Operational assurance for industrial sites
Critical work happens on every shift. The evidence shouldn't disappear with it.
Amberhold preserves the proof — operator rounds, routine checks and temporary controls, recorded on any phone as attributable, append-only evidence you can defend.
Run a round, scan equipment, find a problem — then see exactly what your manager receives. No account, fictional plant, three minutes. A live demonstration is the same thing on your own round sheet, 20 minutes.
- Proven on real rounds at a live process plant
- Nothing to install — runs in the browser
- Per-site pricing, no long contract
Works with
- Microsoft Entra ID
- Excel
- Power BI
- Microsoft Fabric
- Power Automate
- REST API
- CSV export
Live demo — try it
Boiler Status — Nights
Boiler House · point 8 of 30
B-201 · No.2 Boiler
Boiler — status
Steam drum pressure
Burner flame check
[Auto-skipped · B-201 = In bank]
Tap a status and watch the dependent check skip honestly.
The plant runs.
People keep it running.
Every shift, someone walks it — hears the pump that doesn't sound right, isolates what can't be trusted, records what they found, and hands the plant on to the next crew.
That work is real. Its evidence should be too. Amberhold preserves it — every reading, every skip, every temporary control — longer than the shift that produced it.
Today, the evidence is a spreadsheet.
Routine operator monitoring is how a site meets its duties — behind it sit COMAH, Seveso III and OSHA PSM, and it's written into your own safety management system. Yet on most plants the record of it is paper and spreadsheets.
Readings re-keyed into a grid
Dense tables built for a desk, walked with a clipboard. The operator serves the spreadsheet, not the plant.
History is buried
Last shift's reading lives in another file. Drift that would be obvious on a trend goes unnoticed for weeks.
Edits are silent
A cell can be changed after the fact with no trace of who, when or why — exactly what an investigator asks first.
Temporary checks are improvised
An isolation's monitoring lives on a whiteboard and in someone's memory — until a shift change forgets it.
When a regulator, insurer or auditor asks for evidence the rounds happened, a spreadsheet is a weak answer.
Built from what plants actually ask for.
Amberhold's first site had already lived with an enterprise incumbent. These asks shaped every screen.
Operators
“Don't make me fight the tool at 2 a.m.”
- —One point at a time, in walking order — no grid to wrestle on a phone
- —The expected band, last reading and trend right on the point
- —Equipment offline? One tap, reason recorded, move on
Shift managers
“Show me what's wrong before the handover does.”
- —Out-of-range readings surface worst-first, live
- —Round progress and overdue work at a glance
- —Temporary controls that cannot silently expire
HSEQ & audit
“Give me a record I can defend two years later.”
- —Append-only: corrections add, they never replace
- —Every entry attributable — who, when, what
- —Evidence packs drawn from a database-enforced append-only record
How Amberhold thinks
One chain, from duty to proof.
Every feature serves the same chain: a local requirement becomes owned, scheduled work — and the work becomes evidence that stands up on its own.
- 01
Structure
Model your site the way your operators speak — areas, equipment, components.
- 02
Control
Record what must stay true, and the checks that verify it.
- 03
Plan
Schedules and conditions decide what's due — per shift, weekly, or while a temporary control is active.
- 04
Perform
A guided walk on any phone. One point at a time, with context.
- 05
Resolve
Abnormal findings stay open until someone authorised closes them.
- 06
Prove
Append-only records, attributable entries, printable evidence packs.
Working today
Built around the operator, not the spreadsheet.
Software operators tolerate gets left in the mess room. Software built for the walk gets used — and used software is what makes evidence complete.
Guided walkrounds
One point at a time on a phone — with the expected band, the previous reading and the recent trend right where the operator needs them.
Honest skips
Equipment in bank or offline? Dependent points skip automatically with the reason recorded — never silently blank.
A live readings board
Out-of-range readings surface worst-first, with round progress at a glance — so the shift sees problems before the handover does.
Corrections that never overwrite
Mistyped a reading? The correction is appended and the original stays. The record shows exactly what happened, in order.
Build rounds yourself
Describe your plant in plain words and Amberhold proposes the structure. Build a section once, copy it across sister equipment, publish a revision — no vendor visit, ever.
Roles and governed change
Operators, technicians, managers, site admins. Changing a definition is a governed act: permission-checked and written to an immutable audit log.
Site board · Boiler House
NIGHTS · 03:473/4
rounds this shift
0
points recorded
2
out of range
Needs attention — worst first
38FR105 · Cooling water flow
12.6 m³/h · expected 8 – 11
B-203 · Stack temperature
218 °C · expected ≤ 205
Cooling Towers — Nights
due 03:00 · not started
🔒 Active isolation · Feed pump B
pressure check due this shift
Live demo — switch the tabs.
The site board
Walk out of handover knowing, not hoping.
While the rounds are walked, the board fills. Out-of-range readings surface worst-first, overdue work shows itself, and active temporary controls sit right beside the rounds — one screen, live, for the whole site.
No opening historical entries one by one: the previous reading and the trend live inline, on the board and on every point. The oncoming shift opens the same board and sees the same truth.
On the road: notifications that find you when a reading needs eyes — so the board comes to you, not just you to the board.
Temporary controls
When the plant isn't normal, Amberhold keeps watch.
Declare a temporary control — an active isolation, equipment out of service, a bypass — and Amberhold binds the monitoring to it. The checks fall due every shift, appear on the board alongside the rounds, and cannot silently expire.
Clearance is an authorised act, not a lapsed timer. Checks that were never needed close honestly as “Not required — control ended before due”. The whole life of the control — declaration, every check, every concern, clearance — is one audit timeline you can print.
Used alongside your approved isolation process, never instead of it.
Site board · Boiler House
1 ACTIVE CONTROL🔒 Active isolation
Feed pump B — gland leak, isolated for repair
declared Tue 02:14 · Shift Manager
Concerns stay open until someone authorised records a disposition.
Evidence pack
TEMPORARY CONTROL · TC-07
Active isolation — feed pump B gland leak
- Tue 02:14DECLARED
Active isolation — reason recorded · Shift Manager - Tue 06:02CHECK COMPLETE
Isolation pressure 0.0 bar — within guidance - Tue 18:11FLAGGED ABNORMAL
Reading outside guidance — concern opened - Wed 08:47CONCERN DISPOSITIONED
Reviewed; action recorded · Site Manager - Wed 14:36CLEARED
Authorised clearance — open checks closed: “Not required — control ended before due”
append-only source · corrections add, never replace
enforced by the database itself
Prove
Evidence you'd hand straight to an auditor.
- —Every entry carries who and when. Nothing is ever deleted or edited in place; corrections append.
- —Skips and misses are recorded truthfully, with reasons — an honest record is worth more than a perfect-looking one.
- —Evidence packs assemble the full story of a round or a temporary control from the append-only record — nothing summarised away.
Straight talk.
Amberhold supports compliance and produces evidence. It never certifies your site, decides legal applicability, or takes on the dutyholder's responsibility — and routine operator checks are never presented as statutory examinations.
The five laws
Your plant is already described seven ways. None of them agree.
walkround sheets · SOPs · P&IDs · equipment spreadsheets · permits · inspection reports · operators' memory
Amberhold doesn't ask you to rebuild your plant from scratch, and it doesn't replace what you already have — it reconciles your existing descriptions into one governed operational model. It may infer, compare and propose; only your accountable people establish operational truth. That promise is written down as five laws, and every feature obeys them.
01The plant is the truth.
The model is the site's governed description of it — every other source is an unreconciled description. An operator standing at the equipment outranks any document, including ours.
For your site — Your operators' observations can never be overruled by paperwork — so walking the plant keeps its meaning.
02Amberhold proposes; people decide.
No import, parser or inference creates an operational identity. Amberhold may say “I think S2580 is this equipment.” It may never say “I have created S2580.”
For your site — No AI and no import will ever invent, rename or merge equipment in your model. Your register stays yours.
03Every decision is remembered.
Confirmed, corrected, rejected or deferred — attributable and permanent. Undecided proposals are derived, never stored: the ledger holds decisions, not noise.
For your site — It never asks a question your site already answered — the difference between an assistant your team uses and one they abandon.
04Disagreement is a finding, not an error.
Any two descriptions of the plant that disagree produce a finding — never a silent auto-correction. Findings rank by operational evidence, not text frequency: the proposals improve because the plant is being walked.
For your site — The spreadsheets and SOPs you already have become useful on day one — their disagreements surface as ranked findings, worst first.
05Reconciliation never destroys information.
Nothing observed, imported or recorded is overwritten because a newer source disagrees — the newer source may be the wrong one.
SOP references S2580 Equipment register has S2582 → Amberhold records a FINDING. It does not “fix” either side.
For your site — Years later, you can show an auditor what every source said — including the ones that turned out to be wrong.
Amberhold
The name is the design law. In Amberhold, live work glows blue — and nothing historical does. The preserved record holds amber — and nothing live does. Colour is never the only signal. You can see it above: the walk's LIVE dot runs blue; the evidence pack holds amber.
An operator glancing at a board should never have to wonder whether they're looking at the plant as it is, or the record of how it was.
For HSEQ managers
Every regime asks the same question: show me.
Amberhold is regulation-informed, site-controlled, evidence-led. Recognised duties and standards shape what the platform can express; your site decides applicability, limits, frequency and authorised roles; the platform proves what was defined, what was due, what was done and what was found — and, for temporary controls, how each was resolved.
United Kingdom
- COMAH 2015Your safety report promises systematic monitoring. Rounds evidence shows the safety management system runs in practice, not just on paper.
- PUWER 1998Equipment checks and maintenance monitoring, recorded with who, when and what was found.
- PSSR 2000Routine operator monitoring within safe operating limits — alongside your written scheme, never in place of it.
- DSEAR 2002No special hardware: runs in the browser on whatever devices your site's zoning permits.
- HSG65Plan–Do–Check–Act: operator rounds are your Check step. Amberhold makes it inspectable.
European Union
- Seveso III (2012/18/EU)Annex III expects the SMS to cover operational control, performance monitoring, and audit and review — exactly the record rounds produce.
- Work Equipment Directive 2009/104/ECRecorded checks on work equipment in use.
- ATEX 1999/92/ECWorks within your explosive-atmospheres zoning approach — the site chooses the devices.
- Framework Directive 89/391/EECGeneral prevention duties, evidenced by the monitoring your own assessment prescribes.
Member-state implementations differ — which is why applicability is always your site's decision, never the platform's.
United States
- OSHA PSM — 29 CFR 1910.119Operating procedures including temporary operations; inspections and tests documented with who, when, the equipment and the result. That is Amberhold's native record shape.
- EPA RMP — 40 CFR 68The same programme elements, evidenced for covered processes.
- CCPS · API RP 754The conduct-of-operations and operational-discipline record those programmes expect — and the data behind the indicators.
Everywhere: ISO 45001 · ISO 14001 · ISO 9001
Certification auditors sample your documented information and ask for evidence of operational control and performance evaluation. ISO management systems expect records protected against loss of integrity — Amberhold's records are append-only and attributable by construction, not by policy. Insurers and engineering surveyors ask the same questions; a defensible record shortens the conversation.
The audit, rehearsed.
Six questions every inspector, surveyor and certification auditor asks — and the answer the record itself gives.
“Show me these rounds actually happened.”
Every recorded point carries who, when and what — and the schedule shows what was due, so a gap is visible instead of vanishing. An honest gap beats a suspicious blank.
“What happened when this reading was flagged abnormal?”
The operator's flag stands on the record with the reading. Where the check guards a temporary control, the flag and its authorised disposition are one linked trail — nothing closes by itself.
“Who changed this round, and was it approved?”
Definitions are versioned. Publishing is a governed act: permission-checked and written to an immutable audit log.
“What was watching the plant while this pump was isolated?”
The temporary control's whole life — declaration, every check, every concern, clearance — is one printable timeline.
“How do I know this record wasn't tidied up afterwards?”
Append-only by construction: corrections add entries, they never replace them — and the rule is enforced by the database itself, not just the application.
“Who could touch this record — and did leavers lose access?”
The membership trail is append-only too: every invitation, role, access window and deactivation is recorded. Who could write is part of the evidence, not a side question.
Access, governed.
Two conversations every audit gets to — answered in the product, not in a policy document.
Give the audit a seat, not a paper pack.
Invite the audit team with time-boxed, read-only access to the record — rounds, readings, temporary controls, history. You set the window up front; when it closes, access ends by itself — no sweep to run, nobody to remember. The grant, any extension and the ending land in the same append-only trail the auditor came to read.
MEMBER Audit · Viewer (read-only)
STATUS access ended — sign-in refused
An ended grant stays on the register, stated plainly — an honest record includes who could have written to it.
When people move on, their access moves with them.
Deactivate a leaver once and their sign-in stops being honoured from the very next request. Everything they recorded keeps its author — the history stays attributable forever; only the keys stop working. And the deactivation is itself a recorded, attributable act.
No orphaned logins for the audit to find, and no quiet gaps in the record when a contractor's engagement ends — access history is evidence, so Amberhold keeps it.
The line we hold: Amberhold informs itself from these regimes; it never decides legal applicability. Your competent persons, statutory examinations and dutyholder responsibilities stay exactly where the law puts them.
The category
Operational assurance. Not digital checklists.
Why every regime ends up asking the same six questions — and why a reading only becomes evidence once it's anchored to the equipment it was taken on.
Read the argument →
The detail
How Amberhold supports industrial safety management
Regime by regime — COMAH, PSSR, COSHH, HSWA, HSG65, ISO 45001, permits and handover: what each expects, what we record, what we don't do, and what stays yours.
See the mapping →
For procurement
Built to be trusted with your evidence.
Every claim below is standing infrastructure, not a roadmap item — and your due-diligence questions are welcome.
Hosted in the UK
Google Cloud, London region — application, database and evidence storage.
Backed up daily, recoverable to a point in time
Automatic daily backups plus point-in-time recovery on the evidence store.
Restore is rehearsed, not assumed
Full restore drills are run and evidenced — the last complete drill took 14 minutes.
Append-only by the database itself
Evidence tables reject edits and deletes at the database layer — not just in the app.
Access is governed
Role-based permissions, time-boxed guest access that lapses by itself, and leaver deactivation that takes effect on the next request.
Everything administrative is audited
Invitations, role changes, publishes and clearances land in an immutable audit trail.
Pricing
Priced for a site, not an enterprise.
Enterprise rounds systems are sold to head offices for tens of thousands a year — and when the corporate relationship changes, the site loses the software. Amberhold is a straightforward monthly subscription per site: no long contract, cancel any time, continued development included.
Talk to us about your siteOne subscription covers it all
- ✓Runs in the browser on any phone, tablet or desktop — nothing to install
- ✓Your data isolated by server-enforced tenant scoping, on UK cloud
- ✓Individual sign-ins, access by role
- ✓Every user, every round, every revision included
Set up in days, not months: describe your plant in plain language, build the first round together, walk it on the next shift.
How buying works.
No procurement maze — four steps, and most of them are ours to do.
Enquire
Two minutes on the form. A person replies within one working day.
See your own rounds in it
A 20-minute walkthrough — bring a real round sheet and we walk it live.
Pilot on your site
Your rounds, your operators, real shifts — set up in days, not months.
Go live
One monthly subscription per site. Your team gets their logins; the record starts.
Built with running plants, not on spec.
Amberhold grows by what real sites prove they need — not by feature checklists. Going onto the plant now: QR/NFC identity tags at the point — a tag identifies, never authenticates. On the road: routines for non-round work (duty swaps, fire-pump tests), notifications that find you when a reading needs eyes, specialist registers, a proper shift log, and controlled documents.
Operators keep plants safe, shift after shift.
Their work deserves evidence that lasts longer than the shift.
That's why Amberhold exists.