Client Time Report Checklist: Share Without Oversharing

A client time report should explain the hours behind a commercial conversation. It should not expose the agency's full operating record to do that.

Those records serve different audiences. The internal record may contain payroll rates, margin notes, rejected entries, employee details, private comments, monitoring evidence, and identifiers from several clients. The client copy needs enough detail to understand the work, match the agreed billing method, and raise a precise question.

Treating an export button as the release decision collapses that boundary. A better control is simple: approve the source record, choose the client fields, inspect the exact output, and preserve the version that was sent.

Vendor documentation cited in this guide was checked on September 17, 2026. This is an operating checklist, not legal or contractual advice. Your contract and applicable privacy, employment, tax, and recordkeeping rules still govern what the agency must retain or disclose.

The short answer

Build the client copy from approved time, not from an unreviewed export.

Include the client, reporting period, covered project or workstream, useful work labels, approved hours, and totals that reconcile to the commercial document. Add names, entry-level notes, rates, or supporting evidence only when they serve a defined client purpose. Keep internal costs, margin, private comments, exception discussions, unrelated client data, and the raw monitoring record outside the standard report.

The client time report should answer three questions without creating three more:

1. What period and scope does this report cover?
2. What approved work and quantity support the total?
3. Who owns a correction if the client identifies a specific problem?

Start with the report's job

An invoice support report, an account review, and a disputed-hour response are different releases.

An invoice support report usually needs a stable period, agreed work categories, approved quantities, and totals that match the invoice. An account review may add progress context and workstream summaries. A dispute response may need selected entry-level detail for one questioned line.

Do not make the most detailed version the permanent default. Define the purpose before choosing columns. That keeps a reasonable request for evidence from becoming standing access to employee notes or the agency's cost structure.

Approval also comes before presentation. Treat editable, pending, approved, and reopened time as different states. The useful control is the separation between a source record that is still changing and the version eligible for downstream reporting.

Client time report field matrix

Use this matrix as a starting policy. A contract, statement of work, regulated engagement, or client-specific control may require a different choice. Record the exception instead of silently changing the default.

Report software already exposes these choices. My Hours documents detail modes that show grouped totals, individual logs without notes or attachments, or logs with all details. Harvest warns that its default CSV and Excel exports can contain more detail than the report interface, while custom exports can limit columns on eligible accounts.

The lesson is operational: preview the file, not just the screen that produced it.

Run the six-check release control

The reviewer should be able to complete these checks against the exact file or link that will reach the client.

1. Scope: Confirm one client, the intended projects or workstreams, fixed period dates, time zone, and commercial reference. Search the output for other-client names and codes.
2. Approval: Confirm that every included entry passed the agency's approval cutoff. Exclude reopened, rejected, and unresolved entries until a named reviewer decides their state.
3. Exclusions: Inspect columns, notes, attachments, hidden worksheets, file properties, and totals. A clean on-screen view does not prove a clean export.
4. Access: Name the recipients and decide whether the release is an attachment, private link, or another controlled channel. Record whether recipients can download, forward, change the date range, or reach a live report that changes after release.
5. Version: Give the release a version, generation time, and owner. Store the exact client copy and mark which previous version it replaces.
6. Retention: Assign who will revoke access or delete the client copy under the contract and agency policy. Do not confuse the client copy's lifespan with the retention duty for the internal source record.

The control ends with a decision, not a vague review note. The report is either ready, held for correction, or released with a named exception the contract permits.

Answer a disputed line without opening the ledger

A client challenge should narrow the evidence request. It should not expand access by default.

This is progressive disclosure. Each step answers a narrower unresolved question. If the client asks for a broader standing data feed, treat that as a commercial and privacy decision with named scope, recipients, retention, and controls. It is not a routine extension of the invoice attachment.

The same principle applies to employee visibility. A clear monitoring policy should tell people what the agency collects, why it is collected, and how evidence may be reviewed. The agency's client-reporting rule should then say which parts, if any, may cross the client boundary. The ownership questions in Who Controls Your Workforce Data? and the rollout checks in the employee screenshot monitoring guide are useful companions to that policy.

Protect attached evidence as a separate layer

Report content, access control, storage encryption, and transport security solve different problems.

The field matrix controls what is in the client copy. Permissioned access controls who can retrieve it. Encryption at rest protects stored data. TLS protects data while it moves across the network. None of those layers decides whether a private note belonged in the report in the first place.

Apply the least-privilege principle to the release: give each recipient the minimum access needed for the report's purpose. Prefer a fixed client and period, named recipients, an expiry or revocation path, and no access to unrelated records. If evidence is highly sensitive, send the report and the supporting artifact through separate controls so the report does not become a permanent container for monitoring data.

How KordanoTime fits the control

KordanoTime opens customer access on December 1, 2026. The first release captures a daily timeline, works online and offline, carries approvals, and produces payroll-ready exports.

Screenshot monitoring is included with a 500-screenshot monthly limit for Early Access teams and unlimited screenshots on the Team plan. In the prelaunch implementation, screenshot media is stored in Cloudflare R2 with AES-256 encryption at rest and TLS in transit. Signed-in, organization-scoped permission checks precede access, and clear images use five-minute signed links.

Those controls protect screenshot media while it is stored and transferred, and limit retrieval to authorized viewers within the stated scope. This checklist treats the client-copy decisions as manual agency procedures outside KordanoTime: the agency selects the included fields, confirms the approved source period, and chooses the delivery path. GPS, geofencing, and employee location are planned for a 2027 release and are not part of the first release.

For a related test of client-safe reporting inside a broader operational evidence chain, use the BPO time tracking software checklist.

Use a release receipt

Store this beside the exact client-facing file or link:

Client:
Report purpose:
Covered projects or workstreams:
Period and time zone:
Approval cutoff:
Included fields:
Explicit exclusions:
Generated at:
Version:
Delivery path and recipients:
Access expiry or revocation owner:
Supersedes:
Correction owner:

The receipt does not add ceremony for its own sake. It lets an account lead answer which version the client received, lets finance reproduce the total, and lets operations revoke or correct the release without guessing.

For the next client time report, choose the report's job first, apply the field matrix, and refuse release until one person owns all six checks. If KordanoTime's planned time, approval, export, and screenshot controls fit the source-record side of that process, see the planned pricing.