Payroll

Run the month: attendance, variable pay, and the payslips it produces.

Payroll turns a month into payslips: who was at work, what they were owed on top of their salary, what the law takes off, and what lands in their bank account. The KPI bonus you calculated in a cycle is one line on that payslip — payroll is the rest of the month around it.

Admins only

Every payroll screen requires the payroll permissions, which only an Admin holds. That is deliberately stricter than bonus targets, which a Manager can set: this surface shows salaries, bank accounts, and tax positions for everyone.

Before the first month

Two things have to exist before a month can be opened:

A payroll policy— your country’s rules as numbers: the attendance codes you use, overtime multipliers, insurance rates, the tax bands, and the reliefs. It is dated, so a rate change next year is a new version rather than an edit to history.
Pay termsfor each person — base salary, allowances, dependents, insurance regime, bank details. These are dated too: a raise is a new version from the day it takes effect, never an edit that rewrites last month’s payslip. When someone leaves, their latest pay terms carry their last day: they are paid up to it and no further, and from the next month they are no longer on the payroll.

Running a month

Open the month. You pick only the month; the dates and the working-day count are worked out for you.
Setup. Mark the paid public holidays, and tick the KPI cycles whose bonus this month pays.
Attendance.Record only the exceptions — leave, sick days, unpaid days, a Saturday that was worked. Anything you don’t mark counts as a normal working day, a weekend, or a holiday automatically. Confirm each person’s month even when there is nothing to record: that is how the screen knows someone has looked at it. When the Leave module is on, approved leave is already filled in for you — see below.
Variable pay. Add the one-off lines: a bonus, an advance being repaid, a severance, a charitable donation. Each line says what it is (income, deduction, or tax relief) and whether it is taxable and insurable.
Run payroll.Your browser calculates one payslip per person, and the server checks the result before it freezes it — together with the policy it used — onto the month. If the month’s data changed while you were running, nothing is saved and you simply run again. You can re-run as often as you like while the month is a draft.
Review, lock, approve, mark as paid. Every figure on the review table opens up into the arithmetic behind it, so it can be checked against whatever you used before. Before an approver can approve, their own browser recalculates the whole month and compares it with what was frozen: a payslip that does not follow from its own inputs blocks approval, and data that changed since the run asks for an explicit acknowledgement.

Attendance from approved leave

If your company uses the Leavemodule, an approved leave request writes its days into the attendance grid of that month’s draftperiod (using the day code of the leave type) and fills the leave brought forward / carried forward balances. Those cells carry a small “From Leave” marker. A period opened later picks up the leave already approved for it.

Manual edits win. If you change a marked cell, your value stays; the marker disappears once the cell no longer matches the leave request.
Once the month is locked, nothing is written. Leave approved or cancelled after that is not applied; the leave screen tells the requester to adjust attendance by hand.
Re-sync approved leave (on the attendance step, and under Leave policy) re-applies every approved request and the balances of a draft month. Careful: it overwrites manual edits you made to those days after the leave was approved.

Why payroll waits for the KPI cycle

A month will not run while a KPI cycle it pays is still open, or while any result in it is awaiting review or disputed. Both checks matter: an open cycle can still be recalculated underneath a frozen payslip, and an undecided result is exactly the case where the bonus is still being argued about.

Reopening a month

Reopening deletes the payslips

Returning a locked or approved month to draft deletes the frozen payslips, because anything issued from them — a payslip, a transfer list — is now wrong and has to be reissued. Documents are built on demand from the payslips, so nothing old is kept: the next transfer list is made from the next run. A month marked as paid is never reopened: correct it in the next month, which is also what tax and insurance filings expect.

Documents: register, payslips, bank list

Once a month is locked, the Review tab offers three documents. Each is built in your browser from the frozen payslips, so it always matches what was calculated. Nothing is stored on the server — build it again whenever you need a copy.

Payroll register (Excel) — one row per person with every figure behind their pay. The money is stored as numbers, so it can be summed and re-checked against another tool; the totals row is the sum of the rows above it.
Payslips(print or PDF) — one page per person, written in your company’s language rather than in the language of whoever pressed the button. It opens your browser’s print dialog; choose Save as PDF to keep a file.
Bank transfer list(Excel) — who gets how much, to which account. Anyone who is owed money but has no bank details is listed on a second sheet, with the reason, instead of being left off silently. The total to transfer plus what is set aside always equals the month’s total net pay.

The bank list waits for approval

The register and the payslips are available as soon as the month is locked. The bank list is the instruction to move money, so it only becomes available once the month has been approved, and only to someone who can manage payroll — the server withholds the bank details until then, so it cannot be produced from a run nobody has signed off.

Bank details come from each person’s pay terms as they stand at the endof the month, so an account changed mid-month is honoured. If a person’s newest pay terms have no bank details, they are flagged rather than paid to an older account.

Payslips for your team

Under Settings → Permission control, an Admin can let every person open their own payslip. It is off by default.

A person sees only their own, and only for months that have been marked as paid. A month that is merely approved can still be reopened, which would withdraw the payslip — so it is never shown early.
When you mark a month as paid, each person is notified that their payslip is ready. The notification names the month and nothing else — never an amount.
They can print their payslip, or save it as a PDF from the print dialog. It is built in their own browser from what the page already shows; nothing is stored.
What a person sees leaves out the employer’s side — the employer’s insurance and union levy are company costs, not part of their pay.

Turning it on after paying

If you switch the setting on after a month was paid, people can open that month’s payslip straight away, but they are not notified about it — the notification is sent when the month is marked as paid.

Reading your payslip: turning it on and your payroll key

Payslips are encrypted, so before you can read yours your browser needs your payroll key. Turning it on takes one click.

Turn on. Press Turn on. If your device supports it, the browser creates a passkey (fingerprint, face or security key); it always creates a backup code and shows it once. Save it in a password manager or print it. You are asked for it only on a new device, or when the passkey is not available. Nobody can recover it for you.
Staying signed in. A device you turned it on for stays open to your payslips for 30 days of use — the 30 days start again each time you use it, and there is no idle lock on that device. The checkbox Remember on this device for 30 days on the unlock screen is ticked by default.
Forgetting a device. Signing out of the app removes the remembered key from this browser at once, for every company in this browser. You can also press Lock and forget this device in the Your payslip key card on the Payslips page (payroll admins also have it on the Payroll security page); it locks your key in every open tab and forgets only this device.
New device or cleared browser data. Use your passkey, or type the backup code into the box labelled Passphrase or backup code— capital letters and dashes don’t matter. The first time on a new browser you need no number from your admin.
Lost both? If you lost the backup code and the passkey, choose Start over with a new keyon the Payslips page. Your admin then has to confirm the new key and send your old payslips again, because they can’t be read with the old key.
Verification link. Under your key, the card shows your 30-digit Safety number and a Send to my payroll admin button that shares or copies a link. Send it through chat or a call — it is only needed when your admin asks to confirm you by hand; new employees are usually confirmed automatically. The number appears only while your payroll key is unlocked in this browser.

On a shared computer

Untick Remember on this device for 30 days before you unlock, and sign out of the app (or press Lock and forget this device) when you finish. Otherwise the next person to use that browser can read your payslips.

“Your payroll key was replaced or removed somewhere else”

If you see “Your payroll key was replaced or removed somewhere else. If you did not do this, tell your payroll admin now.” and you did not start over yourself, stop. Tell your admin and do not keep using that browser session.

Payroll security: confirming employees

On Payroll → Security, the Members’ keys card lists every employee who set up a key. Payslips are only ever sealed to a key you have confirmed belongs to the right person.

Automatic.An employee’s key is confirmed for you when an admin with payroll:manage has the payroll key unlocked on a payroll page, the employee has no payslips paid yet, their key has never been confirmed before, and they are not a key holder. Nothing is sent and nothing is shared — giving access (Distribute) is still your click.
By hand. For anyone else — an existing employee enrolling for the first time, a changed key, a rotation leftover — the row says why: not confirmed because payslips were already issued, because it was confirmed before the last rotation, or because the key is not the one this browser saw before. Open the link the employee sends with Send to my payroll admin. It opens the right row with the number filled in and shows the person’s name and email.

Where the link must come from

Continue only if that person sent the link through chat or a call. Never trust a link inside an email the system sent. The number is still compared with the key the server shows — the link proves nothing by itself.

The badges on each row:

Confirmed automatically — confirmed under the rule above.
Verified — a number was matched against the key on this browser.
Confirmed and Pending(“Not confirmed yet”) — whether an admin has confirmed the key.
Blocked on this browser — a Verify check did not match, so this browser shares nothing with that key. Treat it as a possible swapped key: ask the employee to start over, confirm the new key from their link, and ask who can write to the database.

Verify is local to your browser, and so is its history. The switch Confirm new employees automatically on this browser is on by default; it is a setting of this browser only, not a company-wide policy.

What the figures mean

Days paid: Days worked, plus paid leave, plus paid non-working days like a public holiday. This is what salary is prorated on.
Working days: The month’s business days. Public holidays are deliberately not subtracted — a holiday is paid, so it stays on both sides of the proration.
Contribution base: The pay that social insurance is calculated from, before any statutory ceiling.
Assessable vs taxable income: Assessable is income after the tax-exempt allowances; taxable is what is left after personal, dependent, and other reliefs. Tax is charged on the taxable figure.