StaffDock

Outcome

A multi-tenant SaaS that turns right to work checks into one routine: people upload, the company checks and records, and StaffDock tracks every date and builds the evidence.

Overview

StaffDock keeps every person’s work documents in one place, records that each one was checked, and reminds everyone before anything expires. A company chooses the documents it needs (right to work is built in, with ready-made presets for care, security, cleaning, construction, recruitment and hospitality), adds its people or imports a spreadsheet, and each person uploads from their phone with an email code. The company’s team checks each document on GOV.UK or by holding the original and records the result. StaffDock then shows who is cleared to work team by team, chases renewals, and produces one evidence PDF per person or a full inspection pack. Agencies and subcontractors that supply workers get their own portal.

Problem

From 1 October 2026, UK right to work rules cover workers, contractors, agency and subcontractor workers, not only employees, and liability can travel up a supply chain. Fines are up to £45,000 per worker for a first breach and £60,000 for a repeat. Most small businesses still track documents in spreadsheets and email and find out too late that something has expired. They needed one simple place to collect documents, record checks properly, track every date and show the evidence quickly if the Home Office asks.

My contribution

• Turned the new UK right to work rules into a product spec and PRD: five kinds of user, the document workflow, statuses, suppliers, billing and data protection.
• Designed the multi-tenant data model and built the NestJS API, the Next.js app, the person and supplier portals and the Super Admin panel.
• Built the review screen and the right to work rules for online, manual and Employer Checking Service checks, with server-enforced required ticks and evidence.
• Built reminders, the compliance dashboard, Cleared to work lists, evidence PDFs and inspection packs as BullMQ background jobs.
• Built plans and billing with Stripe card payments and approved bank transfers, wrote the legal pages with the client and deployed StaffDock to the VPS.

Technical approach

One NestJS API decides everything and the Next.js app only displays. Every route is denied by default, roles are checked on every request, and every query is scoped to one company, so one company can never read another’s data; Super Admin is blind to every company’s people and documents, which automated tests cover. Admins sign in with an argon2id password plus a 6-digit email code; people and supplier contacts use email codes only, with separate code types and rotating refresh cookies. Every stored file is encrypted with AES-256-GCM and served only after a permission check, and share codes, dates of birth and reference numbers are encrypted separately. Check, presence, assurance, contract and status records, invoices and the activity log are append-only through database triggers. Statuses are worked out live from uploads and checks, never typed in. Reminders, imports and PDFs run on BullMQ so pages stay fast.

Engineering highlights

• Append-only records: saved checks, contracts, assurances, invoices and the activity log can’t be edited or deleted, enforced by database triggers.
• Right to work rules enforced on the server: Verified can’t be saved until every required tick, field and evidence file is in place, and late checks are labelled.
• Strict multi-tenancy: every query is scoped to one company, and Super Admin can never read any company’s people or documents.
• Encrypted storage: every file is AES-256-GCM encrypted and served only after a permission check; DBS files can be deleted after they are checked.

Key features

• Free 14-day trial, email-code confirmation and a setup wizard with industry presets for document types.
• People list with CSV import, five person types, mark as left, and a person page with documents, details and history.
• Mobile-first person portal: To do list, upload or replace documents, and three right to work routes (share code, original documents, Home Office application).
• Review queue with the document beside the record form, one-click Check on GOV.UK, and Verified or Ask for a new upload with a reason.
• Follow-up checks for time-limited permission and Positive Verification Notices that can only be cleared by a new check.
• Dashboard with a compliance score by team, an urgency-ordered to-do list, counters and a 6-month chart.
• Cleared to work lists by team, with plain-English reasons, a Starting soon list, printable lists and team QR codes.
• Reminders 60, 30 and 7 days before expiry, invite chasers, weekly admin summaries and monthly director summaries.
• Supplier portal for agencies and subcontractors: workers, uploads, yearly assurance, contracts with prescribed terms, substitution and audit requests.
• Worker status records, evidence PDFs per person, inspection packs, compliance reports, fair checks, activity log and personal data export.
• Starter, Growth and Pro plans with Stripe card payments or bank transfers approved by Super Admin, invoices and read-only mode when a plan ends.
• Super Admin panel for payments, plans, website text, email settings, complaints and the sign-up funnel.

Result

StaffDock went live on staffdock.co.uk in October 2026, operated by Roy & Associates Limited, with a free 14-day trial and Starter, Growth and Pro plans. Companies can collect documents, record checks, see who is cleared to work and download an inspection pack in one place, ready for the right to work rules that took effect on 1 October 2026.

Development timeline

• Spec & design
  Turned the October 2026 right to work changes into a PRD: five kinds of user, the document workflow, statuses, suppliers, billing and data protection.
• Build
  Built the NestJS API and Next.js app: document types, people, the person portal, the review screen and the right to work rules.
• Suppliers, billing & evidence
  Added the supplier portal, reminders, Cleared to work, evidence PDFs and inspection packs, Stripe and bank-transfer billing, and the Super Admin panel.
• Live
  Went live on staffdock.co.uk in October 2026 with plans, legal pages and an illustrated system guide.