← All projects
Internal tooling

Invoice capture and bank reconciliation, running unattended

Every small business has this job: invoices arrive by email, someone saves them somewhere, and at month end someone else works out which ones are missing. It is unskilled, unavoidable and nobody wants it. We automated ours, and the same pattern fits most businesses.

Sector
Our own back office
Built
For our own back office
Status
Running on a schedule
Scope
Design, build, maintenance
3test suites covering storage, rules and the pipeline
Dry runthe default mode, so a bad rule cannot file anything

What it does

The tool we built for our own bookkeeping: it reads supplier invoices out of the inbox, files them in the right place in the accounts drive, and reconciles them against the bank statement export when one is dropped in.

Reads the inbox so nobody has to

Invoices and receipts are found by what they are, not by someone remembering to forward them.

  • Attachments pulled from the accounts inbox automatically
  • Classification by sender, subject and the text inside the document itself
  • Payment processor receipts recognised separately from supplier invoices

Files them where the accountant expects

Straight into the shared accounts drive, in the structure the bookkeeping actually uses.

  • Consistent naming and folder structure applied automatically
  • Byte-identical copies detected by cryptographic fingerprint, so the same attachment forwarded twice is filed once. A rescanned or regenerated copy is a different file and is not caught this way
  • Never overwrites, so a genuinely different document with a colliding name is kept

Reconciles against the bank

The useful half: not just filing documents, but knowing which payments have no invoice behind them.

  • Bank statement export matched against the filed invoices
  • Unmatched items on either side are listed in a report

Safe to leave alone

An automation that files things into your accounts needs to fail safe, not fail quietly.

  • Dry run is the default, so a rule change is inspected before it is ever allowed to file anything
  • Scheduled by the operating system rather than a cloud service with its own bill and outage page
  • Unit tests covering the classification rules, the storage layer and the pipeline end to end

What it connects to

Most of the value in a system like this comes from the systems it talks to, and most of the risk does too. Each connection is scoped to the access it needs for the job.

Sources

  • EmailAuthenticated read of the accounts inbox and its attachments
  • Bank statement exportCSV reconciliation against filed documents

Destination

  • Shared cloud driveFiled into the accounts folder structure

How it fits together

The path a piece of work takes through the system, start to finish.

Scheduled run

The job runs on a timer against the accounts inbox. No dashboard to check and no service to log into. Reconciliation runs against the bank statement export whenever a fresh one is dropped in.

Find and classify

New attachments are pulled from the inbox and classified by sender, subject and document contents into invoices, receipts and everything else.

Fingerprint and file

Each document is fingerprinted so duplicates are recognised regardless of filename, then filed into the accounts drive under a consistent name.

Reconcile

Filed documents are matched against the bank statement export, and anything unmatched in either direction is reported.

The hard parts

The problems that decided how this was built. They are the reason it works the way it does rather than the obvious way.

Automations that file things into your accounts

The problem

An automation with write access to the accounts drive can make a mess faster than a person can. A wrong classification rule, run unattended for a month, is a genuine cleanup job.

What we did

The tool defaults to a dry run: it reports every action it would take and changes nothing unless explicitly told to act. Classification rules, the storage layer and the full pipeline each have tests, so a rule change is verified before it ever runs against the real drive.

The result

An automation that can be left to run, because every rule change is proved in dry run before the scheduled job is allowed to act.

Built with

PythonGmail APIGoogle Drivesystemd timerspytest

We don’t publish screenshots, logos or client names for this work. Much of it runs inside a business and handles sensitive data, so we describe what was built rather than who it was built for. We’re happy to walk through the detail on a call.

Ask a question

Tell us what your version of this needs to do and we’ll come back within one business day with scope, approach and a price.

What is your question about? (required)

Need something like this?

Every build on this page started as a workflow that off-the-shelf software nearly handled. Tell us where the gap is and we’ll scope what it takes to close it.