GuardCore · Licences & compliance
Licences, SWMS, and an audit trail that shows tampering
Four expiry bands swept in the background, licence classes catalogued across eight Australian jurisdictions, and every write hash-chained per organisation under a constraint that makes a forked chain impossible.
The problem this solves
Compliance software usually means a folder with dates in it. The dates are right on the day they are typed, somebody runs a report before an audit, and the thing that actually goes wrong — a licence lapsing quietly between reports — is exactly what a folder cannot catch.
GuardCore sweeps it. Ninety, sixty, thirty and seven days out, in exclusive bands, one notification per item per band, idempotent so a re-run does not repeat itself. A licence is noticed four times before it lapses rather than once afterwards. The register behind it carries the class, and the class catalogue names the actual Australian regulators across eight jurisdictions — with any entry whose code could not be confirmed marked as a placeholder for a compliance officer to correct rather than presented as a fact.
Nine kinds of evidence satisfy a requirement through one evaluator: licences, qualifications, training, police checks, working-with-children checks, right to work, vehicle registration, contractor insurance and site certificates. A requirement marked blocking is the one the roster enforces; a non-blocking one is reported and never enforced, which is said plainly rather than implied.
The safety documents take a position most products avoid: most security work is not construction work, so it needs a safe work procedure rather than a Safe Work Method Statement, and the two are carried apart instead of conflated. A new version moves the pointer, so yesterday’s sign-on stops satisfying today’s requirement — and the receipt records a hash of the object the person was actually shown, not the label they signed.
Underneath all of it, every write is sequenced and hash-chained per organisation, with the actor and the credential inside the hash. The uniqueness constraint on the sequence is what makes it tamper-evident rather than merely tidy: a second write at the same position is refused by the database, so the chain cannot be forked and re-written.
Worked example
A guard’s licence is due to expire in ninety-one days.
- 1
Ninety days out
The first band catches it. One notification, against the licence itself, idempotent on the organisation, the type and the link — so tomorrow’s sweep does not send it again.
- 2
Sixty, then thirty, then seven
Three more bands, each exclusive of the last, so the same licence is raised four times in total and never four times in one day.
- 3
It lapses anyway
The roster stops placing them, evaluated live for the shift date. The gate is the software, not the reminder.
- 4
Every step is in the chain
The renewal, the read of the employment file behind it, the roster refusal — sequenced, hash-chained and verifiable from the stored data alone.
The audit question stops being "do you have a process" and becomes "show me", which is answerable.
Capabilities
What licences & compliance gives you
All 10 of these are in the product today. Each one names what it is built on.
Security licence register
LiveEvery licence with its number, issuer, class and expiry, and a dashboard that counts what has expired and what expires inside thirty, sixty and ninety days — filterable to the site the guards are rostered at.
Australian licence classes, by jurisdiction
LiveA platform-wide catalogue of security licence classes across eight Australian jurisdictions, named against their actual regulators — and any entry whose code could not be confirmed is marked as a placeholder to correct, not stated as fact.
Ninety, sixty, thirty, seven days out
LiveFour exclusive bands swept in the background, one notification per item per band, idempotent — so a licence expiring is noticed four times before it lapses rather than once after.
Nine kinds of evidence, one evaluator
LiveLicences, qualifications, training, police checks, working-with-children checks, right to work, vehicle registration, contractor insurance and site certificates all satisfy a requirement through one evaluator — and a requirement marked blocking is the one the roster enforces.
Induction register that covers everybody
LiveOrganisation, site, client, role, contractor, refresher and return-to-work inductions in one register covering employees, contractor workers and office staff alike, each with its coverage state rather than a tick.
SWMS sign-on, and the honest distinction
LiveA safe work method statement and a safe work procedure are carried apart, because most security work is not construction work — and a new version moves the pointer, so yesterday’s sign-on stops satisfying today’s requirement.
Controlled documents and what was actually shown
LivePolicies, procedures and post orders versioned, issued, acknowledged — and the receipt records a hash of the object the person was shown rather than the label they signed, so "I signed a different version" is answerable.
Pre-start checks a driver cannot pass
LiveA patrol vehicle’s walk-around filed from the phone, where the pass or fail is derived on the server from the answers rather than sent by the client — and a failed safety-critical line raises a work order in the same transaction.
Hash-chained audit trail
LiveEvery write sequenced and chained per organisation under a uniqueness constraint that makes a forked chain impossible, with the actor and the credential inside the hash — so an attribution cannot be rewritten afterwards either.
Reading an employment file is itself recorded
LiveNineteen tables holding employment, pay, recruitment and background-check records log who read them, enforced in the data layer rather than per screen — so a privacy question has an answer that is not "probably nobody".
What backs these claims
Each capability names the decision record, module, route or table it is built on. Ask us for any of them in an evaluation and we will walk you through the code.
- Security licence register
- src/lib/imss-lookups-licences.ts · imss_licences · /imss/licences · GET /api/imss/licences/expiry-dashboard
- Australian licence classes, by jurisdiction
- src/server/imss-licence-classes.ts seedLicenceClasses licenceClassSeedRows · imss_licence_classes
- Ninety, sixty, thirty, seven days out
- ADR 0040 · src/server/imss-jobs/expiry.ts EXPIRY_WINDOWS
- Nine kinds of evidence, one evaluator
- src/server/imss-compliance-evaluator.ts EVIDENCE_SOURCES evaluateRequirements · imss_compliance_requirements · imss_work_rights
- Induction register that covers everybody
- ADR 0053 · src/server/imss-inductions.ts · GET /api/imss/inductions · POST /api/imss/mobile/onboarding · /imss/inductions
- SWMS sign-on, and the honest distinction
- ADR 0053 · src/server/imss-swms.ts signOnState · /imss/swms · POST /api/imss/mobile/swms
- Controlled documents and what was actually shown
- ADR 0053 · src/server/imss-controlled-documents.ts assertVersionStored · POST /api/imss/mobile/policies · imss_controlled_documents
- Pre-start checks a driver cannot pass
- ADR 0050 · src/server/imss-vehicle-checks.ts deriveOutcome workOrderFor · POST /api/imss/vehicle-checks · POST /api/imss/mobile/vehicle-check · imss_vehicle_checks · /imss/vehicle-checks
- Hash-chained audit trail
- src/server/imss-audit.ts verifyChain appendAuditEvent · uq_imss_audit_events_org_sequence · /imss/audit-trail
- Reading an employment file is itself recorded
- src/server/imss-data-scope.ts HR_SENSITIVE_TABLES logHrSensitiveReads · imss_permission_access_logs
Where this sits
Back to
GuardCore — every capability in one place
The whole module: what is live, and what is only on the roadmap.
Read next
Rostering that refuses the guard it ought to refuse
Eligibility worked out live for the shift date from the licences on file — never from a stored score that has gone stale — and the licence class the shift asks for checked, not just that a licence exists.
Twenty minutes on a real contract.
Real data, four logins, nothing typed on the day — including the parts we have not built, which we will point out ourselves.