RegTech / HRTech / Occupational health and safety
Law 27 psychosocial-risk platform
SaaS platform for psychosocial-risk assessment under Québec’s Law 27
Québec’s Law 27 extends employers’ prevention obligations to psychosocial risks, and a firm that runs this assessment for several client organizations needs more than a spreadsheet and a survey link. This platform runs the whole cycle — organizations, mandates, employee survey, scoring and bilingual reports with rules-based recommendations — for the firm and every organization it serves.
- 6 · 146 risk-factor modules and questions in the bilingual survey
- 337 pre-written recommendations matched by a rules engine
- 4 roles, isolated per organization by row-level security
- Status
- In production
- Model
- B2B2E
- Market
- Québec, Canada
The problem
Since Law 27 modernized Québec’s occupational health and safety regime, employers must identify and prevent psychosocial risks the same way they handle physical ones. A firm that runs this assessment for its client organizations has to survey hundreds of employees per mandate, keep each organization’s data strictly separate, compute comparable scores and turn them into a report the client can act on.
The solution
A B2B2E platform operated by the firm for its client organizations: the firm creates the organization, its departments and the assessment mandate, imports the employees and assigns the survey; employees answer six modules at their own pace over several sessions; the platform computes scores by module, department and organization, matches the results against a library of pre-written recommendations and produces a bilingual report printable as PDF. Next on the roadmap: per-organization tracking of corrective actions and a consolidated executive dashboard.
What the platform does
- Organizations, mandates and users Client organizations, departments and assessment mandates with dates, owners and progress; user accounts with four roles; CSV import with validation and preview for organizations, mandates, departments and users.
- Bilingual survey referential Six modules covering the psychosocial risk factors (work climate and conditions, workload, autonomy, recognition, social support, psychological harassment), 146 questions and 337 recommendations, maintained in French and English from an administration editor.
- Survey assignment and completion Assignment by organization or department with duplicate protection and email invitations; module-by-module completion with progressive saving, resumption across sessions and a marker for unanswered questions; scheduled reminders sent hourly by a database job.
- Scoring and rules-based recommendations Scores per module on five risk levels; share of negative answers per question; recommendations selected by a 40 % threshold completed to a top 25, with a performance index — deterministic and traceable.
- Reports Report views by module, organization, department and trend, with filters; a complete organization report in French or English — summary, participation, module scores, recommendations, a four-step management and prevention framework — previewed in the browser and printed to PDF.
- Security operations Server-side brute-force protection with progressive lockout, password policy, one-time-code password reset, forced password change on first login, security alerts with a digest to administrators, a weekly audit email, and a validation page that runs 76 integration tests from the interface.
Architecture
Single-page web application (React, TypeScript) on a managed PostgreSQL backend: 27 tables, every one of them under row-level security, with 124 access policies, 35 SQL functions and 30 triggers enforcing isolation by organization and role; 25 serverless functions for authentication hooks, transactional email, reports served by temporary link and scheduled jobs; three database-scheduled tasks for reminders, the weekly audit and the security digest. Bilingual by design, with French and English content stored side by side.
Who uses it
The firm’s consultants (global administrators and mandate managers), the administrators of each client organization, and their employees, who answer the survey and manage their own profile.
Markets
Québec, where Law 27 makes psychosocial-risk prevention an employer obligation; the assessment model applies to any organization that wants to measure its work climate and psychosocial risk factors.
Where AI fits — and where it does not
No AI in the product — by design. Recommendations come from a deterministic rules engine: the share of negative answers is computed per question, questions at or above a 40 % threshold (completed to the top 25) are matched to a library of 337 pre-written recommendations and ranked by score and priority. Every recommendation traces back to the questions that triggered it, the logic is fully auditable, and no employee answer is sent to any AI provider. The platform supports the prevention process; it does not certify compliance with Law 27, and the interpretation of results remains with the firm’s professionals.
My role
Founder and architect: product vision, functional specifications, platform architecture and technical direction; my team at SOFT M POWER CANADA built it and operates it under my direction for a Canadian professional-services firm that runs it for its client organizations.