The pack you'll actually want to receive.
Your operators have a Food Control Plan obligation. You have an obligation to audit it. We've built the bit in between — so your verifier visits run in minutes instead of hours.
Three things land in your inbox.
A secure link
Operator generates a verification pack covering the period you'll audit. The link is 256-bit unguessable. Goes to your email or phone — your call.
A 4-digit PIN
Sent out-of-band — text or call, not in the email. Link alone is useless; PIN alone is useless. Both together unlock the pack.
A read-only audit view
Open in any browser. No login. Every compliance record in the period, every corrective action, every gap. Filterable, searchable, exportable as CSV. Print-friendly.
The properties that matter for an audit.
These aren't marketing claims. They're enforced at the database level — verifiable from the source code.
Server-timestamped
created_at is stamped by our API, not the operator's device. Compliance evidence requires trustworthy timing — we never trust client clocks.
Immutable
UPDATE on compliance_records is forbidden. Corrections are new rows that link to the original. Both timestamps preserved. No edit history needed because there is no editing.
User-attributed
Every record has completed_by_user_id. Staff name appears in the pack. Anonymous records cannot exist.
4-year retained
DELETE on compliance_records is blocked at the DB level for the first 4 years. Enforced via migration 001_retention_4_years.sql.
Corrective actions linked
A 'fail' record cannot be closed without a linked corrective action. The CA includes the description, the resolution, the staff member who actioned it, and a §50 reportable-breach flag if applicable.
Gap counted
Scheduled tasks that should have happened but didn't show up in the pack as gaps. The verifier sees what's missing as clearly as what's present.
Open a real verification pack right now.
We've seeded a demo business (The Coffee Lab Group, Wellington) with 31 days of compliance records, 37 corrective actions, and 10 modules active. Click below to open the verifier portal, type the PIN, and explore exactly what your operators' verifier visits will look like.
(Replace localhost with your deployed domain when sharing externally.)
Are you an operator?
Your verifier doesn't install anything. They open a browser. You generate the pack. Compliance, sorted.