Give Each Person Exactly the Keys They Need, and a Record of How They Used Them

Permissions per action, not per job title

Every meaningful action in E-Khata has its own permission key: view purchase prices, edit tax on a posted invoice, approve a stock movement, collect at the counter, refund at the counter, file to FBR, issue a customer portal link, export a ledger. There are more than 250 of them. A role is a named bundle of keys, and the effective view shows exactly what a person ends up with after roles and overrides, so nobody has to guess.

• +252 permission keys across every module, including reports one by one.
• +Roles you define, clone and edit; an effective-permissions view per user.
• +Sensitive fields such as purchase price and margin hidden by key, not by hope.
• +Drafting and posting are separate keys, so juniors prepare and seniors post.

Narrowed per branch

In a multi-branch business the same role should not reach as far everywhere. Branch rights set a policy per branch, override what a role grants at that branch, and hold branch-level settings, so a manager runs their own branch fully and sees the others not at all. Head office keeps the wide view.

• +Per-branch policy and per-branch role overrides.
• +A user's reach ends at their branch unless head office widens it.
• +Consolidated views stay with head office.

Invite in minutes, sign in the way they already do

Send an invitation and the person joins the business with the role you chose. They sign in with email, a username, Google, or a phone number with a one-time code, and a lost-phone flow recovers an account without a call to support. Nothing to install for the web; the desktop and Android apps use the same account.

• +Invitations with a role attached, revocable until accepted.
• +Email, username, Google and phone OTP sign-in.
• +Lost-phone recovery flow.

Discount limits and device approval

Two controls that matter more in a shop than in a textbook. Per-user discount limits cap the percentage and the amount a person can give on a document, enforced at the point of entry, with an exempt flag for the owner. Device access records the devices each user signs in from, lets you require approval for a new one, and lets you cut a device off without touching the account.

• +Maximum discount percent and amount per user, enforced or advisory, with exemptions.
• +Device approval on first sign-in from a new device, with schedules if you want access limited to shop hours.
• +Cut off one device; the rest of the team is untouched.

An audit trail with a before and after

Every edit to a document is written to the amendment log with the document as it was, the document as it is now, the user and the time. A separate user activity log records sign-ins, permission changes and actions that are not document edits. Both are reports in the library, both filter by user and date, and both export, which is what an auditor asks for on day one.

• +Audit / Amendment Log with before-and-after snapshots, restricted to owners and admins.
• +User Activity Log across every module.
• +Export to Excel or PDF.

Sign-in and account safety

The sign-in screen asks for a phone number and a 4-digit passcode, with no code to wait for. A new account needs only a phone number: a 6-digit code arrives on WhatsApp, with an SMS option for a number that has no WhatsApp, and the passcode is chosen right after. Once an email is added and verified, the same passcode signs in with the email too. Changes to the things that open an account are guarded, and the owner of the account hears about every one.

• +Passcodes that are easy to guess are refused: repeated digits such as 1111, runs such as 1234 or 4321, patterns such as 1212 or 1122, and the PINs people pick most often.
• +Five wrong passcodes in 15 minutes stop passcode sign-in for that account, and the way back in is a fresh code on WhatsApp.
• +Changing the email, phone number or passcode needs the current passcode, or a sign-in with a one-time code in the last few minutes.
• +Every such change signs out the account's other devices and sends an alert to its verified email with a one-tap undo link, good for 72 hours. Undo puts the old value back and signs out every device.

Layouts an owner sets for everyone

Access decides what a person may do; Customization decides what their screen shows. Someone with the Set for everyone permission can arrange a Daybook or New Product form and make it the layout every member sees, and head office can pin fields for branches. The Customization page covers it.