Contractor Compliance Cockpit

$39.00

the GC or remodeler riding herd on a stack of subcontractor certificates, instead of a spreadsheet you update when you happen to remember.

Local-firstNo telemetry — nothing phones homeNo lock-inNo migration

Point it at your export of sub COIs, licenses and permits and it hands back who’s expired, who lapses in the next 30 days, and a written chase message for every sub who owes you paperwork.

$39 a month for the whole shop, no per-seat charge. Covers the scanner and the four report files it writes. Cancel any day.

A lapsed COI you found out about too late

A sub rolls onto the site Monday and you wave him in. His general liability lapsed back in April. You didn’t know, because the certificate is a PDF buried in an email thread from last spring, and nobody’s opened it since.

Then a torch leaves a wall smoldering, or a guy comes off a ladder. The claim goes looking for coverage and lands on your policy, because his wasn’t there. That’s the expensive day.

The cheap days still cost you. The GC won’t release your draw until every sub’s paperwork is current, and running that down by hand is an afternoon you bill to nobody.

Export it, sort it, chase it

  1. Export and point. Dump your subs’ COIs, licenses and permits to a CSV and aim the tool at the file. It reads holder, credential type, document name and expiry date.
  2. It sorts by date. Every credential runs through daysUntil its expiry and lands in a bucket: expired, expiring inside your ALERT_DAYS window, or current. A blank or garbled date gets treated as expired, not quietly skipped.
  3. It writes the chase. Add a roster of which sub owes which documents and it diffs what’s required against what’s on file and still valid, then drafts one short message per sub, worst offenders first.

What it does

  • An expired certificate counts exactly like a missing one. A sub whose COI ran out shows up on the chase list next to the sub who never sent one, because on your jobsite they carry the same risk.
  • The chase list comes pre-written. One plain message per sub naming the exact docs they owe, sorted worst first, so you paste and send instead of composing forty emails from scratch.
  • EXPIRING_SOON.csv is the punch list of what lapses next, so you’re renewing paperwork the week before the draw meeting instead of during it.
  • COMPLIANCE_DASHBOARD.md lays out who’s expired and who’s clear in tables you can hand a PM without editing.
  • compliance.json holds the full run machine-readable, so you can rank fifty subs by risk or pipe it into whatever else you keep.
  • ALERT_DAYS is yours. Thirty days of warning is the default. Push it to sixty if your renewals crawl.

Who runs this, and who doesn’t

Built for the GC or remodeler carrying five to forty subs, where somebody is nominally tracking certificates in a spreadsheet and that somebody is you, at 9pm.

Run one or two subs you’ve known for years and you don’t need software to hold two renewal dates in your head. Already paying for a compliance module inside a full build platform with a coordinator on it daily? Keep that. This is for the shop whose compliance system is a folder of PDFs and a good memory.

What it replaces

Procore and ServiceTitan both track sub compliance, and inside a full build they do it better than this: they tie a certificate to a project, block a dispatch when coverage is stale, and hold the whole job in one place. You pay for the platform to get there.

A spreadsheet is free and bends any way you want, but it doesn’t know today’s date and it will never write the email. What you get here is the narrow slice. Read the export, tell you who’s lapsed, draft the chase. For a small shop that won’t stomach a per-seat bill, that slice is the whole job.

Your data

The credential export gets read off your disk and nothing goes out. There’s no login and no upload step, because nothing in it was built to send a file anywhere. Reports write only under the folder you name, at 0600 permissions, with every path checked before the write. compliance.json is the record of what the run knew and when, sitting on your own drive, which is the file you want if a claim ever makes you prove you were watching.

Pricing and getting started

$39 a month for the shop, no charge per seat. In the account you get the scanner plus the four files it writes: the dashboard, the chase list, the expiring punch list and the JSON. First run takes about as long as exporting one CSV and setting two paths. Cancel any day and the reports stay put, because they were always just files on your machine.

Security and privacy

Handles subcontractor licensing/insurance/permit records (holder names, document names, expiry dates). Security is designed in.

Principles
Local-first. CREDENTIALS_CSV/SUBS_CSV are read from disk and never transmitted anywhere; nothing in this tool touches the network. Nothing is uploaded, no telemetry, no cloud dependency.
Non-destructive. Source CSVs are only read, never modified or deleted.
Least privilege. Reads CREDENTIALS_CSV/SUBS_CSV, writes only under OUTPUT_FOLDER.

Protections implemented (v0.1.0)
Path-traversal defense — every output filename is sanitized (safeSegment) and every write is checked with assertWithinRoot(), so reports can’t be written outside OUTPUT_FOLDER.
Fail-fast config validation — clear errors for missing/invalid CREDENTIALS_CSV/OUTPUT_FOLDER/ALERT_DAYS/column-name settings before any file is touched.
Restrictive permissions — the generated reports (COMPLIANCE_DASHBOARD.md, CHASE_LIST.md, compliance.json, EXPIRING_SOON.csv) are written 0600.
Fail-safe expiry parsing — an unparseable or missing expires date is treated as already-expired (daysUntil returns -1) rather than silently passing as compliant; a bad row surfaces as a risk, never hides one.
Defensive parsing — the CSV parser never throws on malformed input (missing fields default to empty string); a bad row degrades the report rather than crashing it.
Secrets discipline.env and generated Compliance/ output are git-ignored; no secrets or client data in the repo.

Distribution / AV trust

Known limitations / roadmap
– Sub-to-holder matching is exact-name (case-insensitive) — if sub_name in SUBS_CSV doesn’t match holder in CREDENTIALS_CSV verbatim (e.g. “Acme Roofing” vs “Acme Roofing LLC”), the sub will show as owing everything even though credentials are on file. Keep holder names consistent across both exports.
required_docs matching is by credential type, not doc_name — two different documents of the same type (e.g. two different permits) are indistinguishable to the matcher.
– Chase drafts are generated per sub, not sent — this tool stops at “draft”; delivery (email/SMS) is on the roadmap.

Reporting
Report suspected vulnerabilities privately to the maintainer before public disclosure.

Frequently asked questions about Contractor Compliance Cockpit

What is the Contractor Compliance Cockpit and how does it work?

The Contractor Compliance Cockpit is a subscription tool built for contractors, home services firms, and trades who lose hours every week asking subcontractors for insurance certificates and license copies by hand. A contractor compliance cockpit is more than a reminder list. It tracks every required document, watches expiry dates, and does the follow-up for you when something is missing or about to lapse. You begin by loading your subcontractor roster and the items each sub owes you, such as a certificate of insurance, a trade license, or a signed agreement. The tool then keeps a live status view of who is covered and who is not, so you can tell at a glance whether a crew is clear to be sent out on a job.

The dashboard is the anchor of the whole setup. From it you can filter to any sub, see which items are current and which are overdue, and open the document history without hunting through folders. It answers one question fast, which is who is clear to work today.

The chasing is the part that sets it apart from a plain calendar alert. When a COI is close to expiring or a license copy is missing, the system emails the sub on its own and keeps nudging until the paperwork comes back. You are not the one writing a third follow-up note late at night. Every document it collects is stored and dated, which matters because business records carry real retention periods. The IRS spells out how long different records must be kept, and you can read the current rules in the IRS guidance on how long to keep records. Holding COIs, licenses, and signed contracts on file with clear dates means you can show that coverage was in force on the day a crew actually worked.

Because the tool combines three admin jobs that usually fall through the cracks, expiry tracking, follow-up, and document collection, you stop juggling a spreadsheet, a wall calendar, and your inbox all at once. It is priced for a working contractor at a flat monthly rate, not for a corporate compliance department. If you want the full feature list and pricing, the product page for the contractor compliance cockpit lays it out in plain terms. The short version is simple. You define what each sub must provide, the software watches the dates, and it handles the chasing so your files stay current without you living in your outbox.

Setup does not require a migration or a brand new system of record. You keep working the way you already do, and the tool sits on top of the subcontractor relationships you already have. New documents can be uploaded by the sub or dropped in by your office, and each one is checked against the requirements you set. When a renewal arrives, the old version stays on file and the clock resets on the next expiry date. That running history is what turns a pile of PDF files into an actual record you can stand behind if a general contractor, an auditor, or your own insurer asks who was covered and when. The point is not more software for its own sake. The point is to make sure the right paperwork exists, stays current, and is easy to produce on demand.

How does the Contractor Compliance Cockpit support OSHA and safety documentation?

Safety paperwork is one of the areas where a contractor gets exposed fastest, and it is exactly the kind of documentation the Contractor Compliance Cockpit is built to keep current. Many general contractors and property owners will not let a sub set foot on a site without a site safety plan, proof of training, or a signed acknowledgment on file. The tool tracks whatever documents you decide each sub must provide, watches their expiry dates, and chases the sub when any of them go missing or stale. That means the safety-related paperwork you require sits in one place with clear dates rather than scattered across email threads.

There is a practical reason to keep safety documents this organized beyond the rules themselves. On a busy week, a crew lead does not have time to call around confirming a sub carried current training before sending them into a confined space or up on a roof. The status view answers that in one look. A sub with a lapsed safety document shows up flagged, and the follow-up to collect the renewal is already running in the background. That turns a scramble into a glance, and it means the decision to put someone on a hazardous task is backed by a current document rather than a hopeful assumption. For a small outfit without a safety officer, that view carries real weight.

It helps to be clear about the line between this tool and your own injury logs. OSHA requires covered employers to record work-related injuries and illnesses on specific forms, and you can review that obligation in the OSHA recordkeeping requirements. Those injury logs live in your safety records and stay your responsibility. What the contractor compliance cockpit does is the document-collection side that surrounds them, making sure the certificates, safety plans, and training proofs you ask subs for are actually collected, current, and retrievable. The two fit together. OSHA logs record what happened, and the cockpit keeps the compliance documents that show a crew was qualified to be on the job in the first place.

Because the tool does the follow-up automatically, a lapsed safety document does not sit unnoticed until an inspection or an incident forces the question. The status view flags anything expired or missing before you dispatch, so a sub without current paperwork does not quietly end up on a site. That is a real difference from a spreadsheet that only tells you something expired after you go looking. The cockpit is watching every date on its own and reaching out to the sub without waiting for you to notice.

For contractors who run mixed crews of employees and subs, keeping this documentation orderly also makes any outside review far less stressful. When an auditor, an insurer, or a general contractor asks for proof that everyone on a site was covered and trained, you are not digging through folders. You open the tool and produce the current documents with their dates. You can see how this fits the wider trade in the field service and trades industry overview. The goal is not to replace your safety program. The goal is to make sure the paperwork that program depends on is collected, current, and ready when someone asks, so a missing certificate never turns into a stopped job or a gap in your defense after an incident on site.

Is my subcontractors’ data safe in the Contractor Compliance Cockpit?

Subcontractor paperwork is full of information you do not want floating around loose. A certificate of insurance carries policy numbers, a W-9 carries a taxpayer identification number, and license records tie back to real people and businesses. The Contractor Compliance Cockpit is built to hold that material in one controlled place rather than scattered across inbox attachments, shared drives, and text messages where it is easy to lose track of who can see what.

It also helps to think about who touches this information in a small office. Paperwork that arrives by email tends to get forwarded, downloaded, and copied until nobody is sure how many versions exist or on which machines. Every one of those copies is a place a policy number or a taxpayer identification number can leak from. By pulling the collection into one place, the tool cuts down the number of copies floating around in the first place. There is one current version of each document, in one system, with a record of when it arrived and when it was replaced. That is a simpler thing to protect than a dozen scattered attachments, and it is a simpler thing to clean up when a sub relationship ends and their sensitive paperwork should come off your systems entirely.

The FTC gives plain guidance every small business can follow when handling this kind of information, and its five steps are worth reading in the FTC guide to protecting personal information. The short form is take stock of what you hold, scale down what you do not need, lock down what you keep, pitch what has aged out, and plan ahead for problems. A contractor compliance cockpit maps onto that thinking directly. It keeps only the documents you actually require from each sub, holds them in one place instead of a dozen, and keeps a dated record of what came in and when. That makes it far easier to know exactly what personal information you are storing at any moment.

Keeping this data organized is also what makes it possible to retire it responsibly. When a sub relationship ends or a document ages past the point you need it, you can see it clearly instead of discovering an old W-9 buried in a mailbox years later. The tool gives you a real inventory of the sensitive paperwork tied to your subs, which is the first step the FTC points to. You cannot protect what you cannot see, and a pile of loose attachments is close to invisible.

None of this replaces basic security hygiene on your own side, like strong passwords and limiting who in your office can open the tool. What the cockpit does is shrink the surface area. Instead of insurance certificates and tax forms living in fifteen email threads and three people’s downloads folders, they sit in one place with a record of what is there. If you want to see how the software is scoped and where it fits your workflow, the contractor compliance cockpit product page covers the details. The honest promise is narrow and worth stating plainly. The tool does not make your business breach-proof. It gives you a single, dated home for sensitive subcontractor documents so you actually know what you hold, which is where real data protection starts for a small contractor.

How is the Contractor Compliance Cockpit different from expiry reminders or a spreadsheet?

Plenty of tools will remind you that a certificate is about to expire. Expiry-tracking apps and a shared spreadsheet both do that much. The problem is that a reminder only tells you about a gap. It does not close it. You still have to open your email, find the sub, write the note, wait, and follow up again when they ignore you. The Contractor Compliance Cockpit was built specifically to take over that chasing, which is where the real hours disappear for a busy contractor.

Consider what a real handoff looks like without the tool. A general contractor asks for proof that every sub on last month’s job carried current insurance, and you spend an afternoon reconstructing it from email, texts, and a spreadsheet that was last touched in March. With the collected, dated documents sitting in one place, that same request becomes a short task. You pull the current certificates, confirm the dates, and send them. The record already exists because the tool built it as each document came in. That is the difference between a system that only warns you and one that leaves you holding proof you can produce on demand, which is what actually matters when a job, a claim, or an audit is riding on it.

That is the core difference. A spreadsheet is passive. The contractor compliance cockpit is active. When a COI lapses or a license is missing, it reaches out to the sub on its own and keeps nudging until the document arrives, then files and dates it for you. Reminder tools like the ones this replaces stop at the alert. This one carries the task through to a collected, current document. For a contractor juggling a dozen subs, that is the difference between a list of problems and a system that actually resolves them for you.

The other difference is what you are left with afterward. A spreadsheet row that says a certificate expired in March is not a record you can defend. It is a note to yourself. Because business documents carry real retention periods, keeping the actual dated files matters, and the IRS guidance on how long to keep records shows why different records must be held for different lengths of time. The cockpit keeps the collected documents with their dates, so when a general contractor, an insurer, or an auditor asks who was covered and when, you produce the paperwork instead of pointing at a spreadsheet cell.

There is also the matter of things falling through the cracks. A spreadsheet only works if someone opens it and acts. Miss a week and three certificates quietly expire while crews keep working. The tool watches every date on its own and flags anything expired or missing before you dispatch, so nobody ends up on a site without current paperwork by accident. You can see how it sits alongside the rest of the trade tools in the field service and trades overview. The honest summary is that reminders and spreadsheets tell you about a problem, and this tool does the follow-up and keeps the record. If all you needed was an alert, a calendar would do. The value here is that the software chases the sub and holds the proof so you do not have to.

Can the Contractor Compliance Cockpit auto-chase subcontractors for missing documents?

Yes, automatic chasing is the whole point of the Contractor Compliance Cockpit. Expiry tracking on its own has become crowded, so this tool goes past the reminder and does the follow-up work that usually lands on an office manager or the owner. When a subcontractor is missing a certificate of insurance, a license copy, or any document you require, the system emails that sub and keeps nudging on a schedule until the paperwork actually comes back. You set the requirements once, and the chasing runs on its own from there.

The chasing also adapts to how subs actually behave. Some respond to the first email, and some need three nudges over two weeks before the certificate shows up. Rather than putting that judgment on you, the tool keeps following up on a schedule until the document is in hand, then stops. You are not left wondering whether you already emailed someone twice or whether it is time to call. The system tracks the state of every request, so a sub who has gone quiet for a week is still being worked without you thinking about it. That persistence is exactly what a spreadsheet cannot do, and it is why the collection rate on missing paperwork climbs once the follow-up stops depending on a busy owner remembering to send one more note.

Here is how it plays out in practice. You load your subs and mark what each one owes. The tool watches every expiry date and every gap. The moment something lapses or is missing, it starts reaching out to that specific sub without waiting for you to notice. As documents arrive, they are filed and dated, and the status view updates so you can see who is clear and who is still outstanding. A contractor compliance cockpit built this way turns a nagging manual task into something that handles itself in the background while you run the actual work.

That collected paperwork is worth keeping in order, because information tied to your subs and your own crew carries privacy weight. The insurance certificates and tax forms you gather hold real personal and business data, and the FTC guide to protecting personal information is a plain starting point for handling it. Keeping only what you require, in one place, with a record of what came in, is exactly the kind of orderly control the FTC describes. The auto-chase feature does not just collect faster. It collects into a single controlled home instead of a mess of email attachments.

The payoff shows up right before you dispatch. Instead of hoping every sub is current, you open the tool and see a clear compliance picture, with anything expired or missing already flagged and already being chased. Nobody rolls to a site on a certificate that quietly lapsed last month. If you want to see exactly how the auto-chase and status views are set up, the contractor compliance cockpit product page walks through it. The plain truth is that the chasing is the hard part of compliance admin, and this tool exists to do that part for you so your subs stay current without you sending another reminder by hand every week.

Attributes Value
Deployment

Cloud

Platform

Web

License Type

Subscription

Billing Period

Monthly

Target Customer

Contractors & Trades

Free Trial

Yes

Reviews

Be the first to review “Contractor Compliance Cockpit”

Your email address will not be published. Required fields are marked *