# Company settings center

Open Settings from the workspace menu. The compact grouped navigation links to General, Modules, Email & SMTP, Employee fields, Module policies and Retained records. Search matches titles and keywords such as SMTP, expiry, MFA and custom fields. It filters immediately; pressing Enter also produces server-rendered search results. On mobile, categories wrap into accessible buttons. Section links, filters and pagination work without JavaScript.

General keeps company/branch preferences and inherited defaults. Employee fields retains typed encrypted custom fields. Modules retains company/branch applicability and its commercial/permission boundaries. Policies links to the existing authorized policy editors. History retains read-only module access. Each section has its own Blade partial; add a catalog entry in `app/Support/SettingsCatalog.php` plus an authorized controller/data source and partial to extend it.

## Company SMTP

Settings → Email & SMTP requires both settings.manage and notifications.manage. Each company has its own tenant-scoped SMTP configuration in the InnoDB tenant_mail_settings table. Password and authentication username are encrypted with Laravel encryption. Passwords are hidden from serialization, forms, old-input flash and audit metadata. A blank password preserves the saved value; changing host/username requires re-entering it. A separate remove-password control requires delivery to be disabled.

Use a public mail-server hostname, port 587 with required STARTTLS or port 465 with implicit TLS, mailbox username/password and an authorized sender name/address. Plaintext SMTP, disabled certificate verification, private/reserved addresses and raw IP hostnames are blocked. All resolved A/AAAA addresses are checked on every connection; the socket connects to the checked IP with TLS peer verification against the original hostname. This prevents DNS rebinding to a private service. Use the provider's public SMTP hostname for cPanel; private-only relays cannot be configured through this tenant UI.

Save first, then optionally choose Send test to my account. This explicit action sends one email only to the signed-in administrator's address, is limited to three attempts per minute and returns a generic failure without transport secrets. No real test email is sent by automated tests.

Company delivery starts disabled. In production, enabling it opts the company into new notification emails through the existing maintenance cron. An activation ID boundary and timestamp keep earlier pending email paused, even if created in the same second. Disabling stops future attempts; an already in-flight send may complete. Re-enabling sets a new boundary. Ten emails at most are attempted per company/pass; existing retry limits/backoff/deduplication remain in place. The isolated mailer does not change installation-wide mail configuration or other tenants' credentials. Legacy operator-managed email workers retain their original installation transport when no company SMTP record exists.

Automatic email stays paused in the local installation, including when a saved connection is enabled. The explicit test button still sends if selected. Webhook delivery remains paused. OCR remains disabled by default with its existing Super Admin per-client switch; manual document dates are unaffected. No Docker, Cloudflare, extra daemon or cloud account is required.

After deployment, run migrations, rebuild assets, refresh configuration/views and keep the existing one-minute maintenance cron. On hosting, outbound SMTP ports and DNS must be permitted and sender-domain SPF/DKIM should be configured through the mail provider. Keep APP_KEY backed up privately because it protects stored SMTP credentials as well as existing encrypted settings.

Implementation references: [Laravel Mail](https://laravel.com/docs/13.x/mail), [Symfony TLS mail transport](https://symfony.com/doc/current/mailer.html).