Billing that thinks.
Finances that flow.
PaymentFlow handles your complete billing lifecycle — from AI-powered monthly reports and quotes through to invoices, payments, expenses, and tax reporting. Enterprise-grade security. Multi-tenant. Self-hosted.
Built for the complete
billing lifecycle.
Every module designed to work together — from the first quote to the final report.
Quotes & Invoicing
Full lifecycle management with customer-facing tokenised public links. One-click quote-to-invoice conversion.
- check_circleAccept / Decline via secure link
- check_circleAuto-numbered with configurable prefix
- check_circlePDF generation via mPDF + print fallback
- check_circleDuplicate any invoice or quote as draft
Payment Tracking
Full and partial payments with automatic balance recalculation. Status transitions handled automatically.
- check_circlePartial payment support with live balance
- check_circleDeleting a payment reverses calculations
- check_circleAuto status: partial → paid / overdue
- check_circleFull payment history per invoice
Expense Management
Full expense lifecycle with VAT-compliant split amounts, receipt uploads, and billable linking.
- check_circleNet / Tax / Gross split for VAT compliance
- check_circleMonthly recurring expense auto-generation
- check_circleReceipt uploads (PDF/JPG)
AI Financial Reports
Five report types with date presets, shared KPI strips, and CSV/PDF export. AI-powered insights analyse your financial data and surface actionable recommendations.
- check_circleSales, Customers, Products, Tax/VAT, Expenses
- check_circleDate presets from Today to Last Year
- check_circleCSV and PDF export per report
Live Dashboard
Real-time financial overview with revenue, outstanding, expense breakdowns, and overdue alerts. Role-scoped — each user sees only their data.
- check_circleRevenue, expenses, profit at a glance
- check_circleOverdue invoice alerts
- check_circleRecent activity timeline
Multi-Tenant Architecture
Complete data isolation per company. Every table carries
company_id. Every query filters by it.
Cross-company data leakage is structurally impossible.
- check_circlePer-company branding & settings
- check_circleStructural isolation — not just UI-level
- check_circle4-tier RBAC per company
Security built in,
not bolted on.
Every layer of the stack is hardened — from database queries to session management to encrypted credentials. 20+ security features, not one is optional.
Argon2ID Password Hashing
Industry-leading memory-hard algorithm — stronger than bcrypt. No MD5, no SHA-1.
AES-256-GCM Encryption
SMTP password, AI API key, and Cloudflare token all encrypted
at rest via encrypt_value() using your APP_KEY.
CSRF Protection
Synchroniser token on every state-changing form, verified before any database write.
SQL Injection Prevention
PDO prepared statements throughout. Zero string concatenation in queries — ever.
XSS Protection
All user-rendered data passes through
e() escaping. Nonce-based CSP as the second layer
— 25 nonces across all modules.
Inactivity Session Timeout
DB-configurable per company (2 min–1 hr). 1-minute warning modal with countdown. No persistent sessions.
Login Rate Limiting
5 login attempts per 15 min per IP. 5 password reset requests per 15 min. 30-second OTP resend cooldown.
Secure File Uploads
MIME type verified via finfo, strict extension
allowlist, random UUID prefix on stored filenames.
Tokenised Public Pages
64-character cryptographically random hex tokens on all public invoice and quote links. No session, no guessable IDs.
AI Prompt Injection Guard
Hardcoded system prompt prevents data values from overriding AI instructions. Output sanitised with tag allowlist.
Full Security Header Suite
X-Frame-Options: DENY, nosniff, HSTS, Referrer-Policy, Permissions-Policy (camera, mic, geo, payment all denied).
Scanner & Bot Blocking
Known vulnerability scanners blocked in
.htaccess — nikto, sqlmap, nmap, masscan, nuclei,
acunetix, dirbuster.
What stops what.
An edge security layer
in front of everything.
PaymentFlow integrates directly with Cloudflare from Settings — encrypted token, automatic cache purging on every save, and a WAF that stops attacks before they reach your origin.
settingsBuilt into the App
-
check_circle
Scoped API token — Cache Purge + Zone Read only. AES-256-GCM encrypted, never logged, never sent to the browser.
-
check_circle
Test Connection — validates Zone ID and token; returns domain, plan, and live status.
-
check_circle
Auto-purge on save — whenever settings or the company logo change, all cached files purge automatically.
-
check_circle
Manual purge — Purge Cache Now button available at any time from the Settings panel.
-
check_circle
Audit logged — every cache purge recorded with actor and timestamp.
httpsSSL / TLS Configuration
Recommended Firewall Rules
cf.threat_score gt 30
Cloudflare's threat intelligence scores IPs based on known malicious behaviour.
uri.path eq "/login" AND method eq "POST"
10 POST requests per minute per IP. Complements PHP-level rate limiting.
uri.path eq "/login" AND NOT ip.geoip.country in {"ZA"}
Non-ZA login attempts served a silent JS challenge. Ideal for ZA deployments.
http.user_agent contains "sqlmap" OR "nikto"
Block known scanner user-agents at the edge before they consume any bandwidth.
Email OTP on
every sign-in.
When 2FA is enabled, a cryptographically random 6-digit code is emailed to every user on sign-in — before any session is established. One toggle in Settings.
Role-based permissions
for your whole team.
Four roles from full administrative control to read-only access — managed per user, enforced server-side on every route.
- check_circleAll modules
- check_circleSettings + users
- check_circleAI reports
- check_circleAudit + email logs
- check_circleAll modules
- check_circleSettings
- check_circleReports
- cancelNo user management
- check_circleQuotes & invoices
- check_circleExpenses
- check_circleOwn reports
- cancelNo settings
- check_circleView invoices
- check_circleView reports
- cancelNo create / edit
- cancelNo settings
Billing that thinks.
Finances that flow.
Self-hosted, multi-tenant, AI-powered. Own your billing data — no SaaS lock-in, no per-transaction fees, no third-party access to your financial records.