Legionella compliance software for UK water-hygiene contractors
We were engaged to replace the calendar, forms app, shared drive and spreadsheet that carry a contractor's evidence.
Visit BlueWave (opens in a new tab)
The market and the problem
UK legionella contractors run on evidence: temperatures taken, samples sent, remedials closed, and five years of records ready for whoever asks. We designed and built the whole platform: office web app, offline engineer app, ops console and the infrastructure underneath. Senior engineers and design took it to first release in about 14 weeks of core build.
Legionella control is one of the most tightly evidenced trades in the UK. ACoP L8 and HSG274 set out what must be monitored and when, monitoring records must be kept for at least five years, and the Legionella Control Association audits its roughly 380 registered firms annually, with the assessor picking jobs at random and expecting the full evidence chain. When it goes wrong it ends up in court: one care operator was fined £3 million after a resident died, and a hospital trust was prosecuted after 114 positive legionella tests and 651 out-of-range temperature readings sat in its records without being acted on.
The strange part is the tooling. Most contractors are small firms running this obligation across a calendar, a forms app, a shared drive, Word and Sage, and every hop between those systems is a re-key someone can get wrong. The work gets done. Proving it was done, quickly, while an auditor watches, is the hard bit.
Scheduling has its own breaking point. A contractor with forty-odd sites on mixed monthly, weekly and quarterly frequencies is juggling thousands of dated visits a year, and a whiteboard stops coping long before that.
The brief: one system from booking the visit to producing the record, priced so a six-van contractor can afford it, and honest about what software can and cannot certify.
- The standards in the headline
The page leads with ACoP L8 and HSG274.
- A table of the standards
Each standard sits beside what it governs.
- Where the product helps
The last column says where BlueWave carries the load.
What we built
The platform we delivered covers the whole loop. Office staff plan recurring and reactive work on a drag-and-drop scheduler. Engineers capture evidence on site, with or without signal. The paperwork files itself into a five-year archive that can be searched the way an auditor asks questions.
PPM scheduling for legionella contractors
Recurring visits with real-world rules, including 'third Tuesday' and 'last Friday' patterns. A run-sheet board for who does what today, and a timeline view for the week ahead. Moving one occurrence of a series never scrambles the rest.
An engineer app that works in basements
Plant rooms rarely have signal, so the field app assumes none. Jobs, forms and photos are stored on the device and sync when the engineer surfaces. Logging out never deletes unsynced evidence, because tablets get handed around.
A form engine with versioned templates
Field types from signatures and photos to repeating asset groups. Templates are versioned, so a record always validates against the form it was filled in with, and out-of-range temperature readings are flagged the moment a form is submitted.
The compliance library
Every submitted job sheet, filterable by customer, site, asset and date, with per-visit PDF export. Records are never hard deleted. Removing a document leaves an audit note saying who removed what, and when.
Legionella lab results
UKAS lab reports attach to the visit they belong to, and the morning briefing shows how long results have been waiting. A positive Legionella sample should never sit unread in an inbox over a bank holiday.
Quoting and billing
Quotes move through draft, sent, awaiting PO and invoiced, with itemised lines and PDF export. Platform subscriptions run on Stripe with Bacs Direct Debit, at per-seat prices a small contractor can afford.
Invoices machines can read
Every invoice the platform issues is a Factur-X e-invoice: an ordinary PDF carrying its own figures as structured XML inside, in the EN 16931 profile the European mandates recognise. Each document is validated against the official European rule set before it ships, and a failed check falls back to a plain PDF rather than a blocked download.
The engineering
Compliance software has one non-negotiable: the record must be defensible years later. Most of the interesting engineering here serves that single idea.
BlueWave in outline. The office web app and the engineer app, which works without signal, use the backend. PostgreSQL holds the true record and feeds Elasticsearch, which answers the searches. It runs on Kubernetes in Google Cloud's London region, as the line under the drawing shows. Highlighted: the true record, which has to stay defensible years later.
An audit trail on every record
Years after a visit, an auditor can still find out who changed a record, and when. Each record keeps an append-only log of its changes, so nothing is written over, and deleting a file keeps the file itself and notes who removed it. Job records also copy the customer and asset names as they stood at the time, so renaming a customer today cannot rewrite a two-year-old record.
Does the engineer app work without signal?
Yes, and it assumes it has none, because plant rooms rarely do. Every action goes into a queue on the tablet first, stamped with the time the work was done rather than the time it synced, since that is the time compliance cares about. Each action carries a unique ID, so a flaky connection cannot submit the same reading twice. iPhones and iPads do not let web apps sync in the background, so the app syncs whenever it is open instead of relying on wishful thinking.
Recurring visits
Office staff can move one visit in a series without the others shifting or the moved visit showing twice. Each visit keeps the date it was first due, which never changes, beside the date it is booked for, which can; the iCalendar standard uses the same trick. That one decision kills the duplicate-visit bug that plagues recurring schedulers, and lets a cancelled slot be rebooked without inventing a new record.
Search across five years of records
Office staff can find any customer, site, asset, job or quote from one search box. PostgreSQL 17 holds the true record and feeds Elasticsearch, which answers the searches. Adding a field to a record needs no database migration, so small changes stay small.
The card "Does the engineer app work without signal?", drawn. Every action goes into a queue on the tablet first, stamped with the time the work was done rather than the time it synced. Each carries a unique ID, so a flaky connection cannot submit the same reading twice, and the app syncs whenever it is open. Highlighted: the time stamp, the time compliance cares about.
UK hosting and testing
The data stays in the UK: BlueWave runs on Kubernetes in Google Cloud's London region. Background work moves through a message queue, a separate service renders the PDFs, FusionAuth handles sign-in, and automated tests run in every build.
E-invoicing behind a validation gate
Customers' accounts systems can read BlueWave's invoices without anyone retyping them, and a failed check never stops an invoice going out. A small separate service builds the structured invoice data to the European standard, EN 16931, and refuses anything that breaks the official rules; the PDF service then embeds that data in the invoice. Real output passes veraPDF, Germany's KoSIT validator and the European Commission's own checker with zero errors. If any step fails, the invoice still downloads as a plain PDF and the failure is logged.
Where AI fits
Water hygiene is a documents trade, which makes it unusually good ground for AI. We designed the platform so models can land without re-architecture: every record is typed, versioned and audit-trailed, so anything a model produces can be checked against the schema and traced afterwards. This is the AI roadmap for the continuing work, in the order the economics support.
BlueWave's AI roadmap in one picture: anything a model produces can be checked against the schema and traced afterwards. Highlighted: the model step.
- 1. Checked against the schema: for the form library, a wrong guess is rejected, never silently stored.
- 2. Traced afterwards: every record is typed, versioned and audit-trailed.
Read the legacy form library
Every new contractor arrives with a folder of PDF and Word forms built up over years. A vision model that maps those into BlueWave's typed form schema turns weeks of onboarding into a review pass, which is the commercial case in a market where setup fees are the norm. The strict schema means a wrong guess gets rejected, never silently stored.
Parse lab reports on arrival
Every sample already carries a globally unique reference. Document extraction over the incoming UKAS PDF, matched on that reference, lands results as structured readings and flags positives the hour they arrive instead of whenever someone opens the inbox.
Check evidence at the point of capture
Engineers photograph probe displays next to the number field they type into. OCR on that photo can verify the reading against the field's expected range on device, catching transposed digits while the engineer is still standing at the tank.
Answer the auditor's question directly
The archive is built for retrieval, and the next step is asking it questions in plain English. 'Show me every out-of-range hot-water reading at this site since 2024' should return cited records, and because every record carries provenance, the answer can be checked record by record.
Phases, team and price
Delivery record
- Status
- Live, in use with six contractor organisations
- Discovery and architecture
- 2 weeks
- Core build
- About 14 weeks to first release
- Team
- Senior engineers and design
- Hosting
- Google Cloud, London region
- Since release
- Ongoing product work, on a retainer
Case study published , updated .
Compliance platforms earn trust release by release, so the BlueWave engagement runs as a phased programme. The band below is for a platform of this shape, and we publish bands for smaller builds too, down to a single-workflow MVP.
Five phases, in the order listed below. Highlighted: phase 2, core platform, where the first release into real use came.
- Phase 3: runs in parallel, as its label says.
Indicative price
£150k to £250k to first release
Field-service compliance platforms of this shape, a web app, an offline mobile app, scheduling and billing, typically reach first production release for £150,000 to £250,000. Grown over 18 to 24 months the cumulative programme usually lands between £400,000 and £520,000. Figures exclude third-party costs, at London rates as of mid-2026. That is the band for the shape, not an invoice.
The bands in this study's price note, on one linear scale from zero and numbered in the key. Each is a band for the shape, not an invoice. Highlighted: band 1, the one this page leads with.
- 1. To first production release: £150,000 to £250,000
- 2. Grown over 18 to 24 months, the cumulative programme: £400,000 to £520,000
How we build
What every build goes through
These commitments hold on every build we run:
- Nothing is built until the specification is written down and you have agreed it.
- A senior engineer reviews every change before it is merged.
- Automated tests run on every change, and a failing build does not ship.
The delivery record shows this project's own details. How we work sets out the rest of the method.
What the engagement achieved
The platform is live on Google Cloud's London region for the client, in use with six contractor organisations. An LCA-registered contractor acts as design partner, so the feedback comes from real plant rooms.
A compliance platform is judged on whether its record holds up under someone else's scrutiny. Everything in this build, from append-only audit trails to versioned form templates, was shaped by that test.
- Three apps from one shared design system: office, offline engineer app and ops console
- Invoices that customers' accounts systems can read without retyping
- Automated tests in every build, and each architecture decision written down with its reasons
- Offline evidence capture that survives basements, dead zones and shared iPads
- UK data residency, five-year record retention, append-only audit history
Three apps from one shared design system: the office app, the offline engineer app and the ops console. Highlighted: the shared design system.
The decision we would defend
Each visit keeps the date it was first due
Beside it sits the date the visit is booked for, which can change. That one decision lets office staff move a single visit without the rest of the series shifting or the visit showing twice, and a cancelled slot can be rebooked without inventing a new record. It is the same trick the iCalendar standard uses.
Planning something like this?
Indicative price
£150k to £250k to first release
A band for the shape, not an invoice.
The first step
Specification sprint
£4,500 or £8,500One to two weeks
The written specification, architecture, estimate and risks: one week for a single workflow, two for a platform. You can take it to any supplier, us included.
Asked about this project
What is BlueWave?
BlueWave is a field-service and compliance platform for UK water-hygiene and legionella-control contractors. It covers scheduling, offline evidence capture on site, five-year compliance records, lab results and quoting in one multi-tenant system, replacing the usual mix of calendar, forms app, shared drive and spreadsheets. We were engaged to design and build it.
What did Quantum Craft build for BlueWave?
The whole platform: a .NET 8 backend with PostgreSQL and Elasticsearch, a Next.js office application, an offline-first engineer app, an operations console, Stripe subscription billing and the Google Cloud infrastructure it runs on in London. Design, architecture and delivery came from one team.
How long does a platform like BlueWave take to build?
BlueWave reached its first production release after about 14 weeks of core build, with senior engineers and design. A focused MVP with a single workflow usually takes 6 to 12 weeks. Field-service compliance platforms of this shape typically cost £150,000 to £250,000 to first release and grow in phases from there.
1 more question
Why does water hygiene need its own software?
Because the paperwork is the product. ACoP L8 and HSG274 expect scheduled monitoring, closed-out remedials and five years of records, and LCA members are audited annually. Generic field-service tools handle the visit but not the evidence chain, and the evidence chain is what an auditor checks.
Tell us what you're building or deciding.
Tell us about a product you want built, or a decision about AI you need to make, and we'll set up a 30-minute call. You'll get a straight answer on what it would take.
What happens after you get in touch
We reply within one working day
By email, to arrange a time for the call.
A free 30-minute call
With a senior engineer, about what you are building or deciding.
The fee in writing first
If a first step is worth taking, you get its exact fee in writing before any work starts.