Turning an HR consultancy’s expertise into a compliance platform
A New Zealand HR and health & safety consultancy
What was the problem?
The consultancy delivered employment-relations and health & safety compliance as hands-on advisory work. Every client was served manually, so capacity was capped by consultant hours and the same policy work was rebuilt from scratch for each employer. They wanted their expertise to run as a product without losing the accuracy that made it worth paying for.
What did we build?
- A multi-tenant web application where each employer organisation is isolated at the database level using PostgreSQL row-level security, not application-layer filtering.
- A two-jurisdiction compliance engine covering both New Zealand and Australian employment law, with Australian state-level variation handled per employee rather than per company.
- A statutory figures register in which every legal value carries its source and the date it was last reviewed, so no number in the product is unattributed.
- Automatic obligation alerts driven from that register, including an annual re-indexation countdown for both jurisdictions.
- Mandatory two-factor authentication for administrator accounts, enforced at the point of sign-in rather than left to an organisation setting.
- A Xero integration for payroll and accounting data.
- Continuous deployment: an automated test suite, including a full browser suite, gates every release to production.
What was the hardest part?
Adding a second country. Jurisdiction turned out not to be a property of the company — a New Zealand business can employ Australians. Making it a property of each employment instead of each organisation meant every rule in the system had to resolve whose law applied before it could answer anything. Six separate defects all had exactly that shape, so we wrote a test that fails the build whenever new code applies New Zealand law without first resolving jurisdiction. The class of bug cannot come back.