Finance — the money cockpit

Everything money lives at Finance in the sidebar: the portfolio, the explorer, attribution, reports, and the transactions ledger. All of it follows the period picker at the top of the page (This/Last month, quarter, year, custom range — everything on the page recalculates).

Portfolio

One row per venture: money in, money out, net for the selected period, ▲/▼ deltas vs the equal previous period, a daily-net sparkline, the venture's AI spend (and its share of that venture's income), and an open signals badge from your installed agents. Click any column header to sort; click a venture to open it.

Money explorer

Slices all synced money — revenue, infrastructure, ads, fees, AI — by one dimension at a time: Category, Provider, Source, Service, Venture, or Type. Toggle the KPI cards to switch between Money in / Money out / Net. Use the provider and category dropdowns to filter, and Export for a designed Excel workbook, a branded PDF report, or raw CSV — all respecting your active filters and period.

Attribution — money → ventures

Per-venture P&L is only real when every transaction lands on the right venture. Two mechanisms, both retroactive (history re-attributes on re-sync):

• Source mapping — for providers with clean sub-entities: GCP projects, Cloudflare accounts, Claude workspaces, OpenAI projects. Map each source to a venture in Money explorer → Attribution rules → sources, or Cloud costs → Attribution for infrastructure.
• Rules — "description contains X → venture Y" for everything else (Stripe descriptors, bank memos). A rule can also recategorize (e.g. "anthropic" → category ai). Click Suggest rules and Kordox drafts rules for you — deterministic name matches plus AI drafts for the unclear remainder; nothing applies until you tick and Save & re-sync.

Transactions

The ledger table supports search (by description), a type filter (revenue / expense / refund), and pagination at 50 per page.

Invoices → PDF

On any client's 360 page (Clients → client → Invoices) and on the public pay page, the Download PDF button produces a branded, printable invoice — line items, totals, status, billed-to, and the pay link.

AI spend

Connect Anthropic (Claude) and/or OpenAI under Connectors (admin API keys — the wizard walks you through where to create them). Daily API costs arrive per workspace/project as category ai, attributable to ventures like any other source. The AI Spend Sentinel agent watches week-over-week changes; subscription charges (Claude Pro/Max seats) arrive via your card connectors and classify with one suggested rule.

Ask about your money

Ask Kordox understands ledger questions: "What did GloTax cost in June?", "How much did we spend on Claude this month?" — answered from your attributed data, in your language, with the interpretation spelled out.

Costs — budgets, always-on spend, and what's worth reviewing

The Costs tab is the cost-control half of Finance. Nothing on it needs a provider API you haven't already connected.

Cost budgets

A ceiling on any slice of spend: a whole venture, one provider, one cloud account, or one service — picked from dropdowns built out of your own synced data, so a scope can't be mistyped into never matching. Choose the period (monthly, quarterly, or a fixed range) and the amount, in your organisation's reporting currency, shown beside the field.

Three alerts, worst-first: breached (over), warning (past your chosen threshold), and projected (on the current run-rate it will breach before the period ends). Alerts appear in Triage and the morning digest.

Anomalies catch a change. Budgets catch a level — spend that was always too high and never moved.

Always-on spend

The floor under your bill: the part of each service that's there every single day, whatever you do. Kordox measures a baseline from 90 days of actual usage and shows what it annualises to — the number worth knowing before anyone discusses a committed-use discount. It never claims a saving it hasn't measured.

Worth reviewing

Findings, not verdicts, read straight out of the billing data:

• Per line item — containers kept warm around the clock, reserved IPs, disks that outlived their VM, snapshot buildup.
• Across accounts — the same product billed on several accounts (only visible if something holds all nine of your Cloudflare accounts at once), and prompts paying full price every time: an AI workspace whose input spend is almost entirely fresh prompts rather than cache reads, which cost a fraction of the same tokens.

Each finding names the SKU or token type it matched, so you can check the reasoning rather than trust it. Warm containers may be exactly what you want, and an IP may be held for next week's migration — the judgement stays yours.

One currency, named

Kordox converts every figure into your organisation's reporting currency and prints the currency code beside it — ILS 3,912.94, not $3,912.94. This matters if you bill in more than one: GCP invoices in shekels while Cloudflare and the AI APIs bill in dollars, and a total that mixed them would be a number that is true of neither.

Where a panel genuinely holds two currencies at once — a cost finding read from a provider's own billing export, next to one derived from your ledger — it says so and shows each in its own rather than adding them.

Closing the attribution gap

The dashboard says how much money isn't mapped to a venture yet. Suggest rules handles everything with a recognisable name; See which opens what is actually left, grouped by description, provider or account, with the amount and transaction count for each.

Two ways to settle a group, and the second matters as much as the first:

• Assign it to a venture.
• Belongs to no venture — for genuinely shared spend: a domain renewal covering everything you run, a card fee, a tax line. It stays out of every per-venture P&L and stops counting against the gap.

Without that second option the number could never honestly reach zero, and a figure that can't go down is one you stop reading — which is exactly how a real mis-attribution would slip past unnoticed. Assigning a venture later clears the shared mark automatically.

Cross-account product findings (Cloudflare)

Cloudflare's billing history names documents — invoice, charge, credit — not products. So Kordox reads your subscriptions as well: the rate plans on each account, with their real names and prices, normalised to a monthly figure so an annual plan is comparable to a monthly one.

That is what makes "Workers Paid, on five accounts" possible. Each Cloudflare account genuinely cannot see the other eight; the finding only exists somewhere that holds all of them at once.

It needs Billing:Read on your Cloudflare API token. Without it the panel says so rather than showing an empty list — "we found nothing" and "we could not look" are different answers, and only one is good news. Your transactions sync normally either way.

Findings reach the morning loop

Cost findings used to live only on this page — they reached whoever remembered to come and look. They now raise a Triage signal too — once a day, at 05:00 UTC — so they arrive in the same daily feed as everything else, with a one-click jump back to the Costs tab. Daily rather than hourly on purpose: a billing export moves slowly, and re-raising the same finding four times a day is noise pretending to be vigilance.

Deliberately quiet: at most two signals, whatever the scan turned up — one per cloud account with spend worth reviewing, and one for cross-account duplication however many products duplicate. Four findings is one decision-making session, not four interruptions.

Small amounts never reach Triage at all, and a signal resolves itself once the next scan no longer finds it — spend that stopped, or a duplicate you consolidated.

Figures stop moving once the money has settled

A cost from June used to be converted at today's rate every time a report was opened — so last month's number changed each time you read it, for spend that never moved.

Now the rate is captured as the money lands, and any figure that has settled is reported at the rate that applied then. Rows synced before this have no frozen rate to use — there is no honest way to invent one after the fact — so they are still converted live and will drift until they are re-synced. Panels add the two halves together, so nothing is dropped in the meantime.