The software behind Sugar City's water, sewer and trash billing
Every screen below is the real thing, photographed from a working system — not a mock-up and not a scripted tour. This page explains what each part is for, what it refuses to do, and why.
- Water · Sewer · Trash
- English and Spanish throughout
- Built for a town this size
- The town owns its data
One workspace, and everything in it belongs to the town
Utility billing for a town of a few hundred households is not a smaller version of billing for a city. There is no billing department — there is a clerk who also answers the phone, takes payments at the counter, and books the dumpster. The software has to fit that, which mostly means being honest about what it knows and refusing to guess.
Customer accounts
A resident's file holds their services, their meters, their invoice history and their balance — plus two things that usually live in somebody's memory: notes about every time they got in touch, and a record of everyone who has touched their account.
Billing that refuses to guess
A billing run reads meters, applies the town's rates, and produces a draft. Nothing is collectable until somebody approves it. The rules underneath are all of the same kind: when the system does not know something, it stops and says so rather than picking an answer.
The town sets every price
Water, sewer and trash rates; the deposit a new account pays; what a dumpster rental costs; what a kept trash tote costs per month. Nothing ships with a price in it, and no form opens with a suggested figure — a number we invented, sitting in a box, is how a made-up price ends up on a resident's bill and then gets defended as "what the system said".
A service with no rate cannot be billed. A dumpster size with no price cannot be booked. A deposit cannot be taken until the town has set one. Charging something other than the standard deposit is allowed — hardship waivers are real — but it has to carry a written reason, and both figures are kept side by side.
Two active rates for one service stops the run
If a service somehow ends up with two current rates, billing refuses rather than picking one. Two neighbours on the same service being billed differently is not an error anyone notices until it is a complaint at a council meeting.
The work, and the people who do it
Meter reading, work orders, the fleet, dumpsters, trash totes and the staff roster are all here, because in a town this size they are the same handful of people.
Time off is a small ticket
Somebody asks, somebody with the authority decides, and the person who asked can see where it got to: waiting, approved, refused or withdrawn, with who decided and when. Refusing asks for a reason, because the person who asked will read it.
Once a request is approved it stands. Somebody has arranged their life around it, so it cannot be quietly reversed later. And nobody can be rostered on a day they were granted off — that is the mistake discovered at six in the morning when nobody turns up, so the system refuses it outright rather than showing a warning.
Containers keep the numbers already painted on them
Every tote and dumpster the town owns already has a number on its side, and the crew reads that number off the bin. So that number is the identity here. Nothing assigns its own ids, because that would mean somebody maintaining a translation table between what is on the bin and what is on the screen — and that table is wrong the first time a bin is replaced.
Permissions the town controls, not us
"Billing clerk" means a different job in a town of 250 than in one of 25,000. So every permission is a switch the town's administrator can turn on or off per role — and the server checks it on every request, not just when a screen loads.
Some things are deliberately not the administrator's
Only the mayor can set or change what an employee is paid. Administering the software is not the same as deciding a wage, so an administrator can see pay — payroll runs from those figures — and has no way to change one. Adding a new employee cannot set a rate at all; they start at zero and the mayor sets it, with a reason recorded.
Extra roles sit on top of a job, not instead of it
The person who runs the roster is usually also the clerk or the works foreman. So "scheduler" is granted to a person in addition to whatever they already are, rather than replacing it. They keep reading meters and taking payments; they also approve time off.
A record that can be checked, not just trusted
Every action is recorded with who did it and when — and the record is sealed so that altering it can be detected rather than merely discouraged.
What "verify" actually checks
Each entry is sealed to the one before it with a key the database does not contain, so somebody who can edit the table still cannot re-seal it. Each entry also carries a position, so removing one from the middle leaves a gap. And the running total is written out to the server's own system journal, which the application cannot rewrite — because a chain and a sequence together still cannot notice entries removed from the end.
When the check reports a problem it says which kind: an entry was edited, one was removed from the middle, or entries were removed from the end.
Everyone can read their own
An administrator or auditor reads the whole town's record. Everybody else reads their own, from their own profile — the same record an administrator sees about them, not a separate, friendlier version.
The town's records stay the town's
Take everything, whenever
The whole database exports as ordinary CSV files in one archive. No format anybody needs our software to read, and no asking us first.
Sealed copies we cannot open
The town can have a sealed copy of the entire database made on a schedule and keep it somewhere else. The town generates a key pair and keeps the private half; this system only ever holds the public half. It can therefore write a copy every month and cannot open a single one of them — which is the point, because a backup we could open is a backup an intruder could open too.
Accounting
Billing can be posted into the town's QuickBooks as journal entries — the ledger movement, not every resident's name and address copied into a second system. It is off until somebody deliberately turns it on, and turning it off always works immediately, whatever else is configured.
English and Spanish, everywhere
Not a translated front page with an English system behind it. Every staff screen, every resident page, every letter and text message, and this page. A build check fails if a string exists in one language and not the other, because a half-translated screen is how language access quietly stops being real.
The public pages meet WCAG 2.1 AA, which for a Colorado municipality is a legal requirement rather than a polish item. That is checked automatically on every release and confirmed by hand with a real screen reader.
The rules the town has adopted, where residents can read them
Sugar City's ordinances live in the same system as everything else, and the town decides which of them the public sees. Writing an ordinance down and publishing it are two separate acts: everything starts unpublished, and going onto the public website is one deliberate press per ordinance. A half-typed draft cannot reach the town's front page by accident.
Decades of existing ordinances come in from a spreadsheet. The importer reads the file and tells the clerk what would happen before it writes anything; if any row is bad it refuses the whole file, because an ordinance book loaded halfway is worse than an empty one — afterwards nobody can tell which rules made it in. Ordinance numbers are kept exactly as adopted, because that number is what appears in the minutes and on the signed copy in the vault.
Finding a resident with whatever you actually have
The person at the counter has one thing: a name half-remembered, a phone number read out over the line, a street, or the account number off the bill. One box searches all of it. Part of a name works, and so does the full name in either order. A phone number matches however either side punctuated it — (719) 555-0148, 555-0148 and 7195550148 are the same number, because only the digits are compared. An address matches whether it is where the water runs or where the bill is posted.
The same box is used everywhere a customer has to be chosen: taking a payment, delivering a cart, booking a container, booking a visit. It is operable entirely from the keyboard, because a clerk on the phone is not reaching for a mouse.
Everyone can see what they are allowed to do
When a button is missing, the usual question is whether the software is broken. It is almost never that — it is a permission somebody set. So every member of staff has a page listing their own permissions in plain words, alongside their own history of what they have done. Nobody has to ask an administrator to find out why a screen looks different from a colleague's.
