The audit binder builds itself.
A compliance system for a behavioral health operator running three companies. Every credential tracked live, every signature bound to the document it signed, and the evidence pack generated on demand.
Scroll to explore ↓
Spreadsheets, until an auditor asks.
Behavioral health runs on credentials. Licences, background checks, trainings, countersignatures. Each role needs a different set, all of them expire, and proving it happened matters as much as it happening.
- 01
Different rules per role
A clinician, a supervisor and an admin each owe a different set of credentials. Kept as spreadsheets, updated by hand.
- 02
Everything expires
Licences, certifications and trainings all renew on their own clock. Nobody finds out something lapsed until somebody checks.
- 03
Three companies, one workforce
Staff move between companies. Their record moves with them, without anyone seeing across a boundary they shouldn't.
- 04
The binder
When a regulator asks, someone spends days pulling documents into a folder and hoping nothing is missing.
The requirement, the document and the proof in one place.
Assign someone a role and the system works out what they owe. It routes each step to whoever has to act, records what happened, and keeps the evidence in a form an auditor can read.
- 1
Requirements resolve themselves
Assign a role template and the system works out every credential, form and training that person owes, with due and renewal dates attached. Change the role and it re-resolves.
- 2
Tasks find the right person
Each requirement becomes an ordered sequence of steps: upload, fill, review, sign, countersign. Twelve built-in patterns, plus a builder for anything they don't cover.
- 3
AI reads, a person confirms
Uploaded documents are read automatically and field values suggested. Nothing is committed until a human confirms it, and approval stays blocked until they do.
- 4
The evidence assembles itself
Auditors get their own read-only mode and generate an evidence packet on demand. The activity log shows document and signature events only, never internal admin churn.
Four things that make it hold up.
Read, reviewed, filed
Uploading queues an extraction. A person reviews it. One approved version is active at a time, and the old one stays in the history.
Scored live, never stored
Every compliance score is recalculated the moment it's read. There is no cached number anywhere that can quietly go stale.
Bound to the document
Each signature captures image, name, timestamp and device, cryptographically bound to the exact PDF that was signed.
Six roles, one rule
Every permission check runs through a single function that denies by default. Auditors deliberately cannot reach the operational dashboard.
Built with
AWS Amplify
RDSPostgreSQL
S3Custom auth with MFAWe measured it.
The parts a person still has to do.
Every AI-suggested value is confirmed by a person. Approval on a document is blocked until someone has done it. That is the design, not a limitation.
Alert lead times run on one fixed schedule for everyone. Per-requirement timing is deliberately not built until they can tell us which requirements need it.
The evidence packet layout is generic until the regulator's exact required format is confirmed. We would rather ship it usable and adjust than guess at a legal format.
“We were tracking credentials for three companies on spreadsheets, and every audit meant someone assembling a binder by hand. Mantaq spent the first weeks understanding how our compliance actually works before they built anything. What we have now keeps up with it, and the evidence is there when someone asks for it.”
Shiloh Jones
CEO @ HYPE Counselling Services