Crons + integrations — how HR data flows out

The 4 HR-relevant crons

Linux crontab

# M13 EOSB monthly snapshot — last day of month at 23:30
30 23 28-31 * * /usr/bin/php /var/www/acwms-v5/bin/cron-m13-eosb-accrual.php > /var/log/acwms/eosb.log 2>&1

# M13 leave year-end carry-forward — 1 January at 02:00
0 2 1 1 * /usr/bin/php /var/www/acwms-v5/bin/cron-m13-leave-carry-forward.php > /var/log/acwms/leave.log 2>&1

# M17 expiry reminders — every day at 06:00
0 6 * * * /usr/bin/php /var/www/acwms-v5/bin/cron-m17-expiry-reminders.php > /var/log/acwms/expiry.log 2>&1

# M16 retention — every day at 00:00
0 0 * * * /usr/bin/php /var/www/acwms-v5/bin/cron-m16-retention.php > /var/log/acwms/retention.log 2>&1

Module integrations

1 · M17 Communications (email)

HR triggers email send on:

• Employee doc expiring — template compliance.expiry_reminder · cron T-30/T-7/T-1
• Leave applied — template leave.submitted to manager · immediate
• Leave decided — template leave.decided to applicant · immediate
• Visa expiring — same expiry-reminder cron · separate audit-log channel

Each email is logged in email_log with delivery status (sent / delivered / opened / failed).

2 · M16 File Vault

HR uploads (employee documents, certifications, scans) live under storage/employees/{id}/... but surface in the unified Vault Explorer at /documents/explorer under the "Employees & HR" branch. RBAC respected — managers see only their department's employees.

3 · M11 Invoices (payroll-as-engagement)

For TPL-PAY Payroll engagements, M13 compensation feeds the WPS SIF + payslips for the client's staff. The job-level integration is one-way — M11 invoice for the firm's fee for running payroll, not for the client's salary expense.

4 · M20 Compliance Calendar

Some HR docs (work permits, MOLP labour-card renewals) appear as recurring obligations on the Compliance Calendar. The deadline-generation cron creates a forward 12-month window of upcoming renewals, surfaced on the partner's dashboard.

The audit trail

Every HR action emits an audit_logs row via AuditLogger::log():

Health check

The /health endpoint includes HR-relevant indicators in its JSON:

• db_ping — DB connection alive
• email_queue_stale — emails older than 1 hour still pending (indicator that crons are not running)
• storage_writable — employee photo uploads can write to storage/employees/
• storage_free_bytes — capacity for new uploads

Configure your monitoring (Datadog, Pingdom, Uptime Kuma) to alert on status != ok.

Backup + restore

HR data is part of the nightly backup via bin/cron-backup.php:

• db.sql.gz includes all 33 HR tables
• storage.tar.gz includes storage/employees/ tree (photos, documents, certs)
• Off-site sync via bin/cron-offsite-backup.sh to B2 / S3 / Wasabi
• Quarterly restore drill — pick a random employee · restore from off-site · verify SHA-256