# Core concepts

> The records SecureForce is built on and how they connect, from workspace to employee to deployment to roster to attendance to reports, payroll and billing.

Most "why don't I see…" questions come from one missing link in a chain. This page explains the chain.

## The chain

```
Organization (company, branch, grade)      Clients & Sites (site point + radius)
            │                                        │
            ▼                                        │
       Employee  ──(same email)──►  Login (Field Employee)
            │                                        │
   Onboarding + KYC                                  │
            │                                        │
            ▼                                        ▼
       Deployment  (employee + client + site + role title + start date + pay rate + bill rate)
            │
            ▼
       Roster assignment  (employee + deployment + shift + site + date)
            │
            ▼
       Check-in on the phone  (photo + location vs the site's boundary)
            │
            ▼
       Attendance record  (present / late / half day / absent / leave / holiday / weekly off)
            │
            ├──► Daily report (DMR): approved headcount vs deployed vs present, per designation
            ├──► Payroll Prep: days × deployment pay rate (+ overtime)
            ├──► Billing Prep: days × deployment bill rate, per client and site
            └──► Client Portal and Reports
```

## The records

| Record | What it is | Created in | Needed by |
|---|---|---|---|
| Workspace | One organisation's private space. Nothing crosses between workspaces. | Sign up / workspace switcher | Everything |
| Company, branch, department, service line, grade | Your own company's structure. | Organization | Employees, deployments |
| Client | A customer you supply staff to. | Clients & Sites | Sites, deployments, billing |
| Site | A place where staff work, with latitude, longitude and a geofence radius. | Clients & Sites | Deployments, rosters, check-in |
| Employee | One record per person. Its **email** links it to a login. | Employees, bulk onboarding | Everything about that person |
| Login (member) | A user account in the workspace with a role. | Administration → Add member | Signing in |
| KYC case | The pre-hire checks for one candidate. | KYC Verification | Deployment readiness |
| Onboarding case | The six-step checklist for one person. | Employee profile → Start onboarding | Deployment readiness |
| Deployment | A person posted at a site in a role, from a **start date**, with a **pay rate** and **bill rate**. | Onboarding step 6, Deployment, bulk onboarding | DMR "Deployed", payroll, billing |
| Shift | A time slot (Day 07:00–19:00, Night…). | Attendance | Roster |
| Roster assignment | One person on one shift at one site on one date, ideally linked to their deployment. | Attendance | The guard's check-in screen, muster, payroll link |
| Attendance record | What actually happened that day: check-in/out times, photo, distance, status. | The guard's phone, or the muster | DMR, payroll, billing, reports |
| Approved headcount | How many people of each designation the contract allows at a site. | Field Attendance → Setup | DMR "Total approved" and shortage |
| Data scope | A limit on what one login can see (a branch, client, site or employee). | Administration → Data Scopes | Supervisors, customers |

## Rules that catch people out

1. **The employee's email must match the login's email exactly**, and only one employee may have it. Otherwise the person sees "Your account is not linked to an employee record".
2. **No roster for today means no check-in.** The phone reads today's roster to know the site and shift.
3. **The deployment's role title must match the approved headcount's designation** (e.g. both *Security Guard*). Otherwise the DMR shows the person under "Cover from another post" or "Unassigned role".
4. **A deployment counts as deployed from its start date.** New deployments start today unless you set a date.
5. **Payroll and billing follow attendance → roster → deployment.** If the roster entry isn't linked to a deployment, or the deployment has no rate, the days are counted at ₹0 and flagged.
6. **Without a data scope, a role sees the whole workspace.** Supervisors and customers should always be scoped.
7. **Approved days are locked.** Approve a day in the muster once it is correct; locked payroll periods can't be regenerated.

## Statuses at a glance

| Record | Statuses |
|---|---|
| Employee | candidate, onboarding, active, on leave, suspended, terminated |
| Onboarding | draft, in progress, blocked, completed, cancelled |
| Document | pending, submitted, verified, rejected, expired |
| KYC case | draft, in review, on hold, cleared, rejected |
| KYC check | not started, in progress, verified, failed, waived |
| Deployment | planned, active, completed, cancelled |
| Shift | draft, published, locked, cancelled |
| Attendance | present, late, half day, absent, leave, holiday, weekly off, exception |
| Leave request | requested, approved, rejected, cancelled |
| Payroll input | draft, approved, exported, locked |
| Billing input | draft, approved, invoiced, locked |
| Compliance task | open, in progress, completed, overdue, waived |