Run it yourself
Last updated: Written by Blake Cowan, NCSO
Written for the technical reader. The licence, the architecture, the requirements, and the honest notes an evaluator should read before betting a compliance program on a young codebase.
The short answer
Cor Pathway 360 is licensed under AGPL-3.0-or-later and is designed to be self hosted. You need a Supabase project and somewhere to run a Next.js application, and free tiers of both are enough for a small crew. The source is on GitHub.
This is the one page on this site written for the technical reader, so it leads with the licence and the architecture rather than translating them into business benefits. If you came here from a search for open source EHS software, this is the page you wanted.
Why this matters for a compliance system specifically
Self hosting is usually argued about on ideological grounds. In this category there is a concrete, boring reason for it.
A COR certificate depends on producing three years of audit evidence on demand. If that evidence lives inside a vendor's system, your ability to answer an auditor depends on a commercial relationship continuing on terms you do not set. An acquisition, a price change or a product being retired are all somebody else's decisions that land on your certification.
Four of the biggest names in this market changed hands recently. The verified ownership chains are on the SiteDocs comparison page.
Running it yourself means the evidence is in a Postgres database you control. That is the whole argument.
What you need
| Requirement | Why | Is it optional |
|---|---|---|
| A Supabase project | Postgres database, authentication and file storage. The free tier is enough for a small crew. | No, this is the one hard requirement |
| Somewhere to run Next.js | The application itself. Vercel is easiest and has a free tier for a single small deployment. | No, but the host is your choice |
| Node 20 or newer | Only needed to run or build locally. | Optional |
| A PDF form import key | Importing existing PDF forms. Absent if no key is supplied. | Optional |
| An outbound email key | Sending notifications and invitations. Absent if no key is supplied. | Optional |
| An electronic logging device integration | Transport telematics. Absent if no key is supplied. | Optional |
Scroll the table sideways to see every column. The first column stays in place.
The optional services follow one rule: a feature switches on when its key is added, and is simply absent otherwise. Nothing degrades into a nag screen and nothing prompts you to upgrade, because there is nothing to upgrade to.
What happens when you first sign in
Signing up creates the first Super Admin account and builds the company with four permission profiles, eight starter forms and five managed lists, so the system is usable immediately rather than being an empty shell with a settings menu.
Architecture
Next.js App Router for the application, Supabase Postgres for data, authentication and storage, Tailwind for the interface.
Installed as a progressive web app. Workers add it from the browser. No app store account, no managed device enrolment, no separate build to distribute.
Offline by design. Submissions, photos and signatures queue in the browser's IndexedDB storage and sync when signal returns. Offline is the expected condition rather than an error state, because crews work without coverage for hours or days.
Multi tenant with row level security. There is a tenant_id on 83 tables, with row level security enforcing the boundary in the database rather than in application code. For a self hosted deployment this means one company in the database: yours. The isolation is still there, doing nothing, which is the right way for it to be.
The licence in plain language
AGPL-3.0-or-later. Three sentences:
- Run it for your own company, forever, free, and change whatever you like. No fee, no seat count, no expiry, no permission needed.
- If you run a modified version as a service for other people, publish your changes under the same licence. This is the copyleft condition, and it is what stops somebody taking the work, closing it and reselling it.
- Using it to run your own business is never affected by point 2. Internal use, however modified, triggers nothing.
If you are a contractor running this for your crew, the licence asks nothing of you.
Getting the source
The repository is on GitHub under the Yeti567 account. Setup instructions, environment variables and the database migrations live with the code, and the self host documentation is at docs.corpathway360.com.
Honest notes for a technical evaluator
- It is a young codebase maintained by a small team. Read the commit history and the issues before betting a compliance program on it. That is the correct thing to do with any AGPL project, including this one.
- Supabase is a real dependency. The database schema and row level security policies assume Supabase's authentication. Moving to plain Postgres with a different auth provider is possible but it is not a configuration flag.
- Upgrades are your responsibility when you self host. You pull, you run migrations, you deploy. A managed maintenance engagement exists for companies that would rather not, but the DIY path is genuinely supported and not second class.
- There is no dedicated support desk. Issues on GitHub, or a paid engagement. There is no phone line at two in the morning.
If you would rather not run any of this yourself, that is what the build engagement covers, hosting setup included. Book a call, or take the templates and go build it yourself. Both are real options.
Questions people actually ask
What is the minimum I need to run this?
What does AGPL-3.0 actually oblige me to do?
Is the COR program content covered by the AGPL licence too?
What happens to my system if Cor Pathway stops operating?
Can I modify it for my own company?
Next step
Take the templates and use them, whether or not you ever talk to us. If you would rather not build the program yourself, we will build it inside the app and keep it current.