Everything it does

A multi-tenant system for calibration laboratories and inspection businesses. It covers the whole working life of a job — enquiry, quote, intake, the bench or the batch grid, the calculation, the certificate or inspection report, the invoice, the payment, and the recall that brings the instrument back — and carries the ISO/IEC 17025 quality system around all of it as a by-product of doing the work rather than as a separate filing exercise.

It is not a LIMS bolted to an accounts package. The money and the metrology are the same system, so an item that was certificated cannot be forgotten at invoicing, and an invoice cannot cite a certificate that does not exist.

The fourth is the largest by volume, and it is the reason the batch grid and the inspection report exist at all.

Choosing a field decides what a laboratory starts with and never what it may book in. Adding a field adds instrument types; nothing is ever taken away, because a type with instruments recorded against it cannot be withdrawn without orphaning them. Every field in depth →

Sorted by physical quantity rather than by field, because the two are different questions: “Electrical” holds a spectrum analyser and an appliance tester, and no business does both. Each type carries a default interval of three, six or twelve months and a pinned calculation template version.

1. Enquirya call, an email, a form
2. Quoteaccepted online, no login
3. Book incondition recorded on arrival
4. Bench or batchone instrument, or a pallet
5. Certificateor an inspection report
6. Invoiceand the payment against it
7. Recallbefore it goes out of date

The order is enforced by a state machine rather than suggested by an interface, and that enforcement is the reason everything else on this page can claim what it claims. Repair is a first-class job type: a repair voids the calibration, and an instrument going back uncalibrated has its due date cleared and its recall voided.

Three questions to sign up — what work you do, how big the laboratory is, then the account details — with email verification before the account activates. CSV import for customers, contacts, instruments and reference standards, each run naming the rows it cannot read and writing nothing until you have seen what it would do.

The system refuses to invent any of them. A master’s calibration date, who is competent to sign, whether the business is registered for GST — each is refused until answered, because a plausible default is the expensive kind of wrong.

Two-factor authentication is optional to enrol and mandatory to use: once a factor exists, a restrictive policy refuses password-only sessions and no setting can reach that. Somebody who leaves is suspended rather than deleted — their seat is freed, their records stay. Competence records decide who may perform each method and who may sign for it, and a certificate cannot be issued without a current one.

• Reproducible. Raw inputs, template version and engine version are all stored; recomputing reproduces byte-identically.
• Issuing recomputes and refuses on a mismatch. What the certificate says is what the engine produces.
• Never a float. Decimal arithmetic for money and metrology alike; integer cents in the database.
• A full uncertainty budget: contributions, combined standard uncertainty, effective degrees of freedom, coverage factor, expanded uncertainty.
• AS 2193 grading with three sub-grades per point, the worst deciding the point and the worst point deciding the instrument — and the engine naming which one limited it.
• The decision rule (§7.8.6) — simple acceptance or guard banding — is declared by the laboratory. The system requires one and will not choose it.

There is exactly one model in the system: it reads a customer’s pasted equipment list into proposals a person confirms, and it writes to no table. Deterministic parsing is tried first on every paste and handles the common case outright; the model is asked only when that finds nothing, which means somebody sent prose. Inference is region-pinned to Sydney, and a cross-region profile is refused rather than accepted, because it would quietly make an Australian Privacy Principle 8 disclosure false.

The rule is kept by the type rather than by the prompt: the reader accepts seven keys and drops and counts anything resembling a result, uncertainty, grade, certificate number, due date or price — with the count shown to the reviewer rather than written to a log, so a prompt that drifts is visible the day it does. Even the plain-English search over the register is a deterministic parser rather than a model.

An issued certificate is immutable; an amendment creates a new linked version and the original is retained forever. The PDF sits in a private, immutable bucket with its SHA-256 recorded. Branding — logo, colour, footer — is included on every plan.

• Every certificate carries a QR code; scanning it needs no login, account or app.
• The token is random, never sequential — a sequential id would let anybody enumerate every certificate ever issued.
• Verification also works by typing the certificate number.
• An amended or withdrawn document says so.
• Verification never stops, even if the subscription does, because the person scanning is not our customer and never agreed to anything with us.

• A price book per laboratory, with per-customer arrangements.
• Quotes sent as a link and accepted with no login, recording the name, the time and the version accepted.
• Invoices drafted from the certificated items on a job, with certificate numbers attached.
• GST handled for a registered laboratory and for a sole trader below the threshold, who must not issue a tax invoice at all.
• Card payments, PayID and bank transfer, with statement reconciliation that suggests which invoice each deposit belongs to. A person still records it.
• A dunning ladder that stops the moment payment lands; a failed payment restricts nothing for thirty days.

• A seven-rung ladder: 90, 60, 30 and 7 days before due, on the due date, then 14 and 30 days after.
• One message per customer per rung. It stops the moment they book, and stops altogether after a month.
• Companies with no working address are counted and listed, because a customer you cannot reach is a customer you cannot recall.
• Bounces are fed back to the record, so a dead address stops being silently retried.
• Drift, from each instrument’s own history, once it has three calibrations on record.

Plus method sheets (§7.2 — the counter refuses any instrument type without an authorised method), check plans, and records and retention (§7.5, §8.4). Every one of these is on the smallest plan:

• Document control (§8.3) — A mandatory clause. A tier without it cannot be used by an accredited laboratory, which makes the entry plan unsellable to the buyer it was designed for.
• Training and competence records (§6.2) — A mandatory clause, and the one an assessor opens first. Charging for the evidence behind an authorisation is charging for the authorisation.
• Nonconforming work, complaints, corrective action (§7.9, §7.10, §8.7) — These fire when something has gone wrong. A laboratory discovering it cannot record a complaint because of its plan is a laboratory that stops recording complaints.
• The audit trail and record retention (§7.5, §8.4) — Records are the laboratory’s and its customers’ — they outlive any subscription.
• Uncertainty, traceability and the calculation engine — This is the product. A certificate computed to a lesser standard on a cheaper plan would be a different certificate, and there is no honest way to sell that.
• Public certificate verification — The person scanning the QR code is not the customer and never agreed to anything. Already protected from the subscription state for the same reason — see NEVER_GATED.

• The assessment pack — your own records, clause by clause, in one document, each row naming the screen it came from.
• The audit trail — written by database trigger, so a change made outside this application is recorded too. No role, administrator included, can edit or delete an entry.
• A read-only login for an assessor — sees everything, changes nothing.
• Data quality — what is missing or uncertain, shown as work rather than as notes, because missing data that looks like present data is how a register quietly stops being true.
• Export — 64 tables in 8 groups as CSV with a manifest, at any time, whatever the state of any subscription.

The sweeps are themselves watched. A log written by the thing being watched cannot report the thing not running, so what the scheduler heard back is reported next to what the run recorded.

Your customers get their own login, and portal logins are never charged for. For their own company only they see their instruments with what is out of calibration and what falls due within thirty days, their certificates and inspection reports with amendments visible, quotes to accept or decline, and invoices with what is outstanding. They see nothing of any other company, and the database enforces that rather than the interface.

• Multi-tenant from the first commit, proved against a second live laboratory rather than asserted. Row-level security is forced on every tenant table.
• A rule that must subtract has to be restrictive: permissive policies OR together, so a permissive “deny” is decorative. Five were found that way and fixed.
• Data at rest in Sydney. The privacy policy is derived from the sub-processor register rather than written by hand, so it cannot claim residency the deployment does not have.
• Private storage, signed URLs, immutable certificate bucket with hashes recorded. Attachments served through the application and checked against their hash on the way out.
• Subscription agreement, privacy policy and data processing agreement, with a record of which version each laboratory agreed to and when.
• Runbooks for breach notification, backup and restore, and tenant onboarding. Tenant deletion is a real, tested path.

The platform side — laboratories, activity, health, security, delivery, enquiries and settings, plus seat and billing overrides that require a reason and write an operator action record before the change. It also carries the sending-domain state, the activation checks, the legal-review record, the published sub-processor register and the restore-drill status.

Above the allowance: $49.00 per extra person per month, $99.00 per extra site, and instruments in falling bands — $0.30 each to 500, $0.08 to 2,500, then nothing — so the whole instrument component never exceeds $310.00 a month, however many are registered.

Priced on size, never on discipline. Every one of the thirteen fields is on every plan. Never charged for:

• Certificate branding — logo, colours, footer — It costs nothing to provide and it is the laboratory’s own identity on its own document. Charging for it reads as greed and is quotable.
• Every clause of ISO/IEC 17025 this system supports — A laboratory that cannot record a complaint because of its plan stops recording complaints. See ALWAYS_INCLUDED in lib/domain/entitlements.ts — policy 025 refuses to apply if a policy on a compliance table ever consults the plan.
• Portal logins for the laboratory’s own customers — They are the laboratory’s customers, not ours, and there may be hundreds.
• Taking every record out of the system — The records are legal records and the laboratory’s own. Never withheld — not by plan, and not by a lapsed subscription.

The full price list, with an estimator →

It does not make a laboratory accredited. Accreditation is granted by an accreditation body after assessing your laboratory — its people, its masters, its methods. This system makes the evidence exist as a by-product of the work, refuses the non-compliant case, and shows what is still missing. The rest belongs to the laboratory, and the subscription agreement says so.

It is an ISO/IEC 17025 system. It supports inspection work and produces inspection reports, but it is not an ISO/IEC 17020 management system, and an inspection report it produces will never carry an accreditation mark. It also cannot calibrate an instrument, train a technician, or send a master away for calibration.

And nothing else stops a laboratory working. Only seats refuse. A missing ABN, an instrument over the allowance, a lapsed subscription — none of them stops work being booked in or recorded, because a customer standing at a counter is a worse outcome than an invoice discussion.

Everything in the lifecycle is built and working end to end: enquiry, quote, intake, job, calibration or inspection, certificate or report, invoice, payment, recall — and the platform around it, with multi-tenancy proved against a second live laboratory, seven roles enforced by the database, plans and metering, self-service signup with invitations, the customer portal, public verification, the operator console and the ISO/IEC 17025 quality system.

The system refuses to invent any of these, and the readiness screen reports all of them from the records — there is nothing to tick.

1. Are you registered for GST? Invoicing is refused until this is answered. Both possible defaults are harmful, and one of them quietly costs a registered laboratory a ninth of every invoice.
2. One reference standard, with a real calibration date and the external certificate number behind it.
3. An authorised signatory. §6.2.5(e) forbids self-assessment, so either a second person or a named external assessor with their organisation.
4. An approved procedure, approved by somebody other than its author (§8.3.2(a)).
5. The declared decision rule (§7.8.6) — simple acceptance or guard banding. The choice is yours; the two distribute risk differently.
6. ABN, bank details and the laboratory’s identity for the letterhead.