Skip to content

GuardCore · Licences & compliance

Licences, SWMS, and an audit trail that shows tampering

Four expiry bands swept in the background, licence classes catalogued across eight Australian jurisdictions, and every write hash-chained per organisation under a constraint that makes a forked chain impossible.

The problem this solves

Compliance software usually means a folder with dates in it. The dates are right on the day they are typed, somebody runs a report before an audit, and the thing that actually goes wrong — a licence lapsing quietly between reports — is exactly what a folder cannot catch.

GuardCore sweeps it. Ninety, sixty, thirty and seven days out, in exclusive bands, one notification per item per band, idempotent so a re-run does not repeat itself. A licence is noticed four times before it lapses rather than once afterwards. The register behind it carries the class, and the class catalogue names the actual Australian regulators across eight jurisdictions — with any entry whose code could not be confirmed marked as a placeholder for a compliance officer to correct rather than presented as a fact.

Nine kinds of evidence satisfy a requirement through one evaluator: licences, qualifications, training, police checks, working-with-children checks, right to work, vehicle registration, contractor insurance and site certificates. A requirement marked blocking is the one the roster enforces; a non-blocking one is reported and never enforced, which is said plainly rather than implied.

The safety documents take a position most products avoid: most security work is not construction work, so it needs a safe work procedure rather than a Safe Work Method Statement, and the two are carried apart instead of conflated. A new version moves the pointer, so yesterday’s sign-on stops satisfying today’s requirement — and the receipt records a hash of the object the person was actually shown, not the label they signed.

Underneath all of it, every write is sequenced and hash-chained per organisation, with the actor and the credential inside the hash. The uniqueness constraint on the sequence is what makes it tamper-evident rather than merely tidy: a second write at the same position is refused by the database, so the chain cannot be forked and re-written.

Worked example

A guard’s licence is due to expire in ninety-one days.

  1. 1

    Ninety days out

    The first band catches it. One notification, against the licence itself, idempotent on the organisation, the type and the link — so tomorrow’s sweep does not send it again.

  2. 2

    Sixty, then thirty, then seven

    Three more bands, each exclusive of the last, so the same licence is raised four times in total and never four times in one day.

  3. 3

    It lapses anyway

    The roster stops placing them, evaluated live for the shift date. The gate is the software, not the reminder.

  4. 4

    Every step is in the chain

    The renewal, the read of the employment file behind it, the roster refusal — sequenced, hash-chained and verifiable from the stored data alone.

The audit question stops being "do you have a process" and becomes "show me", which is answerable.

Capabilities

What licences & compliance gives you

All 10 of these are in the product today. Each one names what it is built on.

Security licence register

Live

Every licence with its number, issuer, class and expiry, and a dashboard that counts what has expired and what expires inside thirty, sixty and ninety days — filterable to the site the guards are rostered at.

Australian licence classes, by jurisdiction

Live

A platform-wide catalogue of security licence classes across eight Australian jurisdictions, named against their actual regulators — and any entry whose code could not be confirmed is marked as a placeholder to correct, not stated as fact.

Ninety, sixty, thirty, seven days out

Live

Four exclusive bands swept in the background, one notification per item per band, idempotent — so a licence expiring is noticed four times before it lapses rather than once after.

Nine kinds of evidence, one evaluator

Live

Licences, qualifications, training, police checks, working-with-children checks, right to work, vehicle registration, contractor insurance and site certificates all satisfy a requirement through one evaluator — and a requirement marked blocking is the one the roster enforces.

Induction register that covers everybody

Live

Organisation, site, client, role, contractor, refresher and return-to-work inductions in one register covering employees, contractor workers and office staff alike, each with its coverage state rather than a tick.

SWMS sign-on, and the honest distinction

Live

A safe work method statement and a safe work procedure are carried apart, because most security work is not construction work — and a new version moves the pointer, so yesterday’s sign-on stops satisfying today’s requirement.

Controlled documents and what was actually shown

Live

Policies, procedures and post orders versioned, issued, acknowledged — and the receipt records a hash of the object the person was shown rather than the label they signed, so "I signed a different version" is answerable.

Pre-start checks a driver cannot pass

Live

A patrol vehicle’s walk-around filed from the phone, where the pass or fail is derived on the server from the answers rather than sent by the client — and a failed safety-critical line raises a work order in the same transaction.

Hash-chained audit trail

Live

Every write sequenced and chained per organisation under a uniqueness constraint that makes a forked chain impossible, with the actor and the credential inside the hash — so an attribution cannot be rewritten afterwards either.

Reading an employment file is itself recorded

Live

Nineteen tables holding employment, pay, recruitment and background-check records log who read them, enforced in the data layer rather than per screen — so a privacy question has an answer that is not "probably nobody".

What backs these claims

Each capability names the decision record, module, route or table it is built on. Ask us for any of them in an evaluation and we will walk you through the code.

Security licence register
src/lib/imss-lookups-licences.ts · imss_licences · /imss/licences · GET /api/imss/licences/expiry-dashboard
Australian licence classes, by jurisdiction
src/server/imss-licence-classes.ts seedLicenceClasses licenceClassSeedRows · imss_licence_classes
Ninety, sixty, thirty, seven days out
ADR 0040 · src/server/imss-jobs/expiry.ts EXPIRY_WINDOWS
Nine kinds of evidence, one evaluator
src/server/imss-compliance-evaluator.ts EVIDENCE_SOURCES evaluateRequirements · imss_compliance_requirements · imss_work_rights
Induction register that covers everybody
ADR 0053 · src/server/imss-inductions.ts · GET /api/imss/inductions · POST /api/imss/mobile/onboarding · /imss/inductions
SWMS sign-on, and the honest distinction
ADR 0053 · src/server/imss-swms.ts signOnState · /imss/swms · POST /api/imss/mobile/swms
Controlled documents and what was actually shown
ADR 0053 · src/server/imss-controlled-documents.ts assertVersionStored · POST /api/imss/mobile/policies · imss_controlled_documents
Pre-start checks a driver cannot pass
ADR 0050 · src/server/imss-vehicle-checks.ts deriveOutcome workOrderFor · POST /api/imss/vehicle-checks · POST /api/imss/mobile/vehicle-check · imss_vehicle_checks · /imss/vehicle-checks
Hash-chained audit trail
src/server/imss-audit.ts verifyChain appendAuditEvent · uq_imss_audit_events_org_sequence · /imss/audit-trail
Reading an employment file is itself recorded
src/server/imss-data-scope.ts HR_SENSITIVE_TABLES logHrSensitiveReads · imss_permission_access_logs

Twenty minutes on a real contract.

Real data, four logins, nothing typed on the day — including the parts we have not built, which we will point out ourselves.