folder back to the same night. Run this check afterwards.

10.5 Products (goods companies)

Settings → Products, on the card headed Products / Goods () — Products is the name of the section in the left column, the card carries the company’s name. Type a name, a unit price and the VAT rate, then ＋ Add Product. Edit on a row puts it back in the boxes and the button becomes Save changes, with Cancel beside it to back out; Delete removes it after asking. A product is only the starting point for an invoice line, so changing its price or deleting it leaves invoices already written exactly as they are.

Products belong to one company. Another company’s catalogue is its own; there is no shared list, because no two companies sell the same things.

Deleting a product does not touch an invoice. An invoice line keeps the description, the price and the VAT rate it was written with — a product is the starting point for a line and nothing more. So a price rise is made here and applies from the next invoice; everything already issued stays as the client received it.

Example. A case of wine is €48 and goes up to €52 in April. Edit the product in April. March’s invoices still read €48, which is what was sold and what the VAT return was based on, and April’s open at €52.

10.6 Deadline rules

Settings → Deadline rules holds the practice’s own filing calendar — the rules every client’s dates are worked out from. It is the practice’s, not any one company’s, so a change here moves dates for every client you act for.

Settings → Deadline rules: set Track deadlines from, edit a rule with Edit and Save rule, or Restore the shipped rules.

Remember these are shared by every company — the screen says so, and correcting a rule here corrects every company’s dates at once.

10.7 Defaults, and the app’s own mail server

Settings → Defaults holds two cards.

Global Defaults — the default currency, VAT % and payment terms used when a new document or client is created. Change them and press Save Defaults.

Mail from the app itself — and this one is worth reading properly, because there are two mail servers in this app and they do different jobs:

They are separate on purpose: a security code must never arrive claiming to be from one of your companies, and a mistyped company setting must never be able to lock you out.

Changing either one is an administrator’s, and asks you to confirm it is you. If you can work in a company you can see where its mail goes, and you can press Send test. Saving new details needs a code at the moment you save — because from then on every invoice and statement that company sends leaves through whatever is in those boxes, and nothing on screen would look different.

If the app’s own mail is not set up, three things fail quietly

This is the part nobody would guess. With that card empty:

• the nightly emailed backup does not arrive — and that is your only copy off the server;
• no alert on the Backup & restore list can send, whatever address they are pointed at, including the warning that a file named in the records has gone missing;
• sign-in codes cannot be emailed.

Nothing announces it. The backup card shows the last attempt, which may be weeks old, and the alerts card reports only whether an address is configured — neither mentions the mail server. So a practice can have every address set correctly and still hear nothing.

Filling it in

1. Server (host) — a host name only, e.g. smtp.example.com. Not a web address. Paste one out of a control panel and the save is refused, with the host name you should have typed written out for you.
2. Port and Encryption should agree: 465 with TLS from the start, or 587 with STARTTLS. Choose a pair that disagrees and a note appears under them as you type. It is a note and not a refusal — a mail server may offer encryption on whatever port it likes — but if a test fails, that pairing is the first thing to change.
3. Username and Password — the mailbox’s own. The password is encrypted and never shown again; leaving the box blank later keeps the saved one.
4. From name and From address — the address is required.
5. Tick Sending is switched on.
6. Press Save mail settings, then Send test — the box beside it already has your address in it. A line under the buttons says what happened.

Above the fields the card tells you its own history: “Never tested”, or “Last proved to work …”. Do not leave it on Never tested.

Once it works, go to Settings → Backup & restore and press ✉ Send a test alert and ✉️ Send one now. Those two prove the alerting and the backup separately, and each one lands in a different place from the test above. Check neither was filed as junk — that is the usual reason these go unnoticed.

10.8 Letting the accounting application read the invoices

Settings → Linked applications. Only an administrator sees this card.

The firm’s accounting application posts the invoices and credit notes issued here to its books. To do that it needs a key, made on this screen and pasted into it once.

A key can only read, and only four things: the companies and their VAT numbers, each company’s service names, the issued invoices and credit notes between two dates, and the client each was addressed to. It can change nothing here, and it can see no portal logins, no notes, no costs and no bank lines.

Making one

1. In What it is for, type a name you will recognise on a list in a year’s time. It starts on Accounting.
2. Stops working at the end of — a date, and from 9 October it is required. The box arrives filled in with a date a year ahead; change it to whatever suits. A date means the key works all of that day and nothing after it: 31 October works right through the 31st. You cannot leave it empty any more, and a date already in the past is refused — see the note under step 3 for why.
3. Choose what it may read. Neither is ticked to begin with, also from 9 October, and you have to pick one:
   • Let it read every company — the usual choice for the accounting application, which posts every company’s invoices.
   • Let it read only the companies ticked below — then tick them. A key set this way is refused any other company, and the companies it cannot read are not even listed to it.
   Why both are now asked for. A key is a password that goes on working after the password of whoever made it has changed, after their session has gone, and after they have left the practice. Until this change, a key with no date reading every company was what you got by not answering either question — the widest key the app can make was the easiest one to make. Nothing about the keys you already have changed: they go on working, and you can give one a date with Change whenever you next look at this screen.
4. Press Make a key.
5. The app asks you to confirm it is you — a code from your authenticator app, or your device’s fingerprint or face. This is why: a key keeps working after you change your password, so it is treated like downloading a copy of the practice.
6. The key appears in a box with Copy beside it. Copy it now. It is not shown again — only a fingerprint of it is kept, so a key that is lost has to be replaced.
7. Paste it into the accounting application on its own Invoicing link screen, in its Settings menu, along with this app’s address. The box shows you the address.

An email arrives at the app’s own address saying a key was made. If one arrives and it was not you, revoke the key it names straight away.

Example. The practice has four companies and the accounting application posts the invoices of all of them: make one key called Accounting, take the date a year out that the box offers, and tick every company. Put a note in your diary a fortnight before that date — though the app will tell you anyway, three times over. A bookkeeper outside the practice who needs only Softlemon’s invoices for the year gets a key called Softlemon bookkeeper, a date at the end of January, and Softlemon ticked and nothing else. When January ends, that key stops on its own and nobody has to remember it existed.

The list

Change opens the key’s own date box and company ticks underneath it. This is how you give a key that is about to stop — or one that already has — another year, without having to paste a new key into the accounting application. The same date box takes an empty value, which puts the key back to never stopping. Changing a key asks you to confirm it is you, exactly as making one does, and the change goes on the record as “Changed a linked application’s key”.

Revoke stops a key immediately, and the accounting application brings in nothing until a new one is made and pasted in. From 9 October it asks you to confirm it is you, like making or changing one. It used not to — the thinking was that it is the emergency brake and should be quick — and what that missed is that somebody using a borrowed session to revoke a key breaks the link between the two applications with nothing on screen to say why, because a revoked key looks exactly like one you meant to revoke. It still only costs one code. A revoked key stays on the list marked Revoked, so the record of what it did still has a name attached.

Being told before a key stops

This is worth reading even if you never set a date, because of what an expired key does: nothing visible. The app refuses it in exactly the same words it gives a key that was never real — deliberately, so that somebody who finds an old key is not told it was once genuine — so the accounting application simply brings in no invoices and says nothing about it. The first sign would otherwise be a month-end that will not reconcile.

So the app says it, in three places, about any key with a date on it:

1. A banner on the way in, from a fortnight before the date and again once it has passed. It names the key, says what happens, and has Open linked applications on it. Not now puts it away until you next sign in.
2. The Dashboard’s list of things to do, tagged Linked app, among the deadlines and the unpaid invoices. It shows whichever company you have in the switcher, because a key belongs to the practice rather than to one company. Clicking it brings you here.
3. An email, to the same address the backup notices go to. Once when the fortnight starts, and once more when the key actually stops — two different pieces of news — and not again in between, however many times a day the app checks.

All three are the administrator’s only. And a key you have revoked says nothing at all: you stopped it on purpose, and a warning that it is about to stop would be a message about a decision you already made.

Giving a key a new date starts the warnings again, so a key extended by a year warns you afresh when that year is nearly up.

Seeing what a key has taken

Last used holds one date and is written over each time, so it tells you the key is alive and nothing more. For what it actually read, go to Settings → People & access → “What has been done, and by whom” and look for “A linked application read the invoices”. Each line names the key, the range of dates it asked for and how many documents went. The person on those lines reads nobody signed in, which is right — the accounting application has no account here.

10.9 Teams — who looks after which client

Until now, giving somebody a company gave them every client of it. Teams narrow that, one company at a time.

The one thing to remember before you start:

Somebody with no team and no client of their own sees every client of the company, just as before. Nothing is narrowed until you put a client on a team.

That means nothing changed for anybody on the day this arrived — and it also means that forgetting to put a new junior on a team leaves them with the whole book.

Making a team

1. Check the company switcher at the top right is on the company you mean. A team belongs to one company.
2. Settings → Teams.
3. In the box at the bottom, type a name — Audit, Payroll, Maria’s clients — and click Add team.
4. It appears with 0 people · 0 clients. Nothing has changed yet: an empty team narrows nobody.

Saying who is in it and what it does

1. Click Who and what on the team’s row.
2. Tick the people on the left and the clients on the right.
3. Click Save team.

Example. The practice has eighteen clients. Maria does six of them. Make a team called Maria’s clients, tick Maria on the left and those six on the right, and save. From then on Maria’s client list shows six names, her invoice list shows only their invoices, the compliance list only their filings, and the search box finds only them. If she types another client’s address into the browser she is told “That client is not one of yours. Ask for it to be added to your team.”

The same goes for one of their records. An invoice, quotation, to-do or expense belonging to a client outside her team is refused whichever way she comes at it — opening it, printing it, editing it, emailing it or deleting it — and not only when she browses to the client. An invoice that names no client is nobody’s and stays open to everyone in the company, as does the practice’s own to-do list.

Giving one person one extra client

Settings → People & access → Clients they look after (on that person’s card). It lists the clients of the company in the switcher; tick the ones that are theirs and click Save their clients. These are on top of whatever their teams carry.

Saving this only changes this company’s part of their clients. It cannot disturb what they were given in a different company.

Who is never narrowed

• the owner;
• an administrator who reaches every company — one limited to certain companies is narrowed by teams inside those companies like anybody else;
• the approver of that company — the person who closes its months. They stand behind the work, so they see the whole company whatever team they are in.

A company they have no team in

Untouched. If all of Maria’s teams are in the practice company, she still sees every client of any other company she holds.

A client billed by two of your companies

They reach it in the company they are working in. New on 12 October 2026, and the opposite of what it used to be.

Say Shared Ltd is billed by both the practice company and Kweller Ltd. Maria is on a team in the practice company and Shared Ltd is not on her list there; in Kweller Ltd nothing narrows her. With Kweller Ltd in the switcher she opens the client as usual. With the practice company in the switcher she cannot, and it is not in her client list either.

Before this, she reached it from either — so a team that took a client off somebody had not really taken it off them if they held another company that billed the same client. That is not what anybody setting up the team thought they were doing. If somebody should see a shared client in a particular company, put it on their team there.

Switching a team off, and deleting it

• Switch off suspends the team but keeps its clients. Its people get the whole company back until you switch it on again — the app says so when you press it.
• Delete removes the team. Its people keep their sign-ins and go back to seeing every client of the company, unless another team still narrows them.

Seeing who looks after a client

Open the client. Under Who looks after them, and whether they are also one of ours it names the people and the teams — or says Nobody in particular. Everybody who holds this company sees this client.

10.10 Who changed a figure, and when

Settings → Company details → The record of changes lists what has changed on the money records of the company in the switcher — the before and the after, not just the fact that something moved.

The audit log (10.11) records that a thing happened and deliberately never records values. This is the other half, and it answers the question the audit log cannot: this invoice says €500 now and it said €590 when the VAT return was filed.

• What it covers: amounts, dates, VAT, treatments and statuses on invoices and other documents, on costs, on cash receipts and on recorded time.
• What it does not: a supplier’s name changing is recorded as having changed and no more. This never becomes a second copy of the client book.
• The newest sixty lines, newest first. There is no filter on this list — see the note below.

Cash receipts joined this list on 14 October 2026, and the sentence above said they were on it before they were. Recording a payment writes two things: the receipt document, and the row that says money arrived in a particular account on a particular day. The second one is what a bank reconciliation reads, and neither it being created nor it being deleted left any line here. So a receipt could be deleted — which correctly takes that row with it — and nothing anywhere said the money had stopped being there. Both are recorded now: “Receipt created” when a payment is taken, and on a deletion the amount, the date and the status, which afterwards are the only copy.

No filter, and the manual said there was one. This list showed the newest sixty lines with no way to narrow them, and the two bullets above claimed a filter by kind and by period until 14 October 2026. The list is the truth and the sentence was wrong. Whether to build the filter is on the practice’s own list of things to decide; a busy company can push the line it wants off the end of sixty.

Example. A client queries their statement. Open the invoice’s row here and you can see that the total was changed from €590 to €500 on 14 March by a named person — which is the answer, and it took a minute rather than an afternoon.

10.11 What has been done, and by whom

Settings → People & access → What has been done, and by whom is the practice’s audit log: sign-ins, failed sign-ins, accounts added and switched off, access changed, portal passwords read, backups taken, periods closed and reopened, keys made and revoked.

Filter by event, by person and by period. Every line names who, when, and what it was about — never the value, which is the rule that keeps this table safe to keep for years (see 10.10 for the one that does record values).

Each line is sealed, from 12 October 2026. A second or two after it is written, a line is given the next number in a chain and a fingerprint made from itself and the fingerprint of the line before it. Change a line in the database afterwards and the fingerprint stops matching; take one out and the next line no longer points at the one before. So the claim that this log cannot be edited is now something the app can check rather than something you have to take on trust.

Three things worth knowing:

• It makes a change visible; it does not prevent one. Nothing in the app edits or deletes a line, and that was already true. This is about somebody going round the app and into the database.
• The fingerprint is made with a key kept in the server’s settings and not in the database, so somebody who can reach only the database cannot make a changed line match again.
• Once an hour the newest line’s number and fingerprint are written to a small file on the server, outside the database. That is what catches lines deleted from the end — a shortened chain is still a perfect chain, so nothing inside the database could tell.

Nothing to do, and nothing changes on this screen. The check is read by whoever looks after the server for now, on the diagnostics page; the Security events screen that puts it in front of you is the next step. If a line ever does not hold, the answer names it by number and date — take a backup at once, keep it, and tell whoever looks after the server.

And thirty acts now refuse to happen if their line cannot be written, from 12 October 2026. Until now, if the log would not accept a line, the app went ahead with the act anyway and said nothing. That was the right choice for almost everything on this screen — a sign-in that failed to be logged is still a sign-in, and refusing it would lock everybody out of the building over a bookkeeping problem. It is the wrong choice for a short list where the line is the whole point:

• somebody’s sign-in created, changed, switched off, handed the practice, or sent a password link; their second factor cleared; their access changed
• a team created, changed, switched off or deleted; a member added or removed; a client put into or taken out of somebody’s portfolio
• a timesheet grant given or taken away
• a linked-application key made, re-scoped or revoked (12.6)
• a client deleted, and a company deleted with the clients that went with it
• a company’s bank account added, changed or removed (3.1) — which was recorded nowhere at all before today
• the practice-wide settings changed (10.1)
• a backup downloaded, emailed or restored (10.9), and the stored-password key rotated (10.12)

For those, if the line will not write, nothing happens. You see:

This was not done, because the record of who did it could not be written. Nothing has changed. Tell whoever looks after the server — the audit trail is not accepting lines, and until it is, the things that are kept on it cannot be done.

It is not something you did wrong, and trying again will give the same answer until the server is seen to. Everything else in the app keeps working normally; only the list above waits. If you get this message, pass it on rather than working around it — and do not be tempted to do the same thing a second way, because the first way genuinely did not happen.

Why the bank account is on that list is worth a sentence. Changing an IBAN on a live account breaks nothing, shows on no screen anybody looks at twice, and prints on every invoice from that moment — so the money goes where the new number says. The only way anybody finds out is a client paying on time and the practice not receiving it, weeks later. From today the trail says when the number moved and who moved it; it does not hold the number itself, as nothing on this screen ever does.

10.11a Security events

Settings → Security events. New on 13 October 2026, and it is the screen the sealed audit trail was built to be read on.

The owner and every administrator can open it — unlike the full audit log above, which stays with whoever looks after the server. That is possible because this screen is narrower, not more widely held: the two lines that record who read or changed a client’s portal passwords are deliberately not on it. Leaving them out is exactly what makes the rest safe to put in front of every administrator.

At the top: does the audit trail hold? One of three answers, in words —

• The audit trail holds, with how many lines are sealed and which is newest. This is the answer you want and the one you will almost always see.
• The audit trail does not hold. Nothing in the app changes or deletes a line, so this means something outside it has. Take a backup at once, keep it, and tell whoever looks after the server before doing anything else.
• The trail could not be checked just now. The events below are still what was recorded; it is the seal that could not be read.

Below it, the events, newest first, for the last 30 days. Three kinds, and you can show one at a time:

If you are an administrator of certain companies, you see everything that belongs to the practice rather than to a company — a lockout, a refused second factor, the state of the trail — and, of the rest, only what belongs to a company you hold. The screen says so rather than leaving a short list to be read as “nothing happened”.

A note goes out by email once a week, and only when there is something worth looking at: the trail not holding, a password that was right with a second factor that was not, one address working through a list, or a backup that did not happen. A quiet week sends nothing at all — which is the point of it, so that an email from it always means something. It goes to the same address the alerts go to.

Nothing on this screen can be changed, deleted or hidden. It is a window on the register, not the register itself.

10.12 The key that protects saved passwords

Settings → People & access → The key that protects saved passwords.

Clients’ portal passwords (4.3) and the mail passwords are encrypted before they are stored. This card is about which key does the encrypting.

If no key of its own is set, they are encrypted with the same secret that signs the sign-in cookies. That works, and it ties two things together that should not be tied: replacing that secret — a perfectly ordinary thing to do — would quietly make every saved password unreadable, and you would find out one client at a time.

Giving them a key of their own is done once and takes a minute. The card says which state you are in and what to do about it. It is the server’s setting, so the change itself is made by whoever looks after the server; this screen is where you see whether it has been done, and where any passwords that cannot be read are counted.

A count of unreadable passwords above nought is the one thing to act on here. It means the key in use does not open what is on file, and the screen that shows a password draws an unreadable one exactly like an empty one — so without this line nobody would ever know.

10.13 Checking the server itself

/api/diagnostics — open it in the browser while signed in as an administrator, by putting that on the end of the app’s address.

It is not a screen, it is a page of plain facts, and it exists for the two questions anybody actually asks about a sick server:

• backup — did last night’s backup run, and what did it say.
• schema — does the database still have everything the app is written against. ok is what you want to see; where it is not, it names the missing tables and columns. This is the check that would have saved five days in October 2026, when a table was missing, the migration journal said otherwise, and the only symptom was the nightly backup failing with a reference number.
• migrations — which database updates have been applied, by name, newest last. A half-applied deploy shows here as a list that stops short.
• buildId — which version is actually running, as the commit it was built from. This is the answer to did my deploy land, and it is the question to ask first when a change somebody reports as missing was definitely made.
• alerting, uptimeSeconds, rssBytes, diskFreeBytes — whether warnings can leave the building, and whether the machine is healthy.

Send the whole page to whoever looks after the server when something is wrong. It contains no client data of any kind.

Nothing reaches the server untested. A deploy is started by hand, and before a single file is copied the types, the tests and the build all have to pass; if any of them fails, nothing moves and the version you are using carries on serving. The Handbook’s §12.5h says what each of the three would catch — worth a read once, because it is also the explanation of why a change sometimes takes an hour longer than it looks like it should.

10.14 A client who is also one of your own companies

Sometimes the same business is both: you invoice Kweller Ltd as a client of the practice, and Kweller Ltd also issues its own invoices out of this app as a company. Two records, one business.

1. Open the client.
2. Under Who looks after them, and whether they are also one of ours, use This client is also our company and choose the company.
3. Save the client.

That company’s Settings → Company details then says This company is also kept as the client …, so whoever opens either record knows about the other.

It does not give anybody access to anything. Who may open that company is still decided on People & access. Only one client record can claim a given company; a second one is refused, naming the client that already has it.

Part 11 — Common messages