Six parts, in the order an invoice meets them. At every one of them the invoice is in a named stage, with a named person, and the reason is written down.
Each company gets its own forwarding address. Give it to suppliers, or add a rule to an existing invoice inbox that forwards to it. Mail sent to an address is that company’s and nobody else’s; mail to an address nobody was issued is refused.
Patch Pay takes the attachment, or follows an invoice link when the link goes to a host on the allowlist. A document can also be added by hand, with a note.
The document is read by Claude, Anthropic’s model: supplier, invoice number, dates, currency, net, tax and total, the service period, and any bank details printed on it. The supplier is matched to the vendor list in QuickBooks.
Coding is proposed from how that supplier’s earlier bills were coded: the expense account, the tax code and the month the cost belongs to, line by line. The lines have to add up to the invoice before the bill is posted.
What is read is treated as untrusted. Nothing taken from a document can move money, and bank details from a document are only ever compared with the record.
An invoice goes to the supplier’s default approver, or to whoever usually approves that supplier. Each approver has a limit per company. Over that limit, or over the company’s threshold for a second approval, a second person has to approve as well.
Approvers answer in the app or on a Slack card, and get one worklist a day. An invoice that is not theirs can be handed on in one step, and somebody away names a cover for the dates they are gone.
A rule can approve a routine bill: a known supplier with at least three approved invoices, an amount inside its usual range, and no finding. Anything flagged, anything added by hand and anything that needs a second approver always goes to a person.
Approved invoices wait in Final review. A bookkeeper checks the coding and releases them, and the bill is created in QuickBooks: dated the invoice date, coded line by line, with the document attached. Final review is on by default.
QuickBooks stays the ledger. Patch Pay keeps the workflow and writes one bill; it holds no balances and posts no journals.
The payments page reads the open bills in QuickBooks, by currency and due date. For each one it checks that the payee exists in Revolut and that the bill is not already inside a draft waiting to be sent.
Bills to the same supplier are merged into one transfer. Patch Pay then writes the drafts into Revolut Business, where they wait under Transfers. A person sends them there. Patch Pay has no permission to.
Why it cannot payEvery stage, decision, change to a setting and call to QuickBooks or Revolut is written to an append-only log, with who did it and when. Rules and the reader are named as what they are, never as a person.
Each invoice shows its own trail on its page, and the whole log is under Settings for the company’s admins.
Access is by request, and a person reads every one.