Operational assurance for industrial sites
Turn operator rounds into evidence you can defend.
Amberhold guides your operators through rounds, routine checks and temporary controls on any phone or tablet — and records every reading, skip and correction as attributable, append-only evidence.
- Proven on real rounds at a live process plant
- Nothing to install — runs in the browser
- Per-site pricing, no long contract
Live demo — try it
Boiler Status — Nights
Boiler House · point 8 of 30
F3851A · A Boiler
Boiler — status
Steam drum pressure
Burner flame check
[Auto-skipped · F3851A = In bank]
Tap a status and watch the dependent check skip honestly.
Today, the evidence is a spreadsheet.
Routine operator monitoring is how a site meets its duties — behind it sit COMAH, Seveso III and OSHA PSM, and it's written into your own safety management system. Yet on most plants the record of it is paper and spreadsheets.
Readings re-keyed into a grid
Dense tables built for a desk, walked with a clipboard. The operator serves the spreadsheet, not the plant.
History is buried
Last shift's reading lives in another file. Drift that would be obvious on a trend goes unnoticed for weeks.
Edits are silent
A cell can be changed after the fact with no trace of who, when or why — exactly what an investigator asks first.
Temporary checks are improvised
An isolation's monitoring lives on a whiteboard and in someone's memory — until a shift change forgets it.
When a regulator, insurer or auditor asks for evidence the rounds happened, a spreadsheet is a weak answer.
Built from what plants actually ask for.
Amberhold's first site had already lived with an enterprise incumbent. These asks shaped every screen.
Operators
“Don't make me fight the tool at 2 a.m.”
- —One point at a time, in walking order — no grid to wrestle on a phone
- —The expected band, last reading and trend right on the point
- —Equipment offline? One tap, reason recorded, move on
Shift managers
“Show me what's wrong before the handover does.”
- —Out-of-range readings surface worst-first, live
- —Round progress and overdue work at a glance
- —Temporary controls that cannot silently expire
HSEQ & audit
“Give me a record I can defend two years later.”
- —Append-only: corrections add, they never replace
- —Every entry attributable — who, when, what
- —Evidence packs sealed with a reproducible fingerprint
How Amberhold thinks
One chain, from duty to proof.
Every feature serves the same chain: a local requirement becomes owned, scheduled work — and the work becomes evidence that stands up on its own.
- 01
Structure
Model your site the way your operators speak — areas, equipment, components.
- 02
Control
Record what must stay true, and the checks that verify it.
- 03
Plan
Schedules and conditions decide what's due — per shift, weekly, or while a temporary control is active.
- 04
Perform
A guided walk on any phone. One point at a time, with context.
- 05
Resolve
Abnormal findings stay open until someone authorised closes them.
- 06
Prove
Append-only records, attributable entries, printable evidence packs.
Working today
Built around the operator, not the spreadsheet.
Software operators tolerate gets left in the mess room. Software built for the walk gets used — and used software is what makes evidence complete.
Guided walkrounds
One point at a time on a phone — with the expected band, the previous reading and the recent trend right where the operator needs them.
Honest skips
Equipment in bank or offline? Dependent points skip automatically with the reason recorded — never silently blank.
A live readings board
Out-of-range readings surface worst-first, with round progress at a glance — so the shift sees problems before the handover does.
Corrections that never overwrite
Mistyped a reading? The correction is appended and the original stays. The record shows exactly what happened, in order.
Build rounds yourself
Describe your plant in plain words and Amberhold proposes the structure. Build a section once, copy it across sister equipment, publish a revision — no vendor visit, ever.
Roles and governed change
Operators, technicians, managers, site admins. Changing a definition is a governed act: permission-checked and written to an immutable audit log.
Site board · Boiler House
NIGHTS · 03:473/4
rounds this shift
0
points recorded
2
out of range
Needs attention — worst first
38FR105 · Cooling water flow
12.6 m³/h · expected 8 – 11
F3851C · Stack temperature
218 °C · expected ≤ 205
Cooling Towers — Nights
due 03:00 · not started
🔒 Active isolation · Feed pump B
pressure check due this shift
Live demo — switch the tabs.
The site board
Walk out of handover knowing, not hoping.
While the rounds are walked, the board fills. Out-of-range readings surface worst-first, overdue work shows itself, and active temporary controls sit right beside the rounds — one screen, live, for the whole site.
No opening historical entries one by one: the previous reading and the trend live inline, on the board and on every point. The oncoming shift opens the same board and sees the same truth.
On the road: notifications that find you when a reading needs eyes — so the board comes to you, not just you to the board.
Temporary controls
When the plant isn't normal, Amberhold keeps watch.
Declare a temporary control — an active isolation, equipment out of service, a bypass — and Amberhold binds the monitoring to it. The checks fall due every shift, appear on the board alongside the rounds, and cannot silently expire.
Clearance is an authorised act, not a lapsed timer. Checks that were never needed close honestly as “Not required — control ended before due”. The whole life of the control — declaration, every check, every concern, clearance — is one audit timeline you can print.
Used alongside your approved isolation process, never instead of it.
Site board · Boiler House
1 ACTIVE CONTROL🔒 Active isolation
Feed pump B — gland leak, isolated for repair
declared Tue 02:14 · Shift Manager
Concerns stay open until someone authorised records a disposition.
Evidence pack
TEMPORARY CONTROL · TC-0007
Active isolation — feed pump B gland leak
- Tue 02:14DECLARED
Active isolation — reason recorded · Shift Manager - Tue 06:02CHECK COMPLETE
Isolation pressure 0.0 bar — within guidance - Tue 18:11FLAGGED ABNORMAL
Reading outside guidance — concern opened - Wed 08:47CONCERN DISPOSITIONED
Reviewed; action recorded · Site Manager - Wed 14:36CLEARED
Authorised clearance — open checks closed: “Not required — control ended before due”
integrity fingerprint · sha256
9f3a41c8e2b07d55a6c1f0e8b24d9a73…
Prove
Evidence you'd hand straight to an auditor.
- —Every entry carries who and when. Nothing is ever deleted or edited in place; corrections append.
- —Skips and misses are recorded truthfully, with reasons — an honest record is worth more than a perfect-looking one.
- —Evidence packs assemble the full story of a round or a temporary control, sealed with a reproducible integrity fingerprint.
Straight talk.
Amberhold supports compliance and produces evidence. It never certifies your site, decides legal applicability, or takes on the dutyholder's responsibility — and routine operator checks are never presented as statutory examinations.
For HSEQ managers
Every regime asks the same question: show me.
Amberhold is regulation-informed, site-controlled, evidence-led. Recognised duties and standards shape what the platform can express; your site decides applicability, limits, frequency and authorised roles; the platform proves what was defined, due, performed, missed, abnormal, escalated and resolved.
United Kingdom
- COMAH 2015Your safety report promises systematic monitoring. Rounds evidence shows the safety management system runs in practice, not just on paper.
- PUWER 1998Equipment checks and maintenance monitoring, recorded with who, when and what was found.
- PSSR 2000Routine operator monitoring within safe operating limits — alongside your written scheme, never in place of it.
- DSEAR 2002No special hardware: runs in the browser on whatever devices your site's zoning permits.
- HSG65Plan–Do–Check–Act: operator rounds are your Check step. Amberhold makes it inspectable.
European Union
- Seveso III (2012/18/EU)Annex III expects the SMS to cover operational control, performance monitoring, and audit and review — exactly the record rounds produce.
- Work Equipment Directive 2009/104/ECRecorded checks on work equipment in use.
- ATEX 1999/92/ECWorks within your explosive-atmospheres zoning approach — the site chooses the devices.
- Framework Directive 89/391/EECGeneral prevention duties, evidenced by the monitoring your own assessment prescribes.
Member-state implementations differ — which is why applicability is always your site's decision, never the platform's.
United States
- OSHA PSM — 29 CFR 1910.119Operating procedures including temporary operations; inspections and tests documented with who, when, the equipment and the result. That is Amberhold's native record shape.
- EPA RMP — 40 CFR 68The same programme elements, evidenced for covered processes.
- CCPS · API RP 754The conduct-of-operations and operational-discipline record those programmes expect — and the data behind the indicators.
Everywhere: ISO 45001 · ISO 14001 · ISO 9001
Certification auditors sample your documented information and ask for evidence of operational control and performance evaluation. ISO management systems expect records protected against loss of integrity — Amberhold's records are append-only and attributable by construction, not by policy. Insurers and engineering surveyors ask the same questions; a defensible record shortens the conversation.
The audit, rehearsed.
Five questions every inspector, surveyor and certification auditor asks — and the answer the record itself gives.
“Show me these rounds actually happened.”
Every point carries who, when and what — for every occurrence, including the missed ones. An honest gap beats a suspicious blank.
“What happened when this reading went out of range?”
The abnormal entry, the concern it opened and the authorised disposition are one linked trail — nothing closes by itself.
“Who changed this round, and was it approved?”
Definitions are versioned. Publishing is a governed act: permission-checked and written to an immutable audit log.
“What was watching the plant while this pump was isolated?”
The temporary control's whole life — declaration, every check, every concern, clearance — is one printable timeline.
“How do I know this record wasn't tidied up afterwards?”
Append-only by construction: corrections add entries, they never replace them. Evidence packs carry a reproducible integrity fingerprint.
The line we hold: Amberhold informs itself from these regimes; it never decides legal applicability. Your competent persons, statutory examinations and dutyholder responsibilities stay exactly where the law puts them.
Pricing
Priced for a site, not an enterprise.
Enterprise rounds systems are sold to head offices for tens of thousands a year — and when the corporate relationship changes, the site loses the software. Amberhold is a straightforward monthly subscription per site: no long contract, cancel any time, continued development included.
Talk to us about your siteOne subscription covers it all
- ✓Runs in the browser on any phone, tablet or desktop — nothing to install
- ✓Your own dedicated cloud instance and database
- ✓Individual sign-ins, access by role
- ✓Every user, every round, every revision included
Set up in days, not months: describe your plant in plain language, build the first round together, walk it on the next shift.
Built with running plants, not on spec.
Amberhold grows by what real sites prove they need — not by feature checklists. On the road: routines for non-round work (duty swaps, fire-pump tests), QR/NFC identity tags at the point, notifications that find you when a reading needs eyes, equipment registers, a proper shift log, and controlled documents.