JAM Safety AI Business Operating System
This document sets out a coherent, phased plan to deliver the platform, including the timeline, scope, the risks we'll manage together, and a full technical deep dive into the access control, AI orchestration, and intelligence layers.
We deliver a agreed MVP and Committed MVP+ business operating system, as outlined in these documents, by Week 16 — followed by six weeks of hypercare. The fixed development scope comprises MVP and Committed MVP+, structured and sequenced to manage dependencies through the agreed project process.
The original analysis scoped a 22-week build. We compress to 16 by running the four portals as parallel vertical slices, prioritising the three highest-value AI agents, and folding enhancement work into the live phases. MVP lands at Week 9; everything after is hardening, intelligence and the items that take us to MVP+.
Every sprint named, every deliverable listed. Milestone gates shown against the week they fall.
{{ ph.title }}
{{ ph.weeks }}{{ ph.objective }}
Every feature from your whiteboards, explained — what it does, why it matters and how it connects to the rest of the platform. Colour-coded to delivery tier.
A €-per-phase view — not feature pricing, but a reflection of where effort concentrates across the 16 weeks.
Scope is defined by the Portal Deep-Dive, not by conversation. Features discussed in meetings or emails that do not appear in the Portal Deep-Dive are not in scope. Any addition requires a written change request signed by both parties before work begins. Additional work is billed at a specially reduced rate of €85 per hour, or part thereof, for the duration of the project, or as agreed in a new SOW. Heaventree's normal hourly Dev rate of €170 per hour applies to all work outside of agreed project timelines and new work requests.
For clarification on the deliverables below, please note that all items in green were considered part of a delivered Phase I MVP system.
Items in blue are Committed MVP+ items and form part of the fixed first-cycle delivery commitment. Flex Items are separately identified and remain time-permitting only.
Items in rose are not realistically deliverable within the agreed-upon timeframe. The numerous extra MVP+ features are also included in Phase I on a time-permitting Flex basis.
The fixed scope is MVP+: the complete core platform (the must-have features across four portals) plus the highest-value enhancement work the 16 weeks can safely absorb. Below is an honest split of what is committed, what is delivered if time allows, and what sits in a future statement of work.
These are the "as much of the full app as possible" items. They are sequenced into Phases 4–5 and shipped when capacity allows — but they flex first if anything slips, to protect the launch date.
JAM Safety OS is an enterprise application, not a brochure website, and it should not be judged against standard website-hosting expectations. It runs a live database, background workers, an AI layer and offline sync, and it holds safety-critical and personal data.
€40,000 covers the MVP+ scope set out in this proposal — delivered with the pilot, training and a six-week hypercare period included.
Anything outside the agreed scope is welcomed as a change request: captured, estimated and scheduled by agreement. Nothing is billed without your sign-off.
Some costs are inherently usage-based and billed by third parties — hosting and infrastructure (above), AI and weather API usage, and any support beyond hypercare.
These are billed at cost and agreed before launch — protecting the fixed price while keeping every ongoing cost open and predictable.
External dependencies
These are the inputs and access we need from your side. None of them are obstacles — they're simply things that sit outside our control. We've mapped them to the week they're needed so you can plan ahead, and where anything is late, the dependent feature moves rather than the launch date.
One coherent system, not a bag of services. A self-hostable single-tenant stack where the same database that runs the platform also powers its intelligence — no warehouse, no sync lag. Every request is authenticated and audit-logged before it reaches data.
JAM Safety Business OS is built on Heaventree's NexOS framework. NexOS provides the secure, scalable foundation on which bespoke business systems are developed. This allows development effort to be focused on workflows, automation, AI capabilities and operational requirements unique to JAM Safety, built on a proven technology foundation for core platform services
JAM runs thousands of staff across concurrent events in multiple countries. Access control is designed for that scale from the ground up — six base roles, per-user overrides, pool-level group rules and event-scoped data isolation enforced at the database row, not just hidden in the UI.
Any user can receive individual grants or denials without changing their role. Permissions resolve highest-wins:
For large events with hundreds of field staff, manage permissions at pool level rather than per person.
override: {{ p.override }}
Grant time-limited permissions that auto-revoke — assessors needing 48h read access, deputies covering a shift.
No single AI provider is assumed to be the right fit for every function, or the right fit forever. JAM Safety OS is built to test and benchmark multiple engines — including OpenAI, Claude, DeepSeek, Qwen, Gemma and others — against each individual task, so the optimal provider and model for that job can be identified.
This optimisation only becomes reliable once a meaningful volume of real events has run through the system; early assignments are a starting point, not a final answer.
Pricing across providers also shifts constantly — a model that is cheapest today is not guaranteed to remain so, and the routing strategy is designed to adapt as that changes.
Wherever possible, we aim to shift functions to run from the system's own internal memory rather than an external model call — these run at a small, near-negligible compute cost rather than genuinely free.
Every AI request carries a task profile. The router reads it and picks the engine — admins can override any of it. Choose a profile to see where it routes.
A private, ever-growing vector memory that learns from every document, incident and decision on the platform. Each source is chunked into semantic text segments, converted into high-dimensional vector embeddings via a local nomic-embed model, then written as a structured node collection into pgvector. The index is built on an HNSW graph (Hierarchical Navigable Small World) enabling millisecond approximate-nearest-neighbour retrieval via cosine distance — zero API tokens to index or search, and precision that compounds with every node added.
Resolving an incident or approving a document triggers an async embed — no user waits, no tokens spent.
JAM operates across Gulf state jurisdictions — each with its own evolving mass-gathering legislation, civil defence directives, and event permitting frameworks. The RAG engine continuously indexes authoritative legal sources and automatically grounds every AI agent in the precise regulatory context for each deployment territory. Commission an ESMP for a KSA event and the engine retrieves current Saudi Civil Defence requirements and MOMAH permitting standards before a single clause is drafted — retrieval itself runs on local vector search at near-negligible compute cost, with no per-call LLM fee.
Sources are crawled on a schedule. Changed content re-embeds and version-stamps; admins are notified to review impact on active ESMPs.
The ESMP agent retrieves law + precedent locally first, then prepends them to the prompt. JAMOPS generates a legally-grounded plan — no hallucinated, outdated rules.
This is where everything pays off. Every document, incident, inspection, shift and invoice across the platform flows into one live intelligence layer — no warehouse, no sync lag, no data team. The result: board-level insight into the whole business, in real time, surfaced automatically.
{{ f.desc }}
A weekly scan across all historical events surfaces actionable findings — each with the evidence, the saving and a suggested action.
Every event, incident, inspection and approval is automatically converted into a vector embedding and stored in a private knowledge base. The system then uses that knowledge to ground AI generation, surface similar precedents and detect patterns — all at zero token cost. The platform gets smarter with every event it runs.
Anomaly detection needs a threshold: how far a metric has to drift from normal before the system raises a flag.
Set that threshold once and forget it, and it goes stale — what counts as "unusual" for a 500-person event is very different for a 5,000-person one, and that only becomes clear with real data.
So instead of a fixed rule, JAMOPS learns the right threshold from what your admins actually do with each flag: dismiss one as noise and the system backs off slightly for that pattern; act on one because it was real and the system leans in.
Over a season of events, thresholds settle at whatever level actually matches how your team works — no manual re-tuning required. Try it below — drag the slider or click a button to see the threshold move and the flag count react in real time.
The nerve centre. Accessible only to the Ops Admin role, it gives complete control over every configurable part of the system — users, permissions, AI models, the knowledge base, integrations, billing and security. Every action in admin is itself audit-logged.
{{ w.desc }}
The support retainer covers bugs at no extra charge. The hourly allowance is for enhancements and improvements.
JAM's business is live events — which run in the evenings, at weekends and over holidays, exactly when standard support windows are closed.
The single highest-value protection for a live-events business. We strongly recommend budgeting for it across Year 1's busiest periods.
{{ p.desc }}
A request qualifies as included maintenance only if ALL of the following are true:
Bug fixes are covered under the base retainer's application-support obligation. The hour-bucket is for enhancements and iterative improvements — not repairs. JAM should never pay twice for our defects.
Up to 25% of unused hours roll forward one month only, then expire - goodwill flexibility without stockpiling.
Excluded from the Year 1 retainer unless separately agreed in writing. Each is handled through a change-request process: scope definition, impact review, timeline and commercial approval.
Availability excludes: scheduled maintenance windows (≥3 Support Business Days' notice), third-party provider outages (Microsoft, Anthropic, Frappe), client-side connectivity issues, and force-majeure events.
This system depends on numerous third-party services to function — cloud hosting, AI providers (Anthropic, OpenAI, Google Gemini), Microsoft services, and others. Outages of these upstream providers are relatively common industry-wide and are entirely outside Heaventree's control. Heaventree accepts no responsibility for downtime, degraded performance, or data issues caused by an outage of any required third-party service, and such outages do not count against the monthly uptime target above.
Example: 98.5% actual (1% shortfall) → €200 credit against €2,000 retainer.
Support effectiveness is a shared responsibility. JAM Safety is expected to:
"Security is not a product you install — it is a discipline you sustain."
The JAM Safety platform is a business-critical operational system processing safety documents, managing live events, handling subcontractor credentials and coordinating field teams. That operational reality demands operational-grade security.
{{ sl.plain }}
{{ sl.tech }}
Heaventree does not pentest its own work — a team assessing its own build has no independent value, and we won't charge you for the appearance of one.
What we do instead is build in a robust set of security layers and protocols from the ground up — see the 8-layer defence model opposite — so the system is hardened by design rather than patched after the fact.
Independent penetration testing is a client option, available at any time, carried out by a third-party dedicated pen-testing agency of your choosing. We're happy to help scope an engagement and remediate findings — this is simply not a service we provide ourselves.
Security patterns are baked into the build — not addressed after the fact. The goal: when the independent pen tester arrives, most common findings have already been closed.
{{ ow.desc }}
In our experience, platforms built with security-by-design principles see 40–60% fewer findings in formal penetration tests compared to platforms where security is addressed retrospectively.
Any technology partner that guarantees absolute security is either uninformed or dishonest. We choose transparency instead.
We will not insult your intelligence by claiming the platform is invulnerable. Instead, we commit to making it as resilient as a platform of this nature can credibly be — and maintaining that resilience throughout Year 1 and beyond.
Platform security is a partnership. Heaventree secures the environment, the code, the infrastructure and the defences. JAM Safety governs its users, their access, their devices and their conduct.
The strongest technical controls cannot protect a platform where accounts are shared, passwords are on sticky notes, or leavers retain access for months after departure. We will provide security guidance, onboarding checklists and access governance templates.