Why we gave the safety app away

I am an NCSO. I have sat through COR audits from both sides, as the person being audited and as the person getting a company ready to be audited, in construction, in trucking and in oilfield.

Here is the thing I kept running into, and it is not a big philosophical thing.

A company would have a safety app. Good one, in some cases. And when the summer crew showed up, the summer crew would not go into it. Not because anybody was being negligent. Because every head costs money every month, and the guy signing the invoice is looking at a seasonal hand who might be gone by fall. So the new people ride along on somebody else's login, or they get added later, or they get a paper orientation that goes in a folder in the truck and never gets scanned.

Then the audit comes. And the week before the auditor arrives, somebody is standing in front of a filing cabinet, a shared drive and whatever app the last safety person set up, trying to assemble one coherent story out of places that do not talk to each other. I have done that rebuild. It is a miserable week and it produces a binder that describes a program nobody was actually running.

The software was never the hard part

I started building the app because I wanted the forms to work offline in a cab with no signal. That part is real work, but it is ordinary work. Forms, a database, sync, permissions. There are a lot of people who can build that.

What is hard is everything the app does not contain when you first log in.

Somebody has to write the policies. Somebody has to build formal hazard assessments for the tasks your company actually performs, not generic ones about a job site that is not yours. Somebody has to write the orientation your new hire sits through on day one. Somebody has to take all of that and map it to your certifying partner's audit elements, so that when an auditor asks what you do about a specific thing, there is a document, a record that the document was used, and a corrective action that came out of it.

Most companies with 5 to 100 field staff do not have a spare person for that. They have an owner who is also the estimator, and a foreman who is also the safety guy on Fridays.

So the blank app is not the product. The program is the product. Once I said that out loud, charging for the app looked like charging for the wrong thing.

What that means commercially, stated plainly

The application is licensed AGPL-3.0-or-later and it is free forever. You run it on your own Supabase project and your own hosting. There is no per seat fee, no trial, no paid tier, and nothing to switch off.

Revenue comes from the program build, priced by company size and by how much usable documentation already exists, plus optional monthly maintenance if a company wants it. A company with a current binder that needs restructuring is a different job from a company with a few photocopied forms from a previous employer. No dollar figure for the build is published anywhere on this site, because a number quoted before seeing the documentation would be a guess, and a guess in either direction is useless to the buyer. Firm pricing comes on a call.

Be clear about what that makes us. This is a consulting business with a free tool attached, not a software business with a free tier. Those are genuinely different animals. A software business with a free tier is trying to convert you. I am trying to do a piece of work, hand it over, and leave you able to run without me.

Certification is an evidence problem, not a software problem

Here is the part that is about the buyer rather than about me.

A COR certificate depends on producing about three years of audit evidence on demand. That is the actual mechanic. Not having a nice app. Being able to answer a question with records that already existed.

If that evidence sits inside a vendor you cannot leave, then your certification quietly depends on a commercial relationship continuing on terms somebody else sets. That is not a preference or an ideology. It is a dependency sitting underneath a certificate you need in order to bid work.

And ownership in this category moves. SiteDocs was founded independent in Alberta, was acquired by GoCanvas, which was held by K1 Investment Management, and Nemetschek Group announced on 6 June 2024 that it was acquiring GoCanvas for over $700 million USD, at 11.5 times GoCanvas 2023 annual recurring revenue of $67 million. eCompliance was founded in Toronto, acquired by Alcumus, which then sold its entire EHS software business to EcoOnline. KPA launched Novara backed by Providence Equity, announced January 2026. Safety Reports now trades as SafetyReports by AlignOps.

None of those decisions involved the customers. That is not a criticism. It is how software companies work, and any of those businesses may well be better run for it. It is a fact worth knowing if your audit binder lives in one of them. The full ownership chains are on the SiteDocs comparison page.

Per seat pricing bills you hardest in your worst month

This is the argument I actually care about, so I am going to give it room.

A seasonal trades company is not a fixed headcount. You run 20 in February and 80 in July. In July you have the most new people, the least experience per head, the longest days, the most equipment moving and the highest exposure you will have all year.

Per seat pricing means that is also the month your compliance software costs the most.

Nobody writes that incentive down in a proposal, but it is there, and everyone who has run a crew has felt it. Under license slightly. Add the short term hands next month. Have two guys share an account. None of it is malicious and all of it produces exactly the gap an auditor finds, and worse, the gap where a new hire is on site without a documented orientation.

Take the per seat cost to zero and the incentive disappears. Add every worker, every subcontractor and every seasonal hand on their first day, because it costs you nothing to do it. That is the whole reason the licence is what it is. The rest is downstream of that.

What we give up by doing it this way

This section is the one I would want to read, so here it is without softening.

Anyone can fork the code. Including a competitor. Including someone who then sells the same consulting I sell, using the app I wrote, and does it better or cheaper. The AGPL means they publish their changes if they run a modified version as a service, and that is all it means. It is not a moat.

There is no recurring licence revenue. That makes the business lumpier, harder to forecast, and worth materially less on paper than a software company with the same number of customers. A venture investor would look at this and see a worse business, and that is a fair criticism rather than a badge of honour. Recurring revenue is genuinely better than project revenue, and I have traded it away deliberately.

There is no lock in, which sounds nice until you are on my side of it. Every renewal has to be re earned on the work. If the maintenance is not worth the fee, the customer stops paying and keeps the entire system, running, with all their data in it.

And the honest list of what we do not have: no dedicated support desk, no 24/7 phone line, no published case studies or customer references yet, no association endorsement, no AuditSoft integration today, and a young codebase with a short track record. If those things matter more to you than owning the system, buy from a vendor that has them. That is a reasonable decision and I will not argue with it.

The mechanics of the licence and the architecture are laid out on the self host page and on open source safety software.

Where it is

The repository is on GitHub under the Yeti567 account.

The forms are free at templates, no email required. If you want the program built, that is pricing.