Everything you need. Nothing you don't.
A focused toolkit for small teams that need dependable timekeeping without the bloat of enterprise software.
Independent timekeeping
Server-authoritative timers, breaks, revisions, and approvals continue working through every Project-Alpha outage. Your time data never stops being captured.
Reliable synchronization
Durable queues, idempotency keys, signed webhooks, reconciliation, and visible conflicts protect every integration event when you connect Project-Alpha.
Financially controlled
Administrator approval freezes duration, rate, amount, currency, and revision before records leave Alpha-Ledger. No silent changes to financial data.
Layered security
TOTP for admins, AES-256-GCM for credentials, CSRF on every mutation, rate-limited login, session rotation, and HMAC-SHA256 webhooks.
Employee pay
Pay rate hierarchy, billable and non-billable tracking, and is_payable decoupled from billable so non-billable time can still be employee pay.
Reports and exports
PDF and CSV exports, dashboard charts rendered from your own data. No third-party analytics or charting service. Your data stays yours.
Layered controls by default
A Project-Alpha outage, duplicate event, employee account, or database-only disclosure cannot silently alter financial records.
Session security
SHA-256 hashed session tokens in MySQL. Rotation at login and TOTP enrollment. 15-minute idle timeout, 8-hour absolute (7-day remember-me). HttpOnly, SameSite=Strict, Secure cookies.
Admin TOTP required
Administrators must enroll TOTP. Integration enablement requires password plus TOTP reauthentication. Recovery key shown once, stored outside the host.
AES-256-GCM encryption
Project-Alpha credentials encrypted with a 256-bit key generated atomically in the data volume. Key never stored in MySQL or committed. Recovery key for volume loss.
HMAC-SHA256 webhooks
Signed webhooks with 5-minute replay window. Durable storage and event-ID deduplication. Incoming events stored before processing.
CSRF and rate limiting
Symfony CSRF tokens on every browser mutation. Login attempts rate-limited by hashed IP and email bucket. Role and ownership checks on every operation.
Hardened deployment
Security headers deny framing, MIME sniffing, unneeded capabilities. HSTS with subdomains. Containers run as unprivileged www-data user.
Standalone now. Connected later.
Alpha-Ledger works perfectly on its own. For the most seamless experience, set up Project-Alpha first, then connect Alpha-Ledger for billing, invoicing, and client management.
Phase 1: Set up Project-Alpha
Deploy and configure Project-Alpha for clients, quotes, contracts, and invoicing. This becomes the billing hub that Alpha-Ledger will sync into.
- Create clients and projects
- Configure quotes and contracts
- Set up invoicing and payment tracking
- Generate Project-Alpha API token
Phase 2: Connect Alpha-Ledger
When ready, supply your Project-Alpha URL and token, reauthenticate with TOTP, and map projects and employees. Alpha-Ledger backfills history and syncs going forward.
- Durable transactional outbox
- Project and employee mapping
- Idempotent event delivery
- Reconciliation every 6 hours
- Operational ledger mirroring
Ownership boundaries
Alpha-Ledger owns time, breaks, pay rates, and approvals. Project-Alpha owns clients, billing, invoices, and payment status. Neither silently overwrites the other.
Visible conflicts
Foreign-owned conflicts are recorded with timestamps. No silent winner selection. Admin resolves explicitly.
Graceful degradation
When Project-Alpha is unreachable, Alpha-Ledger queues pushes, uses cached data, and never blocks clock in / out. Timekeeping always works.
See how to deploy Alpha-Ledger
Self-hosted, source-available, and ready for your infrastructure.