← All documentation · Running the company
Supplies, keys and compliance
Web and mobile3 min readUpdated
Each site can carry supply items with a par level, and crews flag shortages from their phone in one tap; billable restocks are priced at delivery and land on the month’s invoice. Alarm codes and keys live in a per-site vault, encrypted at rest, where revealing a secret is a separate audited request. Compliance documents — COI, W-9, badging — warn the office thirty days and seven days before they expire.
Three small things a commercial contract runs on, and each of them is the sort of thing that gets answered in a group chat until the day it costs you an account.
Supplies and consumables
Restocking a building's paper, liners and soap is part of the job, and in most contracts it is either billed back or explicitly included. The person who notices is a cleaner on site at 2am; the person who orders is in an office the next morning.
On the site's page, list what the building stocks and its par level — the level "low" is measured against. This is not an inventory: nobody is going to count every roll, and a system that demanded it would be abandoned in a fortnight.
From the phone, a crew member taps an item and it is flagged. Nothing but the item is required — a form that demanded a count at 2am would get a made-up one.
The office works the list from Supplies → Restocks: open, ordered, delivered. Marking one delivered is what puts it on the bill, if the item is billable:
- The price is taken at delivery, not when the request was raised. The client pays the price at the time the goods arrived, and re-pricing the item next month cannot restate a bill already sent.
- An item you absorb carries no price at all, which is what keeps it off the client's invoice entirely.
- Once a restock is on an invoice it is frozen.
Keys, codes and access
A commercial building has an alarm panel with a code that rotates, a fob that opens the loading dock and not the lifts, and a key held by one supervisor.
Each of those is a row on the site: what it opens, who holds it, and when the secret was last rotated. Two rules make it safe to keep them here at all:
- A secret is never in a list. The site's page shows labels, holders and rotation dates. Whether there is a code at all is the only thing it says about the secret.
- Reading a code is written down. Revealing one is its own action, and the audit trail records who read what, when — before the code is shown. That is the reason a facilities manager will accept that their alarm codes live in a cleaning company's software.
Secrets are encrypted at rest in the same envelope as your payment keys. Rotating a code stamps the rotation date; the previous code is not kept, because a rotated code is a live credential for as long as somebody has it written down. Retiring a credential keeps the record — so the audit trail still names something you can identify — and destroys the secret.
Compliance documents
Clients ask for a certificate of insurance before the first clean, a W-9 before they will pay, and in banks, hospitals and schools proof that the people coming in have been background checked and badged. All of it expires, and a lapsed COI is usually discovered by a crew standing at a locked door at 10pm.
Documents attach at three levels:
- Company-wide — your general liability certificate, your W-9.
- Per client — the COI naming them as an additional insured, which is what most facilities managers actually demand.
- Per site — badging paperwork for one building.
Set an expiry date and the office is warned twice: thirty days out, which is enough to renew through a broker, and seven days out, which is the one that gets acted on. Not on the days in between — a daily reminder trains people to ignore the mail. Renewing a document clears the warning, so the new expiry gets its own.
Documents that do not expire — a W-9 — simply never warn.