Everything a company uses, it's all here.

Quotes and orders each have their own state machine. Which status may move to which is fixed in code, and illegal transitions are rejected by the backend. A shipped order can't be voided, for instance, because stock has already moved; that calls for a reversal, and the document stays.

Clients confirm online

Generate a login-free link to email the client; they accept or decline themselves and can add a note. The decision enters the audit chain with its timestamp and source IP.

The link is a limited grant

It expires, it maps to that one quote, and it can only be answered once. Even if the link leaks, all it can do is show that one document.

Expiry handled for you

Quotes past their validity are marked expired automatically; ones about to expire send you a reminder to follow up, once per quote.

One click to an order

Accept, then convert to an order with amounts and line items copied across. Later edits to the quote never affect an order already placed.

Copy a previous document

Issuing the same document every month doesn't mean building it again. What's copied is the snapshot at the time. If the product's price or name changed later, the copy keeps the original.

Print and send

Quotes print or save as PDF, laid out as a document rather than a screenshot of a web page.

The outstanding balance is always computed live as “order total − payments received”, never stored in a cached column. A cache drifts from its source, and “the books say paid while the money never arrived” is far worse than being slightly slower.

Dashboard

The first screen after signing in: invoiced this month, total outstanding, overdue, quotes to follow up, products with negative stock, and the countdown to the next filing.

Receivables ageing

Grouped by client into 1–30, 31–60, 61–90 and 90+ day buckets, so you can see who to chase first. Expand for individual documents.

Client statements

Produce a statement for a chosen period with opening balance, the documents and payments in it, and closing balance. Prints ready to send.

Recording payments

Cash and bank transfers are entered by hand; ECPay online payments are written in automatically once the amount checks out.

Quantity on hand is not stored in any column; it is totalled live from the movement ledger. That makes “the cached number and the ledger disagree and nobody knows which is right” impossible.

The ledger is the truth

Receipts, issues and adjustments are each a movement record, append-only. A mistake is corrected with a reversing entry, not an edit.

Shipping is never blocked

When stock is short, negative quantities are allowed and flagged in red. In reality the goods may already be gone, and blocking only makes the books diverge from the warehouse.

Purchase vouchers

Enter a purchase invoice, optionally receive the stock at the same time, and it counts towards input tax on Form 401 automatically.

Integrated with ECPay for online payments and e-invoicing. Payment callbacks verify the signature and also re-check the amount against the local order before the status changes; verifying the signature alone means trusting the numbers the other side sent. (The integration follows ECPay's public documentation and has not been verified with real transactions in the sandbox.)

Online payments

Generate a payment link; once the client pays by card or transfer, the order and payment records update automatically.

E-invoices

Issue an invoice from an order, with carriers and donation codes supported. Invoices are always issued in TWD (as the law requires); foreign-currency orders use the rate stored on the order.

Voids and allowances

Issued wrong? Void and reissue. Partial refunds or after-sale discounts get a sales allowance, which reduces output tax in the period it is issued, with no need to reopen the previous one. (Allowances are currently recorded and taxed locally only, not yet transmitted to the tax authority.)

No separate reporting tables. Output tax comes from issued, non-voided invoices and input tax from purchase vouchers, recomputed on every query, so the report cannot disagree with the documents.

Tax categories kept apart

Taxable, zero-rated and exempt are totalled separately from the tax-category snapshot on each line, each with its own subtotal.

Allowances deducted automatically

An allowance is apportioned across the original invoice's tax categories; the last rounding cent has a defined home, so the categories always add back up to the total.

CSV export

Export the CSV for the 401 filing. The export neutralises spreadsheet formula injection, so no dangerous string goes straight into Excel.

Filing countdown

The dashboard shows the next deadline and the days remaining, in red inside the last week.

The usual approach at filing time is to give the accountant your login. That hands over every permission along with the credibility of your audit trail, and after that no entry can say who did what.

By invitation

Send an invitation link; the other person joins with their own account. The link is bound to an email address, expires, is single-use and can be revoked.

Three roles

Owners manage members; accountants read and write documents and reports but can't touch membership; read-only can only look.

Removal takes effect at once

A removed member loses access immediately, with no waiting for a token to expire.

Everyone's actions stay distinguishable

Because each person uses their own account, the activity log can actually answer “who did this”.

If append-only is only a promise, then it is only a promise. Anyone with write access to the database can quietly alter one row and nobody would ever notice, unless the records can prove themselves.

Hash chain

Every audit record folds the previous record's hash into its own. Change any one and every record after it stops matching; delete any one and the sequence has a gap.

External witness (not yet enabled)

A chain alone doesn't stop someone with write access from recomputing the lot, so the chain head has to be deposited periodically with a third party the platform doesn't control. The mechanism is implemented, but the staging deployment isn't connected to an external endpoint yet. For now there are only local checkpoints.

You can verify it yourself

The activity log shows the verification result and the time of the last external witness, and states plainly what it can and cannot prove.

If an administrator reads your data, you'll know

Platform administrators may not access business data; retrieving any requires a written reason, the access itself becomes a record, and you are notified.

Companies are fully isolated

Queries on business data get the company identifier enforced at the data-access layer; the few cross-table aggregations (reports and tax) add the condition themselves by rule, covered by dedicated cross-company isolation tests.

Account security

Passwords are hashed with argon2id; failed logins lock the account; platform administrators support TOTP two-factor, with the secret stored encrypted and backup codes stored only as hashes.

Tax ID lookup

Enter a business number when creating a client and the company name and address fill in, so fewer invoices carry the wrong name. Not finding one never blocks you.

Multi-currency

Foreign-currency documents store the rate at the time of issue, so later rate moves don't change an issued document. Reports and filings always total in TWD.

Mail service

Guided setup to connect your own domain to a third-party mail provider (Cloudflare, Resend, Postmark) and record forwarding rules. I deliberately do not run a mail server of my own. That means IP reputation and bounce complaints, wildly out of proportion for a one-person company. Sending and receiving stay with the provider.

In-app notifications

Anything you need to know, such as a quote about to expire or an administrator accessing your data, stays in the system with a timestamp and a read state.