These two groups are the system's control room: security and users, workflows, tax, notifications, integrations, backups, and auditing.
| Subgroup | Pages |
|---|---|
| Users & Security | User List · Access Groups · User Sign-in Approval · API Keys · Tag Management |
| Process Configuration | Process Instances · Process Definitions |
| Tax Management | Configuration · Tax Operations Report |
| Notifications | SMS & Notification History · SMS Panel Management |
| Integrations | Payment Gateway Management · POS Device Management |
| System | General · Currency Settings · Theme & Appearance · Database Management · Data Migration from Pishro to Karitm · System Events |
Two naming notes: the menu item "Administration → Tax Management → Configuration" opens the "Tax Authority Portal" page — mention both names to the user. And the menu item is called "User List," but the tab title and the in-page title are simply "Users."
Users & Security
"User List"
Columns: # · checkbox · display name · national ID · mobile number · username · role · actions. The role column is shown as a chip. The actions column has three icons: permissions, reset password or key, delete. Two buttons at the top of the page: New User and User Sign-in Approval.
"Access Groups"
The heart of the system's security model. The system has hundreds of individual permissions; instead of assigning them one by one to each user, permissions are packaged into an access group, and the group is assigned to the user. If a person's job duties change, you just change their group, not dozens of permissions.
Columns: # · group name · description · permission count · user count · status · actions. Five actions in the actions column: delete · report · copy · members · edit.
"All" vs. "Own Ownership." Most permissions are defined in two scopes. The "All" scope means the user sees and changes all of the organization's records in that section; "Own Ownership" means only the records they created or that were assigned to them. For example, a sales rep may see only their own customers and invoices, while the sales manager sees the whole organization. When building each group, deliberately choose between these two modes for every section.
Not all system permissions are typically enabled even for the admin group; a few permissions remain reserved for the organization owner. So the correct answer to "does admin have access to everything?" is: almost everything, not exactly everything. The group copy feature is an important setup shortcut: copy a similar group and change a few permissions.
"User Sign-in Approval" is the queue for approving new sign-ins. A user is not activated until an administrator approves them — a control layer that complements the username and password.
"API Keys"
Subtitle: "Programming keys for connecting devices and services (such as a time-clock device) to the system." Informational banner on the page: "Each key is created with the access of your current profile. If device fingerprint validation is enabled, the key is locked to that same device on first use, and using another device requires a new key or key rotation."
- An API key inherits the permissions of the user who created it; so create it with a user who has limited access, not an admin user.
- Being locked to a device fingerprint means a stolen key does not work on another device.
- Switching devices requires key rotation.
"Tag Management" defines the organization's shared tags that are applied to records across various modules.
Process Configuration
"Process Definitions" is the system's workflow engine and one of the product's most advanced areas. Columns: # · name · entity type · status · version · actions.
| Column | Details |
|---|---|
| Name | Shown with a tree-structure icon; the default process for each entity gets a "Default ★" chip |
| Entity type | A chip showing the entity the process runs on: lead · service reception · activity · invoice |
| Status | Draft (gray) · Published (green) · Archived (red) |
| Version | Processes are versioned, and the version number is shown next to the name |
Row actions depend on status: view · edit · publish · upgrade version · copy · archive · process diagram. Two buttons at the top of the page: Create Process Definition and Create from Template.
Workflow versioning is an important point: when you change a process, in-progress instances of the previous version finish under the old rules, and only new instances run with the new version. This is exactly what auditors ask: "under which rules was this case approved?"
"Process Instances" lists the current and past runs of each process, with status and current stage. The workflow task inbox is found on the Task Inbox page.
Tax Management
The menu item "Configuration" opens the "Tax Authority Portal" page and has two main cards.
| Credential card element | Details |
|---|---|
| Three status chips | Credential is registered (green) · Private key is saved (green) · Token has expired (red) |
| Client ID | Required field |
| Private key | Multi-line field; if left empty, the current private key does not change |
| Four buttons | Save credential information · Validate · Refresh · Delete |
The "Tax Operations" card has a button to send invoices to the Tax Authority Portal, with the guidance: "You can send approved invoices to the Tax Authority Portal. Make sure the tax credential and the company's national ID are set." At the bottom of the page: "Recent Submissions" and a collapsible "Common Tax Authority Portal Errors" section.
The three status chips are the most important tax troubleshooting tool. If invoices are not being sent, check these three chips first: "Token has expired" is the most common cause, and it is refreshed with the Validate button.
"Tax Operations Report" is an overview report of the status of invoice submissions to the Tax Authority Portal — it complements the "Tax Status" column in the Sales Invoice List.
Notifications & Integrations
"SMS & Notification History" is the record of all sent SMS messages and notifications with delivery status. "SMS Panel Management" configures the SMS provider: credentials, sending line, message templates. These two pages underpin all of the system's automated notifications: invoice due-date reminders, storefront order status notifications, two-step sign-in codes, and loyalty-program SMS campaigns.
"Payment Gateway Management" defines online payment gateways for the storefront and payment links. "POS Device Management" defines connected card readers. Access to the device itself and access to its connection credentials are two separate permissions; that is, you can allow a user to see and select a device without them seeing the connection credential information. This is exactly what makes "recording a receipt with a direct card reader" in the Treasury wizard possible.
"Connecting Local Devices"
Installing a program on the business location's computer lets it connect two kinds of devices to Karitm: a card reader (POS) or an attendance device. The connection is made with a one-time code: generate a code from this same page, hand it to whoever is doing the installation, they enter the code in the installed program, and from then on the computer appears in the "Connected Computers" list; each row shows the status of the last contact (Connected, quiet for a while, quiet for over a day, or Unknown) and a Revoke Access button.
Printers and barcode scanners don't need this program and work a different way.
System
- "General" — the organization's base settings: name, logo, print letterhead, contact information, national ID, and the system's default behaviors (including the default "issue voucher" setting in the Treasury wizard). The full list of these settings is in the General Settings section below.
- "Currency Settings" — defines currencies and rates. This page determines which unit amounts are displayed in; the difference in units between reports (Rial on the balance sheet, Toman on the sales report) is unified from here.
- "Theme & Appearance" — the system's theme, color scheme, and visual layout.
- "Data Migration from Pishro to Karitm" — the official migration tool from the product's previous generation ("Pishro") to Karitm.
"Database Management"
Subtitle: "Backup, restore, and viewing the database operations history."
| Section | Content |
|---|---|
| Backup space | Remaining space and used space; buttons to create a backup and request additional disk space |
| Automatic backup | The "Enable automatic backup — take automatic backups at regular intervals" toggle and a Save Settings button |
| Available backups | List of backup versions with restore capability |
| Database operations history | Log of backup and restore events |
Dedicated permissions: backup · restore · view backup list and size · operations history · view and manage automatic backup settings. This means you can allow a user to see backup status without allowing them to restore.
Practical administrator advice: turn on automatic backup once and save the settings, and also perform one test restore to make sure the backup can actually be restored. A backup that has never been tested is not really a backup.
"Service Status"
This page isn't in the menu; it opens by clicking the connection-status indicator in the bottom bar. It live-monitors three of the system's underlying services: the identity and authentication service (sign-in, tokens, permissions), the financial and operations service (accounting, inventory, sales, purchasing, reports), and the support service (ticketing). Each service shows one of three states: Healthy (the server responds), Degraded (a slow response or a server error), or Down (no response or a timeout). Each service's card shows the response time, the response code, and a chart of recent checks; a separate section also places the browser's own network connection status alongside these same checks, so you can tell whether the problem is on the user's connection or on the server. It rechecks either with the Refresh button or the "Auto-refresh" toggle, every 30 seconds.
This page is for when the system seems slow or unresponsive and you want to find out which part of the server the problem is in, or whether it's your own connection.
"System Events"
The system's complete audit trail: every recorded operation on records is kept here. Columns: # · checkbox · date and time · operation type · entity type · user · changed fields · actions (view). The "Event Details" dialog has two tabs: event details and entity history.
| Field | Description |
|---|---|
| Date and time | The exact time the event occurred, in the Persian calendar |
| Entity | The type of record the event occurred on |
| IP address | The network address the operation was performed from |
| Device / browser | Full details of the user's device and browser |
| Operation type | View, create, edit, delete, etc. |
| Performed by | The user's name along with their role chip |
| Change reason · footer | The context in which the event was recorded · the event's correlation ID for detailed tracking |
The "Entity History" tab shows all changes to a specific record over time and has its own dedicated permission. This page is the standard answer to an auditor: "who changed what field, when, and from which device."
General Settings
This page is the control room for the system's default behaviors: the default invoice tax rate, whether a voucher description is required, the POS settlement accounts, invoice numbering, and dozens of other settings that each affect one or more modules. The rail on the right of the page groups the settings into ten categories; clicking a category shows only that section, but all categories are saved together with a single "Save" button in the top bar — you don't need to save the current category separately before moving to the next one.
| Category in the side rail | About |
|---|---|
| Accounting Settings | Account coding and whether a voucher description is required |
| Sales Settings | Tax, default customer, and automatic sales-invoice actions |
| Purchase Settings | Tax and automatic purchase-invoice actions |
| Receive & Pay | Automatic transaction vouchers and default check book |
| Warehouse Settings | Default warehouses, stock-reach scope, and receipt/remittance vouchers |
| Production & Costing | Automatic vouchers for production completion and landed costs |
| POS Settlement | Settlement accounts, order charges, rounding and invoice numbering, kitchen, delivery and table reservations |
| Invoice Print Settings | Letterhead, logo, footer text, and default print format |
| Division & User Exceptions | Setting a separate value for one branch or one person, instead of the company value |
| Other | The system calendar and when the invoice receipt/remittance is created |
Unless stated otherwise, every setting is a company-wide value applied equally to every till and user; only the settings listed under "Division & User Exceptions" can be set separately for one branch or one user.
Accounting Settings
| Setting | What it does | Default |
|---|---|---|
| Default level of general accounts | Sets the coding depth of general ledger accounts | 1 |
| Show account code in the accounts tree | Shows each account's code next to its name in the accounts tree | Off |
| Require a voucher description | An accounting voucher can't be saved without a description | Off |
Sales Settings
| Setting | What it does | Default |
|---|---|---|
| Default VAT on goods in a sales invoice | When a product has no tax rate of its own, this percentage is suggested on the sales invoice | 0% |
| Quick-sale default customer | In the POS terminal's quick sale, this customer is selected automatically when no real customer is entered | Not set |
| Require full settlement to confirm a sales invoice | A sales invoice can't become confirmed (operational) until it's fully settled | Off |
| Auto-issue a warehouse remittance when a sales invoice is confirmed | Confirming the invoice automatically creates its warehouse remittance | Off |
| Auto-issue an accounting voucher when a sales invoice is confirmed | Creates the invoice's accounting voucher automatically instead of issuing it manually | Off |
| Require an end customer on an agent (reseller) invoice | An invoice issued for an agent/reseller must also specify the end customer | Off |
| Validate account or customer credit before final confirmation | The account's or customer's credit is checked before a sales invoice is finally confirmed | Off |
Charges such as a service fee or delivery fee on a sales invoice don't have a separate setting on this page; the "Invoice Charges" page manages them — see Invoice charges in the Sales doc.
Purchase Settings
| Setting | What it does | Default |
|---|---|---|
| Default VAT on goods in a purchase invoice | When a product has no tax rate of its own, this percentage is suggested on the purchase invoice | 0% |
| Require full settlement to confirm a purchase invoice | A purchase invoice can't become confirmed (operational) until it's fully settled | Off |
| Auto-issue a warehouse receipt when a purchase invoice is confirmed | Confirming the invoice automatically creates its warehouse receipt | Off |
| Auto-issue an accounting voucher when a purchase invoice is confirmed | Creates the invoice's accounting voucher automatically instead of issuing it manually | Off |
A related setting, "Defer receipt and remittance issuance until after invoice settlement," also affects sales invoices, so it's listed under Other, not here.
Receive & Pay
| Setting | What it does | Default |
|---|---|---|
| Default receivable check book | This check book is pre-selected on the form for recording a received check | Not set |
| Issue a voucher for a deposit transaction (receipt) | Recording a receipt automatically issues its accounting voucher | On |
| Issue a voucher for a withdrawal transaction (payment) | Recording a payment automatically issues its accounting voucher | On |
| Register the voucher right after saving the document | The accounting voucher is registered immediately after the receipt/payment document is saved, not left as a draft | On |
Unlike most settings on this page, all three switches in this section default to on. Practical details: Recording receipts and payments and Check books in the Treasury doc.
Warehouse Settings
| Setting | What it does | Default |
|---|---|---|
| Default receipt warehouse | The warehouse suggested by default for a goods-in receipt (e.g. a purchase invoice) | Not set |
| Default remittance warehouse | The warehouse suggested by default for a goods-out remittance (e.g. a sales invoice) | Not set |
| Stock-availability reach | When the user's own division runs short, how far it may draw from other divisions' stock in the same warehouse: the whole warehouse (all divisions), its own division plus sub-divisions and the shared division, or its own division only | "All warehouse stock" |
| Auto-issue a voucher after a warehouse receipt is created | Recording a warehouse receipt also automatically issues its accounting voucher | Off |
| Auto-issue a voucher after a warehouse remittance is created | Recording a warehouse remittance also automatically issues its accounting voucher | Off |
Production & Costing
| Setting | What it does | Default |
|---|---|---|
| Auto-create the production-completion voucher | Completing a production order automatically creates its accounting voucher | Off |
| Auto-create the landed-cost voucher | Recording a goods-in receipt that carries a landed cost (freight, customs, and the like) automatically creates that cost's accounting voucher | Off |
POS Settlement
The largest category on this page; it's split into several sub-sections of its own.
Settlement Accounts
| Setting | What it does | Default |
|---|---|---|
| Cash receipt account | Cash taken in at the till is recorded on this account | Not set |
| Check receipt account | Checks received at the till are recorded on this account | Not set |
| Card-to-card receipt account | Card-to-card transfers and deposits at the till are recorded on this account | Not set |
| Cash-box account group | Only accounts in this group (family) appear in the "cash receipt account" picker | Cash-box family (code 1410) |
| Banks' parent account | Only sub-accounts of this account appear in the till's bank pickers | Not set |
| Banks selectable for checks | The list of banks selectable when recording a check at the till | Empty |
The card-reader (POS device) account isn't set here; it's read from the card reader's own device definition. Full details on these accounts and how they're used during a sale: POS settlement accounts in the Treasury doc.
Order Charges
| Setting | What it does | Default |
|---|---|---|
| Charge rules (service fee, packing, delivery, or any custom title) | Each rule applies a charge — a fixed amount, a percentage, per item, or equal to a service's own price — to a specific order type (dine-in/takeaway/delivery) | No rules (off) |
| Cashier can remove it | If on, the cashier may remove this charge from that order | Depends on each rule's own setting |
| Cashier can edit its amount | If on, the cashier may manually change this charge's amount on that order | Depends on each rule's own setting |
This editor is the older version, and the page itself tells the user it has a successor. The new, recommended path is the standalone "Invoice Charges" page, which works for both sales and purchases and has more precise conditions (time of day, day of week, holidays, order-amount range); see Invoice Charges in the Sales doc. How these charges land on a POS order and what the cashier sees is described in Order Charges in the POS doc.
Rounding and Discount
| Setting | What it does | Default |
|---|---|---|
| Cash rounding step (Rial) | The invoice total is rounded to this step — always down, in the customer's favor | Off (0) |
| Default loyalty discount percent | Suggested when the server's response for a loyalty member doesn't include a discount percentage | Off (0, meaning don't guess) |
Invoice Numbering
| Setting | What it does | Default |
|---|---|---|
| Invoice start number | When no numbered invoice exists yet, the sequence starts from this number; leading zeros are preserved | Not set |
| Minimum digit count | A number shorter than this is padded with zeros; it can only make the number longer, never shorter | Empty (no minimum) |
| Number reset period | How often the count restarts: never, every shift, every day, every month, or every year | Never |
| Sequence shared by | Whether all tills share one sequence, or each till gets its own separate sequence | Shared across all tills |
| Number prefix | Fixed text placed before the number; can include tokens for the Persian year, month and day (and, for a per-till sequence, a token for the till itself) | Empty (no prefix) |
Choosing a reset period or a per-till sequence automatically suggests a prefix, and saving is blocked until the prefix carries the required token — otherwise the next period's numbers would collide with this period's. This sequence is also shared with the portal's own invoices. More detail: Numbering in the POS doc.
Kitchen
| Setting | What it does | Default |
|---|---|---|
| Product-category-to-station mapping, and the default station | Determines which station (e.g. hot kitchen, bar) an order for each product category appears under on the till's prep display; a category with no mapping goes to the default station | Not set — until set, the till's Kitchen tab stays empty |
Prep-display details: Invoice, receipt and kitchen in the POS doc.
Delivery and Table Reservations
| Setting | What it does | Default |
|---|---|---|
| Delivery zones | A list of zones with a name, fee and approximate time; a zone's fee takes precedence over the flat delivery fee, and an amount the cashier types manually on the invoice takes precedence over both | Empty |
| Table-reservation length (minutes) | The length of the bar the till draws on the reservation timeline for each table, since the server only keeps the reservation's start time | Not set — each till falls back to its own local default (90 minutes) |
Delivery and table details: Order Charges and Tables in the POS doc.
Till User Profiles
This section isn't a company-wide value; a separate profile can be created for each cashier that sets their device, permissions, print template, and even their own dedicated invoice-numbering sequence. Because each profile is that user's own record, not a row in the company settings table, it isn't listed in the tables above.
Invoice Print Settings
| Setting | What it does | Default |
|---|---|---|
| Company name | Printed on the invoice's and receipt's letterhead | Empty |
| Company address | Printed on the invoice's and receipt's letterhead | Empty |
| Economic code | Printed on the invoice letterhead; required for an official invoice | Empty |
| National ID | Printed on the invoice letterhead; required for an official invoice and for the tax authority system | Empty |
| Logo | Printed on the invoice's and receipt's letterhead | Empty |
| Footer text | Printed on the invoice's and receipt's footer | Empty |
| Default print format | Which format the invoice prints in by default: standard print (A4/A5) or a thermal slip | Standard print |
The national ID entered here is the same one the tax authority system requires on official invoices — see Tax Management. For the invoice's PDF output and printing itself: Printing an invoice, Sales doc; for designing print templates: Report templates, Printing doc.
Till Thermal Receipt Layout
Beyond the settings above, the receipt the till prints after every sale has a layout of its own:
| Setting | What it does | Default |
|---|---|---|
| Number display | Print the invoice number on the receipt as a large full code, or as a large serial with the full code shown smaller underneath | Large full code |
| Barcode | Whether a linear barcode is also printed under the invoice number | No barcode |
| Line detail | Print each item's line with its unit price and discount (detailed), or just name, quantity and total (compact) | Detailed |
| Copy count | How many receipt copies print each time — for example, one for the customer and one for the kitchen | 1 copy |
| Print logo | Also print the letterhead logo on the receipt | On |
| Cashier name | Print the cashier's name on the receipt | On |
| Payment breakdown | When an invoice was settled with more than one payment method, print the breakdown of each method | On |
Full receipt content details: Receipt in the POS doc.
Division & User Exceptions
The general rule on this page is that each setting has one value applied equally to everyone. But nine settings — the ones that shape a cashier's and customer's day-to-day experience — can have a separate value for one specific branch or one user: instead of the manager inventing a new rule for every exception, the same company value stays in force for everyone, and only the necessary cases are split off.
| Group | Settings that can be excepted |
|---|---|
| Charges | Dine-in service charge (percent) · Packing fee (Rial, per unit) · Delivery fee (Rial) |
| Rounding & Discount | Cash rounding step · Default loyalty discount percent |
| Invoice Numbering | Invoice start number · Minimum digit count · Number prefix |
| Delivery & Reservations | Table-reservation length |
How to use it: click "New Exception" ← pick a branch, a user, or both together (picking both means the exception applies only when that specific user works at that specific branch) ← next to a setting in the list, click "Set my own value" and type the new value ← each setting's current value is shown along with where it came from (company, branch, user, or user-at-branch).
When several levels have an exception at once, the most specific level wins: user-at-branch, then user (at any branch), then branch, and, failing all of those, the company value. For example, if the "service charge" is 10% for a branch and 5% for one specific user at that branch, that user always sees 5% while everyone else at that branch sees 10%.
Removing an exception (the undo icon) only deletes that one level; the next level up — user, branch, or ultimately the company — takes over again. This section's home view lists every recorded exception grouped by "who," so it's clear who has been split off from the company value.
The thermal receipt layout, the number reset period, and whether tills share a sequence or not cannot be excepted; those three are always company-wide values.
Other
| Setting | What it does | Default |
|---|---|---|
| Calendar type | Sets the system-wide calendar to Persian or Gregorian | Persian |
| Defer receipt/remittance issuance until after invoice settlement | Defers the automatic creation of a warehouse receipt (for a purchase invoice) and a warehouse remittance (for a sales invoice) from the moment the invoice is confirmed to after it's fully settled | Off |
Sample Workflows
Security setup for a new organization
Access Groups → create a group for each job role → use group copy for similar groups → User List → create a user and assign a group → User Sign-in Approval → control the "All" vs. "Own Ownership" split.
Connecting a device to the system
Create a user with the minimum access required → sign in with that user → API Keys → create a new key → set the key on the device (it locks on first use) → to switch devices, rotate the key.
Setting up the Tax Authority Portal
System → General → register the national ID → Tax Management → Configuration → enter the client ID and private key → save → validate and check the three chips → send invoices → track in the Tax Operations Report.
Defining an approval workflow
Process Definitions → create from template → select entity type → design steps and conditions → save as draft → publish → if changed, upgrade the version → track in Process Instances and the Task Inbox.
Backup policy
Database Management → check space → turn on automatic backup → one manual backup → one test restore → check the result in the operations history.
Responding to an audit inquiry
System Events → filter by date, user, or entity type → the event details tab for "who, from where, when" → the entity history tab for the record's full change path.
Frequently Asked Questions
The menu item is "Configuration"; which page does it open?
The "Tax Authority Portal" page.
Invoices are not being sent to the Tax Authority Portal.
Check the three status chips on the credential page; "Token has expired" is the most common cause. Click the "Validate" button.
Does the admin group have access to all features?
Almost; a few permissions remain reserved for the organization owner and are not in the admin group.
What is the difference between "All" and "Own Ownership" in an access group?
"All" means the user sees all of the organization's records in that section; "Own Ownership" means only their own records.
With what access level should I create an API key?
With a user who has the minimum access required; the key inherits the permissions of its creator.
The API key does not work on a second device.
The key was locked to the device fingerprint on first use; create a new key or rotate the key.
I changed a process — what happens to in-progress cases?
If you upgrade the version, in-progress instances finish with the previous version.
How do I find out who changed this record?
System Events → the record's "Entity History" tab.
What happens to our data from the Pishro software?
The "Data Migration from Pishro to Karitm" tool in the System menu is for exactly this.