Access tier — a per-page permission preset (e.g. Viewer, Preparer, Reviewer, Approver, Full access) that maps to a bundle of underlying permission keys. See Authentication & Authorization.
Audit assurance (auth_assurance) — the authentication strength behind a logged action: password, totp, sso, or otp (email one-time-passcode, used by the change-request flow).
BareLedger — the product name (rebranded from "Books by Syneria" in August 2026). Built by Syneria Technologies OPC.
BIR — Bureau of Internal Revenue, the Philippine tax authority. Several statutory forms/books in this system target BIR requirements (2550Q, 2551Q, 1601-series, Books of Accounts).
Books of Accounts — statutory accounting books (general journal/ledger, sales/purchase books, cash books) in the specific columnar format BIR examiners expect, distinct from general financial reports.
Change request — a pending, email-OTP-confirmed edit to a sensitive resource (org profile, branch, period status), created instead of applying the edit immediately. See change_requests table and Multi-Tenancy & Organization.
Commercial document — the unified backend table/model (commercial_documents) underlying invoices, bills, credit notes, debit notes, quotations, and sales orders — discriminated by a kind field.
CAS — Computerized Accounting System, the BIR classification for accounting software like BareLedger; the "CAS Audit Trail" report supports this classification's audit requirements.
Engine account codes — a fixed set of chart-of-accounts codes (e.g. 1200 AR, 2010 AP, 3020 Retained Earnings) that the posting engine resolves by code and protects from renumbering once in use.
EOPT — Ease of Paying Taxes Act (Philippines, RA 11976) — governs the invoice/receipt lifecycle distinction (invoice = sale recognition, receipt = collection proof) this system implements.
Feature gate — a plan-entitlement check (feature:<key> middleware) distinguishing which capabilities a tenant's subscription plan includes; "strict" mode blocks reads as well as writes when unentitled.
Ledger entry — an immutable, posted general-ledger row (ledger_entries table) — the ultimate output of the posting engine, never edited or deleted after creation.
Maker-checker — a control pattern requiring one person to create/prepare an action and different people to check and approve it (for financial transactions: maker, reviewer and approver are three different people); enforced in this system both for document workflows (segregation of duties) and administrative changes (the change-request OTP flow).
Numbering sequence — a per-document-type, atomically-incremented counter used to assign official document numbers only at posting time (not at draft creation).
Permission key — a flat module.action string (e.g. sales.approve) that is the actual unit of authorization enforcement, as opposed to a role (a convenience bundle of permission keys).
Reversal / reversing entry — the mechanism for correcting a posted (immutable) record: a new, debit/credit-swapped entry is created and posted, rather than editing the original.
Reverse charge — a tax mechanism where the buyer, not the seller, self-assesses and remits tax on cross-border digital-service purchases; posts as a net-zero input/output tax pair.
Segregation of duties (SoD) — the three-person rule: whoever prepared a document can never also review or approve it, and whoever reviewed it can never also approve it, enforced server-side (and again at posting) regardless of the acting user's role/tier or owner status.
Statutory form — a country-specific tax filing (e.g. PH 2550Q, US 1099-NEC) generated by the Compliance, Tax & E-Invoicing form engine from posted ledger data.
Tenant — an organization/company using BareLedger; the top-level unit of data isolation. A user can belong to multiple tenants via memberships.
TOTP — Time-based One-Time Password, the MFA mechanism used for both login-time 2FA and per-action step-up verification.
Withholding tax (WHT) — tax withheld at source; this system tracks both outbound certificates (issued to BareLedger's own suppliers) and inbound certificates (received from customers), each with its own lifecycle.
X-Tenant header — the HTTP header a client sends to select which tenant a request operates within; only trusted if it matches one of the authenticated user's own active memberships.