Construction Site Safety Software: Can You Prove in One Hour Who Was Inducted and Who Signed the Permit?

The hour after an incident is the only test that matters

A steel erector falls from a leading edge at 10:15am on a hospital extension with nine subcontractors on site. By 11:00 the site is stopped, the client's representative is on the phone, and your EHS director is being asked four questions. Was that worker inducted, and when. Who signed the permit for the activity he was performing. Who was the competent person who inspected that fall protection anchor, and on what date. Who witnessed it.

The answers exist. The induction sheet is in a binder in the gatehouse, and the gate attendant who signed him in works nights now. The permit is a carbon copy in a folder in the trailer, possibly still open, possibly closed by somebody who did not write the time. The inspection was recorded in SafetyCulture by a supervisor who has since left the sub, so the PDF is in an account nobody can access. The witnesses are two labourers from a sub who packed up at 10:30 when the site stopped.

Nothing here is a paperwork failure in the ordinary sense. Every record was created. They simply live in eleven systems belonging to eight companies, joined only by a person's memory. And in a multi employer environment the controlling employer can be held accountable for hazards it created or could reasonably have corrected, which means your ability to demonstrate what you knew and what you did about it is the whole defence.

Problem 1: worker identity is not a thing anyone owns

On a site with 400 operatives from 30 employers, the same person may appear as three records: one on a paper induction sheet, one in a sub's own system, one on a badge print. There is no spine. So the questions that matter cannot be answered without a human doing a reconciliation.

The fix is unglamorous and it is the foundation of everything else. One worker record per human, carrying their employer, their induction with a validity period, their competency cards and certifications with expiry dates, their site specific training, and their access history. Once that exists, the hour after an incident becomes a single query. It also enables the control that actually prevents incidents: a worker whose confined space certification expired last Tuesday should not be able to badge through the turnstile onto a site running confined space work today.

SafetyCulture, which is genuinely good at what it does, has no concept of this. It is a forms engine. Forms are useful and they are not an identity model.

Problem 2: permits to work are paper, and their state is unknown

Hot work, confined space entry, live electrical, excavation, lifting operations, roof access. Each carries a permit with an issuer, a receiver, conditions, a time window, isolations, and a closure step. In most operations these are carbon books. That means at any moment nobody can say how many permits are open on site, which ones expired without closure, and whether the fire watch after a hot work job actually happened.

The scenario every EHS director has lived: a hot work permit issued at 14:00 for four hours, welding finishes at 16:30, the crew leaves, the fire watch period is not observed because the permit was in a pocket, and a smouldering ignition is found by a security guard at 21:00. The permit was compliant on paper and useless in practice.

A build turns permits into live objects. Issued state, active state, suspended, expired, closed, each with timestamps and signatures captured on a phone. Conditions become checklist items that must be ticked with evidence, including a photo where it matters. Expiry triggers escalation to the permit issuer and the site manager before the window ends rather than after. A site dashboard shows every open permit by location, which is also what a fire brigade or an inspector wants to see when they walk on. Off the shelf tools increasingly offer permit modules, but they encode a generic permit. Yours has conditions specific to your client, your jurisdiction and the asset you are working next to.

Problem 3: findings are recorded and never closed

Inspections generate findings. Findings generate PDFs. PDFs go into folders. Three weeks later the same finding is raised again by a different supervisor, because nothing tracked whether the first one was fixed.

The loop that matters is finding, owner, due date, evidence of correction, verification by someone other than the person who fixed it, closure. That is a workflow with accountability, and it is where most safety tools stop short, because the corrective action owner usually works for a different company than the person raising the finding. Cross company assignment with escalation to a subcontractor's own management is not a feature a forms product wants to own, and it is exactly what a multi employer site needs.

A build also makes the finding hazard specific rather than form specific. Being able to ask which activity generates the most unresolved findings, and which subcontractors close findings slowest, turns safety reporting from a count of inspections into something a project director can act on before an incident rather than after.

Problem 4: safety data does not talk to who you let on site

You prequalify subcontractors partly on safety history. You require insurance certificates. You induct workers. In almost every contractor we have worked with these three live in three places and none of them controls the turnstile.

The whole point of the data is to make an access decision. A subcontractor whose insurance lapsed on Friday, whose safety suspension is active, or whose supervisor has an expired competent person qualification should hit a locked gate on Monday morning, and the reason should appear on the guard's screen in plain language. Building that link is what converts records into a control. It is also the single reason many large contractors end up building rather than buying, because the access system is theirs, the prequalification data is theirs, and no vendor is going to join them for you.

Problem 5: incidents have clocks, and nobody starts them

Serious incidents carry regulator notification requirements measured in hours, not days. Under OSHA rules a work related fatality is reportable within eight hours and an inpatient hospitalisation, amputation or loss of an eye within twenty four. The recordability decision for the 300 log has its own rules, and the annual summary posting has its own dates. Every one of those is a clock that starts at the moment of the event, and the moment of the event is usually the least organised hour your project will have.

A build starts the clocks automatically when an incident is logged at a severity that triggers them, assigns them to named people with escalation, captures witness statements while witnesses are still on site with signatures and timestamps, and produces the investigation record in a format your legal team has reviewed in advance. Root cause analysis structure matters less than the discipline of capturing evidence in the first two hours, which is the window that closes fastest.

What this costs and how long it takes

Across the 2,000 plus projects Digital Heroes has delivered, the shape is as follows. A first release covering worker identity with induction and competency validity, the permit to work engine with live status and escalation, and observations with a full corrective action loop runs $60,000 to $140,000 and ships in 12 to 16 weeks. A full platform adding turnstile or access control integration, incident management with regulator timers, subcontractor safety scorecards, toolbox talk delivery and multi site analytics runs $150,000 to $400,000 over 6 to 12 months.

What drives the number up: access control hardware integration, since turnstiles, biometric readers and badge printers each speak their own protocols and require someone who has commissioned them on a live gate. Offline capability, which is not optional on early stage sites with no coverage and which changes the architecture rather than adding a feature. Multiple languages, because your workforce is multilingual and a safety induction in a language a worker does not read is not an induction. Client specific permit regimes, particularly on rail, live industrial plant or healthcare estates. And integration with prequalification and insurance data if those systems already exist.

What keeps it down: pick one site and two permit types for the first release. Get the loop closing on a live job before you generalise, because the conditions that matter are the ones your supervisors argue about, and they will only surface in use.

Build versus buy, and when buying is right

Buy if you are a subcontractor or a smaller general contractor whose main need is structured inspections, toolbox talks and observation capture on a phone. SafetyCulture is well built, cheap relative to a build, and adopted quickly by field staff. Intelex is a reasonable answer for enterprises that need EHS management sitting alongside environmental and quality across an existing corporate stack. HammerTech is genuinely strong for large multi employer construction sites and should be on your shortlist before you consider building anything.

Build when two or more of these are true. Your permit regime is dictated by a client whose rules do not fit any product, which is common on rail, aviation, utilities and operating hospitals. Site access must be gated on live competency and insurance status through your own hardware. You run many sites and need one worker identity across all of them, including workers who move between projects weekly. Your safety, prequalification and certificate of insurance data need to be one system because they are one decision. Or your insurer or a major client has made a specific evidentiary demand that no product currently satisfies.

How to choose a developer for construction safety software

Ask them how they model a worker who is employed by a subcontractor, inducted on three of your sites, and holds a competency card that expires next month. If the answer is a users table, they have not understood the problem. Worker identity across employers is the hard part and it is invisible in a demo.

Ask what happens to a permit when the phone has no signal. Offline first with conflict handling is an architecture decision made at the start or a rewrite later, and site trailers on day one have no wifi.

Ask how corrective actions are assigned to people who do not work for you, and what escalation looks like when a subcontractor ignores them. This is the difference between a system that records safety and one that improves it.

Ask who owns the code, and settle it before kickoff. You should hold the repository, the infrastructure accounts and the right to hire another firm. At Digital Heroes the client owns the code from the first commit. On safety records that may be evidence in a regulatory proceeding or a claim years later, control of the data and the system that produced it is not a detail.