Help & Documentation

Contents

Getting started — overview

This page orients you on day one. For the full feature list see About inveazy (/about). For server setup see Installation & Docker.

What is inveazy?

inveazy is a multi-tenant business hub on a single installation. Each workspace (tenant) is an isolated company environment — own users, data, and enabled apps — sharing one database with row-level security.

Shipped modules today include CRM and project management; full supply chain (buy, stock, sell, ship); accounting with local GL, QuickBooks export, and Stripe; B2B web orders; hub apps (files, notifications, calendar, blog); and a workspace assistant with module-scoped AI. Planned modules are on Roadmap; shipped highlights are in Changelog.

Who should read what?

You are…	Start here
End user (sales, warehouse, PM)	Sign in → `/` hub launcher → open your module; use megamenus (CRM, SCM, PM, HUB)
TenantAdmin	Tenant Admin overview — workspaces, Integrations, branding
Admin	Admin menu overview — dashboards, users, roles
Executive / manager	Dashboard launcher (`/dashboard`) — CRM, PM, finance, SCM analytics
Operator / developer	Installation & Docker — Docker, Azure, Cloudflare, nginx

Signing in

Open your organization’s inveazy URL and sign in with the email and password from your administrator. Use Forgot password on the sign-in page if needed. After auth you may need to pick a workspace if your account belongs to more than one tenant. When enabled on Public site branding, public Sign up for a demo registers into the configured demo workspace (usually sandbox) if self-registration is on there — see Tenant workspaces.

Lab installs may include seeded demo accounts — rotate those passwords or disable them before exposing the host (see Integrations and AppHubWeb ReadMe).

Navigation — four ideas

Hub launcher (/) — tiles for every module enabled for you. Good first stop after sign-in.
Megamenus (top bar) — ADMIN, HUB, CRM, PM, SCM group related screens the way the app dropdowns do.
Dashboards (/dashboard) — read-only analytics (pipeline, projects, P/L, sales, purchasing, inventory). Not where you edit documents.
Help (/help) — this library; sidebar order matches megamenus plus Assistant and Roadmap (About, glossary, planned modules, changelog).

Hub collaboration apps (files, notifications, calendar, blog, assistant) are under HUB in the app and in the Hub and Assistant help groups.

Enabling modules

TenantAdmins turn apps on under Admin → Integrations → Applications. Disabled modules are hidden from navigation and return 404/403 if accessed directly. Roles under Roles further limit which enabled apps each user may open.

Inventory implies warehouse and order flows; Products can run lighter for catalog/storefront-only setups. Accounting adds invoices, bills, cash entries, and the financial dashboard. Pair toggles with Stripe and QuickBooks when you are ready for payments and export sync.

Common first-week paths

Set up the workspace — Users, Integrations (SMTP, AI), My organization
Run sales — CRM → pipeline; Sales orders when deals become fulfillment
Run the warehouse — SCM menu overview → Buy side (products, POs, receipts, on-hand)
Run the storefront — Storefront overview → Web orders fulfillment
Close the books — Accounting overview, vendor bills, invoices, QB export batches
Use AI — enable Assistant in Integrations → Assistant overview

Using this help library

Sections follow the app megamenus: Tenant Admin, Admin, Hub, CRM, PM, SCM (Buy side, Sell side, Accounting, Storefront), plus Assistant and Roadmap (About, glossary, planned modules, changelog). Use the search box in the sidebar to jump to a topic. SCM has the longest trail — start with SCM menu overview and End-to-end workflows if you are new to ERP-style document chains.

Installation & Docker

This guide is for the person installing inveazy for an organization. Everyday users do not need any of this.

What you are setting up

SQL Server — your own server, Azure SQL, or SQL Server in a Docker container.
Database — create AppHubDb and install AppHubDb.dacpac with SSMS and SqlPackage.
AppHubWeb — run docker-compose.web.yml with a connection string to that database.

Docker runs the website only. SQL Server can be Docker too, but the database install is still done with SSMS — not by starting the web container.

Installation order

Prepare the app server — Docker (and optional stack manager).
Run SQL Server — existing server or Docker.
Connect with SSMS — create the database; Local recovery SIMPLE.
Install the DACPAC — SSMS + SqlPackage from Command Prompt.
Deploy AppHubWeb — compose file + connection string.
Optional production settings — public URL, Stripe, QuickBooks, SMTP.

Step 1 — Prepare the app server

This machine runs the inveazy website container. It must be able to reach SQL Server on the network (port 1433).

Docker Engine + Compose v2 — Install Docker
Stack manager (optional) — Dockhand, Dockge, or Portainer
Registry access — pull the apphubweb image (docker login to your registry)

docker --version
docker compose version

Step 2 — Run SQL Server

Pick one path below. Skip the Docker section if you already have SQL Server or Azure SQL.

Option A — SQL Server in Docker

Run Microsoft SQL Server 2022 in a container on your Linux server (or the same machine where AppHubWeb will run). Data is kept in a Docker volume so it survives container restarts.

Start SQL Server with Docker Compose — create a file named docker-compose.sql.yml on the server:

services:
  sqlserver:
    image: mcr.microsoft.com/mssql/server:2022-latest
    container_name: apphubdb-sql
    hostname: apphubdb-sql
    restart: unless-stopped
    ports:
      - "1433:1433"
    environment:
      ACCEPT_EULA: "Y"
      MSSQL_SA_PASSWORD: "YourStrong!Passw0rd"
      MSSQL_PID: "Developer"
    volumes:
      - apphubdb_sql_data:/var/opt/mssql

volumes:
  apphubdb_sql_data:

Replace YourStrong!Passw0rd with a strong password that meets SQL Server policy (upper, lower, number, symbol). Save that password — you need it for SSMS and SqlPackage as login sa.

From a terminal on the server, in the folder with that file:

docker compose -f docker-compose.sql.yml up -d

Wait about 30–60 seconds for SQL Server to finish starting. Check status:

docker ps
docker logs apphubdb-sql

When ready, the logs show SQL Server is accepting connections. The repo also has docker-compose.yml with the same SQL service if you prefer that file.

Connect from SSMS (Windows PC):

Server name: YOUR_SERVER_IP,1433 — the LAN IP of the Docker host (e.g. 10.0.0.128,1433). If SSMS runs on the same machine as Docker, try localhost,1433.
Authentication: SQL Server Authentication
Login: sa
Password: the MSSQL_SA_PASSWORD you set above
On the login dialog, open Options >> → check Trust server certificate (common for Docker / lab SQL).

If connection fails: confirm port 1433 is open on the server firewall and that docker ps shows the container running.

Option B — Existing SQL Server or Azure SQL

Use SQL you already manage — a Windows SQL instance, a VM, or Azure SQL Database. Connect with SSMS the way you normally do (server admin login). Ensure the app server can reach the instance on port 1433 and that firewall rules allow the AppHubWeb host.

Step 3 — Connect with SSMS and create the database

On a Windows PC, open SSMS and connect as SQL administrator (sa for Docker SQL, or your usual admin login).

Connect Object Explorer to your server (see Option A for Docker connection details).
Open a New Query window connected to master.
Run:

CREATE DATABASE AppHubDb;

On Azure SQL, create AppHubDb in the Azure portal instead if you prefer. Refresh Object Explorer and confirm AppHubDb appears under Databases.

Local / Docker SQL — recovery model (important)

New databases on SQL Server (including Docker) often inherit FULL recovery from the model database. Without regular transaction log backups, the log file can grow to many gigabytes over weeks of publishes and testing — while the data file stays small.

For Local LAN / Docker / self-hosted lab installs where you do not need point-in-time restore from log backups, set SIMPLE recovery right after create (and on any existing local DB that has already ballooned):

ALTER DATABASE AppHubDb SET RECOVERY SIMPLE;
-- Optional reclaim after switching (local only):
-- USE AppHubDb;
-- DBCC SHRINKFILE (N'AppHubDb_log', 128);

Replace AppHubDb with your database name if different (provisioned customer DBs often use the workspace slug). Local customer provision scripts apply RECOVERY SIMPLE automatically for new databases.

Azure SQL: leave FULL recovery. Azure manages log truncation with automated backups — do not switch Azure databases to SIMPLE for this reason.

Step 4 — Install `AppHubDb.dacpac` (SSMS + SqlPackage)

The DACPAC creates all tables, security, and seed data, plus the contained user AppHubUser. AppHubWeb does not do this step for you.

The DACPAC needs a password variable (AppHubUserPassword). Run SqlPackage from Command Prompt on the SSMS PC (SqlPackage installs with SSMS). The SSMS Deploy Data-tier Application wizard cannot set that variable.

You need:

AppHubDb.dacpac — from your maintainer, or build AppHubDb/AppHubDb.sqlproj in Visual Studio (Release), or download the AppHubDb-build pipeline artifact
A password you choose for AppHubUser — save it; the AppHubWeb connection string uses the same password

Run SqlPackage from Command Prompt:

Open Command Prompt on the Windows machine where SSMS is installed.
Find SqlPackage.exe — common paths:
- C:\Program Files\Microsoft SQL Server\160\DAC\bin\SqlPackage.exe
- C:\Program Files\Microsoft SQL Server\150\DAC\bin\SqlPackage.exe
Or download from Microsoft SqlPackage.
Run (edit paths and passwords for your server):

"C:\Program Files\Microsoft SQL Server\160\DAC\bin\SqlPackage.exe" ^
  /Action:Publish ^
  /SourceFile:"C:\path\to\AppHubDb.dacpac" ^
  /TargetConnectionString:"Server=YOUR_SERVER_IP,1433;Initial Catalog=AppHubDb;User ID=sa;Password=YOUR_SA_PASSWORD;Encrypt=True;TrustServerCertificate=True" ^
  /Variables:AppHubUserPassword="YOUR_APPHUB_USER_PASSWORD" ^
  /p:RegisterDataTierApplication=false

For Docker SQL, use sa and your container MSSQL_SA_PASSWORD. For Azure SQL, use your server admin login and TrustServerCertificate=False.

Wait for Successfully published database. If publish fails, close other SSMS query tabs that have AppHubDb open and try again.

Confirm in SSMS:

Expand AppHubDb → Tables — you should see many tables.
File → Connect Object Explorer (second connection).
Login: AppHubUser. Password: your AppHubUserPassword.
Options >> → Connect to database = AppHubDb (not master).
Click Connect. If this works, AppHubWeb will connect too.

Alternative: Visual Studio — open AppHubDb.sqlproj, Publish, set SqlCmd AppHubUserPassword in the publish dialog.

More detail: AppHubDb/ReadMe.md

Step 5 — Deploy AppHubWeb (compose file + connection string)

Paste docker-compose.web.yml into your stack manager and set:

APPHUBWEB_IMAGE — e.g. myregistry.azurecr.io/apphubweb:latest
ConnectionStrings__DefaultConnection — points at AppHubDb on your SQL Server

Dockhand / Dockge / Portainer: new stack → paste YAML below → add variables → deploy.

Terminal:

docker compose -f docker-compose.web.yml up -d

`docker-compose.web.yml`

Use the file from the repo root (preferred). Essential shape:

services:
  apphubweb:
    image: ${APPHUBWEB_IMAGE}
    pull_policy: always
    container_name: apphubweb
    restart: unless-stopped
    ports:
      - "${WEB_PORT_SPEC:-18548:5148}"
    extra_hosts:
      - "host.docker.internal:host-gateway"
    environment:
      ASPNETCORE_URLS: http://+:5148
      ASPNETCORE_ENVIRONMENT: "${ASPNETCORE_ENVIRONMENT:-Production}"
      Web__TrustForwardedHeaders: "${Web__TrustForwardedHeaders:-true}"
      Web__ShowDevHub: "${Web__ShowDevHub:-true}"
      Web__EnableOpenApiDocs: "${Web__EnableOpenApiDocs:-true}"
      DataProtection__KeysPath: "${DataProtection__KeysPath:-/app/dpkeys}"
      ConnectionStrings__DefaultConnection: "${ConnectionStrings__DefaultConnection}"
      # Ops-only local provision (default off). Leave false on customer stacks.
      Provision__Enabled: "${Provision__Enabled:-false}"
      Provision__ListenerUrl: "${Provision__ListenerUrl:-}"
      Provision__SharedSecret: "${Provision__SharedSecret:-}"
      Provision__DefaultHostPort: "${Provision__DefaultHostPort:-10150}"
    volumes:
      - apphubweb_dataprotection_keys:/app/dpkeys

volumes:
  apphubweb_dataprotection_keys:

Provision install (ops only): Admin → Provision is available only on inveazy.com, hvt.inveazy.com, and hivoltech.com when Provision__Enabled=true and the host listener is running (deploy/docker-compose.provision-listener.yml). Customer slug stacks and localhost do not show the page (404). Do not copy Provision secrets into customer Dockhand env. Details: repo deploy/PROVISION-LOCAL.md.

Connection string — SQL Server in Docker on the same host as AppHubWeb:

ConnectionStrings__DefaultConnection=Server=10.0.0.128,1433;Database=AppHubDb;User Id=AppHubUser;Password=YOUR_APPHUB_USER_PASSWORD;Encrypt=True;TrustServerCertificate=True;MultipleActiveResultSets=true

Use the server’s LAN IP (not localhost) — from inside the AppHubWeb container, localhost means the container itself, not the SQL container. Replace 10.0.0.128 with your host’s IP.

Connection string — Azure SQL:

ConnectionStrings__DefaultConnection=Server=tcp:yourserver.database.windows.net,1433;Database=AppHubDb;User Id=AppHubUser;Password=YOUR_APPHUB_USER_PASSWORD;Encrypt=True;TrustServerCertificate=False;MultipleActiveResultSets=true

Test: http://127.0.0.1:18548 on the app server. Do not delete apphubweb_dataprotection_keys on redeploy.

Step 6 — Dockhand environment block (production)

Step 5 only needs APPHUBWEB_IMAGE and ConnectionStrings__DefaultConnection to get running. When you go live, paste the block below into your stack manager’s Environment panel (Dockhand, Dockge, or Portainer). Use the same variable names — no .env file is required on the server.

Replace every CHANGE_ME and example URL with real values for this customer. Never commit this block with live secrets to Git.

If SQL Server runs in Docker on the same host, set TrustServerCertificate=True in the connection string (as in Step 5). Azure SQL uses TrustServerCertificate=False.

# Required — replace yoursite.com / YOUR_SLUG with this install's values
APPHUBWEB_IMAGE=myregistry.azurecr.io/apphubweb:latest
ASPNETCORE_ENVIRONMENT=Production
ConnectionStrings__DefaultConnection=Server=YOUR_SQL;Database=YOUR_SLUG;User Id=AppHubUser;Password=CHANGE_ME;Encrypt=True;TrustServerCertificate=False;MultipleActiveResultSets=true

# Site URL + proxy (customer public hostname)
Web__PublicBaseUrl=https://yoursite.com
Web__TrustForwardedHeaders=true
Web__ShowDevHub=false
Web__EnableOpenApiDocs=false
Web__DisableSandboxSeededDemoLogins=true
DataProtection__KeysPath=/app/dpkeys

# Host email (optional if the workspace uses custom SMTP in Admin → Integrations)
Smtp__Host=smtp.mailersend.com
Smtp__Port=587
Smtp__Ssl=true
Smtp__User=CHANGE_ME
Smtp__Password=CHANGE_ME
Smtp__From=noreply@yoursite.com
Smtp__FromName=YOUR_COMPANY

# Stripe commerce — omit this whole block from Dockhand for customer installs.
# Enter secret, publishable, and webhook signing secrets in the app:
#   Admin → Integrations → Providers → Payments
# (Do NOT paste platform / inveazy subscription keys.) Uncomment stack Stripe__* only if you
# intentionally drive checkout from compose env instead of Integrations.
# Stripe__SecretKey=
# Stripe__PublishableKey=
# Stripe__WebhookSecret=
# Stripe__InvoiceCheckoutSuccessUrl=/pay/invoice?success=1&session_id={CHECKOUT_SESSION_ID}
# Storefront catalog workspace (config, not Integrations) — Core_Tenant.Slug for /store:
# Web__Store__CommerceTenantSlug=tenantname   # this install's workspace slug; not sandbox

# QuickBooks — Intuit OAuth app for this install (tenant Connects company in Admin → Integrations)
QuickBooks__ClientId=CHANGE_ME
QuickBooks__ClientSecret=CHANGE_ME
QuickBooks__Environment=production
QuickBooks__RedirectUri=https://yoursite.com/api/integrations/quickbooks/callback
QuickBooks__WebhookVerifierToken=CHANGE_ME

# Optional
ConnectionStrings__AzureStorage=DefaultEndpointsProtocol=https;AccountName=CHANGE_ME;AccountKey=CHANGE_ME;EndpointSuffix=core.windows.net
Mapbox__AccessToken=pk.CHANGE_ME

# Provision__* — omit on customer installs (defaults stay false). Ops hosts only: see note under docker-compose.web.yml.

Commerce Stripe on a dedicated install belongs to that customer — enter it under Admin → Integrations → Providers → Payments (and omit the Stripe__* block from Dockhand). Do not copy Hivoltech / inveazy platform keys. Copy the webhook URL from that Payments tab into the Stripe Dashboard. See Stripe payments. QuickBooks ClientId/Secret stay in env; the tenant still Connects their QBO company under Integrations → Providers → Accounting.

What each section does is documented in Prod.md at the repo root. Variable names only (no secrets): .env.web.example.

Check that it works

AppHubWeb logs show no SQL errors.
http://127.0.0.1:18548 loads.
Sign-in works (change demo passwords before go-live).
Add users under Admin → Users.

Common problems

SSMS cannot connect to Docker SQL — check docker ps, firewall on port 1433, use YOUR_SERVER_IP,1433, enable Trust server certificate.
AppHubWeb cannot connect but SSMS can — connection string must use the host LAN IP, not localhost, when SQL and web are both in Docker on the same machine.
Login failed for AppHubUser — include Database=AppHubDb; password must match AppHubUserPassword from SqlPackage.
DACPAC not installed — publish AppHubDb.dacpac before starting AppHubWeb.
Image pull fails — docker login; APPHUBWEB_IMAGE must not include https://.

See also production.md, Prod.md, and AppHubDb/ReadMe.md.

Tenant Admin overview

Tenant Admin is the platform-owner lane in inveazy. Users with the TenantAdmin role can provision workspaces, connect external services, set operational letterhead, and control the public marketing site. If you only manage users and roles inside one workspace — without provisioning new tenants — you may be an Admin instead; see Admin menu overview.

These screens still live under the top-bar ADMIN megamenu, but the help library groups them here so Tenant Admins can find platform tasks without wading through dashboard analytics. The ADMIN dropdown’s Platform & support column maps to this section; the middle ADMIN column (users, roles) and Dashboards column are documented under Admin in the sidebar.

Topics in this group

Tenant workspaces — catalog of workspaces you administer
Self-registration — per-workspace toggle on workspace detail (Demo, pilots, etc.)
New tenant workspace — provision another isolated tenant
Multitenancy — isolation, TenantId scoping, and terminology
My organization — letterhead on POs, invoices, and operational PDFs
Integrations — applications, Stripe, QuickBooks, SMTP, AI, read-only SQL
Public site branding — anonymous marketing home and blog frame

Typical onboarding order

Understand Multitenancy and open Tenant workspaces.
Provision customer workspaces via New tenant workspace (or the first-run setup wizard on a fresh install).
Switch into the workspace and enable modules under Integrations → Applications.
Set My organization letterhead before issuing SCM documents.
Connect Stripe, QuickBooks, and SMTP on the same Integrations page.
Configure Public site branding if you use the marketing landing page.
Invite users via User manager (documented under Admin).

TenantAdmin and Admin both see the ADMIN menu; individual links are hidden when your role lacks permission.

Tenant workspaces

Admin → ADMIN → Tenant workspaces (/admin/tenants) lists every workspace (tenant) you administer on this inveazy install. This screen is for TenantAdmin only. It is one of the most important concepts to understand: a workspace is not a CRM account or customer company — it is the isolated container that holds all of your team's CRM accounts, products, users, and settings.

One physical inveazy deployment can host many workspaces. A software vendor might run one install for fifty customers, each with their own workspace slug and data. A single company might use one workspace for production and another for training. Each workspace has its own module toggles, roles, integrations, and document number sequences. Data never mixes between workspaces unless a platform operator explicitly copies it outside the app.

From the catalog you can open a workspace detail page to see its slug, enabled modules, user list, and self-registration settings. Use the workspace switcher in the top bar to change which workspace you are signed into; the tenant catalog is the map of workspaces you control.

Demo / SandBox and customer workspaces

Fresh installs seed only SandBox (sandbox) for training sample data. The lean Demo workspace (demo) used for public Sign up for a demo is created manually on the marketing demo host — it is not seeded by the dacpac and must never be removed by a republish. That CTA (when enabled under Public site branding) targets Web:PublicSite:DemoTenantSlug (default demo) with self-registration on; keep SandBox self-reg off. Paid customer databases should not include a demo tenant.

To offer public signup on the marketing host: keep that demo workspace, enable self-registration on its detail page, and leave Show Sign up for a demo button checked. To hide the button on a paid customer site, uncheck that option even if SandBox still exists for training.

Customer workspaces are created via New tenant workspace or the first-time setup wizard. Production data should live in a dedicated workspace with real users and integrations — not in SandBox.

Self-registration (per workspace)

On a workspace detail page, TenantAdmins can enable self-registration for that slug only. When on, the page shows a Request access link you can copy to prospects or staff. Registrants submit name and email; you approve or deny in the registration queue before they can sign in.

Any workspace can use self-registration — not only SandBox. Turn it on only for workspaces you trust on a shared host (SandBox for public trials; a private pilot slug for a known customer). Marketing Sign up for a demo targets the configured demo slug; the link only works while self-registration is enabled on that workspace and the public-site button toggle is on.

Tenant workspaces vs User manager

Tenant workspaces shows the list of workspaces and, on detail, users for that chosen workspace. User manager always shows users in the workspace you are currently signed into. If you administer multiple workspaces, switch context in the header before opening User manager, or open users from the specific workspace detail page.

See also Multitenancy for isolation, security, and database scoping in more depth.

Integrations

Admin → Platform & support → Integrations (/admin/integrations) is where the workspace meets the outside world: which apps are turned on, payment and accounting providers, outbound email, AI, analytics database access, and sync health. Only TenantAdmin should routinely change these settings. API keys and secrets are stored encrypted; after save they are not shown again — keep a secure record when rotating keys.

Applications tab

Choose which hub modules appear in the sidenav and HUB megamenu. Disabling an application hides navigation entry points and causes direct URLs to return 404 for users who are not administrators. Admin itself and public site settings remain available regardless. Enabling Inventory typically implies warehouse and order flows; Products alone is a lighter catalog tier for storefront SKUs without full SCM.

Providers tab

Connect external services by category:

Accounting — QuickBooks Online OAuth (connect the company / realm). Products, vendors, customers, invoices, vendor bills, and payments can sync; use Sync status afterward.
Payments — Stripe commerce for invoices and storefront. Enter secret, publishable, and webhook signing secrets; copy the webhook URL into Stripe Dashboard → Webhooks. Checkout still uses stack Stripe__* until runtime BYOK override ships — keep Dockhand/compose env in sync. Details: Stripe payments.
Shipping & maps / AI — carrier and map tokens; assistant BYOK keys (enable the assistant on the AI tab).

Each dedicated install uses that customer’s own Stripe and QuickBooks accounts — not Hivoltech platform SaaS keys.

Sync status tab

When QuickBooks is connected, Sync status summarizes Site_ExternalSync rows: counts synced, pending, and errored by record type (Product, Vendor, Customer, Invoice, VendorBill, Journal, and others). Recent errors list with one-click Re-sync. A red badge on the tab highlights outstanding failures. Use this page after posting journals or issuing invoices to confirm QBO received them.

Email (SMTP) tab

Override system email with tenant-specific SMTP — host, port, TLS, credentials, from/reply addresses. When custom SMTP is off, the host uses application-wide Smtp settings from server configuration. Tenant SMTP is used for notifications, invoice emails, and other outbound mail initiated inside the workspace.

AI assistant tab

Configure the workspace assistant: built-in model endpoint or bring your own key (BYOK), optional read-only SQL access for MODULE SCOPED DATA, and toggles for which modules the assistant may query. Without read-only data enabled, the assistant answers from general knowledge and your prompt only — not live inventory or pipeline numbers.

Read-only database tab

Provision a per-tenant SQL login for Power BI, Excel, Tableau, or SSMS reporting. Row-level security limits results to the workspace TenantId. This is reporting access, not a backup or migration path — operational changes still happen inside the app.

Operational letterhead is under My organization; marketing site appearance is under Public site branding.

Public site branding

Admin → Platform & support → Public site branding (/admin/organization-site) controls the anonymous marketing experience — what people see at your organization's public URL before they sign in. TenantAdmin only. This is separate from signed-in hub chrome and separate from operational letterhead on POs/invoices.

General — landing page and blog toggles

Use landing page decides whether / for anonymous visitors shows a marketing home or redirects toward sign-in. Use blog controls whether public blog routes are active. Signed-in users always get the hub launcher at / regardless of the landing toggle — the toggle affects guests only.

Show Sign up for a demo button controls whether guests see that CTA on the public home page. Turn it off for paid customer sites that should not offer public trials. When it is on, visitors register into the demo workspace from host config (Web:PublicSite:DemoTenantSlug, usually demo on the marketing host). Create or keep that tenant under Tenant workspaces and enable self-registration on it, or the button will open a page that says signup is unavailable.

Show integrations strip on landing page controls the Connects to enterprise data, payments, and services logo band (and related deployment badges). Uncheck it when that marketing strip is not appropriate for the customer site.

Show Pricing button and page controls the header Pricing link, home-page Features & pricing CTAs, and the public /pricing page (inveazy SaaS plans). Leave it on for the marketing/demo host; uncheck it on paid customer installs.

Use store turns on public /store and the header Shop link. Before taking card payments, configure commerce Stripe under Admin → Integrations → Providers → Payments (keys + webhook URL) — see Stripe payments. Catalog workspace comes from host Web:Store:CommerceTenantSlug.

Company display name is the public header/footer brand and the signed-in topbar label. Sidebar name is the left sidenav brand only — leave it blank to reuse the company display name, or set a shorter label when the full company name is too long for the menu.

Home hero and theme

Choose theme skin, color mode, navbar style, and hero imagery for the stock inveazy landing layout. Upload a hero image (JPEG, PNG, WebP, GIF, or SVG) or restore the default illustration (/images/center.jpg). The Home hero tab includes a Quill editor for the subhead (bold, lists, links, text size) — same idea as footer About. Use Preview home after saving to verify appearance on desktop and mobile.

Where branding is stored

Uploaded hero, logo, favicon, and PWA assets are saved in the database (Site_OrganizationSiteProfile for URLs and copy; Site_PublicSiteAsset for image bytes). The app also writes a cache copy under wwwroot/images/public-site/ and wwwroot/images/pwa/site/ on the server — those files are not in Git. When localhost and production share the same database, a branding change from either environment applies to both; each app server rebuilds its local cache from SQL on startup or first request.

Custom landing page

When Use custom landing page is enabled, replace the stock layout with your own HTML blocks — mission statements, product highlights, calls to action — while still using shared theme controls for colors and header/footer chrome.

Contact, footer, and social

Configure inquiry email routing, footer text, social network links, and rich "about" content shown on the public site. These fields feed the marketing footer, not SCM documents.

Brand & PWA

Public logo, favicon-related assets, theme color, and progressive-web-app metadata for add-to-home-screen experiences on mobile devices.

Blog authoring for employees still happens under Hub → Blog; this screen only controls whether published posts are visible publicly and how the public site frame looks around them.

Admin menu overview

The ADMIN button in the top navigation bar is your control center for the whole inveazy installation and for the workspace you are signed into. It is aimed at people who configure the system — typically a TenantAdmin or Admin role — not at day-to-day warehouse or sales staff. If you do not see the ADMIN menu, your role does not include those permissions; ask your workspace administrator.

Unlike module menus (CRM, PM, SCM), the Admin menu is organized around how you run the workspace, not around a single business process. The ADMIN dropdown has three columns that match the app:

Dashboards — read-only analytics: overview launcher (/dashboard), CRM, project, financial, and SCM dashboards (sales, purchasing, inventory) when those modules are enabled. Documented in this Admin help group.
ADMIN — users and security for the workspace you are signed into: User manager and Roles. Also documented here.
Platform & support — workspace provisioning, letterhead, integrations, and public marketing site. Those items are TenantAdmin tasks — see the Tenant Admin help group above.

Think of Admin as the layer above CRM, PM, and SCM for day-to-day workspace operations. Tenant Admin is the narrower platform-owner lane for provisioning tenants and wiring external services. Many small businesses have one person in both roles; larger deployments split them.

Who should use which Admin item?

A small business might have one TenantAdmin who does everything. A larger deployment often splits responsibilities:

IT / platform owner — Tenant Admin topics: tenant workspaces, integrations, read-only database, SMTP, AI keys.
HR or office manager — User manager, Roles, and My organization letterhead (TenantAdmin configures letterhead; Admin may request updates).
Marketing — Public site branding (TenantAdmin).
Executives — dashboards only, no configuration.

Work through dashboards in this group to orient yourself, then users and roles before inviting the team. Tenant provisioning and integrations live under Tenant Admin overview.

Documentation for Hub, CRM, PM, and SCM megamenus is in the sidebar groups below — each menu link has its own page.

Dashboard

Admin → Dashboards → Dashboard (/dashboard) is the dashboard launcher — a grid of cards that link to each analytics screen your role can access. Where the hub home (/) opens modules, this page answers: How is the business performing?

Cards appear based on enabled applications and permissions. Everyone with CRM may see the CRM dashboard card; Accounting unlocks the financial dashboard; Inventory unlocks purchasing, sales, and inventory dashboards. Open a card to drill into charts, KPIs, filters, exports, and optional Analyze buttons that send context to the Workspace assistant.

The same dashboards are listed under the Dashboards submenu in the left sidenav (and in the horizontal nav on smaller layouts). The ADMIN megamenu shows Home, Dashboard, CRM, and Project links in its first column; finance and SCM dashboards are on the launcher and sidenav even when they are not duplicated in that megamenu column.

All dashboard screens

Screen	Route	Requires
CRM dashboard	`/dashboard/crm`	CRM
Project dashboard	`/dashboard/projects`	PM
Financial dashboard	`/dashboard/finance`	Accounting
Sales dashboard	`/dashboard/scm-sales`	Inventory
Purchasing dashboard	`/dashboard/scm-purchasing`	Inventory
Inventory dashboard	`/dashboard/scm-inventory`	Inventory

When to use a module dashboard instead

If your question is specifically about sales pipeline health, open CRM dashboard. If it is about sprint load and project risk, open Project dashboard. For GL profit & loss and cash, use Financial dashboard. For open POs, booked sales, or stock on hand, use the three SCM dashboards. Operational SCM dashboards show document-level KPIs; the financial dashboard shows posted journal balances — both are useful and answer different questions.

Hub overview

Hub → Hub apps → Hub overview opens the workspace landing page at /apps/workspace. If you are new to inveazy, think of this screen as the front door to collaboration tools — files, messages, calendar, assistant, and blog — rather than the place where you run sales or warehouse operations. Those live under the CRM and SCM megamenus.

This page is different from the main Applications launcher at /hub (also reachable from Admin → Dashboards → Home). The /hub launcher shows tiles for every enabled module in your workspace — CRM, PM, Inventory, Blog, and so on. The workspace landing at /apps/workspace is narrower: it groups shortcuts to hub-style apps only, organized in cards so you can jump straight to All files, Notifications inbox, Calendar, Assistant, or Blog without hunting through the full module grid.

The layout uses three columns on wide screens. The first column covers File manager entry points (all files, recent, folders, and diagnostics for administrators). The second column covers Notifications (inbox and compose) plus Calendar. The third column shows Blog hub when that module is enabled; the Workspace assistant lives in its own top-bar column and in the Assistant group in this Help sidebar. Cards you do not see mean either the module is turned off under Integrations or your role does not include access.

When to start here vs the module launcher

Use /apps/workspace when your day revolves around documents, team messages, scheduling, or content — for example an office manager checking notifications, a marketer opening the blog, or anyone grabbing a file from a shared folder. Use /hub when you need CRM, PM, SCM, or another business module and want the full tile grid. Many users bookmark one or the other depending on their job; both are valid front doors after sign-in.

For the full Hub megamenu map, see Hub menu overview. Detailed guides for each card on this page are in the sidebar Hub group: File manager, Notifications inbox, Calendar, and Blog hub. AI chat is documented under Assistant — start with Assistant overview.

File manager

Hub → Hub apps → File Manager (/apps/file-manager) is where your workspace stores uploaded documents, images, and other attachments. If you have used Google Drive, Dropbox, or a network share, the idea is familiar: folders organize files, and each file has a name, size, and owner. inveazy keeps files inside your workspace so CRM, Blog, Notifications, and other modules can reference the same library without copying bytes into every feature.

The main view lists files and folders for the tenant you are signed into. You can browse the tree, open a folder to see its contents, upload new files, download or preview existing ones, and run actions the UI exposes (rename, move, delete — depending on your role). Recent (/apps/file-manager/recent) shows files you opened or changed lately, which is handy when you are jumping between blog images and email attachments. Folders (/apps/file-manager/folders) emphasizes the folder tree for quick navigation when you already know the directory structure.

Files uploaded here are not anonymous public links by default. Other signed-in users in the same workspace see them according to permissions. When you pick a featured image for a blog post or attach a file in Notifications compose, you are usually choosing from this library. The Workspace assistant (see Assistant in this sidebar) can also reference folder names when read-only data is enabled under Integrations → AI assistant.

Stock images and blog media

Marketing and blog workflows often rely on images stored in File manager. The Blog hub lets you attach featured images and inline media from your tenant library rather than pasting random URLs. Keep a sensible folder structure — for example Marketing / Blog / 2026 — so editors can find assets quickly. Large video files are supported in some editors, but email and notification delivery may still prefer smaller attachments; test before sending to external recipients.

Diagnostics (administrators)

TenantAdmin and Admin roles see a Diagnostics entry on the workspace landing and inside File manager (?view=diagnostics). This screen runs storage and pipeline health checks — useful when uploads fail or thumbnails do not generate. It is a troubleshooting tool, not a day-to-day browse view. Regular users should use All files or Recent instead.

File manager must be enabled under Admin → Integrations → Applications. If the menu link is missing, ask your administrator to enable it or grant your role access. See also Hub overview for shortcut cards into this app.

Notifications inbox

Hub → Hub apps → Notifications (/apps/notifications) is the in-app inbox for messages sent inside your workspace. It works like a simplified email client built into inveazy: you see a list of notifications, open one to read the full body, and optionally reply or follow links to related records (a purchase order, a CRM activity, a blog post). The bell icon in the top bar also surfaces recent items, but the inbox is where you search, filter, and work through everything systematically.

Notifications are tenant-scoped. You only see messages for the workspace you are signed into. System-generated alerts — for example when an order status changes or someone assigns you a task — may appear here alongside human-written broadcasts from Compose notification. Treat the inbox as the official record of what the app told you, even if you also received email for the same event (email depends on SMTP settings under Integrations).

The hub shell uses a left sidebar for navigation. In Mail mode you get folders, labels, and search across your tenant's notification stream. Click a row to expand the message; the layout can switch to a focused reading view with thread history and action buttons at the bottom. Unread items typically stand out in the list; use filters when the volume grows after go-live.

Folders, labels, and search

Folders help you organize messages the way you would in Outlook or Gmail — for example Operations, HR, or Archived. Labels add cross-cutting tags without moving the message out of its primary folder. Search scans subjects and bodies so you can find an old announcement months later. If you are unsure where a message lives, start with search rather than clicking every folder.

Bell dropdown vs full inbox

The topbar bell is a quick preview of the latest notifications. Use it for glanceable alerts during the day. When you need to mark items read in bulk, compose a reply, or read a long HTML message with images, open the full inbox. The bell's View all link lands on this same page.

To send a new message, use Compose notification. To see dates alongside CRM tasks and PM work items, switch the sidebar to Calendar mode or open Calendar directly. Notifications must be enabled under Integrations → Applications for non-admin users to reach this URL.

Compose notification

Hub → Hub apps → Compose (/apps/notifications/compose) is where you write a new notification to other users in the workspace — or, when configured, to external email addresses. Think of it as send a team announcement rather than edit a customer record. Sales updates still belong in CRM; warehouse alerts might be automated from SCM, but Compose is for deliberate human messages.

The compose screen uses a rich text editor (similar to the Blog hub) so you can format headings, bullet lists, links, and embedded images. Fill in recipients — often individual users, roles, or distribution lists depending on what your administrator enabled — plus a subject line and body. A Send action stores the notification in the tenant inbox and, when SMTP is configured, may also deliver HTML email to external inboxes. Plain-text fallback is used when HTML cannot be sent.

Before your first outbound message, confirm Admin → Integrations → Email (SMTP) is set up if you expect real email delivery. In-app delivery works without custom SMTP; email to external inboxes (Outlook, Gmail, etc.) does not. Tenant SMTP overrides the host-wide mail settings when turned on. See Integrations for host, port, TLS, and from-address fields.

Images and attachments

Inline images in compose are sanitized for safe storage and email rendering. Prefer images already uploaded to File manager when possible so you are not pasting untrusted URLs. Very large images may be slow for mobile readers; resize marketing graphics before embedding. Video embeds may appear in-app but not every email client displays them — include a text link as backup.

Who can compose?

Not every role can open Compose. Your workspace administrator controls access through roles and the Notifications module toggle. If you see the inbox but not Compose, ask for a role adjustment rather than sharing your account. Composed messages appear in recipients' Notifications inbox and may trigger bell alerts immediately after send.

After sending, return to the inbox to confirm delivery or open the message thread. For automated system notifications (order shipped, invoice paid), you do not use this screen — those originate from business modules and background jobs.

Calendar

Hub → Hub apps → Calendar (/apps/calendar) shows upcoming dates in one grid-style view. The goal is to answer a simple question without opening three different modules: What is happening this week? Hub calendar events sit alongside dates pulled from CRM activities and PM work items when those modules are enabled, so sales follow-ups and project deadlines can appear next to team meetings or internal reminders.

You can open Calendar from the Hub megamenu, from the workspace landing cards, or by switching the Notifications hub sidebar to Calendar mode (the Mail | Calendar toggle at the bottom of the left panel on /apps/notifications). All routes aim at the same calendar experience; pick whichever entry point matches where you already are in the app.

Calendar is a read-oriented aggregation for most users today. Creating or editing the underlying CRM activity or PM task still happens in CRM or PM screens. When you click an item, the app should take you to the source record or show enough context to decide your next step. Do not expect full project scheduling (Gantt-level detail) here — that remains under PM → Gantt.

What appears on the grid?

Typical rows include CRM activities with due dates, PM work items with target dates, and hub-native calendar placeholders as the feature matures. Color or icon cues may distinguish module sources. If a module is disabled under Integrations, its dates will not feed the calendar. Empty grids usually mean no dated items exist yet, not a broken integration.

Planning your day

A practical morning routine: open Calendar for the week view, note overdue CRM activities, check PM items due before Friday, then jump into the relevant module to do the work. Pair this with the Notifications inbox for messages that do not have a calendar date attached.

Calendar access requires the Calendar application to be enabled and your role to include hub permissions. Administrators configure modules under Integrations → Applications.

Blog hub

Hub → Blog → Blog hub (/apps/blog) is the editor workspace for marketing and editorial content inside your tenant. If you have used WordPress or Medium's admin screens, the split is similar: this hub is where authors write and publish; the All posts library is where readers browse finished articles. Blog is optional — enable it under Integrations → Applications and grant blog edit permissions to marketing roles.

The hub uses a three-column shell. A post list or tree on the left helps you switch between drafts and published articles. The center holds the rich text composer (Quill) for title, body, and HTML source editing. The right rail stores metadata: slug, publish state, categories, tags, featured image from File manager, SEO fields, and landing-page options tied to Public site branding. Save often; long drafts are easier to recover than retyped paragraphs.

Publishing makes a post visible to readers who can open /apps/blog/read or follow links from your public marketing site when blog integration is wired. Draft posts stay inside the hub until you explicitly publish. Preview flows let you check layout before go-live. Exact public routing (subdomain vs path) depends on branding settings and roadmap items noted in the Hub megamenu's Next sessions column.

Compose, tags, and media

Write in the rich text editor for everyday formatting — headings, lists, bold, links, block quotes. Switch to HTML source when you need precise control or paste content from the Workspace assistant (blog scope outputs Quill-friendly HTML, not Markdown). Tags and categories help organize posts for the read index filters. Featured images should be chosen from File manager so URLs stay tenant-stable.

AI-assisted drafting

The hub links to /apps/assistant?scope=blog for review and rewrite workflows. Ask the assistant to critique structure, suggest SEO improvements, or produce a draft from a topic outline — then paste the HTML back into the composer. Scoped blog data lets the assistant see existing post titles and bodies when read-only data is enabled. See Workspace assistant for BYOK, models, and report formatting rules.

Who can edit?

Only roles with blog edit permission see the Blog hub link. Readers without edit rights may still open All posts when the Blog module is enabled. Coordinate with your TenantAdmin if marketing staff need compose access but should not see SCM or CRM menus — roles are granular under Roles.

After publishing, share the read URL with stakeholders or embed links in Compose notification announcements. Future roadmap items (public area routing, RSS feeds) are placeholders in the Hub menu and are not production features yet.

All posts

Hub → Blog → All posts (/apps/blog/read) is the read-friendly index of published blog content in your workspace. Authors live in Blog hub; this page is for browsing, searching, and opening individual articles without the editing chrome. Think of it as the internal newspaper rack for your company blog.

The layout typically includes a hero area for featured stories, a searchable grid or list of posts, and sidebar widgets for categories, latest posts, and popular tags. Click a title to open the full article at /apps/blog/post/{id}. The read view focuses on typography and images — not on Quill toolbars or publish buttons.

Filtering by category or tag helps new employees find onboarding articles or product release notes. Search matches titles and excerpts so you can jump directly to a policy document or tutorial. If a post does not appear, confirm it was published in the Blog hub and that your role may view blog content (the module can be enabled for readers who cannot edit).

Readers vs editors

Users with edit permission see shortcuts back to the hub to revise a post. Pure readers stay in the library and post detail pages. This separation mirrors how many organizations give all staff read access to the internal blog but limit compose rights to marketing.

Public site relationship

Depending on Public site branding, some posts may also surface on the anonymous marketing site visitors see before sign-in. The internal read index is always available to authenticated workspace users when Blog is enabled. Public routing features on the roadmap will extend discovery (RSS, dedicated public zones) without replacing this signed-in library.

Enable Blog under Integrations → Applications. For writing workflows, pair this page with Blog hub and optional Workspace assistant drafting at ?scope=blog (documented under Assistant in this sidebar).

Accounting — how it fits together

inveazy Accounting is the finance slice of SCM: you run warehouse and sales operations here, record money in and out, and optionally keep QuickBooks Online (QBO) aligned as your accountant’s system of record. inveazy is not a full QuickBooks replacement — it gives you operational AR/AP, a lightweight general ledger (GL) in SQL (Acct_Journal), and controlled export/sync to QBO. Stripe is the card-payment rail for customer invoices and storefront checkout; inveazy never stores card numbers.

Enable the Accounting module and connect providers under Admin → Integrations. Each workspace connects its own QBO company and Stripe account. After changes, use Sync status on that screen to confirm exports succeeded.

Three layers: operations, local GL, QuickBooks, Stripe

Think of four cooperating pieces:

SCM documents — purchase orders, receipts, shipments, vendor bills, and customer invoices. These mirror what happened in the warehouse and on the sales desk.
Local GL — balanced journal entries posted in inveazy when you approve documents or record payments. You can report in-app (finance dashboards, GL queries) without opening QuickBooks every day.
QuickBooks Online — optional but typical for small businesses. Master data (products, vendors, customers) and subledger documents (Bills, Invoices, Payments) sync or export to QBO. Your bookkeeper reconciles bank accounts and runs formal financial statements there.
Stripe — optional card collection. Customers pay on a Stripe-hosted checkout page; webhooks tell inveazy the invoice is paid. Processing fees are tracked for GL and can be reflected in QBO without double-counting revenue.

Sell side (simplified):
  Quote → Sales order → Shipment → Invoice
    │                              ├─ Local GL: DR Accounts Receivable / CR Revenue (+ tax)
    │                              ├─ QBO: Invoice (via AR export batch or direct sync)
    │                              └─ Customer pays → Stripe Checkout OR check/ACH recorded in-app
    │                                     ├─ Local GL: clear AR to Cash (fee split if Stripe)
    │                                     └─ QBO: Payment on Invoice (+ fee entry if Stripe)

Buy side (simplified):
  PO → Receipt → Vendor bill
    │       ├─ Local GL: inventory / GR-IR on receipt (when enabled)
    │       └─ QBO: Bill (via AP export batch or direct sync)
    └─ You pay vendor in bank / QBO Bill Pay (outside inveazy)

Outside PO/SO:
  Income & expenses (cash entry) → Local GL → QBO Purchase (expense) or Deposit (income)

Income & expenses (`Acct_CashEntry`)

Income & expenses (/inventory/cash-entries) is for money that does not belong on a formal vendor bill or customer invoice — petty cash, bank service charges, a one-off consulting deposit, or a quick office supply run without a PO. Each entry is either expense or income, with:

A category account (expense or revenue line on your chart).
A money account (bank or cash — e.g. operating checking).
Amount, date, payee/party, memo, and optional link to a CRM customer on income rows.

Workflow: save as draft, then post. Posting creates a balanced local journal — expense posts DR category / CR money; income posts DR money / CR category. If QuickBooks is connected, the entry syncs as a native QBO Purchase (expense) or Deposit (income), not as a duplicate journal entry. Edits to a posted entry update both the local journal and the existing QBO transaction on re-sync.

Use Vendor bills and Invoices when you need open AP/AR aging, three-way match, or ties to PO/SO lines — not cash entries.

Accounts receivable — invoices, exports, and Stripe

When you issue a customer invoice from fulfilled sales (or a storefront order), inveazy records what the customer owes:

Local GL at invoice — typically debits Accounts Receivable and credits sales revenue (and sales tax payable when applicable). Shipment posting may also move COGS and inventory when inventory accounting is enabled.
QuickBooks — approved invoices export through AR export batches (or sync on demand). Customers, items, and tax accounts must map to QBO first — configure under Integrations.
Stripe payment — when Stripe is enabled, sending an invoice email can create a Stripe Checkout link (checkout.stripe.com). The customer pays on Stripe’s page; a webhook marks the invoice paid in inveazy. Local GL then records cash received net of Stripe’s processing fee (fee booked to a merchant-fees expense account). QuickBooks receives a native Payment against the invoice for the gross amount, plus a separate fee entry — the app avoids pushing the full cash-receipt journal twice so QBO does not double-count AR.
Non-Stripe payment — check, ACH, wire, or cash recorded manually clears AR in the local GL (DR bank / CR AR). QuickBooks payment recording for manual methods may be completed in QBO; the local books still reflect the receipt for in-app reporting.

Storefront Web orders follow the same pattern: order → shipment → invoice → Stripe checkout at checkout or invoice email, depending on terms.

Accounts payable — vendor bills and export batches

On the buy side, a vendor bill records what you owe after goods or services arrive. Match it to the PO and receipt when possible (three-way match). Approved bills roll into AP export batches and become QBO Bills. You pay suppliers in your bank portal or QuickBooks Bill Pay; inveazy tracks approval and open balance until export and payment are reflected in QBO.

Receipt posting may capitalize inventory or expense consumables immediately depending on product setup — see End-to-end workflows for the PO → receive → bill chain.

Avoiding double-counting in QuickBooks

inveazy deliberately separates native QBO documents from journal-only events:

Event in inveazy	Local GL	What goes to QuickBooks
Customer invoice	Yes — AR / revenue	QBO Invoice (not the same journal again)
Vendor bill	Yes — AP / expense or inventory	QBO Bill
Income / expense cash entry	Yes	QBO Purchase or Deposit
Stripe invoice payment	Yes — cash, fee, clear AR	QBO Payment + fee entry (not duplicate cash journal)
Cycle count variance, some adjustments	Yes	QBO Journal entry (no native document)

If Sync status shows errors, fix account or name mapping, then Re-sync. Common failures: missing QBO bank account for cash entries, customer not synced before an AR deposit, or item/account mismatch on bills.

Typical month-end rhythm

Close warehouse activity — finish shipments and receipts for the period.
Post stray cash items in Income & expenses.
Approve vendor bills and invoices; run AP and AR export batches to QuickBooks.
Confirm Stripe-paid invoices show paid and check Sync status for QBO payments and fees.
Reconcile bank and QBO in QuickBooks (official statements) — inveazy operational totals should align with exported documents.

Where to read next

Income & expenses — day-to-day cash in/out outside PO/SO.
Stripe payments — platform vs tenant commerce, checkout, webhooks.
QuickBooks setup — OAuth checklist and troubleshooting.
Invoices and AR export batches — money customers owe you.
Vendor bills and AP export batches — money you owe suppliers.
End-to-end workflows — sell-side and buy-side document chains.
Integrations — Stripe, QuickBooks OAuth, sync status, module toggles.
Reference & glossary — AR, AP, GL, COGS, export batch definitions.

Stripe payments

Stripe in inveazy serves two separate purposes. Do not mix them — they use different accounts, keys, and webhooks.

World	Who pays whom	Where configured	Typical use
Platform SaaS billing	Tenants pay you (the host) for inveazy subscription	Demo / billing host `Stripe__*` only — never paste these into a customer install	Admin billing Checkout / Customer Portal; webhook `/api/billing/stripe/webhook` on that host
Tenant commerce	Your customers pay your business for invoices and web orders	Stack env `Stripe__` for that install (what checkout uses today) + Admin → Integrations → Providers → Payments* for keys checklist and webhook URL	AR invoice pay links, storefront checkout; card data stays on Stripe

This guide focuses on tenant commerce — the Stripe account for buyers paying invoices and web orders. See Accounting overview for how paid invoices post to GL and QuickBooks.

What you configure where

Stack / Dockhand env (Stripe__SecretKey, Stripe__PublishableKey, Stripe__WebhookSecret, optional Connect secret) — required for checkout and webhook verification at runtime. New provisions should leave these blank (or use shared test keys) until the customer supplies their own account — do not copy Hivoltech live keys into customer stacks.
Integrations → Providers → Payments — paste the same four secrets for the workspace record (encrypted; not shown again after save), enable Stripe, and Copy the webhook endpoint. Keys saved here do not override stack env yet.
Checkout return URLs (invoice success/cancel, platform billing success/cancel, portal return) — live in stack/appsettings. The app sends them to Stripe when creating Checkout or Portal sessions. You do not paste those into the Stripe Dashboard.

Setup checklist (TenantAdmin / operator)

Enable Accounting (and Inventory / storefront if you take web orders) under Integrations → Applications.
In the customer’s Stripe Dashboard → Developers → API keys, copy secret (sk_test_… / sk_live_…) and publishable (pk_…) keys.
Open Admin → Integrations → Providers → Payments. Paste secret, publishable, and webhook secrets; enable Stripe; Copy the webhook URL shown (e.g. https://{slug}.inveazy.com/api/billing/stripe/webhook).
Stripe Dashboard → Developers → Webhooks → Add endpoint → paste that URL. Select events you need (at least checkout.session.completed). Reveal the signing secret (whsec_…) and put it in both the Payments form and stack Stripe__WebhookSecret.
Set the same keys on the stack env (Dockhand / compose .env) and redeploy/recreate the app container so runtime picks them up.
Start in test mode — send a test invoice email, pay on checkout.stripe.com, confirm the invoice shows paid in Invoices.
Switch to live keys only after smoke-testing AR pay and (if used) Web orders checkout. Register a separate live webhook endpoint (or mode) and matching whsec_.

Localhost: do not register http://localhost:… as a Dashboard webhook. Use stripe listen --forward-to http://localhost:5148/api/billing/stripe/webhook and paste the CLI whsec_… into WebhookSecret.

How customer invoice payment works

Finance issues and sends a customer invoice (email with PDF/link).
When Stripe is configured on the host, sending the email can create a Stripe Checkout Session — the pay link points to checkout.stripe.com, not an in-app card form. inveazy never stores card numbers (PCI scope stays on Stripe).
The customer completes payment. Stripe fires checkout.session.completed; inveazy marks the invoice paid, posts local GL (cash net of fee, merchant fee expense, clear AR), and can notify your team.
If QuickBooks is connected, a native Payment is recorded against the QBO invoice plus a separate fee entry — see Accounting overview to avoid double-counting journals.

Storefront and prepaid terms

Web orders often collect payment at checkout (prepaid) instead of Net 30 invoice terms. The same commerce Stripe keys apply. B2B customers on account may still receive desk invoices with optional Stripe pay links later. Payment terms on Customers drive which path applies.

Troubleshooting

Pay button missing or disabled — stack Stripe__SecretKey empty, Accounting off, or invoice not in a sendable status. Check Sync status Connections for host Stripe configured.
Customer paid but invoice still open — webhook not delivered (firewall, wrong URL for this hostname, wrong whsec_). Use invoice detail Check Stripe payment if available; fix webhook and retry.
Keys in Integrations but pay still fails — runtime uses stack env today; update Dockhand/compose Stripe__* and recreate the container.
Test vs live mismatch — session created with test keys but Dashboard viewed in live mode (or vice versa).
Amount disputes — Checkout uses invoice grand total; partial payments are not the default AR Checkout path.

Platform SaaS subscription keys stay on the billing/demo host only. Tenant admins should never paste those into a customer install’s Payments tab or stack env.

QuickBooks Online setup

QuickBooks Online (QBO) is the usual system of record for small-business books after operations run in inveazy. Connect once per workspace under Admin → Integrations → Providers → QuickBooks Online. OAuth tokens are stored encrypted; Intuit handles sign-in — you pick the QBO company (sandbox companies work for testing).

Read Accounting overview first for how local GL, export batches, and native QBO documents fit together without double-counting.

First-time checklist

Enable modules — Accounting (and Inventory if you sync products) on Integrations → Applications.
Seed chart of accounts — new tenants get a default chart via sp_Acct_SeedDefaultGlChart (accounts such as 1000 Cash, 1100 AR, 1200 Inventory, 2000 AP, 5000 COGS, 6400 Bank & Merchant Fees). Posting errors mentioning a missing GL account may require re-running seed for the tenant.
Connect QBO — Providers → QuickBooks → Connect to QuickBooks. Complete Intuit OAuth; confirm Sync status shows connected realm. If Connect fails with redirect_uri is invalid, copy the displayed OAuth redirect URI and contact us (info@inveazy.com) to register it on the Intuit app — do not edit the developer portal yourself unless asked.
Webhook (optional) — outbound sync works without it. The displayed webhook URL is for Intuit → inveazy change notifications; ask us to register it if you need that.
Sync master data (order matters for fewer errors):
- Products → QBO Items
- Vendors → QBO Vendors
- Customers (CRM accounts) → QBO Customers
Smoke test transactional sync — post one cash entry (Purchase or Deposit), one vendor bill, one invoice. Use Integrations Test export or normal approval + AP/AR export batches depending on your workflow.
Review Sync status — confirm Product, Vendor, Customer, Invoice, VendorBill, CashEntry rows show synced; clear any errors with Re-sync.

What syncs as what

inveazy document	QuickBooks entity	Notes
Customer invoice	Invoice + Payment (when paid, incl. Stripe)	Do not also push the invoice GL journal
Vendor bill	Bill	AP export batch groups releases
Income / expense cash entry	Deposit (income) or Purchase (expense)	Money account must map to a QBO Bank account
Cycle count / some adjustments	Journal entry	No native QBO document in inveazy
Product	Item	Expense/income accounts resolved from GL mapping

Export batches vs direct sync

AR and AP export batches let finance review totals before releasing a group to QBO — typical for month-end. Individual documents may also sync on approval or via Re-sync from Sync status when a single row failed. Re-sync on an already-linked record updates the same QBO entity rather than creating duplicates.

Common errors and fixes

Symptom	Likely cause	Fix
Cash entry sync failed — bank account	Money GL account has no matching QBO Bank	Create/map bank account in QBO; re-sync entry
Invoice sync failed — customer	CRM account not synced to QBO Customer	Sync customer first; re-sync invoice
Bill sync failed — vendor or account	Vendor missing or expense account mismatch	Sync vendor; align bill line accounts with QBO chart
Product / item errors	No expense or income account in QBO for item type	Fix product GL mapping; sync product again
OAuth / token errors	Refresh token revoked or company disconnected	Reconnect QuickBooks on Providers tab
Stripe paid but QB payment missing	Invoice not in QBO yet or sync lag	Export/sync invoice first; check AR batch Re-sync for fee payment

After fixing mapping, use Sync status → Re-sync on the failed row. Persistent failures often mean the QBO company chart differs from inveazy defaults — align account names/numbers or adjust product and category GL links before bulk month-end exports.

Related: Integrations (OAuth UI), Stripe payments (invoice checkout), Reference & glossary (AR, AP, GL terms).

Workspace assistant

HUB → Assistant → Workspace assistant (/apps/assistant) is an AI chat panel for your workspace. You can ask how inveazy features work, draft text, brainstorm ideas, or — when configured — request summaries grounded in live CRM, PM, or blog data. It is not a replacement for clicking through modules; it is a conversational layer on top of the same tenant you already signed into.

The page has three regions. On the left, Scope chooses which module context the assistant may use (General, CRM, PM, Blog, File manager, Notifications, Calendar, Dashboard, and others your administrator enabled). In the center, the thread shows the conversation. On the right, tabbed panels let you write a message, pick a model, edit workspace rules, inspect built-in report templates, and read the in-app guide. Pick a scope first, then send from the Message tab — the empty state reminds you of that order.

If the assistant is disabled, the center panel explains why and links to Admin → Integrations. A TenantAdmin must enable the Assistant application and configure AI under the AI assistant tab before chat works. Until then, non-administrators see a friendly blocked state rather than a broken send button.

Bring your own key (BYOK) and models

inveazy supports two ways to connect to large language models. The host may provide a built-in endpoint (Azure OpenAI or similar) managed by the platform operator. Alternatively, your workspace can use bring your own key (BYOK) — you paste an API key from OpenAI, Anthropic, Google Gemini, or another supported provider under Integrations → AI assistant. BYOK bills go to your provider account; the built-in path bills the host.

End users choose a Model on the assistant's right rail (stored per browser). Pricing hints in the Guide tab are approximate list prices for planning only. Admins set which providers and model names are allowed. Never paste API keys into the chat box — use Integrations, which stores secrets encrypted and does not show them again after save.

Scope and read-only workspace data

General scope answers from public knowledge plus any workspace rules you configured — not from live database rows. To ask How many open opportunities do we have? or Summarize this week's PM work items, select the matching module scope (CRM, PM, etc.) and ensure Allow read-only workspace data is on in Integrations. That toggle lets the server attach a sanitized MODULE SCOPED DATA block to your prompt. Without it, the model must not invent counts; it should tell you data was not loaded.

Read-only SQL access (optional AppHubAssistantRead login) is documented under Integrations → Read-only database. It is related but distinct: scoped data in chat is curated per module, while the SQL login is for Power BI or SSMS reporting. Both respect tenant isolation.

Workspace rules and built-in templates

The Workspace tab holds custom instructions for your tenant — tone, terminology, boundaries (for example do not quote prices), and optional module-data rules. Admins edit these once; every user inherits them. The Built-in tab shows locked templates such as Report / export — rich HTML output and Blog draft — Quill-ready HTML that shape how answers are formatted when you request reports or blog content.

The Guide tab summarizes costs, scope behavior, and links back to Integrations. Use Clear history in the header if a thread becomes slow or stuck; that deletes saved chat messages for your user without changing workspace settings.

HTML reports and prompt templates

When you ask for a report, status summary, or executive summary, the assistant can reply with formatted HTML instead of plain text. Built-in report rules enforce a table-first layout: title, date, numbered table of contents, KPI cards, status badges, and short prose after each table. PM-focused prompts cover project status, phase progress, risk analysis, resource capacity, and weekly standups. CRM prompts cover pipeline forecasts, activity follow-ups, and account reviews. Say quick report or one-pager for a shorter template.

Reports should only cite rows present in MODULE SCOPED DATA. The model marks uncertain cross-module guesses with [VERIFY]. You can print or copy the HTML into email; for blog drafts, switch to Blog scope and use prompts that output Quill-compatible HTML (no Markdown fences). The Blog hub also links to /apps/assistant?scope=blog for review workflows.

Privacy and support boundaries

Do not share passwords, payment card numbers, or private API keys in chat. The assistant should redirect secret management to Integrations. It must not invent inventory quantities, pipeline dollars, or customer names when scoped data is missing. For account-specific escalations, contact your TenantAdmin.

Configure AI under Integrations, enable the Assistant app on the Applications tab, and pair this guide with Blog hub when drafting posts. For module business data without AI, use CRM and PM dashboards directly. Start with Assistant overview for the product-level AI story.

About inveazy

inveazy is a multi-tenant business hub: one installation hosts many isolated workspaces (tenants). Each workspace enables only the modules it needs — CRM, supply chain, accounting, blog, assistant, and so on — from a single sign-in. Operational documents (POs, SOs, invoices, work items) and posted journals share one SQL database per install, with row-level isolation by TenantId.

What is shipped today

The Available today section on /about summarizes live modules. In plain terms:

Area	What you get	Help / entry
CRM & PM	Pipeline, opportunities, projects, board, sprints, dashboards	CRM, PM
Supply chain	Vendors, PO/SO, WMS, receipts, shipments, cycle counts, mobile scan, web orders	SCM overview
Accounting	Invoices, vendor bills, cash entries, GL posting, financial dashboard, QB + Stripe	Accounting overview
Hub apps	Files, notifications, calendar, blog, workspace assistant (AI)	Hub, Assistant
Platform	Tenant provisioning, module toggles, integrations, public site branding, analytics dashboards	Tenant Admin & Admin

Analytics dashboards (shipped)

Read-only KPI screens — not the same as the /about page:

CRM dashboard — pipeline and activity
Project dashboard — portfolio and sprints
Financial dashboard — P/L and GL balances
Sales, Purchasing, Inventory — SCM operations

Launcher: /dashboard or sidenav Dashboards. See Dashboard help.

Roadmap

Roadmap on /about lists net-new modules (BOM/kits, manufacturing, GPO, assets, field service, logistics/TMS, POS, agriculture, environmental sensors, hardware catalog, tickets, events, courses). They are not enabled in your tenant until they ship. Full table: Roadmap. Shipped highlights (including license plates & staging): Changelog.

Incremental improvements to shipped modules (e.g. consumables pick, BOM queues) ship in regular releases rather than as separate roadmap cards.

Is a module on for me?

Three gates: (1) Applications toggle under Integrations, (2) your role includes that module, (3) the feature is actually shipped (not roadmap-only). If /about links to an app but you get 403/404, ask a TenantAdmin about roles or toggles — the product may be live globally but off for your workspace.

About vs Help

/about = feature catalog and links. Help = how to run each screen day to day. Start with About for orientation; use Getting started and the module groups in this sidebar for procedures.

Reference & glossary

Use this page when you encounter an unfamiliar acronym in SCM, CRM, or admin screens. Terms are grouped loosely by topic. For narrative walkthroughs, open the matching item in the SCM, CRM, or Admin sidebar groups.

Platform

Term	Definition
Tenant / workspace	Isolated organization environment on one install — own users, data, modules.
Module	Functional app area (CRM, PM, Inventory) enabled per workspace.
RBAC	Role-based access — roles bundle module permissions assigned to users.
TenantAdmin	Workspace administrator — users, integrations, branding, provisioning.
BYOK	Bring your own key — tenant-supplied AI API key for the assistant.

SCM documents

Term	Definition
PO (purchase order)	Commitment to buy from a vendor; drives receiving and AP matching.
SO (sales order)	Customer order to fulfill; drives pick, ship, and invoicing.
Quote	Non-binding offer to a customer; may convert to an SO.
Receipt	Inbound document posting stock from a PO (or ad hoc receive).
Shipment	Outbound pick/pack/ship against an SO; reduces on-hand.
Transfer	Stock move between warehouses or bins without a sale or PO.
RMA / return	Customer return authorization — restock, scrap, or refund path.
Cycle count	Physical count vs system qty; variances post adjustment journals.

Warehouse & inventory

Term	Definition
SKU	Stock keeping unit — product identifier you buy, stock, and sell.
Warehouse	Physical or logical site holding inventory (MAIN, secondary DC).
Location / bin	Address inside a warehouse (aisle, shelf, pallet position).
On-hand	Quantity physically available by product, warehouse, and bin.
Lot	Batch identifier for traceability (often with expiration).
FEFO	First-expired, first-out — pick order favors soonest expiry dates.
Backorder	Demand or supply shortfall — SO line waiting for stock or PO line waiting for vendor.
Standard cost	Planned unit cost for GL inventory valuation and COGS.
Consumable	Product type for internal-use items (gloves, labels) issued without an SO.

Accounting

Term	Definition
AR (accounts receivable)	Money customers owe you — customer invoices.
AP (accounts payable)	Money you owe vendors — vendor bills.
GL (general ledger)	Chart of accounts and posted journal entries in `Acct_Journal`.
Three-way match	AP control: PO + receipt + vendor bill quantities and costs align.
COGS	Cost of goods sold — expense when shipped stock leaves inventory.
GR-IR	Goods received / invoice received clearing account on PO receipt posting.
Export batch	Grouped AR or AP documents pushed to QuickBooks Online.

CRM & PM (short)

Term	Definition
Account	CRM sell-to customer company (not a tenant workspace).
Opportunity	Active deal with amount, stage, and close date.
Work item	PM task/bug/story with status, assignee, and dates.
Sprint	Time-boxed PM iteration grouping work items.

Roadmap

inveazy ships in phases. The table below lists planned modules — not product-complete yet. For what is live in your tenant, see About inveazy or /about. For what already shipped, see Changelog.

Module	Code	Status	Notes
BOM / kits / toolsets / consignment	`inventory`	Planned	Extends the inventory module — bills of materials, kitting, toolsets, consignment stock.
Manufacturing	`manufacturing`?	Planned	Shop-floor and production workflows (code TBD).
Group purchasing organization (GPO)	`gpo`?	Planned	Member GPO programs, vendor contract pricing on products and POs, spend under contract, and optional inveazy-run GPO for member workspaces.
Assets, tracking, maintenance	`assets`?	Planned	Asset registry and maintenance; Mapbox asset/site pins.
Field service	`fieldservice`?	Planned	Technician dispatch and routes; Mapbox dispatch + routes.
Logistics, shipping / TMS	`logistics`?	Planned	Transport management; Mapbox routes, stops, proof of delivery.
POS	TBD	Planned	Point-of-sale retail checkout — pairs with card readers and thermal receipt printers.
Issues / tickets	TBD	Planned	Internal or customer issue tracking.
Events	TBD	Planned	Event registration and scheduling.
Education / courses	`edu`?	Planned	Curated training and courses inside the hub.
Livestock management	`agriculture`?	Planned	Herd and flock records, health events, movements, and grazing or pen assignments.
Crop management	`agriculture`?	Planned	Fields, plantings, growth stages, harvest plans, and yield tracking.
Environmental sensors & location	TBD	Planned	IoT feeds (temperature, moisture, soil, tank levels), GPS/asset pins, and alerts for fields, livestock, and equipment.
POS & payment hardware	TBD	Planned	Hardware catalog and sales — POS terminals, card readers, and Stripe-ready payment devices.
Scanners & printers	TBD	Planned	Zebra barcode scanners, mobile computers, and thermal label/receipt printers — quote, fulfill, and integrate with warehouse and POS.

QuickBooks Online and Stripe integrations are available for many tenants today under Integrations. Roadmap rows here are net-new modules; smaller enhancements to shipped modules appear in Changelog.

Changelog

High-level shipped highlights — newest first. This is not a per-commit log; it summarizes releases tenants care about. Planned work lives on Roadmap and /about.

2026-07-16

License plates (LPN) & staging bins
- WMS license plates: create/print pallet labels, assign warehouse location and zone, edit staging bin.
- Mobile Lic. plate mode: scan LPN to view linked POs, product details (Inv#, vendor, Mfg#, UOM, unit price), and pallet grand total.
- Mobile Staging: scan LPN or staging bin to move whole pallets or break down and shelve contents.
- Receive-to-LPN on mobile: multiple POs on one sealed pallet with print label and close-pallet flow.
- Shipments: picked status (draft → picked → packed → shipped) and shipping-staging bins after pick.
2026-07-14

Help, dashboards & platform docs
- Help: Tenant Admin vs Admin split; Buy/Sell/Accounting/Storefront groups; Roadmap and Changelog.
- Tenant Admin docs: Demo vs SandBox, per-workspace self-registration, public branding stored in SQL.
- SCM help: reorder alerts, mobile scanner, throughput KPIs on sales/inventory dashboards.
- Inventory dashboard: calendar-quarter variance; slow movers exclude consumables.
- Financial dashboard charts aligned to AppHub design palette.
2026-07

Help library, storefront & fulfillment
- In-product Help at /help with collapsible sidebar groups matching megamenus; About inveazy catalog.
- B2B storefront V1: web checkout, customer profile, staff web-order fulfillment queue.
- Sales order / pick list / mobile scanner hardening; Stripe webhooks and redirect URLs.
- Inventory dashboard, order mapping updates, and returns (RMA) system.
- CRM customer updates; landing page and new-user onboarding polish; workspace assistant updates.
2026-06

SCM dashboards, mobile warehouse & labels
- Sales, purchasing, inventory, and financial analytics dashboards; Stripe fee visibility.
- Mobile scanner menu: receive, pick, put-away, count, transfer, and track flows (camera / wedge).
- Cycle counts with QuickBooks-aware posting; income & expense cash entries.
- Product labels, Kanban barcodes/QR, ZXing scan stack, and print product sheets.
- Bulk product upload with template; AP export batches and bill-pay setup.
- Order confirmation emails and PO layout improvements.
2026-05

Accounting, integrations, hub apps & assistant
- Local GL path: invoices, vendor bills, cash entries, AR/AP export; order/invoice email processes.
- QuickBooks Online OAuth/sync and Stripe platform + tenant checkout integrations.
- Workspace assistant (AI) V1: module-scoped chat, model options, HTML report writer.
- Hub apps: file manager, notifications inbox/email, calendar, and blog authoring/read.
- Org branding, PWA/icons, multi-tenant registration, and read-only SQL tenant login for reporting.
- SCM document chain foundations (PO → receive → SO → ship) and Docker packaging fixes.
2026-04

CRM, project management & platform shell
- CRM milestone: organizations, accounts, contacts, pipeline/Kanban, activity boards, deals, and CRM dashboard.
- Project management: projects, work items, Kanban boards, Gantt chart, and demo data.
- AppHubWeb replaces the separate API host — signed-in Razor shell, auth, and Scalar in production.
- CRM frontend + APIs/DTOs; theme system, gulp/CSS pipeline, and static asset map.
- Docker Compose, Azure Pipelines CI, container registry, and Azure SQL publish path.
- User manager and login / password-reset flows for workspace users.
2026-03

Foundation — database, API & warehouse schema
- Solution bootstrap: AppHubDb SSDT project, git root, and initial database build.
- Core schema and SQL tests; early warehouse management docs and product catalog tables.
- AppHubApi setup and integration tests (later folded into AppHubWeb).
- Docker and Azure pipeline scaffolding to run the database with the app.
- Backlog and schema spikes for assets, HR, and AI tables ahead of module work.
2026-03-30

Project started

First commits landed this evening (Pacific): .gitignore, project files, init/db, then the initial AppHubDb build the next day. Everything above grew from that foundation.

Help & Documentation

Getting started — overview

What is inveazy?

Who should read what?

Signing in

Navigation — four ideas

Enabling modules

Common first-week paths

Using this help library

Installation & Docker

What you are setting up

Installation order

Step 1 — Prepare the app server

Step 2 — Run SQL Server

Option A — SQL Server in Docker

Option B — Existing SQL Server or Azure SQL

Step 3 — Connect with SSMS and create the database

Local / Docker SQL — recovery model (important)

Step 4 — Install AppHubDb.dacpac (SSMS + SqlPackage)

Step 5 — Deploy AppHubWeb (compose file + connection string)

docker-compose.web.yml

Step 6 — Dockhand environment block (production)

Check that it works

Common problems

Tenant Admin overview

Topics in this group

Typical onboarding order

Tenant workspaces

Demo / SandBox and customer workspaces

Self-registration (per workspace)

Tenant workspaces vs User manager

New tenant workspace

After you create a workspace

My organization

What to configure

Integrations

Applications tab

Providers tab

Sync status tab

Email (SMTP) tab

AI assistant tab

Read-only database tab

Public site branding

General — landing page and blog toggles

Home hero and theme

Where branding is stored

Custom landing page

Contact, footer, and social

Brand & PWA

Multitenancy

Tenant vs workspace vs CRM account

Isolation and reporting

Admin menu overview

Who should use which Admin item?

Home

Relationship to the public site

Dashboard

All dashboard screens

When to use a module dashboard instead

CRM dashboard

Typical workflow

Project dashboard

CRM vs PM dashboards

Financial dashboard

Filters and period

Analyze with AI

SCM dashboards vs financial dashboard

Sales dashboard

Typical KPIs

Purchasing dashboard

Typical workflow

Inventory dashboard

Where to act

User manager

Adding users

Workspace context matters

Users vs CRM contacts

Roles

Applications vs roles

Practical guidance

Step 4 — Install `AppHubDb.dacpac` (SSMS + SqlPackage)

`docker-compose.web.yml`