Finance Manual

The whole module rests on four things. Once you understand how they relate to each other, the rest of this manual reads itself.

For Pleno to suspend and reactivate customers it has to reach your routers. This is done in two separate steps, and mixing them up is the most common mistake when starting out.

2.1One VPN per company

Pleno does not open a tunnel per router. It opens one per company, and that tunnel ends on a single router: the edge router, normally the one that already has internet access and from which the rest of your network can be reached. That device acts as the door: everything Pleno needs to send to the other routers goes through it.

The practical consequence is what matters. When you later register your other routers, the address you type in is not the public IP, nor the one you use from the office. It is the private IP by which the edge router reaches that device.

2.2Step 1 — Bring up the tunnel

Go to Settings → VPN, in the sidebar. This is the account Settings, not the Finance ones.

1. Create the container and the tunnel. Press Set Up Container. Pleno creates a private container for your company and generates the VPN credentials your edge router will connect with. It takes about a minute and consumes no credits.

2. Set up the agent workspace. Press Set Up Workspace. This is a step apart from the previous one: if you skip it, the tunnel exists but the Network Admin agent has nowhere to run and stays offline.

3. Turn it on. Start. The container status changes to Active. Later on you also have Restart and Stop.

4. Pick your RouterOS version. 7.x or 6.x. You can see it in Winbox, under System → Packages.

5. Paste the script into the edge router. Press Copy Script — it already carries your credentials, there is nothing to fill in. Open the terminal of your edge router (Winbox → New Terminal) and paste it. It is idempotent: you can run it several times without breaking anything.

6. Verify. Press Test VPN. The tunnel must read Connected and Edge router reachable must appear within seconds. If this does not go green, do not move on to step 2: nothing you register afterwards will work.

2.3Step 2 — Register the routers

Go to Finance → Configuration → Routers and press New Router. Here you register every router that serves customers, including the edge one if it also has customers hanging off it.

Prepare the device before saving

• Dedicate a clean interface. A bridge or VLAN reserved for Pleno, with no IP address and no customers on it yet. Do not reuse the interface where your current customers already live.
• Enable SSH access with the username and password you are about to enter here.
• Paste the VPN script generated after saving into that router's terminal, so the tunnel comes up.

Connection types

On save, Pleno configures that interface end to end: the gateway (first IP of the subnet), the PPPoE server, the profiles for your plans and each customer's IP. It is not instant — it runs in the background and you follow the progress under Provisioning status, on the same screen.

2.4The three recurring mistakes

• Putting the public IP in Host (IP). The tunnel already placed you inside the network; from in there the public one does not apply.
• Putting an IP the edge cannot reach. Check it with a ping from the edge router's terminal, not from your computer.
• Skipping Set Up Workspace. The tunnel shows as created but the agent has nowhere to run.

Under Finance → Configuration → Plans. A plan is the template of what you sell.

If you already have customers in WispHub, UISP, a spreadsheet or anything else, do not load them one by one. The wizard imports them from a spreadsheet and matches the names of your old plans against the ones in Pleno.

It lives under Finance → Configuration → Migration, in Start Migration Wizard.

4.1The four steps

1. Prerequisites — you confirm routers and plans, and pick the mode.

2. Upload data — you load the file or paste the rows.

3. Map plans — you say which plan of yours matches which Pleno plan.

4. Review & import — the system validates everything and only then imports.

4.2The two modes

The first question is Do your clients already have PPPoE credentials?, and it changes which columns the file needs.

4.3The file

Excel (.xlsx), CSV and tab-delimited files are accepted, up to 500 customers per import. You can also copy rows straight from Excel and paste them into the screen.

The simplest path is to start from Download Excel template —or the CSV one— and fill it in. That way the headers come out exact; if a required column is missing or repeated, the wizard rejects it before going any further.

4.4Mapping the plans

The wizard collects every distinct plan name it found in your file and asks you, for each one, which Pleno plan it corresponds to. If you leave any unmapped, it tells you how many are missing and will not let you import.

On the same screen you pick the Target router. The whole import goes to a single router, so if you have several nodes, do one import per node.

4.5Review and import

Before writing anything, the wizard validates the rows and shows you the summary: how many customers, how many active, how many suspended and how many rows carry errors. If there is a single error, nothing is imported — either everything goes in, or nothing does. These are the most common rejections:

Plan X is not mapped

You still have to say which Pleno plan it matches. Go back to step 3.

The mapped plan uses another currency

The plan is in a currency other than your company's. It is fixed in the regional settings, not in the file.

A zero-price plan cannot start suspended

If the plan charges nothing, there is no possible debt to justify the suspension.

An active customer has a next due date in the past

Active customers must be due today or later in the company's timezone. Suspended customers may keep a past date.

The client IP is missing, invalid or already in use

The IP is required in both modes, must be a valid IPv4 address and cannot be repeated or already exist in Pleno.

The coordinates are incomplete or outside their range

Latitude and longitude are optional, but they must be supplied together and within their valid ranges.

The document already exists or is duplicated

The document is optional, but when supplied it cannot belong to another customer or repeat in the file.

The PPPoE username already exists, or is duplicated in this batch

Two customers with the same username, or one you loaded earlier. Identifiers are unique.

The data changed; validate again

You edited something after validating. In mode B the generated credentials are tied to that validation, so it has to be redone.

4.6What happens when you import

For every row, Pleno creates the customer and their subscription, and then configures it on the router.

Suspended customers with a past date receive the charge for every elapsed cycle and their next due date advances to the current cycle. If a suspended customer has a future date, Pleno records one cycle as the opening balance. In both cases the customer remains suspended without charging the same period twice.

If a customer was imported but their configuration never reached the router, the wizard tells you when it finishes. The customers are loaded all the same; what is missing is retrying the provisioning, which you follow under Provisioning status.

4.7Recommendations

• Try five customers first. Import a small batch, check that they really connect, and only then upload the rest. It is far cheaper than discovering an error on row 400.
• A fresh, empty interface. Give Pleno a reserved bridge or VLAN, with no customers on it yet, and move yours over one by one. Your current network stays untouched while you migrate.
• One import per router. Split your file by node before starting.
• Check the plan names before exporting. If the same plan is spelled three different ways in your old system, you will have to map it three times.
• Strip the accents from PPPoE usernames. Only ASCII characters are accepted.
• 500 at a time, maximum. If you have more, split the file.

5.1The customer

Under Finance → Customers. Click any row to edit it — there is no pencil button, the whole row is the button.

5.2The subscription

Under Finance → Subscriptions. Clicking a row opens its full record on a page of its own — it has a web address, so you can share it or reload it without losing where you were.

This is the section worth understanding properly, because it explains 90 % of the questions from your customers and from your own team.

6.1The metronome

Every subscription has a due date that advances on its own, like a clock. When that date arrives, a charge for the plan's total price is issued and the date jumps to the next cycle. This always happens: whether they paid or not, whether they are connected or suspended.

A suspended customer still being billed is not a bug, it is the right call: that customer is still taking up a port in the box, a fibre and a place in your network. What grows is their debt. If they really leave, the subscription is cancelled or archived, and only then does it stop billing.

If a subscription went untouched for several months, the system issues all the charges that were due, one per cycle, not one big rounded charge. When the due day does not exist in the following month —a due date on the 31st in a 30-day month— it falls on the last day of that month.

6.2The debt clock and the suspension

The moment the balance crosses below zero, a clock starts. The suspension is computed like this:

suspension = (day the balance went negative) + Grace Days

Before that date the customer is overdue but with internet. After it, they get suspended. And as soon as the balance is back at zero or above, the clock is cleared and the service reactivates on its own.

6.3The five states

6.4What time it suspends

Under Finance → Configuration → Operation, section Billing cutoff time.

Once a day, at the hour you choose, Pleno walks through all your subscriptions, issues the charges that are due, suspends the customers who have not paid and reactivates the ones who did. The default is 04:00.

6.5Granting an extension

When a customer asks you for a few days, do not change their Grace Days: that is permanent and applies to all their future cycles. Use the payment extension, which is a one-off exception.

You pick a date and the connection is not suspended until then, even if the grace has run out. If the customer was already suspended, they get reconnected until that date. The extension consumes itself when the next billing cycle arrives, so no customer ends up with an eternal extension through forgetfulness. On the Dashboard you see all the live ones under Promise to pay.

6.6Reactivation

There is no “reactivate” button. You register the payment, the balance reaches zero or above, and the system reconnects the customer on the router. If the payment came in as Pending —a transfer awaiting reconciliation, for instance— the customer is not reactivated until that payment is approved or reconciled.

WhatsApp messages that go out on their own before the due date. They are configured under Finance → Configuration → Operation, section Payment Reminder.

7.1What you configure

7.2Message variables

{{client_name}}

Customer name

{{plan_name}}

Plan name

{{plan_price}}

Plan price, in your currency and format

{{current_debt}}

What they owe today (zero if they owe nothing)

{{due_date}}

Due date, DD/MM/YYYY

{{days_remaining}}

Days left until the due date

{{grace_days}}

Grace days of that subscription

{{company_name}}

Your company's name

Hi {{client_name}}, your {{plan_name}} plan is due
on {{due_date}} and the amount is {{plan_price}}.
Write to us here if you need anything. — {{company_name}}

7.3The rules that keep you from pestering your customers

• One per cycle, not one per day. Each subscription receives a single reminder per billing period, even though the system checks every day.
• Only to those it applies to. It is sent only to Active or Overdue subscriptions. Suspended, blocked and cancelled ones get nothing.
• Never in the small hours. Outside the time window messages wait for it to open.
• If the window closed, it is picked up again. A reminder that did not make it out today goes out tomorrow; the whole cycle is not lost.
• It is checked twice. Right before each message is sent, the customer's state is read again. If they paid while the queue was draining, the notice does not reach them.
• They go out one at a time. Never in a burst: the channel spaces them out so the number is not put at risk.
• One failing number does not cause a storm. If sending fails, it is marked as attempted anyway and is not retried in a loop.
• Per-customer switch. The Reminder field on each subscription excludes that particular customer.

8.1Registering a payment

From Finance → Payments with Register Payment, or from the subscription record. The methods are Cash, Transfer, Card and Other.

You can attach the Voucher Number and photos of the voucher. If the number was already used on another payment, the system warns you before saving.

8.2A payment has two states, not one

This is confusing at first and is worth getting straight: every payment carries two independent labels.

Cash payments are born Exempt: there is no bank email to look for. Transfers and cards are born Unreconciled and go automatically into the reconciliation engine of section 9.

8.3Automatic receipt over WhatsApp

Under Finance → Configuration → Operation, section Payment Receipt. When a payment is confirmed, the customer receives a PDF over WhatsApp without anyone doing a thing.

Just like reminders, it has a time window. A payment confirmed at 2 in the morning does not wake the customer up: the receipt sits in the queue and goes out when the window opens. The Receipt switch on each subscription turns it off per customer.

The PDF layout is edited under Receipt Template: logo, prefix and numbering, your company details, footer and the language of the labels.

The problem it solves is old and familiar: the customer says they transferred, you have to log into the bank and look, find the movement, guess whose it is —because the account holder's name is almost never the name on the service— and only then enable them. Multiplied by fifty customers at the end of the month.

Pleno reads the emails your bank sends you when you receive a transfer, pulls out the amount, the sender, the ID number and the voucher number, and matches them against the payments you have loaded. When there is a single possible match, it reconciles on its own.

9.1How it works, step by step

9.2Connecting your mailbox

Under Finance → Configuration → Bank Accounts, press New Bank Account.

1. Name — how you will recognise it: “Pichincha Current”.

2. Bank — which bank the emails come from. It determines which template is used to read them.

3. Allowed domains — which domains you accept emails from, for example pichincha.com. This is the anti-fraud filter.

4. Bank cash box — which cash box the reconciled money lands in.

5. Authorize Gmail — you grant read-only permission. Pleno cannot send, delete or modify anything in your mail, only read the messages from those domains.

9.3How it decides a transfer belongs to a given customer

The system looks for payments that are not reconciled yet and that meet all three conditions:

• The amount matches, within the tolerance you configure.
• The dates are close, within the window of days you configure.
• There is a strong key breaking the tie: the sender's document matches the customer's, or the bank's voucher number matches the one entered on the payment.

If after all that exactly one candidate is left, it reconciles. If zero or several are left, the notification stays in the inbox and you resolve it by hand by picking the right payment. The system would rather do nothing than assign the money to the wrong customer.

Matching works both ways and regardless of order: if the bank email arrived before you loaded the payment, loading it searches backwards and reconciles it all the same.

The four configurable rules

9.4Why it cannot be faked

With no protection, anyone who knew your email address could send you a message that looked like the bank saying “you received $20” and enable their own service. That is why every email is verified against its DKIM signature, the cryptographic signature the bank puts on its messages and that cannot be imitated.

An email that fails that verification, or whose domain is not on your allowed list, never reconciles or approves anything: it is stored as Ignored and stays there. Each message is processed once only, so a forward does not duplicate the charge either.

9.5Adding your bank: what we need from you

Every bank writes its emails differently. One puts “Value: $20.00”, another “Amount USD 20.00”, another buries it in a table with the account holder's name in a different cell. To read a new bank, at Pleno we write an extraction template specific to that bank.

Those templates are exact rules written by hand, not written by an AI. That is deliberate: your customers' money cannot depend on a model interpreting an email correctly. An exact rule either gets it right or fails visibly — and when it fails, the notification lands in the inbox for a person to review, which is exactly what you want to happen.

In the meantime, a bank without its own template still works through a generic reader that recognises the region's most common formats. It gets a fair share right, but fewer: you will see more notifications landing in the inbox to be resolved by hand. That is why it is worth sending us the email as soon as you start operating with a new bank.

9.6The inbox

Under Finance → Cash → Reconciliation. There you see everything that came from the bank:

• Unreconciled — it arrived and it is legitimate, but the system could not tell whose it is. You match it yourself by picking the payment.
• Reconciled — already matched with a payment.
• Ignored — it did not pass verification, or you discarded it by hand.

The Review queue is the one at the other end: payments you confirmed but that never showed up at the bank once the grace period passed. Those are the ones worth looking at — a typo, or a customer who said they transferred and did not.

Under Finance → Cash. Cash boxes answer where the money coming in physically is.

• Cash boxes — they can have an assigned owner, so each collector accounts for their own.
• Bank boxes — fed by the reconciled transfers of section 9.
• Default box — where any income with no resolvable box lands.

The tabs in that section are Boxes, Movements, Suppliers, Reconciliation and Close. The close compares what the system says you should have against what you actually counted, and records the difference.

The customer paid and still has no internet

Look at the balance: if it is still negative, the payment did not cover the debt. If it is at zero or above, look at the state: if it says Blocked, you blocked it by hand and the system will not touch it. If the payment is Pending, it does not count as money yet.

Customers were suspended a day early

The cutoff timezone was left on UTC. Set your country under Settings → Company. Section 6.4.

Reminders are not going out

Three causes, in this order: no WhatsApp channel picked, the customer has no phone number on file, or the Reminder switch on that subscription is off. Check as well that the current time falls inside the send window.

Transfers are not reconciling

Does the customer have their document on file? It is the primary key. Then: is the amount within tolerance? Are the dates inside the window? Is the bank's domain on the allowed list? If none of that is the problem, that bank probably has no template yet — send us a sample email (section 9.5).

I cannot change a router's subnet

It is locked because the router already has customers assigned. This is intentional. Section 2.3.

I registered a router and nothing happens

Try Test VPN under Settings → VPN. If the tunnel does not answer, nothing underneath it works. If it does answer, check that the IP in Host (IP) is reachable from the edge router, not from your computer.

A suspended customer keeps accruing debt

That is the correct behaviour: they are still taking up a port on your network. If they really left, cancel or archive the subscription. Section 6.1.

The migration rejects active rows over the date

An active customer must be due today or later in the company's timezone. If the customer is really overdue and cut off, use suspended; that status accepts past dates. Section 4.3.

I migrated customers and they do not connect

Customers are loaded even if the router configuration fails. Look at Provisioning status on the router's record. If the mode was “No PPPoE yet”, your customers' devices also have new credentials that have to be entered on each one. Section 4.2.

I granted an extension and they were suspended again

The extension lasts until the date you set and is consumed when the next billing cycle arrives. If you need something permanent, raise their Grace Days. Section 6.5.