Multi-location workforce management, built on a counter tablet.

That last line is load-bearing. A person who works two stores used to have their whole cross-store rota attached to their first row — the unscheduled store's timesheet filled up with the other store's hours. Scheduled hours are now keyed by employee and location, and a schedule-only row is filed under the store the shift is at. If a timesheet number looks wrong to you, it is wrong, and there's a drawer to fix it with your name on the edit.

Most systems hand payroll off as a flat export and let the office rebuild the workbook they actually use. We built the workbook. One owner-only button produces a genuine .xlsx that mirrors the sheet the bookkeeper was already keeping by hand — sections per legal entity, live SUM formulas in the subtotal cells, hourly rows carrying hours and overtime straight from the punches, and blank leave columns where they're meant to be filled in by hand.

The details that make it usable are unglamorous and all real: a layout switch between per-entity sections and person-major (salary block, then hourly, with mixed people appearing in both); vacation, sick, holiday, bereavement, paternity/maternity and a labelled “other” with its reason appended to the comments; whole-row highlighting when a pay change landed inside that week, when there are leave hours, or when there's a note the office should read; and per-store payroll extras — weekly salary split, mileage, loans, deductions, direct deposit — because a salaried person who covers three entities gets paid differently by each one.

Salary is per store, not per person. Someone can be salaried at three locations and hourly at a fourth, and the workbook, the timesheet and the schedule's salary/hourly split all read it the same way: the salary belongs to the stores that have a profile row for it. Salaried rows show literal zero actual hours with a SALARY tag next to the name — the client's own convention, matched deliberately so the sheet ties out.

One rule worth stating plainly, because it's the kind of automation that goes wrong everywhere else: pay-rule automation suggests. You can set a rule — this many write-ups in this window implies a dock or a raise, by percent or by cents — and when it fires it creates a suggested pay change for the owner to approve or dismiss on its own screen. Nothing changes anyone's pay silently. Every approved move is written to a pay-change ledger with an owner-only history chart.

Multi-location HR is mostly a permissions product. Two mechanisms do the work: store scope, and per-area revokes. A GM or manager is assigned stores; every list they can reach — people, schedule, timesheets, quotes, stamp logs, write-ups — is filtered to those stores, and a direct link to a record outside their scope returns a 404 rather than opening. Assigned nothing means seeing nothing. That's deliberate: an empty assignment used to mean "everything", which is the wrong default for the only mistake an owner is likely to make.

On top of that, the owner can revoke individual areas per person from an access drawer — hiring, documents, schedule, leave, people. The revoke is enforced in middleware, and the sidebar asks the API what the signed-in user can actually do before it draws itself. We found that one in production: a revoked area returned 403 while its tab sat there in the nav, visible on a fresh login. Nav and API now read the same answer, and someone sitting on a tab that just got revoked is moved off it.

Pay is stricter than everything else. Rates, pay history, the payroll workbook, the hours export, clock rules, PTO and store creation are owner-only at the endpoint. The schedule doesn't even return who is salaried to a GM — that key is absent from the response, so the salary tag and the salary/hourly split simply don't exist for them. View-as inherits the target's permissions rather than the owner's, which is the whole point of view-as.

There's also a help button on the counter tablet: PIN, type the problem, and it posts into a single reused chat thread with the owners and pushes to their phones. It reuses the thread on purpose — a help button that spawns a new thread every time is a help button owners learn to ignore.

Quotes become a pipeline — new, quoted, won or lost — email the owners in one batched send, and can be edited afterward by the owner or a scoped manager with the reference and signature preserved. The same forms are available from the office portal, not just the tablet, so a phone quote doesn't have to be taken at the counter. Deeper on the tablet itself: the counter kiosk and staff roles and management.

Camera scanning depends on the tablet. Continuous barcode scanning uses the browser's barcode API, which means Chrome and Android tablets. iOS falls back to typing the code. We also support a plain USB or Bluetooth handheld scanner as a keyboard wedge on the returns screen, and honestly that beats any tablet camera on a dense UPS label — if your counter has a handheld, use it.

Per-seat billing isn't automated yet. Workforce deployments are quoted and invoiced as a buildout plus a per-active-employee monthly rate. The metering behind that is not yet wired into our self-serve billing, so it's handled as an account rather than a checkout.

Address lookup is a live integration. The counter's address type-ahead runs through a Google Places proxy that needs a key configured for your account. USPS address verification is built but dormant until credentials are set — we won't claim it works for you until it does.

Pricing is quoted. Unlike the loyalty platform's published $200/mo, workforce and ops pricing depends on sites and headcount. Ask and you'll get a number on the call.