Foster Compliance Workspace
Every requirement cites the rule that created it.
Know who is qualified before the shift starts, and hand an inspector evidence they can follow, with the CFR paragraph behind every due date and a tamper-evident record of who proved what, when.
No signup, no sales call. Real workspace, sample data.
Cardinal Forge & Machine
14 employees · 6 overdue
Annual audiometric test
29 CFR 1910.95(g)
Sep 14
Respirator fit test
29 CFR 1910.134(f)(2)
Aug 2
Powered industrial truck evaluation
29 CFR 1910.178(l)(4)(iii)
Mar 9
The citation is the difference. It is how you answer “why is this due?”
Try it before you talk to anyone.
Two seeded workspaces, a hearing conservation shop and a DOT motor carrier. Record evidence, apply a rule pack to a new hire, export the evidence book.
What it does
Two things every safety manager has to answer, and most systems answer neither: who is qualified right now, and can you prove it.
The requirement explains itself
Each requirement carries the standard it came from, the cadence that standard sets, and who it applies to. When someone asks why a fit test is due in September, the answer is on the row, not in somebody's memory.
Respirator fit test
29 CFR 1910.134(f)(2)
Hearing conservation training
29 CFR 1910.95(k)
Bloodborne pathogens training
29 CFR 1910.1030(g)(2)
Powered industrial truck operator evaluation
29 CFR 1910.178(l)(4)(iii)
Completion is not qualification
A course certificate does not satisfy a forklift evaluation or a respirator fit test. Hands-on evaluations are tracked separately, with the evaluator named on the record, which is what actually gets checked in an inspection.
Overdue surfaces early
A live status view across every site, so a gap shows up on a Tuesday afternoon instead of during an audit. Due dates roll forward automatically when evidence lands.
The evidence book
Export a filtered PDF with page numbers, a running ledger hash, and a certification page. A document an auditor can hold and check, plus a CSV when they want the data. It says so on the report itself: it organizes employer records, it does not certify compliance on your behalf.
Your roster stays current
Import a CSV, or sync from BambooHR so new hires and leavers do not have to be re-keyed. Sync credentials can be rotated or revoked, and both are recorded.
Built for a security review
Your procurement team will ask for the audit log before they ask for the price.
So here is what is in it, and what holds it up. No badges we have not earned.
Single sign-on
SAML 2.0, service-provider initiated, with just-in-time provisioning restricted to the email domains you allow. Verified end to end against a live Okta tenant. The owner account can never be created or changed through SSO.
Multi-factor and session freshness
MFA on manager accounts, and a manager session goes stale after 12 hours, so managers reauthenticate before touching records again. An SSO login satisfies the MFA gate, because your identity provider already enforced it.
Encrypted before storage
Evidence records, evaluator notes, and stored documents are encrypted with AES-256-GCM before they are written, and storage paths are keyed so an object cannot be found by guessing. Keys are versioned, so one can be rotated without stranding data written under the old one. Basic roster fields (name, work email, role, site) are not encrypted at the application layer.
Hash-chained audit ledger
Every change appends to a chained ledger: evidence recorded, requirement added, roster imported, member invited, role changed, access revoked, SSO configured, retention policy changed. Break a link and verification fails.
Retention you set, not us
You choose the minimum retention window (1, 3, 5, 7, or 30 years) and can place a legal hold that blocks deletion entirely. Deletions are recorded in the ledger with what was removed and which policy allowed it.
Second-provider durability
When the mirror is configured for your tenant, roster, ledger, and evidence records are copied on write to a separate provider through a path with no delete method, checksum-verified on a schedule. The retention window itself is enforced by that provider's bucket policy rather than by our code, so we describe this as durable and verifiable, not as immutable.
Incident controls
A suspected account compromise, an integration compromise, or a data-integrity event can each be declared, which suspends writes while the ledger stays verifiable. Unknown state fails closed rather than open.
Recovery you can rehearse
Export a portable copy of your workspace, and run a restore drill on a schedule rather than discovering the gap during an incident. Drill due dates are tracked like any other requirement.
5,000
employees in the load test
20,000 tracked requirements
425ms
p95 roster page load
at full test scale
890ms
p95 full ledger verification
chain walked end to end
16
rule packs written
5 OSHA general industry, 11 DOT driver qualification
Tenant separation is enforced first in the application and again at the database, where row-level security is forced on every table and a query with no tenant context returns nothing rather than everything. The load-test figures come from a single run at the size shown, not a continuous benchmark. Ask us for the report, or for a walkthrough of the ledger.
What is covered today
Each pack is written from the CFR text and pinned to it by content hash. A pack that has not been approved cannot be assigned. It fails closed rather than guessing.
OSHA general industry
Respirator fit test
29 CFR 1910.134(f)(2)
Hearing conservation training
29 CFR 1910.95(k)
Bloodborne pathogens training
29 CFR 1910.1030(g)(2)
Powered industrial truck operator evaluation
29 CFR 1910.178(l)(4)(iii)
Hazard communication training
29 CFR 1910.1200(h)(1)
DOT driver qualification
Eleven packs covering the driver qualification file end to end: employment application, initial and annual motor vehicle records, the annual review of driving record, road test certificate, medical examiner's certificate and variances, National Registry verification, and both the pre-employment and annual Drug & Alcohol Clearinghouse queries.
Written against 49 CFR Parts 40, 382, and 391, the same file a DOT auditor asks for, tracked per driver with the same citations and evidence trail.
Pilot pricing
$299/site/mo
Includes 100 employees, then $2 per employee per month.
Everything on this page is included. We are not holding single sign-on or the audit ledger back for an enterprise tier.
Book a walkthroughStraight answers
How is this different from a training platform or LMS?
An LMS proves someone finished a course. OSHA often requires more: a fit test, a hands-on forklift evaluation, an evaluator's sign-off. We track the qualification and the proof, with the governing standard cited on each requirement, whether the training happened online, in person, or with another vendor.
What happens to my data if we stop paying?
You can export a portable copy of your workspace at any time, including the evidence records and the audit ledger. Compliance records outlive vendor relationships, and your export does not depend on us staying in business.
Are you SOC 2 certified?
Not yet. We are a small company being straight with you about that rather than implying otherwise. The controls described on this page are built and running, and we can walk your security reviewer through the architecture, the audit ledger, and the load-test results. If a SOC 2 report is a hard requirement for your purchase, tell us early so we can be honest about timing.
Who reviews the rule packs?
Each pack pins the exact CFR text it was written from, and a pack version can only be assigned if its content hash matches an approval on file. Change one word and the hash changes, the approval is void, and assignment stops until it is reviewed again. Today those approvals are owner-directed, with the CFR text cross-checked against the source. Outside counsel review is the next step and is not finished, so we do not present the packs as attorney-certified.
Does this make us OSHA compliant?
No, and any vendor who says otherwise is selling you something. Every evidence book we produce carries the line “this report organizes employer records; it does not independently certify OSHA compliance or replace required workplace evaluation.” What the workspace does is keep the requirements, the cadences, and the proof in one place with the standard cited, so that when someone asks, you can answer with records instead of recollection.
Do you install anything?
No. It runs in the browser. There is nothing to install on your machines, and nothing to keep patched on your side.
What if we already track this in spreadsheets?
Import your existing roster as a CSV and pick up from there. You can also sync the roster from BambooHR so leavers and new hires do not have to be re-keyed.
Book a walkthrough
Tell us about your site and we'll walk you through the workspace. If you would rather poke at it yourself first, the demo is right here.
Prefer to call? 513.891.0868