Everything that happens to people and places, in a history you can hand over.
A hazard reported from a phone becomes a record with a name, a clock and a history that cannot be quietly edited — and stays that way when an inspector asks eleven months later.
Four moments that decide whether a record survives.
Each of these is a thing the software refuses to let go wrong. Turn motion off and the same four are laid out side by side.
A photograph, and one sentence.
The form fills itself in from the picture while it is still uploading. The place is suggested and the person confirms it — and a place nobody recognises never stops a report being made.
It becomes work with someone’s name on it.
Not an email. A numbered job with an owner and a date, sitting in a queue ordered by what is closest to going wrong rather than by what arrived.
The person who fixed it cannot be the person who signs it off.
The rule belongs to the workflow itself rather than to a setting, so there is nothing to switch off and nothing saved that has to be explained later.
Eleven months later, it still proves itself.
Each entry is sealed to the one before it. Change any of them and the seal stops matching, which is a question you can answer on the spot rather than a claim you have to make.
Example data, real behaviour. The screens show how the software behaves; no real person’s information appears in them.
One record system, not ten small ones.
Injuries, near misses, inspections, permits, chemicals, hazardous waste, lone working, accommodation, committee walks and return to work — the same permissions, the same clock and the same kind of history in each.
Three ways in, and none of them is a form nobody fills in.
A photo and a sentence. A sticker on the door frame, scanned. Or spoken aloud, which is how a record gets filled when both hands are busy. A scanned code identifies the place — it is a pointer, never a permission, so scanning one never grants anybody anything.
Coded where it has to be, plain where it does not.
An injury carries a body map with the regulatory codes underneath — region, side, view — so the record exports as something a regulator recognises rather than as a sentence somebody has to interpret. The clock for a reportable injury runs on working days, and the software never tells you that you must file.
A failed line is work, not a note.
When a check fails it becomes a finding with an owner and a date, and a finding can close the room it condemned. An inspection cannot be marked passed while its findings are still open — the screen says so rather than letting it through and arguing later.
Send a finding to someone who will never have a login.
A contractor or a landlord gets a link that expires, can be withdrawn, and works for that one recipient. They can answer; they cannot close anything — verification closes a finding, never submission. What they see carries nothing personal about any worker.
Sealed as it is written, not signed off at the end.
Every entry is sealed to the one before it, so the history is checkable rather than merely stored. A state change, its event and its history entry are written together or not at all — there is no version of the record where the state moved and the history did not.
Four questions asked before anything is shown.
What the person’s role permits, which part of the organisation the record belongs to, which fields that role may read, and where the record has reached. All four must agree. When any of them cannot be answered the answer is no — the safe direction when a question is unclear.
What Aegis does not do yet.
Published here because you would find out anyway, and it is cheaper for both of us if you find out now.
- There is no Aegis mobile app. Reporting from a phone means the browser, which is a deliberate choice and also a limit.
- Nothing is running in a customer’s production. A hosted demonstration runs in a US region.
- We hold no certification. Not SOC 2, not ISO 27001, not a completed HECVAT or VPAT. We can show you how the software behaves; we cannot show you somebody else’s letter about it.
- No directory sync from your identity provider, and no incident map.
The same engine as the other two.
Forms, the workflow, who may act and the audit trail are the same source in all three. That is why the second product did not start from zero, and why the assistant can be left out entirely where it is not wanted — Praxis carries none at all, deliberately.
Tell us the awkward one.
The process you would rather not show anybody. That is the one worth a conversation.