CES Payroll — clients

One row per client. Red: a file was downloaded days ago and the register was never checked, or a run has sat untouched. CES can mark a payroll complete here once it has been processed and invoiced — the record and the files stay in the client's bucket.

Adding a client gives you a private link to send them. Rotating a key makes the old link stop working.

Every night at 2:17 Central each client's settings, weeks and records are copied into that client's own bucket (ces-<id>), kept 90 days. Restore puts a day back exactly and issues the client a new link.

Two lists have to agree: this one (which company an email belongs to) and the Access policy in Cloudflare (whether the email may sign in at all). Add a person in both places; remove in both. Anyone with an @trustces.com address counts as CES staff without a row.