Founder-led, operator-built.

QEHS Ethos is founder-led and operator-built. The people on this page have shipped enterprise QEHS software for Tier-1 manufacturers, utilities, and offshore operators, carried a pager for a real program, or both. That is the whole hiring premise: every person who touches the roadmap has run the system in the field, not only modelled it in a slide.

We started QEHS Ethos because the programs we ran kept hitting the same wall. The QMS, the EMS, and the EHS platform each came from a different vendor, with a different data model, a different login, and a different audit trail. Quality, environment, and safety teams ended up maintaining three half-integrated systems and reconciling the differences by spreadsheet. The work that mattered — catching the hazard before the incident, closing the CAPA before the audit — sat behind the work that did not.

So we built the platform we wanted to use. The Composer lets a program owner assemble modules — incident, permit, inspection, CAPA, audit, training — without custom development, because the four disciplines share one data model. A supplier scorecard and a contractor pre-qualification record are the same object with different labels. A nonconformity CAPA and an incident CAPA share one workflow and one audit trail. Twenty-two module templates ship in the catalogue, each configured for a real program shape we have run.

We built the platform to be composed, not configured-by-consultant. A module is a configuration object — fields, workflows, lookup lists, permissions — that a program owner can change without a pull request, and the Composer ships a tenant-scoped rules engine so one customer can add a field to their incident form without forking the schema for everyone else. Multi-tenant by construction: every customer gets an isolated database namespace, module-scoped role-based access control, an immutable audit log, and a choice of data-residency region. The architectural goal is that a quality manager and a safety manager at the same company see the same record from their own angle, not two records that have to be reconciled by hand.

We built it with design-partners, not for a hypothetical buyer. Every module on the roadmap exists because a real program owner asked for it, tested it against their own audit calendar, and told us what was missing. That is also why nothing on this site is invented. The customer evidence we show is tied to shipped work. The author bylines on the blog belong to people who wrote the posts. The trust posture in the Trust Center — encryption at rest, TLS 1.3, SSO with SCIM, MFA, tenant isolation, an immutable audit log, SOC 2 and ISO 27001 underway — is a list of controls that are live or in flight, not a wishlist.

The same standard applies to this page. We do not stock bylines or invent credentials. When a real contributor joins and publishes, their author profile goes up alongside their first post, with verifiable experience and a real LinkedIn. Until then the founder carries the page, and the work carries the company.

We also build for the way the work is read now. The site publishes a full llms-full.txt corpus and WebMCP service definitions so AI agents can answer questions about QEHS programs against the same source the site renders, not a stale summary. Schema.org entities — Organization, WebSite, SoftwareApplication, Article, Person, DefinedTerm — are reconciled by stable @id across every page so an answer engine can trace a claim back to a page and a person, not a loose phrase.

The content surfaces exist to make the work legible, not to fill a page. A 136-term glossary defines the metrics and standards a QEHS program trades in — TRIR, DART, leading indicator, Annex SL — so a finance leader and a safety leader can mean the same thing by the same word. Topic guides walk through ISO 45001 audit prep, permit-to-work, PSM, and contractor management end to end. The docs centre keeps an engineering record of the platform, with a last-reviewed date on every page. The site targets WCAG 2.2 AA and ships in English and German, with locale-prefixed routing so the German glossary and guides are first-class, not a translated afterthought. The newsroom and the platform changelog are public on purpose — a customer can see what shipped, when, and what is next, the same way an internal team would.

What is next: deeper integrations across ERP and SIEM, the pressure-vessel and PSM program guides, and the field-capture work that turns a near-miss into a leading indicator instead of a footnote. We are hiring engineers, designers, and customer-facing people who have run a real program — the open roles are below.