JAM Safety AI Business Operating System
This document sets out a coherent, phased plan to deliver the platform, including the timeline, scope, the risks we'll manage together, and a full technical deep dive into the access control, AI orchestration, and intelligence layers.
We deliver a working MVP+ business operating system, as outlined in these documents , by Week 16 — followed by four weeks of hypercare. The fixed scope is MVP+, sequenced so the launch date is protected even when features depend on inputs from your side.
The original analysis scoped a 22-week build. We compress to 16 by running the four portals as parallel vertical slices, prioritising the three highest-value AI agents, and folding enhancement work into the live phases. MVP lands at Week 9; everything after is hardening, intelligence and the items that take us to MVP+.
Every sprint named, every deliverable listed. Milestone gates shown against the week they fall.
{{ ph.title }}
{{ ph.weeks }}{{ ph.objective }}
Every feature from your whiteboards, explained — what it does, why it matters and how it connects to the rest of the platform. Colour-coded to delivery tier.
A €-per-phase view — not feature pricing, but a reflection of where effort concentrates across the 16 weeks.
Scope is defined by the Portal Deep-Dive, not by conversation. Features discussed in meetings or emails that do not appear in the Portal Deep-Dive are not in scope. Any addition requires a written change request signed by both parties before work begins. Additional work is billed at €85 + VAT/hr or agreed as a new SOW.
The fixed scope is MVP+: the complete core platform (the must-have features across four portals) plus the highest-value enhancement work the 16 weeks can safely absorb. Below is an honest split of what is committed, what is delivered if time allows, and what sits in a future statement of work.
These are the "as much of the full app as possible" items. They are sequenced into Phases 4–5 and shipped when capacity allows — but they flex first if anything slips, to protect the launch date.
JAM Safety OS is an enterprise application, not a brochure website, and it should not be judged against standard website-hosting expectations. It runs a live database, background workers, an AI layer and offline sync, and it holds safety-critical and personal data.
€40,000 covers the MVP+ scope set out in this proposal — delivered with the pilot, training and a four-week hypercare period included.
Anything outside the agreed scope is welcomed as a change request: captured, estimated and scheduled by agreement. Nothing is billed without your sign-off.
Some costs are inherently usage-based and billed by third parties — hosting and infrastructure (above), AI and weather API usage, and any support beyond hypercare.
These are billed at cost and agreed before launch — protecting the fixed price while keeping every ongoing cost open and predictable.
External dependencies
These are the inputs and access we need from your side. None of them are obstacles — they're simply things that sit outside our control. We've mapped them to the week they're needed so you can plan ahead, and where anything is late, the dependent feature moves rather than the launch date.
One coherent system, not a bag of services. A self-hostable single-tenant stack where the same database that runs the platform also powers its intelligence — no warehouse, no sync lag. Every request is authenticated and audit-logged before it reaches data.
JAM Safety Business OS is built on Heaventree's NexOS framework. NexOS provides the secure, scalable foundation on which bespoke business systems are developed. This allows development effort to be focused on workflows, automation, AI capabilities and operational requirements unique to JAM Safety, built on a proven technology foundation for core platform services
JAM runs thousands of staff across concurrent events in multiple countries. Access control is designed for that scale from the ground up — six base roles, per-user overrides, pool-level group rules and event-scoped data isolation enforced at the database row, not just hidden in the UI.
Any user can receive individual grants or denials without changing their role. Permissions resolve highest-wins:
For large events with hundreds of field staff, manage permissions at pool level rather than per person.
override: {{ p.override }}
Grant time-limited permissions that auto-revoke — assessors needing 48h read access, deputies covering a shift.
Claude is the most capable model — but it costs proportionally more per token. JAM Safety OS runs a four-tier model strategy: every AI function is assigned the cheapest engine that can do its job well, and that assignment is a setting in admin — never hard-coded. You are never locked to one provider.
Every AI request carries a task profile. The router reads it and picks the engine — admins can override any of it. Choose a profile to see where it routes.
A private, ever-growing vector memory that learns from every document, incident and decision on the platform. Each source is chunked into semantic text segments, converted into high-dimensional vector embeddings via a local nomic-embed model, then written as a structured node collection into pgvector. The index is built on an HNSW graph (Hierarchical Navigable Small World) enabling millisecond approximate-nearest-neighbour retrieval via cosine distance — zero API tokens to index or search, and precision that compounds with every node added.
Resolving an incident or approving a document triggers an async embed — no user waits, no tokens spent.
JAM operates across Gulf state jurisdictions — each with its own evolving mass-gathering legislation, civil defence directives, and event permitting frameworks. The RAG engine continuously indexes authoritative legal sources and automatically grounds every AI agent in the precise regulatory context for each deployment territory. Commission an ESMP for a KSA event and the engine retrieves current Saudi Civil Defence requirements and MOMAH permitting standards before a single clause is drafted — zero manual maintenance, zero regulatory lag.
Sources are crawled on a schedule. Changed content re-embeds and version-stamps; admins are notified to review impact on active ESMPs.
The ESMP agent retrieves law + precedent locally first, then prepends them to the prompt. Claude generates a legally-grounded plan — no hallucinated, outdated rules.
This is where everything pays off. Every document, incident, inspection, shift and invoice across the platform flows into one live intelligence layer — no warehouse, no sync lag, no data team. The result: board-level insight into the whole business, in real time, surfaced automatically.
{{ f.desc }}
A weekly scan across all historical events surfaces actionable findings — each with the evidence, the saving and a suggested action.
Every event, incident, inspection and approval is automatically converted into a vector embedding and stored in a private knowledge base. The system then uses that knowledge to ground AI generation, surface similar precedents and detect patterns — all at zero token cost. The platform gets smarter with every event it runs.
Every admin action feeds back into the detection thresholds. Dismiss a false positive and the sensitivity drops for that pattern. Act on a confirmed flag and it becomes more alert. Try it:
The nerve centre. Accessible only to the Ops Admin role, it gives complete control over every configurable part of the system — users, permissions, AI models, the knowledge base, integrations, billing and security. Every action in admin is itself audit-logged.
Following the 4-week hypercare period, the platform transitions into Year 1 managed operational support under a structured Service Level Agreement. This is not ordinary website maintenance.
{{ w.desc }}
A 10-hour allowance would be exhausted within the first fortnight of most months in Year 1. The 20-hour allowance reflects the genuine bedding-in workload — onboarding support, workflow refinements and edge-case handling — without forcing a monthly overage conversation that helps nobody.
JAM's business is live events — which run in the evenings, at weekends and over holidays, exactly when standard support windows are closed.
The single highest-value protection for a live-events business. We strongly recommend budgeting for it across Year 1's busiest periods.
{{ p.desc }}
A request qualifies as included maintenance only if ALL of the following are true:
Bug fixes are covered under the base retainer's application-support obligation. The hour-bucket is for enhancements and iterative improvements — not repairs. JAM should never pay twice for our defects.
Up to 50% of unused hours roll forward one month only, then expire — goodwill flexibility without stockpiling.
Excluded from the Year 1 retainer unless separately agreed in writing. Each is handled through a change-request process: scope definition, impact review, timeline and commercial approval.
Availability excludes: scheduled maintenance windows (≥3 business days' notice), third-party provider outages (Microsoft, Anthropic, Frappe), client-side connectivity issues, and force-majeure events.
Example: 98.5% actual (1% shortfall) → €550 credit against €5,500 retainer.
Hosting and third-party API costs (cloud infra, Claude AI, OpenWeather) are billed separately at cost — estimated €800–1,200/month.
Support effectiveness is a shared responsibility. JAM Safety is expected to:
"Security is not a product you install — it is a discipline you sustain."
The JAM Safety platform is a business-critical operational system processing safety documents, managing live events, handling subcontractor credentials and coordinating field teams. That operational reality demands operational-grade security.
{{ sl.plain }}
{{ sl.tech }}
Security controls built in-house are only as trustworthy as an independent firm's assessment of them. Two dedicated engagements in Year 1 — not Heaventree marking its own work.
Penetration testing is conducted by an independent specialist provider and scoped against OWASP ASVS as the acceptance benchmark. Costs are a separate line item from the support retainer.
Security patterns are baked into the build — not addressed after the fact. The goal: when the independent pen tester arrives, most common findings have already been closed.
{{ ow.desc }}
In our experience, platforms built with security-by-design principles see 40–60% fewer findings in formal penetration tests compared to platforms where security is addressed retrospectively.
Any technology partner that guarantees absolute security is either uninformed or dishonest. We choose transparency instead.
We will not insult your intelligence by claiming the platform is invulnerable. Instead, we commit to making it as resilient as a platform of this nature can credibly be — and maintaining that resilience throughout Year 1 and beyond.
Platform security is a partnership. Heaventree secures the environment, the code, the infrastructure and the defences. JAM Safety governs its users, their access, their devices and their conduct.
The strongest technical controls cannot protect a platform where accounts are shared, passwords are on sticky notes, or leavers retain access for months after departure. We will provide security guidance, onboarding checklists and access governance templates.