What Patch Pay stops, how it stops it, and who is able to clear it. Each row below is how the product behaves today.
Patch Pay asks Revolut Business for two permissions: READ and WRITE. Every operation at Revolut that moves money needs a third, PAY, which Patch Pay never requests and so never holds.
The drafts it writes sit in Revolut under Transfers until a person sends them. If your Revolut account has its own approval process, the draft goes through that as well. This is how the connection is made, not a switch inside Patch Pay, so nobody can turn it off.
The usual invoice fraud is a real-looking invoice with somebody else’s account number on it. Patch Pay never pays to details taken from a document: a draft goes to a counterparty that already exists in Revolut.
The details on the document are still read, and compared. When they differ from the supplier’s record the invoice is blocked, the approver is told why, and Approve is not offered until two people have dealt with the change.
| Control | What it does | Who can clear it |
|---|---|---|
| Bank details changed | Bank details printed on an invoice are compared with the supplier’s record. If they differ, the invoice is blocked and there is no Approve button, in the app or in Slack. | Two people. One confirms the change with the supplier and records how. A different person commits it. The invoice then returns to approval, never straight to approved. |
| Second approval | An invoice over the first approver’s own limit, or at or over the company’s threshold, needs a second approver. Limits are set per person, per company. | A different person whose own limit covers the amount. An admin sets the limits and the threshold. |
| Separation of duties | A bookkeeper codes bills and prepares payments and never approves. An approver approves and cannot code, prepare payments or change settings. Whoever added an invoice by hand cannot approve it. | Nobody, for a single invoice. An admin changes a person’s role, and the change is in the audit log. |
| Final review | An approved invoice waits for a bookkeeper to release it before the bill is posted. On by default. Preparing a payment automatically when a bill posts is refused while Final review is off. | An admin can switch Final review off for a company. Automatic preparation then stops with it. |
| Closed periods | The current month and the one before it are open. An invoice whose coding reaches an earlier month is sent to a person, with the closed months named, and cannot be approved by a rule. | A person accepts the month by name on the invoice. Who accepted which month, and when, stays on the invoice. |
| Duplicates | The same file, or the same supplier, number and amount, is flagged with a link to the earlier invoice. A bill that is already inside an unsent draft is never drafted again. | The approver, after comparing the two. The earlier invoice stays linked. |
| Credit notes | A credit note posts to QuickBooks as a vendor credit and never as a bill. Payment runs are built from open bills, so a credit cannot be paid. | Not a setting. There is nothing to clear. |
| Untrusted documents | Anything read from an invoice is treated as untrusted. Invoice links are followed only to hosts on an allowlist, and a supplier writing from a new sending domain is flagged. | An admin adds a host or a sending domain to the trusted list, per company. That change is audited. |
| Access per company | A person reaches exactly the companies named on their membership. Adding a company never widens anybody else’s access. Each company’s rows are isolated in the database with row-level security. | An admin grants or removes a company, one person at a time. Each grant names who made it. |
| Audit log | Every stage, approval, setting change and call to QuickBooks or Revolut is recorded with who and when. The log is only ever added to. | Nobody. Patch Pay has no screen and no route that edits or removes an entry. |
Invoices, decisions and the audit log are stored in a Postgres database in London. Bank details, access tokens and API keys are encrypted before they are stored.
Put it in the note on the request form. A person reads it.