The record belongs to the building.
Every building has an owner who lets people in. Assessors, contractors and their engineers are named members of that building, and when a contract changes hands the history stays with the building.
For procurement
Supplier information.
What is held, what is in progress.
Legionella Ready is a record system for premises water controls: the building's map, its assessments, its checks and its evidence, owned by the building and worked on by the people the owner lets in. It is not a water hygiene contractor and it does not certify compliance. This page sets out what a buyer can rely on today and what is still being put in place.
The company
The contracting company, its registration number, VAT status and registered office are being inserted before payments open. The service terms and privacy notice say the same.
What the product proves today
Operational records are append-only.
Checks, readings and work are written once and kept. A later record can supersede an earlier one; nothing is edited or deleted. Issued assessments, written schemes and report snapshots are protected by database rules that refuse updates and deletions.
Every issued report is retained exactly as issued.
An issued assessment is stored as the document the reader saw, with its revision history. Later corrections create a new issue; the earlier one remains downloadable.
Access is recorded.
Invitations, acceptances and removals are kept with the person, the time and the buildings involved. Company administration does not by itself grant authority at a building.
Your data comes back to you.
Issued reports download as documents, records are available as structured data through the application interface, and evidence files download in their original form. Removing a building from a portfolio does not delete the building's record.
Data is held in Western Europe.
The database and the evidence store run on Cloudflare in the Western Europe region. Transactional email is sent through Resend from its EU region. No card or bank details are held; payments, when they open, run through Stripe.
Accounts are protected in the usual ways.
Passwords are hashed with PBKDF2-SHA256 at 100,000 iterations and session tokens are stored only as SHA-256 hashes in secure, HttpOnly cookies. Sign-in locks after ten failures in an hour. Writes check their origin. Password links expire in thirty minutes and work once.
The record follows the published guidance.
Duties are drawn from the Health and Safety at Work etc. Act 1974, COSHH 2002, the Approved Code of Practice L8 and HSG274 Parts 1 to 3. Professional assessments follow the structure of BS 8580-1:2019, with each decision recorded with its reasoning and evidence.
Public-sector readiness
Each item is marked as a buyer would check it. Nothing below is claimed as held unless it is.
| Requirement | Status | Note |
|---|---|---|
| Contracting company, registration number, VAT and registered office | In progress | Being inserted before payments open; the terms and privacy pages say the same. |
| Professional indemnity, public and employer's liability insurance | In progress | Limits and insurer to be published here when confirmed. |
| Cyber Essentials | Not yet | Required for G-Cloud and for most public contracts that handle personal data (PPN 09/23). Self-assessed certification, about £320 to £650 a year. |
| Cyber Essentials Plus | Not yet | Independently tested level, often asked for where personal data is involved. About £1,350 to £1,600 a year. |
| ISO 27001 information security | Not yet | G-Cloud 15 accepts evidence that certification has begun. |
| G-Cloud framework listing | Not yet | G-Cloud 15 is an open framework worth an estimated £14 billion to September 2030; the first supplier window closed on 30 January 2026 and the framework reopens to new suppliers. |
| Accessibility statement to WCAG 2.2 AA | In progress | Public bodies must buy accessible services. The statement will be published on this site. |
| Penetration test | Not yet | Commonly expected alongside Cyber Essentials Plus. |
| NHS data security toolkit (DSPT) and digital technology assessment (DTAC v2) | Not yet | Relevant only to NHS buyers. DTAC applies where a product is classed as a digital health technology. |
| Social value statement | In progress | Carries a minimum 10% weighting in above-threshold public tenders under PPN 002. |
| Modern slavery statement | In progress | Mandatory only above £36 million turnover; published voluntarily. |
| Carbon reduction plan | Not required at this scale | Required as a condition only for contracts above £5 million a year. |
| Published service levels and continuity arrangements | In progress | The service runs on Cloudflare's global network; formal service levels are being written. |
Why the record matters at tender
Water hygiene is bought by estates in multi-year contracts, and every retender starts again from the outgoing contractor's folder. A record owned by the building survives the change of contractor: the incoming firm inherits the map, the assessments and the history, and the estate's next tender is cheaper than its last. The library on this site lists assessors and companies with what they declare and what they have done here, so an estate can see its own contractors' standing in the same place as its records.