AQB Comply
A compliance platform for a gas and electrical contractor. It replaced spreadsheets, email chasing and paperwork in vans with one system, at a point where the business was one missed renewal away from a serious problem.
- User surfaces
- 3
- Automated tests
- 150+
- Tenant isolation
- Enforced in DB
- Status
- Live
The problem
A contractor looking after gas and electrical compliance across a portfolio of managed properties was tracking every certificate in spreadsheets, chasing renewals by email, and piecing job history together from paperwork in engineers' vans. When a managing agent rang to ask whether a property was compliant, somebody had to go and find out.
That is more than an admin headache. A gas safety certificate that lapses is a legal failure with a named person attached to it, and the only thing holding it all together was somebody remembering.
What we built
One platform for three groups of people who work in completely different ways, each with their own screens, their own devices, and their own rules about what they are allowed to see.
The managing agent portal
Agents see their own properties and only their own. A traffic light view across the portfolio, certificates to download the moment they are issued, quotes to accept or decline, and the full history of every job on a property. They answer their own questions now, where they used to ring the office.
The engineer app
An app engineers install on their phone and use one-handed, standing in a customer's property, often with barely any signal. They see the jobs offered to them, accept the first one they can take, fill in a job sheet with photographs grouped by room, and issue the certificate from the device. Phones are registered and enrolled, so losing one does not mean losing an account.
The back office
Scheduling and dispatch, a renewals queue that raises work eight weeks before the anniversary, quotes that generate a branded PDF from a form, a review queue for job sheets, key custody tracking, and an invoice queue that opens only once the work is actually finished.
A small detail that shows how we work. When a certificate is issued early, the next renewal falls on the original anniversary plus the interval, rather than the completion date plus the interval. Get that backwards and every property's due date quietly walks forward a little each cycle, until the whole portfolio has drifted out of compliance. You only catch it by asking what the date is actually for. There is a test named after it.
Keeping one company's data away from another's
This is a system where one company seeing another company's information would be a reportable data breach. So the separation is enforced by the database itself, rather than by application code where a single query written slightly wrong would open a hole.
- Asking for somebody else's record returns the same "not found" answer as asking for a record that never existed, so the system cannot be used to work out what other companies hold.
- Uploaded files are held back until they have been checked. Files of the wrong type or the wrong size are refused, and the refusal keeps quiet about which rule they broke.
- Personal details never reach the logs. Names, emails, telephone numbers and postcodes are masked as they are written, and the build fails if a raw value ever slips through.
- Exported spreadsheets are safe to open. A value starting with a formula character is neutralised on the way out, so a report cannot run code when somebody opens it in Excel.
- Every change runs a test suite that deliberately tries to reach one company's data while signed in as another. Broken access control is the most common serious flaw in web applications, so we try to break it, every time.
Outcome
Compliance status is a screen now, where it used to be an afternoon's work. Renewals appear before they are urgent. Agents answer their own questions. Engineers file their evidence at the property. Every certificate, quote, job sheet and invoice sits with the property it belongs to.
The platform is live and still being developed, with an automated test suite covering the access boundaries and the certificate lifecycle on every release.