Finance & accounting
Close the month without hunting for the difference.
Most of the work in small-company accounting is not entering figures. It is finding the one that is wrong, weeks after it was entered, in a system that accepted it. Oneop keeps a real double-entry general ledger, and the checks that keep it tied run at the write — so the difference you would have spent the evening looking for never got in.
Invoicing, receivables, payables, expenses, bank feeds, tax and the six statements sit on top of that ledger rather than beside it. Sending an invoice posts. Approving a bill posts. Shipping stock posts. You read the result, you do not assemble it.
No credit card. Free plan, 2 seats.
2
Independent balance checks, and the second does not trust the first
3
Named refusals that fire before a single row is written
0
Posted entries that can be edited — a correction is a linked reversal
26
Ledger accounts and four journals, seeded before your first invoice
6
Statements read from posted rows, never from a kept-up total
Something happens in the business. The books already know.
An invoice goes out, a supplier bill is approved, a unit leaves the warehouse. In most small companies each of those is a thing that happened and, separately, a thing somebody will type into the accounts later. Here the second half is the same act as the first.
- An invoice posts three lines, not oneReceivable debited, revenue credited, and the tax credited to its own account — because tax you have collected is money you owe, not money you earned.
- A bill posts the expense and the liability togetherApproval is the posting event. Paying it later moves the liability to cash rather than recording the cost a second time.
- Shipping stock posts the cost of the goodsInside the same transaction that decrements the stock, so margin is recorded against the sale that produced it rather than reconstructed at month end.
- Every entry carries its number and its sourceEntry numbers are allocated by the database in the same transaction as the entry, so two people posting at once cannot be handed the same one.
INV-1842 · Dana Kim · $73.10
| Dr · Accounts Receivable | 73.10 | |
| Cr · Sales Revenue | 68.00 | |
| Cr · Sales Tax Payable | 5.10 |
Where the books are actually kept honest
Four mechanisms below. Each one is something you can check, not a capability we claim.
Fixed point 1
The refusal happens before a row exists
A system that only compares column totals accepts several things that are not entries. Oneop checks three of them in order, before it writes anything: a line carrying both a debit and a credit, an entry whose sides do not tie, and an entry where every line is zero — balanced, and a record of nothing, which has still burned an auditable entry number. Then it checks that every account named on the entry belongs to your workspace.
Nothing partial is left behind
- The checks run firstThe entry, its lines and its number are one transaction — a refusal leaves no draft, no gap in the numbering and no orphan line.
- A cent is enoughThe balance tolerance is a ten-thousandth of a unit, two orders of magnitude tighter than a cent, so it is not a rounding allowance.
And the refusal has a name
- Each rejection is distinctUnbalanced, both-sided line and zero-value are separate answers, so you fix the actual problem rather than guessing.
- Every surfaceImports, integrations and the API post through the same service, so none of them routes around it.
| Attempt | At a glance | Result |
|---|---|---|
| Debits $73.10, credits $73.09 | One cent out | Refused — unbalanced |
| One line carrying a debit and a credit | Column totals tie perfectly | Refused — a line takes one side |
| Every line 0.00 | Balanced, and genuinely is | Refused — it records nothing |
| An account from another workspace | A valid account number | Refused — not your account |
The middle two rows are the interesting ones: both are balanced by the naive test, and both are still refused.
Fixed point 2
Once it is posted, the only correction is another entry
There is no path that edits a posted entry's lines. A correction is a reversal: a mirror entry with every debit turned into a credit, marked as a reversal and joined back to the original in both directions, so the wrong figure and its correction are both readable afterwards. The same entry cannot be reversed twice, and the reversal itself has to land in an open period — which is what stops a closed month being reopened sideways.
The period is the other half of that. Posting checks the period covering the entry's date, and the entry's date is re-checked at post time, so re-dating a draft cannot slip it into a period it does not belong to. Overlapping periods are refused when you create them; where one already exists, the least permissive period wins — an open period never outranks a locked one, and a status the resolver does not recognise never outranks one it does. Only owners and admins may lock or unlock.
Six statements read from those posted rows rather than from a total something keeps up to date: profit and loss, balance sheet, trial balance, cash flow, and receivables and payables aging across five buckets. The trial balance reports a computed balanced flag rather than asserting that it ties.
| Period | Situation | A posting dated inside it |
|---|---|---|
| Open | The normal case | Posts |
| Closed | Month-end done | Refused, named as closed |
| Locked | Owners and admins only | Refused, named as locked |
| None for that date | A gap in the calendar | Refused, and told apart from locked |
| Two periods overlap | One open, one locked | The locked one decides |
The last two rows are the ones that took real work. "There is no period for this date" and "this period is locked" need different fixes, so they are different answers.
Fixed point 3
Money in and money out, each posting a named pair
Receivables, payables and expenses are not three ledgers that agree afterwards. An invoice debits receivables and credits revenue and tax; its payment moves the receivable to cash. An approved bill debits the expense or cost of goods and credits payables; its payment moves the payable to cash. An approved expense claim debits the expense and credits accrued liabilities; reimbursing it moves that liability to cash. Each of those is one posting with both sides named, not a status change with bookkeeping to follow. The invoice the customer receives is a real PDF in your colours, A4 or Letter, in their language, with right-to-left scripts mirrored inside the document itself.
Who may approve is the part most systems leave as a permission. By default anyone with the permission can approve, including the person who raised it — that is how most small teams actually work, and it is why the control ships off rather than on. Turning on segregation of duties takes an environment switch and a per-workspace setting, and then a submitter cannot approve their own expense or bill.
What that control covers
- Approval, on both pathsExpense claims and supplier bills, checked at the moment of approval.
- The workspace decidesIt is a per-workspace setting, so a two-person company and a twenty-person one do not have to agree.
And what it deliberately does not
- Not rejection, reopening, voiding or reimbursementOnly approval. Naming the boundary is the point — a control you think is wider than it is, is worse than none.
- No amount threshold, and never retroactiveIt applies from the moment you switch it on. Approvals already recorded are left as they were recorded.
A bill that has received any payment cannot be voided.
Fixed point 4
The bank line and the ledger line stay two rows
Connect an account through Plaid and transactions pull on a daily background sync. What arrives is a bank line; what it is compared against is a posted ledger line. They are joined by a score rather than merged into one record — which is what lets you see the match, and reject it.
The score is arithmetic you can predict: amounts agree to the cent, dates fall within five days either side, and a same-day match scores 0.95, within three days 0.80, within five 0.65, plus 0.10 for a bank reference that appears on the entry — capped at 0.99, because the system does not get to be certain. A person confirms, unmatches or excludes each one, and only then is the reconciliation finalised. Nothing posts itself out of the feed, which is the difference between reconciliation and hoping.
Connected with Oneop
Everything that earns or costs money already posts here
A won deal becomes an invoice, a shipped unit posts its cost, an approved bill becomes a payable, a project's billable hours become a line, and reporting reads the entries all of them wrote. Not a nightly sync between an operations system and an accounting one — the event and the entry are the same act.
- CRMCustomer and commercial context follows the work.
- Project managementSold work becomes delivery without rebuilding customer context.
- Inventory & warehouseSales and operations work from the same product and order context.
- ReportingEvery module is already a reportable dataset, so nothing has to be exported to be measured.
- AutomationA trigger in one module can act in another without an integration between them.
The other 6 modules sit on the same record, and reach Finance the same way:
- Help deskSupport sees the customer, commercial and operational history.
- Live chatConversations become part of customer context.
- SequencesOutreach works from CRM and customer context under controlled automation.
- AI chatbotAI responds using permitted business context.
- AI agentsAI acts on the same records people do, under limits that are published rather than described.
- AI governanceWhatever AI touches in any other module is metered on the same path first.
Beyond the four
Real statutory tax, four jurisdictions deep
Pakistan's federal and four provincial authorities, the 27 EU member states with effective-dated rates and 27 VAT-number formats, Canada's federal-plus-nine composition, and Egypt. Seeded rates, not a percentage box.
Filing and e-invoicing
Live submission for the UK and Pakistan; a ready-to-file export for the UAE, Bahrain, the US and EU OSS; UBL 2.1 XML and TLV QR for Saudi Arabia. Live filing is a separate, individually verified opt-in.
Tax that was never determined blocks the posting
A guard that tells a genuine zero apart from a tax that was silently dropped, and stops the second from reaching the ledger. It never computes or alters an amount, and it is inert until tax localization is on for your workspace.
Year-end close that actually closes
One entry dated the last day of the fiscal year, clearing every profit-and-loss account to retained earnings — where retained earnings is the difference of the two accumulated sides, so it ties to the cent by construction.
Genuinely AI, and metered as such
Document parsing — photograph an invoice, bill, receipt or statement and Gemini extracts header and line detail, with the file type verified from the bytes — and expense categorization, which proposes an account with a reason you can reject.
Not AI, and we will not say it is
Cash-flow forecasting is a deterministic projection of open receivables and payables against their due dates. Duplicate bill detection is a comparison over supplier, amount and date. Both are good features. Neither is a model.
Where the ledger meets the rest of your stack
The accountant's system you may already be running, the rails money actually arrives on, the storefronts that raise the invoices, and the two tax authorities Oneop files to directly. The first six are native integrations with their own pages; the last two are filing connections you configure inside Finance, which is why they are not on the integrations directory.
See all integrations- QuickBooks Online
- Stripe
- Plaid
- Shopify
- WooCommerce
- HubSpot
- HMRC Making Tax Digital
- FBR via PRAL
For the technical evaluator
An unbalanced journal entry cannot be written.
Not flagged on a report, not corrected by a nightly job. Refused at the write, by two checks that do not trust each other.
The two checks, and exactly how far each one reaches
The first check is in the posting service. Creating an entry sums the debit and the credit lines and compares them against a tolerance of one ten-thousandth — a floating-point epsilon, not a rounding allowance, and two orders of magnitude tighter than the smallest amount you can enter. Before that comparison it rejects a line carrying both a debit and a credit, which is the case a naive column-total check waves through, and after it rejects an entry whose every line is zero, which is balanced and records nothing while consuming an entry number. It then asserts that every account on the entry belongs to your workspace — a check added after a reproduction in which one workspace successfully posted to another's account and got a success response.
The second check is in PostgreSQL. A trigger fires on the update that moves an entry to posted, re-sums the lines directly from the lines table rather than trusting anything the application passed it, and raises an exception if the totals differ — which aborts the transaction rather than returning an error the caller could ignore.
The boundary worth stating plainly: that trigger watches the transition to posted. A small number of internal paths — the cost-of-goods entry a shipment writes, for instance — insert a row already marked posted and so do not cross it. Those paths assert the same balance in the application immediately before inserting. So the claim this page makes is the one the code supports: every posting path asserts balance before it writes, and the ledger's own post transition is additionally re-checked by a database trigger that does not trust the application. Not that the database independently re-verifies every entry in the system.
Posting also re-checks the things a draft could have changed since it was created: that it is still a draft, that it has lines, that its date still falls inside its period, and that the period is open — distinguishing a locked period from no period at all, because those need different fixes. Entry numbers are allocated by a single atomic update inside the same transaction, so two people posting simultaneously cannot be handed the same number, and a refused entry does not leave a gap.
Reversal is checked in the order that matters: whether this entry has already been reversed comes first, so a second attempt is refused for the right reason rather than silently producing a duplicate mirror. Only posted entries can be reversed, and the reversal's own date has to fall in an open period.
Everything above is scoped to your workspace at the data layer. Accounts, journals, entries, lines, periods and settings all carry the workspace they belong to, and no query crosses that boundary.
What it costs
Finance is activated separately rather than sold separately — once it is on, invoicing works on a chart of accounts, a fiscal year and twelve open periods that are already seeded, including on Free. What the plan changes is volume and depth: how many invoices a month, whether the statements are available, and whether payables, expenses, tax, bank reconciliation and multi-currency are. The balance guarantee is not a plan feature and never has been.
See full pricing| Plan | Invoices / month | Statements | Payables & expenses | Bank reconciliation | Multi-currency |
|---|---|---|---|---|---|
| Free $0 | 5 | Not included | Not included | Not included | Not included |
| Starter $19 | 50 | Included | Not included | Not included | Not included |
| Pro $59 | 500 | Included | Included | Included | Not included |
| Business $129 | 2,000 | Included | Included | Included | Included |
Frequently asked
Do I have to ask for Finance?
You do not buy it separately, and there is no connector to license — Finance is the same application, seeded with a chart of accounts, a fiscal year and twelve periods already open. It is one of the modules activated separately, because posting to a ledger has financial side effects. What is plan-gated rather than switched is depth: statements start at Starter; payables, expenses, tax and bank reconciliation at Pro; multi-currency at Business. Live tax filing submission to a tax authority is a further, genuinely separate opt-in — see the tax card on this page.
What exactly stops an unbalanced entry from being saved?
Two independent checks. The posting service sums the entry’s debit and credit lines and refuses it as unbalanced if they differ, before any row is written. Separately, a PostgreSQL trigger fires on the update that sets an entry to posted, re-sums the lines directly from the lines table, and raises an exception that aborts the whole transaction if the totals differ. The database check does not trust the application check. The tolerance is a ten-thousandth of a unit, so a one-cent difference is a rejection rather than a rounding allowance.
Can I edit or delete a posted journal entry?
No. There is no path that updates a posted entry’s lines. Corrections post a linked reversal — every debit mirrored to a credit — marked as a reversal and joined back to the original in both directions, and the same entry cannot be reversed twice. The reversal itself has to land in an open period, so a closed month cannot be quietly reopened by reversing into it. Only owners and admins can lock or unlock a period.
Who is allowed to approve a bill or an expense?
By default, anyone with the permission — including the person who raised it, which is how most small teams need to work and is why the control is off rather than on. When you want it, segregation of duties requires an environment switch and a per-workspace setting, and then refuses to let a submitter approve their own expense or bill. It covers approval specifically: it does not cover rejection, reopening, voiding or reimbursement, it has no amount threshold, and it was never applied retroactively to approvals already recorded.
Which countries have real tax support?
Real seeded statutory rates ship for Pakistan, the 27 EU member states, Canada and Egypt, with 27 EU VAT-number formats validated. Live filing submission exists for the UK (HMRC Making Tax Digital) and Pakistan (FBR via PRAL). The UAE, Bahrain, the US and EU OSS produce an export file you upload yourself. Saudi Arabia ships UBL 2.1 XML and TLV QR generation. The US layer tracks nexus states, $100,000 economic-nexus thresholds, exemption certificates and per-product taxability. All of it is inert until tax localization is turned on for your workspace.
Is the cash-flow forecast AI?
No. It is a deterministic projection of your open receivables and payables against their due dates, with scenario multipliers you can adjust. Duplicate bill detection is likewise a SQL comparison, not a model. The two genuinely AI features in Finance are document parsing and expense categorization, both running on Google Gemini and both metered against your AI credit balance. Calling the other two AI would be the kind of small lie that makes you doubt the large truths on this page.
Send your first invoice on a real ledger.
Post one invoice on the free plan. Or book a walkthrough and we will show you a one-cent imbalance being refused, a locked period turning a posting away, and the reversal that corrects an entry nobody was allowed to edit.
Free forever · 2 seats · No credit card