Open source safety management software

This is the one page on this site that leads with the licence, because if you searched for open source safety software then the mechanism is what you came for. Everywhere else we translate it, because most safety buyers reasonably do not care what AGPL means.

The honest state of the category

If you have been searching for this, you have probably noticed that the results are poor. That is not your search technique. The category really is thin, and it is worth understanding why before you spend a week evaluating options that do not exist.

Safety and environmental compliance software is jurisdictional. A system that produces a COR audit binder for a Canadian certifying partner is not the same product as one built for OSHA recordkeeping in the United States or for an Australian regulator. Open source projects thrive where the problem is universal, like databases and web servers. Compliance is the opposite of universal. It fragments by province, let alone by country.

That fragmentation means the addressable community for any single open source EHS project is small, and small communities do not sustain large projects. So the field looks like this:

We are not going to publish a list of named projects with capability claims we have not verified, because that is exactly what the bad lists in this category do. If you are evaluating a named project, check its repository activity and its issue tracker yourself. That tells you more than any comparison page.

What AGPL-3.0 actually means for a business

Most explanations of this licence are written for lawyers or for people who already agree. Here it is in three sentences.

1. You can run it for your own company, forever, free, and change whatever you like. No fee, no seat count, no expiry, no permission required, no obligation to tell anybody.
2. If you run a modified version as a service for other people, you must publish your changes under the same licence. This is the copyleft condition, and its purpose is to stop somebody taking the work, closing it, and reselling it.
3. Point 2 never affects using it to run your own business, however heavily you modify it.

If you are a contractor running this for your crew, the licence asks nothing of you at all. The clause that makes people nervous is aimed at companies that would take the code and build a competing hosted product, not at the people the software is for.

The argument that actually matters: continuity of certification

Here is the part that is not about ideology, and it is the only reason a safety manager should care about a software licence.

A COR certificate depends on producing about three years of audit evidence on demand.

Now ask where that evidence lives. If it sits inside a vendor's system, then your ability to answer an auditor depends on a commercial relationship continuing on terms you do not set. A price increase, an acquisition, a product being retired, or a contract dispute are all somebody else's decisions, and all of them land on your certification.

This is not a hypothetical in this market. Four of the biggest names changed hands recently:

• SiteDocs was founded independent in Alberta, acquired by GoCanvas, which was held by K1 Investment Management. Nemetschek Group announced on 6 June 2024 that it was acquiring GoCanvas for over $700 million USD, at 11.5 times GoCanvas 2023 annual recurring revenue of $67 million.
• eCompliance, founded in Toronto, was acquired by Alcumus, which then sold its entire EHS software business to EcoOnline, taking Field iD with it.
• KPA separated its businesses and launched Novara, backed by Providence Equity, announced January 2026.
• Safety Reports now trades as SafetyReports by AlignOps.

None of those decisions involved the customers. That is not a criticism of anybody, it is simply how the software industry works.

Self hosting is the specific answer to that specific risk. Your evidence sits in a Postgres database under your own account. There is no licence server to check in with and no switch anybody else can flip. That is the whole argument, and it is a compliance argument rather than a philosophical one.

What self hosting actually costs you

Being straight about this, because the ownership argument is only honest if the burden comes with it.

You own the operations. Somebody creates the Supabase project, runs the upgrades, watches the backups, and notices when something breaks. That somebody is you, or somebody you pay.

There is no escalation path by default. No support desk, no 24/7 line. Issues on GitHub, or a paid engagement.

Upgrades are your call and your responsibility. You pull, you run migrations, you deploy.

A young project carries risk. Ours is young. Read the repository before you bet a certification on it. That advice applies to every project in this category, including the ones that look more established.

If your company has no technically inclined person at all and nobody who wants to be, a boring commercial subscription may genuinely be the better decision. We would rather tell you that than win an argument and leave you with a system nobody maintains.

What running Cor Pathway 360 involves

Concretely, for a technical evaluator:

The source is on GitHub under the Yeti567 account, and the self host page has the fuller technical detail including the honest notes for evaluators.

How to evaluate any option in this category, including ours

1. Check the repository activity. Recent commits, and more than one contributor if you can get it. A single maintainer is a real risk and you should price it in.
2. Read the issue tracker. Not the count, the pattern. Are bugs acknowledged and closed, or ignored?
3. Test the offline case on real hardware in a real dead zone. This is the most commonly overstated capability in safety software, open source or commercial.
4. Ask how evidence maps to your certifying partner's audit elements. A generic form builder is not an audit system. The naming and number of elements differ between partners, so ask how that mapping is done for yours specifically.
5. Work out who fixes it at 6am in February. If the answer is nobody, decide whether you are comfortable with that before you migrate three years of records.
6. Export your data on day one, as a test, and confirm you can actually get it out.

That last one is worth doing with a commercial vendor too, before you sign anything.

If you would rather not do any of this yourself

The templates are free, ungated and yours to modify: the template library has the audit readiness checklist, the field level hazard assessment card, the formal hazard assessment worksheet and the rest. No email required.

If you want the software running with a program written and mapped for your certifying partner, that is what a build engagement is, and what it costs sets it out with the hosting caveats included. If you would rather compare against the commercial options first, the honest comparison names the situations where a competitor is the better choice.