Ledgr/Documentation/Portals & self-service
Portals & self-service
What Ledgr hands to four kinds of people who do not work for you — your customer, your employee, your supplier and your driver. None of them takes a seat on your plan, because none of them is a user of your Ledgr.
Each portal follows the module it belongs to: the customer portal and the ordering portal come with invoicing (on every plan), employee self-service with payroll, the supplier portal with procurement, and the driver app with logistics. See pricing.
A portal link is not a login. Nobody in this guide has an account, a password or a place in your user list, and none of them counts against your plan's seat limit — however many customers, suppliers, employees and drivers you invite.
The customer portal
Emailing an invoice includes a link. Opening it gives your customer the invoice exactly as you see it — the same single layout used by the preview, the PDF and the emailed attachment — plus:
- A PDF to download.
- A Pay now button, if you have connected PayFast or Yoco under Settings → Payments. Either way the money goes to your merchant account, and the invoice settles itself when the gateway confirms the payment.
- On a quote, Accept or Decline buttons.
- A statement of everything outstanding, if you send them a contact link rather than an invoice link.
Quote acceptance is the one worth switching on
The customer decides, and Ledgr records who typed their name, on which quote, and when. The typed name is the signature.
The page works with no JavaScript at all, because it has to survive whatever browser the customer's email client hands it to. Anybody holding the link can decide — the same trust model as "view and pay online" — but once a quote is decided the link cannot change the decision, so a forwarded email cannot reopen it.
No IP address and no browser fingerprint. Both are personal information under POPIA and would need their own purpose and retention period. What makes the acceptance evidential is that the answer came back through a link signed for that one quote, at a recorded time.
Accepting also moves the deal it came from, so your pipeline reflects the customer's decision rather than somebody's memory of it.
The ordering portal: customers ask for what they want
A customer who reorders every month should not have to phone it in for somebody to retype. Open the ordering portal for them from their contact — Contacts → the customer → Ordering Portal copies their link, opening the portal if it is closed — and they can:
- Browse the products you have chosen to offer, with your sell price and whether each is in stock. Only products you tick Offer this in the customer portal on appear, and the page says in stock or not — never how many you hold.
- Put together a basket and send it. It arrives as a draft quote, priced by Ledgr from your own price list at that moment — a customer cannot name their own price.
- See the quotes they have asked for and the ones you have sent back.
Their basket is a draft quote: it posts nothing, reserves no stock and binds no price. One of your people reads it, adjusts it and sends it, and sending it is what makes it an offer. The customer then accepts it the same way as any other quote.
The link lives in the customer's bookmarks rather than an email, so it opens for a year. Close Ordering Portal on the contact ends it, and every portal link already sent to that customer stops working with it.
Employee self-service
Each employee gets their own link, which gives them:
- Every payslip, current and historical, as a PDF.
- Their IRP5 when it is issued.
- Leave balances — annual, sick and family responsibility — and a form to request leave.
- Their deductions and what they are for.
- A way to submit a change of address or banking details for your approval, rather than by WhatsApp message to whoever runs payroll.
This is the tab that stops payroll day being interrupted. It is also the reason payroll never needs to email a payslip as an attachment to a personal address.
The supplier portal
Without a portal, procurement only points one way: you send a purchase order and hear nothing back, and a supplier's invoice arrives as a PDF for somebody to retype. The supplier portal closes that loop. Your supplier can:
- See requests for quotation and submit a priced, multi-line quote.
- See purchase orders awaiting acknowledgement, and confirm them with a delivery date.
- Submit their invoice against a purchase order.
- See which of their invoices are received, queried or paid, and their statement balance with its ageing — including the match verdict, so an invoice held for a price variance is a conversation they can have today rather than a payment that silently does not arrive.
- Offer a price on something nobody asked them to quote for, and revise an offer — a revision arrives as a new version beside the old one rather than overwriting the price you agreed to.
- Keep their own price list, with price breaks, minimum order quantity and order multiples. Adopting a price copies it onto your approved-vendor record, so a contract price cannot move because the other party edited their catalogue.
- Load their compliance documents — B-BBEE certificate or affidavit, tax clearance PIN, VAT, COIDA, insurance, CIPC, bank confirmation — each with its expiry date and what lapses with it, in words.
- Send a despatch advice from the order before delivery, so nothing arrives unannounced. It moves no stock: what you counted is still what you counted, and booking the delivery in marks their despatch as delivered.
- See their own scorecard, including their on-time delivery rating. A rating a supplier cannot see is one they cannot improve.
Whenever a supplier answers an order, sends an invoice, a quote, an offer, a document or a despatch advice, or applies to become a supplier, the people who can change procurement are told — by push, and by email unless it is switched off under Settings → Notifications. The supplier is told so only when somebody was; otherwise they are told it is waiting in your Procurement screen.
An invoice submitted through the portal arrives as a draft bill. It posts nothing to your ledger and appears in nobody's payables until one of your people accepts it. A B-BBEE level from their certificate is held as a claim until somebody with approval rights accepts the document, because it is the buyer who gets the audit finding for spend claimed on a certificate nobody checked. Nothing a supplier does through this portal moves money, moves stock, or changes a figure you have already acted on.
The quiet benefit is the matching. A bill somebody retypes from a PDF has no line breakdown to check, so the three-way match falls back to comparing totals — which passes an invoice whose total is right and whose items are wrong. An invoice submitted through the portal carries the purchase-order line on every line as a side effect of how it was submitted, so the strictest payables control in Ledgr becomes the default rather than the diligent case. See procurement.
The driver app
Drivers get a token scoped to one driver record. It opens Ledgr itself in driver mode — not a separate app to install, and not a browser link that expires by lunchtime. Send the pairing link once and the phone stays paired; from then on the driver opens Ledgr and lands straight on their run. There is no email address and no password, because a driver has no Ledgr account to have one.
A driver sees their trip, the stops in order, and captures at each one: who received the goods, their signature, a photograph, the quantities actually handed over, and a reason code if something went wrong — load shedding among them, because it is the most common reason a South African delivery is turned away. They can also mark themselves on the way and arrived, and open and close the trip against an odometer reading.
It is built for a kerbside on a bad connection: one request per screen, reason codes that arrive with their labels so nothing has to be looked up, and every capture safe to send twice. A proof captured with no signal — who received it, the signature, the quantities, the reason — is kept on the phone and sent automatically when there is some. So are its photographs: they are held on the phone with the proof and uploaded after it is accepted, each once, and the app shows them waiting until they have gone. The phone holds a limited amount of photographs for proofs it has not sent; a photograph too large to keep, or one taken when that space is full, is named on the spot so the driver can tell the office what it showed. In a web browser the photographs are held only while the app stays open, and it says so. Nothing is refused for being incomplete — an unsigned proof is recorded and graded as what it is, so a customer who will not sign cannot strand a driver at the door. Logistics & fleet covers what the proof establishes and how it is graded.
Links, expiry and taking access away
Scroll the table sideways to see every column.
| Portal | How they get in | How you take it away |
|---|---|---|
| Customer | A signed link in the email, scoped to one document or one contact, that opens for 30 days. The ordering portal's link opens for a year. | For one document: Reissue link on its preview — every link already sent for it stops working and you get the new one. For everything: Revoke Portal Links on the contact, which retires their statement link, their ordering link and the link in every document they have been sent. |
| Employee | A signed link scoped to one employee record. | Revoke from the employee's record. Ending employment ends access. |
| Supplier | Open their portal under Procurement → Supplier portal and send them the link. It opens for a year. The code that signs them in is part of the link itself, so the link is their password: anybody holding it can act for that supplier. | Close their portal under Procurement → Supplier portal. Every link already issued stops working, and so does that contact's customer portal link. |
| Driver | A pairing link opens Ledgr in driver mode and pairs the phone; the token travels in a normal authorisation header, never in the address bar. | Revoke from the driver record — it takes effect on the next request, even on a phone already holding a token. |
Every one of them is scoped to a single record and a single business. A link to one invoice cannot be edited into a link to another, and none of them can reach anything else in your Ledgr. Read security & POPIA for how that is enforced.
Anyone holding it can open what it points at, exactly as anyone holding a posted invoice can read it. That is the intended behaviour and it is what makes "view and pay online" work without asking your customer to create an account.
The supplier portal and the supplier registration page carry their code in the link itself, so it shows in the address bar and in the browser's history, and a forwarded link works for whoever receives it. Send it only to the person who deals with you, and if it goes astray, Close their portal under Procurement → Supplier portal and open it again: every copy already sent stops working at once, and the new link is the only one that opens. Ledgr keeps the code out of its own logs and error messages.
Let them serve themselves
Four portals, no seats, no passwords to reset.
Common problems
| What you see | What to do |
|---|---|
| A portal link will not open at all | Most often the link was wrapped or shortened by an email client, which breaks the part that identifies the recipient. Send it again with the copy-link option rather than forwarding the original message. |
| A link that worked has stopped | Either it was revoked — which retires every copy of it, including the one already sitting in somebody's inbox, and that is the point — or it is older than 30 days. A document's link is renewed by sending the document again or by Reissue link on its preview. |
| A customer cannot pay from the portal | Three things to check, and the page names which: no gateway is connected (see Settings → Payments), the gateway is only half set up, or the invoice is not in rand — a card link is refused on a foreign currency invoice at both points, because neither gateway is told a currency and the customer would be charged the number rather than the amount. |
| Ledgr says it cannot build a portal link | Ledgr has no public web address set up to build the link on, and it refuses rather than guessing one, which would produce a link that stops working the moment somebody reads the mail. Nothing on your account can fix this — contact support. |
| A quote was accepted and you were not told | You should be: acceptance and decline both email the business. If the decision is on the document and no email arrived, check your spam folder, and if it is not there contact support. The decision itself is on the document — who decided, when, and the reason if they declined. |
| A forwarded quote link cannot change the decision | Correct. Once a quote is decided, the link shows the decision rather than offering the buttons again. Anyone holding the link may decide the first time — the same trust model as "view and pay online" — so the protection is that a settled question stays settled. |
| A driver's phone shows no loads | A planned trip is invisible; dispatching hands it to the phone. If the
phone shows nothing at all, it is not paired — the pairing link is a
/driver/pair#… address the office sends over WhatsApp, and it can be
pasted rather than tapped if the message mangled it. |
| An employee cannot see a payslip | Payslips appear once the run is finalised. A draft run shows nothing, which is the same reason an EMP201 built from it reads low. |
| A supplier cannot find the invoice they submitted | It shows as awaiting acceptance, never as a debt, until somebody on your side accepts it. That distinction is deliberate — telling a supplier they are owed money before anyone has agreed the invoice is how a statement stops being believed. |