SafetyCompass
ISO 45001 and OSHA safety management software. Audits, findings, incidents, corrective actions, OSHA 300/300A/301 recordkeeping, and a 52-week ISO 45001 implementation roadmap in one workspace, built for safety consultants and the organizations they serve.
The Problem
Most safety programs still run on binders, spreadsheets, and email. ISO 45001 tells an organization what an occupational health and safety management system must do, but not how to get there week by week, and OSHA recordkeeping adds forms with deadlines and medical details that cannot sit in a shared spreadsheet.
Safety consultants carry that load for several clients at once. They needed one system that could run a client’s whole program, from the first self-audit to certification readiness, while keeping every client’s records completely separate from every other client’s.
The Solution
We built SafetyCompass with a working safety professional, turning the ISO 45001 framework into a structured, step-by-step system a team can actually follow.
A self-audit sets the baseline. Findings become corrective actions with an owner and a severity. Incidents are investigated to a root cause and flow into the OSHA logs. Progress against the 52-week roadmap rolls up by quarter, so a company always knows how close it is to being ready for its certification audit.
Each organization gets its own workspace, and the database itself refuses to show one organization’s data to another.
What We Built
52-Week ISO 45001 Roadmap
A full implementation plan with a milestone every week and readiness audits per section. Start any time of year; progress rolls up by quarter and overall.
Self-Audits, Findings and CAPAs
Audit against OSHA 1910 general industry and 1926 construction checklists. Every finding is tracked to a corrective action with an owner, a severity, and a due date.
OSHA 300, 300A and 301
Incident reports feed the OSHA injury and illness log, the annual summary, and the incident report, with TRIR and DART rates calculated from the same records.
Hazard Analyses and Pre-Task Plans
Job and activity hazard analyses (JHA/AHA), pre-task plans, end-of-shift reviews, and a PTP self-check, each savable and downloadable for the crew.
State-Aware Standards Library
A searchable library of federal OSHA standards plus the company’s own state: whether it runs an OSHA State Plan, its workers’ comp agency, and in-depth state rules for California, Washington, Oregon, Minnesota, Nevada, Maryland and Texas.
Reports in PDF and Word
Executive summaries, audit details, and compliance reports download as PDF or Word, filtered by fiscal year and fiscal week, with each company’s own fiscal year start.
Technology Stack
Application
- ✓ Next.js 16 with the App Router, server-side sign-in
- ✓ React 19, TypeScript and Tailwind CSS
- ✓ Serverless hosting on AWS Lambda behind API Gateway
- ✓ Infrastructure defined in CloudFormation, CI on every change
Data and Security
- ✓ Multi-tenant Aurora PostgreSQL with forced row-level security
- ✓ Amazon Cognito with authenticator-app MFA for every user
- ✓ KMS-encrypted, Object Locked records archive
- ✓ Hash-chained, append-only audit trail
Why It Was Built This Way
Isolation is enforced by the database
A consultant’s clients share one platform, so a missed filter in application code must never be able to leak one company’s incidents to another. Every table enforces row-level security, and a test suite proves the isolation against the live database rather than a mock.
Medical details are role-gated
The OSHA 301 form holds an injured employee’s personal and medical information. Only users holding the medical records role can read or write those fields, and privacy cases are handled as OSHA requires.
Records outlive the backups
OSHA requires injury and illness records to be kept for five years (29 CFR 1904.33), far longer than database backups last. Every month the records are exported to an encrypted archive that is locked against deletion for five years.
Nothing signs itself off
Every change is written to a hash-chained, append-only audit trail, so the record of who changed what, and when, cannot be quietly edited after the fact. That is the evidence trail a certification auditor asks for.
Outcome
SafetyCompass is live at safetycompass.ai, with a public user guide and organizations onboarding through a request-access flow. Product information and demos are at getsafetycompass.com, the marketing site the SafetyCompass team built themselves.
SafetyCompass does not certify anyone to ISO 45001; an accredited certification body does that. What it gives an organization is the plan, the records, and the evidence trail to walk into that audit prepared.
Building software for a regulated industry?
Compliance records, medical details, or several clients on one platform where a leak between them is not survivable. Tell us what you need and we will quote it in 48 hours.
Get a custom quote →