The evidence register
Proof.
This page lists only what has been built and proven. Every entry traces to a test result, a measured number, or a logged decision, and each one states how we know it. If we cannot evidence a claim, it does not appear here.
Security & isolation
Your data is walled off inside the database engine.
How we know: Row-level isolation is enforced on every table by the database itself, not by the application, and verified live under the application’s own credentials.
Shipped Apr 2026No screen can bypass the rules.
How we know: Every write goes through controlled database functions that validate the business rules; there is no path around them.
Shipped Apr 2026The system checks its own security every morning.
How we know: Automated daily checks verify the security invariants and alert on any drift, including deliberate tripwires that fire on unexpected structural change.
Shipped Jul 2026Backups that survive a lost server, a lost region, or a leaked credential.
How we know: Data and the application layer are backed up cross-region with delete protection, and restores are tested, not assumed.
Shipped Jul 2026Accountability
Audit evidence writes itself.
How we know: Every status change is timestamped and attributed to a named person; rejections and cancellations require a written reason; the trail is append-only.
Shipped May–Aug 2026Everyone sees exactly their responsibility.
How we know: Officers see their work; leaders see their team through the real reporting chain; managers see everything, enforced in the database and tested for peer and cross-branch leakage.
Shipped Aug 2026Day to day
The system does the chasing.
How we know: One clean digest per person, twice a week on the Sun–Thu cadence; items overdue beyond seven days escalate to the line manager automatically.
Shipped Aug 2026Dashboards that scope themselves.
How we know: Each person’s dashboard reads through the same visibility rules, so KPIs, drill-downs and filters show their world with zero report-building effort.
Shipped Aug 2026“Send me all open actions for project X” takes three clicks.
How we know: Any action is findable by its ERP project code, with one-click export.
Shipped Aug 2026Go live with your history, not an empty system.
How we know: Legacy actions import with their identities and audit context intact, so KPIs mean something from week one.
Shipped Aug 2026Architecture
The platform outlives any interface technology.
How we know: The business rules live in the database, not the screens, and the entire user interface has already been replaced once, with zero data or logic loss.
Proven 2026On the roadmap, held to the same rule
These are commitments, not claims. Each moves up this page only when it has shipped and passed its tests.
Questions we get asked.
Answered the same way as everything above: plainly, including where the answer is “not yet”.
What is BSLR?
BSLR is HSE governance software for the MENA market. It holds corrective actions, incidents, audits, permits, risk assessments and competency records in one governed core, where every record carries a named owner, a due date, an approval path and an append-only audit trail. It is in production across a multi-country engineering and technology group covering six countries.
Who is BSLR built for?
Contracting groups, industrial operators and multi-factory manufacturers running HSE across multiple sites, subsidiaries and countries. The three roles it is designed around are group HSE leadership, operations and plant leadership, and risk or GRC owners.
Which modules are available today, and which are not?
Live today: action tracking and follow-up, incident management and investigation, audits and inspections, permit to work, training and competency, field capture from a mobile browser, and role-scoped dashboards. Every other module on the site carries a Roadmap badge, which means it is specified but not yet built. The site labels this on each module page rather than leaving it ambiguous.
Does BSLR support Arabic?
Not yet. An Arabic-first interface, designed right-to-left rather than translated, is on the roadmap and is listed as a commitment rather than a claim.
How is one customer's data kept separate from another's?
Tenant isolation is enforced inside the database engine with row-level security on every tenant-scoped table, applied even to table owners, rather than being enforced by the application. Every write passes through controlled database functions, so no screen can bypass a business rule.
Is BSLR ISO 27001 certified?
No. BSLR is built against the ISO 27001 control areas covering access control, cryptography, operations security and communications security, but it is not certified and does not imply otherwise. ISO 45001, ISO 14001, ISO 9001 and ISO 31000 are reflected in the workflows themselves.
Can we import our existing action history?
Yes. Legacy actions import with their original identities and audit context intact, so KPIs are meaningful from the first week rather than starting from an empty system.
Does BSLR have a public API?
Not at this time. There is no public API and no OpenAPI document. Integration questions are best raised directly through the contact form.
Ask us to show any line on this page.
Every entry above can be demonstrated live in a walkthrough. Pick the ones you doubt most.