Contractor Safety Prequalification Software: Who Decides at the Gate, and on What Evidence?

Why prequalification is not the same problem as site access

A crew of six arrives at a plant gate at 6am for a shutdown job. The contracting company was prequalified nine months ago. Since then, the general liability certificate expired and was renewed at a lower limit than your contract requires, the company took on a subcontractor for the rigging scope who was never assessed at all, two of the six workers are new hires with no confined space training, and one of the six was removed from a sister site last year after a serious near miss. The gate guard has a printed list of approved companies. The company is on the list. Six people walk in.

Every element of that failure is knowable. The certificate has an expiry date. The training records exist. The exclusion was recorded somewhere. The subcontractor was on a purchase order. The failure is that qualification is assessed at company level, periodically, in one system, while access is granted at individual level, continuously, at a gate that has no connection to it.

The market leaders here are ISNetworld, Avetta, Veriforce and Alcumus, and they are established for good reasons. They maintain contractor populations at scale, they collect insurance certificates and safety statistics, they run programme reviews, and they spread the administrative burden across many owner clients so a contractor completes one profile rather than forty. If your requirement is company level qualification, buying is usually correct and we say so.

The gap that pushes owners to build is the last two hundred metres. These platforms tell you a company is compliant. They do not decide whether this specific person, holding these specific certifications, working for this subcontractor, under this permit, on this day, may pass through this turnstile. That decision is where your liability actually sits, and it depends on your site rules, your training matrix, your permit system and your access hardware.

Problem one: the qualification is about a company, the risk is about a person

Company qualification asks about insurance, safety statistics, written programmes, and sometimes financial standing. Useful, and entirely silent on whether the welder standing in front of your gate guard has a current hot work certification and a valid medical.

Worker level credentialing is a different data problem. Certifications come from many issuers with different formats and validity periods. Medicals expire. Site specific inductions expire on their own cycle. Some tickets are role specific and some are hazard specific. Crews change daily during a turnaround, and the contractor's own record of who is qualified is a folder in a site office.

What a custom build does: model person, employer, credential type, issuer, issue date, expiry and evidence document as first class objects, then define a requirement matrix per work type and per area of your site. The access decision becomes a computed answer rather than a list lookup: this person, for this scope, in this area, today, yes or no, with the specific failing requirement named when the answer is no. Naming the failure matters operationally, because a guard who can say the confined space ticket expired on Tuesday resolves a queue faster than one who can only say denied.

Problem two: evidence expires quietly and nobody is watching

An insurance certificate expires and nothing happens. A training record ages past validity and nothing happens. The status only changes when someone looks, and nobody looks until an incident.

What a custom build does: make expiry an event rather than a query. Every credential and certificate carries a validity window, generates warnings ahead of expiry to both the contractor and the responsible owner side manager, and changes status automatically when it lapses. Certificates arrive as PDFs in a hundred layouts, which is the one clearly useful place for document extraction: read the policy limits, named insured, coverage dates and endorsements, then compare them against the requirements in your contract and flag mismatches for a human to confirm. Reading certificates manually is a job nobody does properly, which is exactly why the lapsed certificate is such a common finding.

Problem three: subcontractors are invisible until they are on site

You qualify a prime contractor. The prime brings a specialist rigging firm, who brings two independent operators. None of them appear anywhere in your qualification data, and all of them are on your site under your liability.

What a custom build does: require declaration of subcontractors against the specific scope of work before mobilisation, enforce it by making access provisioning depend on it, and apply flow down rules where a subcontractor working in a high hazard area must meet the same standard as the prime. That is a policy decision your organisation must make, and the software's job is to make the policy unavoidable rather than aspirational. In practice the enforcement mechanism that works is simple: no declared employer, no gate credential, no exceptions on shutdown week.

Problem four: the gate is a hardware problem with a two second budget

An access decision has to happen at a turnstile in a queue at shift change, offline if the network drops, and consistently across contractor badges, biometrics or a mobile credential. It has to fail in the direction your safety team chooses, and that decision should be deliberate rather than accidental. It has to handle the visitor who is legitimately escorted, the emergency responder, and the muster requirement that someone can produce an accurate list of who is on site during an evacuation.

This is where builds succeed or fail operationally. Access control platforms speak their own protocols and every site has a different one installed. The right architecture is usually a local decision service at each site that caches the current credential state and can operate independently of head office connectivity, syncing decisions and events back when the link returns. Design the offline behaviour first, not last, because the network at an industrial gate is not a reliable dependency and a turnstile that stops working during a shutdown becomes a business decision within an hour.

Problem five: the induction and the permit both assume the access system knows things

Site induction is usually a video and a quiz, delivered at a desk on the first morning, which costs your operation an hour of crew time and costs the contractor a day of mobilisation. It should be deliverable in advance on a phone, in the languages your contractor population actually speaks, with the result written straight into the credential record so it is checked at the gate rather than remembered by a supervisor.

Permits to work have the same dependency in reverse. A permit issued to a crew for confined space entry implicitly asserts that the people named are qualified for it. If the permit system and the credential system do not share data, that assertion is a supervisor's assumption. Connecting them means a permit cannot be issued naming an unqualified person, which is a genuinely valuable control and one of the strongest reasons owners commission a custom build rather than a subscription.

What this costs and how long it takes

Across the industrial and field operations work Digital Heroes has delivered, this is the honest shape. A focused first release, meaning company qualification records, worker credential management with expiry events, the requirement matrix per work type and area, the real time access decision service, and the audit trail, runs $80,000 to $160,000 and ships in 12 to 18 weeks.

A full platform adding physical gate and turnstile integration with offline operation, digital induction delivery in multiple languages, subcontractor declaration and flow down, permit and work order linkage, contractor self service portal, and muster reporting runs $190,000 to $420,000 phased over 6 to 12 months.

What pushes cost up here specifically: the number of sites and the number of distinct access control systems installed across them, which is the biggest driver by a wide margin. Biometric enrolment, if you go that route, since it carries privacy obligations and consent handling that must be designed properly rather than bolted on. Languages, because a workforce that cannot read the induction has not been inducted. Integration with a subscription platform you keep, since most owners retain ISNetworld or Avetta for company qualification and feed the result into the build. And union or works council consultation where worker data is involved, which is a timeline item rather than a cost item but it is real.

What keeps cost down: start at your highest risk site with your top twenty contractor companies by hours worked. That covers most of the exposure and produces the operational learning cheaply.

Build versus buy, and when buying is the right call

Buy, and do not call us, if your requirement is company level qualification, you have one or two sites, and your gate process is a staffed checkpoint that works. ISNetworld and Avetta will beat a custom build on cost and on contractor adoption, since your contractors are probably already in those networks and will resist another portal.

Build when two or more of these are true. You need worker level decisions at a physical access point rather than company level status in a report. You run multiple sites with different access hardware and want one consistent policy. Your permit to work process needs to check qualifications automatically. You maintain site specific exclusion lists that no external network will hold for you. Or you have already had an incident or an audit finding where an unqualified person was on site, which is the moment this project usually gets funded.

The hybrid architecture is the one we recommend most often: keep the subscription network for company prequalification, because contractors already maintain profiles there and duplicating that is a fight you will lose, and build the worker credential and access decision layer on top of it. That is cheaper than replacing either half and it respects the contractors' administrative time, which matters more than owners usually admit.

How to choose a developer for contractor access systems

Ask them what happens at the gate when the network is down. If the answer is that access is denied, ask whether their proposal survives contact with a shutdown crew of two hundred people at 6am. The correct architecture caches credential state locally and makes a deliberate, documented decision about fail behaviour.

Ask how they will handle a person who works for three different contractor companies over a year, which is normal in industrial trades. If the model attaches credentials to an employment record rather than to a person, every job change destroys the history.

Ask which access control platforms they have integrated with by name, and what happens at a site with hardware nobody supports any more. Also ask how they would handle biometrics and consent, because the answer reveals whether they have thought about worker privacy at all.

Ask who owns the code, and get it in writing before kickoff. You should own the repository, the infrastructure accounts and the right to hire anyone else to continue the work. At Digital Heroes the client owns the code from the first commit. This system produces the record you will rely on after an incident, and that record has to remain yours regardless of any commercial relationship.