Inspection records for industrial sites
Know what was checked. See what was found. Retrieve the evidence.
From food production and waste management to chemical plants and utilities, Amberhold puts your routine inspections on a phone and keeps the record: who checked what, when, against which limit, and what they found.
Tell us what you check and we send a short recording of a similar round on our fictional demonstration plant, no meeting needed. Or try a round on the fictional demo plant (no account, about 90 seconds), or send one blank check sheet and we rebuild it free.
- Proven on real rounds at a live process plant
- Runs in the browser, or in the Android app
- Priced per unit, never per user, no long contract
Works with
- Microsoft Entra ID
- Excel
- Power BI
- Microsoft Fabric
- Power Automate
- REST API
- CSV export
Live demo — try it
Boiler Status — Nights
Boiler House · point 1 of 4
B-201 · No.2 Boiler
Boiler — status
Steam drum pressure
Burner flame check
[Auto-skipped · B-201 = In bank]
Tap a status, drag the reading, then record — the round moves to the next point.
Industries
Built for sites that walk their plant every day.
If your people walk routine checks and someone may ask to see them later, Amberhold is built for you, whatever you make, treat or store. And if you run a COMAH site, it speaks your language.
Industries and compliance: the UK rules behind your routine checks, in plain words →Waste and recycling
Storage and containment, fire prevention, drainage, plant and the site boundary.
Waste and recycling sites →Food and drink
Refrigeration, boilers, compressed air, effluent treatment and production equipment.
Food and drink sites →Chemical and COMAH
Tank farms and bunds, pumps and process plant, and temporary controls.
Chemical and COMAH sites →Energy and utilities
Boiler houses, pumps, generators, water treatment and plant rounds.
Energy and utilities: the rules behind the checks →Manufacturing and engineering
Machinery condition, compressed air, extraction and routine safety checks.
Manufacturing: the rules behind the checks →See it working at a site like yours.
Tell us what you check and we send a short recording of a similar round on our fictional demonstration plant. No meeting, nothing to prepare.
Web app · Android app
Industrial inspections. On the plant. In your pocket.
Amberhold is a web app: it runs in the browser on any phone, tablet or desktop, with nothing to install. It is also an app on Android. Either way, operators walk their rounds one point at a time, with recent readings in view, each reading recorded against your limits and each piece of equipment identified by its QR label, or by an NFC tag in the Android app.
Any phone or tablet reads the QR tag with its camera; NFC tags are read in the Amberhold app on Android phones with NFC.
Where operators carry iPhones, set their points to accept a QR scan for now.
iPhone
Coming soon. Until then, Amberhold runs in the browser on iPhone.
Not using Amberhold yet? Try a round on the fictional demo plant in your browser, no account needed →
The plant runs.
People keep it running.
Every shift, someone walks it — hears the pump that doesn't sound right, isolates what can't be trusted, records what they found, and hands the plant on to the next crew.
That work is real. Its evidence should be too. Amberhold preserves it — every reading, every skip, every temporary control — longer than the shift that produced it.
Today, the evidence is a spreadsheet.
Routine checks are how a site does what it has committed to: in an environmental permit, a food safety plan, a COMAH safety report or its own safety management system. Yet on most sites the record of them is paper and spreadsheets.
Readings re-keyed into a grid
Dense tables built for a desk, walked with a clipboard. The operator serves the spreadsheet, not the plant.
History is buried
Last shift's reading lives in another file. Drift that would be obvious on a trend goes unnoticed for weeks.
Edits are silent
A cell can be changed after the fact with no trace of who, when or why — exactly what an investigator asks first.
Temporary checks are improvised
An isolation's monitoring lives on a whiteboard and in someone's memory — until a shift change forgets it.
When a regulator, insurer or auditor asks for evidence the rounds happened, a spreadsheet is a weak answer.
Working today
Built around the operator, not the spreadsheet.
Software operators tolerate gets left in the mess room. Software built for the walk gets used — and used software is what makes evidence complete.
Guided walkrounds
One point at a time on a phone — with the expected band, the previous reading and the recent trend right where the operator needs them.
Honest skips
Equipment in bank or offline? Dependent points skip automatically with the reason recorded — never silently blank.
A live readings board
Out-of-range readings surface worst-first, with round progress at a glance — so the shift sees problems before the handover does.
Corrections that never overwrite
Mistyped a reading? The correction is appended and the original stays. The record shows exactly what happened, in order.
Build rounds yourself
Describe your plant in plain words and Amberhold proposes the structure. Build a section once, copy it across sister equipment, publish a revision — no vendor visit, ever.
Roles and governed change
Operators, technicians, managers, site admins. Changing a definition is a governed act: permission-checked and written to an immutable audit log.
Site board · Boiler House
NIGHTS · 03:473/4
rounds this shift
0
points recorded
2
out of range
Needs attention — worst first
FW-110 · Feedwater flow
12.6 m³/h · expected 8 – 11
B-203 · Stack temperature
218 °C · expected ≤ 205
Cooling Towers — Nights
due 03:00 · not started
🔒 Active isolation · Feed pump B
pressure check due this shift
Live demo — switch the tabs.
The site board
Walk out of handover knowing, not hoping.
While the rounds are walked, the board fills. Out-of-range readings surface worst-first, overdue work shows itself, and active temporary controls sit right beside the rounds — one screen, live, for the whole site.
No opening historical entries one by one: the previous reading and the trend live inline, on the board and on every point. The oncoming shift opens the same board and sees the same truth.
Built from what plants actually ask for.
Amberhold's first site had already lived with an enterprise incumbent. These asks shaped every screen.
Operators
“Don't make me fight the tool at 2 a.m.”
- —One point at a time, in walking order — no grid to wrestle on a phone
- —The expected band, last reading and trend right on the point
- —Equipment offline? One tap, reason recorded, move on
Shift managers
“Show me what's wrong before the handover does.”
- —Out-of-range readings surface worst-first, live
- —Round progress and overdue work at a glance
- —Temporary controls that cannot silently expire
HSEQ & audit
“Give me a record I can defend two years later.”
- —Append-only: corrections add, they never replace
- —Every entry attributable — who, when, what
- —Evidence packs drawn from a database-enforced append-only record
Temporary controls
When the plant isn't normal, Amberhold keeps it on the board.
Declare a temporary control — an active isolation, equipment out of service, a bypass — and Amberhold binds the monitoring to it. The checks fall due every shift, appear on the board alongside the rounds, and cannot silently expire.
Clearance is a recorded act, not a lapsed timer. Checks that were never needed close honestly as “Not required — control ended before due”. The whole life of the control — declaration, every check, every concern, clearance — is one audit timeline you can print.
Used alongside your approved isolation process, never instead of it.
Site board · Boiler House
1 ACTIVE CONTROL🔒 Active isolation
Feed pump B — gland leak, isolated for repair
declared Tue 02:14 · Shift Manager
Concerns stay open until a manager records a disposition.
Evidence pack
TEMPORARY CONTROL · TC-07
Active isolation — feed pump B gland leak
- Tue 02:14DECLARED
Active isolation — reason recorded · Shift Manager - Tue 06:02CHECK COMPLETE
Isolation pressure 0.0 bar — within guidance - Tue 18:11FLAGGED ABNORMAL
Reading outside guidance — concern opened - Wed 08:47CONCERN DISPOSITIONED
Reviewed; action recorded · Site Manager - Wed 14:36CLEARED
Clearance recorded — open checks closed: “Not required — control ended before due”
append-only source · corrections add, never replace
enforced by the database itself
Retrieve
Evidence you'd hand straight to an auditor.
- —Every entry carries who and when. Nothing is ever deleted or edited in place; corrections append.
- —Skips and misses are recorded truthfully, with reasons — an honest record is worth more than a perfect-looking one.
- —The printable timeline of a temporary control assembles its whole life from the append-only record. A finished round opens later in the words, units and limits that applied.
Straight talk.
Amberhold supports compliance and produces evidence. It never certifies your site, decides legal applicability, or takes on the dutyholder's responsibility — and routine operator checks are never presented as statutory examinations.
How Amberhold thinks
One chain, from duty to evidence.
Every feature serves the same chain: a local requirement becomes owned, scheduled work — and the work becomes evidence that stands up on its own.
- 01
Structure
Model your site the way your operators speak — areas, equipment, components.
- 02
Control
Record what must stay true, and the checks that verify it.
- 03
Plan
Schedules and conditions decide what's due — per shift, weekly, or while a temporary control is active.
- 04
Perform
A guided walk on any phone. One point at a time, with context.
- 05
Resolve
A reading beyond an action limit stays under Needs attention until a manager or site administrator records a decision.
- 06
Retrieve
Append-only records, attributable entries, and a printable timeline for each temporary control.
The five laws
Your plant is already described seven ways. None of them agree.
walkround sheets · SOPs · P&IDs · equipment spreadsheets · permits · inspection reports · operators' memory
Amberhold doesn't ask you to rebuild your plant from scratch, and it doesn't replace what you already have — it reconciles your existing descriptions into one governed operational model. It may infer, compare and propose; only your accountable people establish operational truth. That promise is written down as five laws, and every feature obeys them.
01The plant is the truth.
The model is the site's governed description of it — every other source is an unreconciled description. An operator standing at the equipment outranks any document, including ours.
For your site — Your operators' observations can never be overruled by paperwork — so walking the plant keeps its meaning.
02Amberhold proposes; people decide.
No import, parser or inference creates an operational identity. Amberhold may say “I think RF-410 is this equipment.” It may never say “I have created RF-410.”
For your site — No AI and no import will ever invent, rename or merge equipment in your model. Your register stays yours.
03Every decision is remembered.
Confirmed, corrected, rejected or deferred — attributable and permanent. Undecided proposals are derived, never stored: the ledger holds decisions, not noise.
For your site — It never asks a question your site already answered — the difference between an assistant your team uses and one they abandon.
04Disagreement is a finding, not an error.
Any two descriptions of the plant that disagree produce a finding — never a silent auto-correction. Findings rank by operational evidence, not text frequency: the proposals improve because the plant is being walked.
For your site — The spreadsheets and SOPs you already have become useful on day one — their disagreements surface as ranked findings, worst first.
05Reconciliation never destroys information.
Nothing observed, imported or recorded is overwritten because a newer source disagrees — the newer source may be the wrong one.
SOP references RF-410 Equipment register has RF-401 → Amberhold records a FINDING. It does not “fix” either side.
For your site — Years later, you can show an auditor what every source said — including the ones that turned out to be wrong.
Amberhold
The name is the design law. In Amberhold, live work glows blue — and nothing historical does. The preserved record holds amber — and nothing live does. Colour is never the only signal. You can see it above: the walk's LIVE dot runs blue; the evidence pack holds amber.
An operator glancing at a board should never have to wonder whether they're looking at the plant as it is, or the record of how it was.
Pricing
Priced for a site, not an enterprise.
Enterprise rounds systems are sold to head offices for tens of thousands a year — and when the corporate relationship changes, the site loses the software. Amberhold is a straightforward monthly subscription per operating unit (for most customers, one site): no long contract, cancel any time, continued development included.
Founding Sites · 5 of 5 places open
No setup fee, £350 a month per operating unit
Monthly, stop any month. Prefer a fixed term? A three-month pilot is £950, then £350 a month if you continue. Cancel any time.
See what a Founding Site gets →
Talk to us about your siteOne subscription covers it all
- ✓Runs in the browser on any phone, tablet or desktop, or in the Android app
- ✓Your data isolated by server-enforced tenant scoping, on UK cloud
- ✓Individual sign-ins, access by role
- ✓Every user, every round, every revision included
Set up in days, not months: describe your plant in plain language, build the first round with your input, walk it on the next shift.
How buying works.
No procurement maze — four steps, and most of them are ours to do.
Enquire
Two minutes on the form. A person replies within one working day.
See it at a site like yours
We send a short recording of a similar round on our fictional demonstration plant. No meeting, nothing to prepare.
Start on your site
A Founding Site place or a fixed three-month pilot. Your rounds, your operators, real shifts — set up in days, not months.
Go live
One monthly subscription per operating unit. Your team gets their logins; the record starts.
Built with running plants, not on spec.
Amberhold grows by what real sites show they need, not by feature checklists. Live today: QR and NFC identity tags at the point (a tag identifies, never authenticates). Not built yet, and not sold until it is: routines for non-round work (duty swaps, fire-pump tests), specialist registers, a proper shift log, and controlled documents.
Who you'll be talking to
Built by a process operator, for process operations.
Amberhold is built by Andy Cassels, whose background is in plant operations across control room, reactor front end, movements and utilities. When you enquire, he is the person who replies.
For procurement
Built to be trusted with your evidence.
Every claim below is standing infrastructure, not a roadmap item — and your due-diligence questions are welcome.
Hosted in the UK
Google Cloud, London region — application, database and evidence storage.
Backed up daily, recoverable to a point in time
Automatic daily backups plus point-in-time recovery on the database.
Restore is rehearsed, not assumed
Full restore drills are run and evidenced — the last complete drill took 14 minutes.
Append-only by the database itself
Evidence tables reject edits and deletes at the database layer — not just in the app.
Access is governed
Role-based permissions, time-boxed guest access that lapses by itself, and leaver deactivation that takes effect on the next request.
Everything administrative is audited
Invitations, role changes, publishes and clearances land in an immutable audit trail.
For HSEQ managers
Every regime asks the same question: show me.
Amberhold is regulation-informed, site-controlled, evidence-led. Recognised duties and standards shape what the platform can express; your site works out which duties apply and sets limits, frequency and authorised roles; the platform shows what was defined, what was due, what was done and what was found — and, for temporary controls, how each was resolved.
United Kingdom
- COMAH 2015Every operator needs a safety management system; upper-tier sites describe it in their safety report. Rounds records are one kind of evidence a site may keep within that system. They are not the system.
- Environmental permits (EPR 2016)In England, Environment Agency guidance says permits for waste operations, installations and some other activities need a written management system. Amberhold records the routine checks it describes; the system and the permit stay yours.
- Food safety plans (HACCP)Your plan decides what is monitored and what happens next. Amberhold records the routine checks you put on it, from plant and utilities to temperatures and hygiene rounds. It is not a HACCP system.
- PUWER 1998Equipment checks and maintenance monitoring, recorded with who, when and what was found.
- PSSR 2000Routine operator readings against the operating range you set within safe operating limits, alongside any written scheme of examination, never in place of it.
- DSEAR 2002Your DSEAR assessment decides whether a phone or tablet may enter a zone. Where it may not, the check is recorded at the zone boundary.
- HSG65Plan–Do–Check–Act: HSE says checking can include regular, planned checks of the workplace. Operator rounds can be one part of your Check step.
European Union
- Seveso III (2012/18/EU)Annex III expects the SMS to cover operational control, performance monitoring, and audit and review. Rounds evidence is one part of the performance-monitoring record.
- Work Equipment Directive 2009/104/ECRecorded checks on work equipment in use.
- ATEX 1999/92/ECWorks within your explosive-atmospheres zoning approach — the site chooses the devices.
- Framework Directive 89/391/EECGeneral prevention duties, evidenced by the monitoring your own assessment prescribes.
Member-state implementations differ. Whether a rule applies is for your site to work out, never the platform.
United States
- OSHA PSM — 29 CFR 1910.119Operating procedures must cover temporary operations, and inspections and tests on process equipment must be documented. Amberhold records routine operator checks with who, when, the equipment and the result; they are not mechanical integrity inspections.
- EPA RMP — 40 CFR 68The same programme elements, evidenced for covered processes.
- CCPS · API RP 754The conduct-of-operations and operational-discipline record those programmes expect — and the data behind the indicators.
Everywhere: ISO 45001 · ISO 14001 · ISO 9001
Certification auditors sample your documented information and ask for evidence of operational control and performance evaluation. ISO management systems expect records protected against loss of integrity — Amberhold's records are append-only and attributable by construction, not by policy. Insurers and engineering surveyors ask the same questions; a defensible record shortens the conversation.
The audit, rehearsed.
Six questions every inspector, surveyor and certification auditor asks — and the answer the record itself gives.
“Show me these rounds actually happened.”
Every recorded point carries who, when and what — and the schedule shows what was due, so a gap is visible instead of vanishing. An honest gap beats a suspicious blank.
“What happened when this reading was flagged abnormal?”
The operator's flag stands on the record with the reading. Where the check guards a temporary control, the flag and its recorded disposition are one linked trail — nothing closes by itself.
“Who changed this round, and was it approved?”
Definitions are versioned. Publishing is a governed act: permission-checked and written to an immutable audit log.
“What was watching the plant while this pump was isolated?”
The temporary control's whole life — declaration, every check, every concern, clearance — is one printable timeline.
“How do I know this record wasn't tidied up afterwards?”
Append-only by construction: corrections add entries, they never replace them — and the rule is enforced by the database itself, not just the application.
“Who could touch this record — and did leavers lose access?”
The membership trail is append-only too: every invitation, role, access window and deactivation is recorded. Who could write is part of the evidence, not a side question.
Access, governed.
Two conversations every audit gets to — answered in the product, not in a policy document.
Give the audit a seat, not a paper pack.
Invite the audit team with time-boxed, read-only access to the record — rounds, readings, temporary controls, history. You set the window up front; when it closes, access ends by itself — no sweep to run, nobody to remember. The grant, any extension and the ending land in the same append-only trail the auditor came to read.
MEMBER Audit · Viewer (read-only)
STATUS access ended — sign-in refused
An ended grant stays on the register, stated plainly — an honest record includes who could have written to it.
When people move on, their access moves with them.
Deactivate a leaver once and their sign-in stops being honoured from the very next request. Everything they recorded keeps its author — the history stays attributable forever; only the keys stop working. And the deactivation is itself a recorded, attributable act.
No orphaned logins for the audit to find, and no quiet gaps in the record when a contractor's engagement ends — access history is evidence, so Amberhold keeps it.
The line we hold: Amberhold informs itself from these regimes; it never decides legal applicability. Your competent persons, statutory examinations and dutyholder responsibilities stay exactly where the law puts them.
The category
Operational assurance. Not digital checklists.
Why every regime ends up asking the same six questions — and why a reading only becomes evidence once it's anchored to the equipment it was taken on.
Read the argument →
The detail
How Amberhold supports industrial safety management
Regime by regime — COMAH, PSSR, COSHH, HSWA, HSG65, ISO 45001, permits and handover: what each expects, what we record, what we don't do, and what stays yours.
See the mapping →
Operators keep plants safe, shift after shift.
Their work deserves evidence that lasts longer than the shift.
That's why Amberhold exists.