Case study · RegTech · Law 27 · Psychosocial risks

A digital prevention platform for psychosocial risks under Law 27

RegTech · Occupational health and safety · Québec (Law 27)

A B2B2E platform that runs psychosocial-risk assessments end to end — organizations, mandates, a bilingual six-module employee survey, scoring, rules-based recommendations and printable reports — built for a professional-services firm and operated for its client organizations.

27 · 124 tables, all under row-level security, and access policies
19 documented releases, from v1.0 to v1.19
76 integration tests runnable from the administration interface

Status In production

Context

Québec’s Law 27 modernized the occupational health and safety regime and made psychosocial risks — workload, autonomy, recognition, social support, harassment — part of the employer’s prevention duty. A Canadian professional-services firm delivers this assessment to its client organizations as a consulting mandate: survey the employees, score the risk factors, hand back a report with recommendations. Doing that with spreadsheets and generic survey tools does not scale past a handful of mandates, and it leaves one organization’s data next to another’s. The firm needed a platform of its own, one it could operate for every client organization, in French and English, with the assessment content under its control. I designed and built it with my team at SOFT M POWER CANADA, and it is in production.

Challenge

Three populations share the same platform: the firm, its client organizations and their employees. Every read has to be scoped by organization and role, and the survey has to let employees answer 146 questions across six modules over several sittings without losing anything. The assessment content — modules, questions, recommendations — had to remain editable by the firm and bilingual in the database, not hard-coded. Results had to be comparable from one mandate to the next, which means deterministic scoring and recommendation logic that a consultant can explain to a client. The reports had to be printed and shared as documents, in either language, without turning the platform into a document-management system. And all of it had to be built by a small team on a compressed schedule, then withstand an external security review.

My role

Founder and architect. I defined the product from the firm’s assessment practice: personas, the four-role model, the business rules for scoring and recommendations, and the functional specifications feature by feature, with ready and done criteria. I designed the data model and the isolation strategy — row-level security as the real barrier, the interface as a guide — and set the technical direction: managed PostgreSQL backend, serverless functions, HTML reports printed by the browser. My team at SOFT M POWER CANADA built, tested and shipped the platform with an AI-assisted development workflow driven from those specifications, and we operate it for the firm: releases, security fixes, the reminder and audit jobs, and the migration of the backend to a Canadian-region project in 2026.

Architecture / approach

One operator, many organizations, one database: an organization key on every business table, and row-level security policies that scope each role — global administrator, mandate manager, organization administrator, respondent — to what it may read or write, enforced by SQL functions rather than by the front end. The survey referential is data, not code: modules, questions and recommendations are bilingual rows that the firm edits from an administration page, and an integrity test guards the mapping between them. Scoring and recommendations are a rules engine: share of negative answers per question, five risk levels per module, a 40 % threshold completed to a top 25, ranked by score and priority. Reports are generated as HTML from those results and printed to PDF by the browser, in French or English.

Technology

React 18 with TypeScript and Vite, Tailwind and shadcn/ui, React Router, TanStack Query, react-hook-form with zod validation, recharts for the report views and papaparse for CSV import. A managed PostgreSQL backend with authentication: 27 tables under row-level security, 124 policies, 35 SQL functions and 30 triggers, delivered through 301 migrations; 25 serverless functions in Deno for the authentication hook, one-time-code password reset, server-side login validation, bilingual transactional email, reports served by temporary key and scheduled jobs; three database-scheduled tasks for hourly reminders, the weekly audit report and the security-alert digest. A home-grown FR/EN mechanism with content stored side by side, a built-in user guide per role, and a validation page that runs 76 integration tests against the live backend.

Execution

The platform started in May 2025 as a generic HR-forms manager and was refocused within weeks on psychosocial-risk assessment; nineteen documented releases followed, from v1.0 in June 2025 to v1.19 in March 2026, with specifications, a regression test plan and a user guide maintained alongside the code. The recommendation logic went through three iterations — threshold only, top 25 only, then the hybrid with a performance index — each recorded in the release notes. Server-side PDF generation was tried twice and abandoned in favour of printable HTML reports. An external penetration test in late 2025 led to a round of server-side hardening, confirmed by a retest in early 2026. In September 2026 the whole backend — schema, data, accounts, jobs and functions — was migrated to a Canadian-region project with a read-only pre-cutover audit.

Constraints

Sensitive data by nature: survey answers about workload, recognition and harassment, held for organizations that are the firm’s clients, so isolation by organization and by role had to be enforced in the database. A single operator with several client organizations rather than a self-service multi-tenant SaaS, which shaped the role model and the onboarding flow — CSV import rather than sign-up. Two languages in every screen, every email and every report. No document store: reports live as generated HTML, not as files. A small team and an AI-assisted workflow, which made written specifications and integrity tests the main line of defence against drift. And a legal framework the platform supports without certifying: the assessment informs the firm’s professionals; it does not replace their judgement or guarantee compliance with Law 27.

Business impact

The firm runs its psychosocial-risk mandates on a platform it controls: it creates the organization, imports the employees, assigns the survey, follows completion from the dashboard and hands the client a bilingual report with scores by module and department and a ranked list of recommendations drawn from 337 pre-written measures. The assessment content is maintained by the firm without a developer, and every recommendation can be traced back to the questions that triggered it. Delivered: the full B2B2E workflow, the bilingual referential of six modules, 146 questions and 337 recommendations, the rules engine, the reporting views and the printable report, security operations — brute-force protection, alerts, weekly audit — 76 runnable integration tests, and a production backend relocated to a Canadian region. Next on the roadmap: tracking of corrective actions per organization and a consolidated executive dashboard.

Key takeaways

Isolation belongs in the database: row-level security is the barrier, the interface is only the guide.
When assessment content is data, the domain experts own it — and an integrity test keeps the mapping honest.
A deterministic rules engine is the right tool when every recommendation must be explainable to a client; AI would have added opacity, not value.
The simplest report pipeline that ships — HTML printed by the browser — beat two server-side PDF attempts.
With AI-assisted development, written specifications and release notes are what keep a fast-moving codebase coherent.