Can I vibecode Qooling?
NOT REALLY · don't botherYou can absolutely build a register: incidents in, corrective actions out, documents with version numbers, a dashboard that looks convincing. What you cannot build in a session is the thing anyone actually buys, which is an evidence trail an external ISO auditor will accept without argument, plus a mobile flow that a warehouse worker will actually use to report a near miss. Compliance software lives or dies on immutable audit logs, controlled document approval with signatures, retention rules and the fact that the vendor, not you, is the one explaining the system during a certification audit. A personal replacement also makes little sense here: this is inherently multi-user, and the value appears only when an entire site logs into it. Build the register if you want to understand your own processes; do not put your certification on top of it.
Build a self-hosted single-organisation QHSE register. This is a learning and internal-tracking tool, not a certification system, and it should say so on the dashboard. Stack, no substitutions: - Next.js (App Router) with TypeScript and Tailwind - SQLite via Prisma, file at ./data/qhse.db - Local disk storage for attachments under ./data/uploads - Single shared password from AUTH_PASSWORD in .env, cookie session, no user accounts, no OAuth, no cloud services, no telemetry Data model: - Person: name, email, site - Incident: type (incident, near miss, unsafe situation), date, site, reporter, description, severity 1-5, photos, status (open, investigating, closed) - Risk: hazard, activity, likelihood 1-5, impact 1-5, computed score, existing controls, owner, review date - Action: title, source (incident or risk or audit), owner, due date, status, closure note, closed date - Document: title, code, current version number, category, owner, review date, uploaded file per version, status (draft, approved, retired) - AuditLog: append-only table, every create and update writes actor, timestamp, entity, field-level before and after JSON. Never allow deletes on this table in application code. Screens: - Dashboard: open incidents, overdue actions, risks above score 15, documents past review date - List and detail views for each entity, with inline forms, no modals-only flows - Risk matrix view: 5x5 grid, colour by score, click a cell to see the risks in it - Evidence pack: pick a date range, get a single printable HTML page with all incidents, actions, risks and document versions in it, plus the relevant audit log rows In scope: seed script with two sites, five people, sample incidents and risks. CSV export for every list. Overdue highlighting. Out of scope: mobile app, offline capture, email notifications, e-signatures, multi-tenant, ISO clause libraries, permissions and roles. On the dashboard, print a fixed banner: "Internal tracking only. Not an audited compliance system." Include README with setup, .env.example with AUTH_PASSWORD, and a backup script that copies ./data to a timestamped folder.
$ open in your agent (prompt prefilled, you press enter) or copy it raw · this prompt is generated from the build plan · improve it via PR
prompt copied. want to know what dies next week?
new verdicts + top votes, weekly. free. one-click out.
Because compliance is a social process, not a data model. Getting fifty people across three sites to report incidents, sign off documents and close corrective actions requires a tool that everyone tolerates, a mobile app that works in a loading bay, and a paper trail that survives an auditor picking a random clause and asking for proof. Companies also pay for someone to blame: if the certification audit goes badly, a vendor with ISO-shaped templates and support is a better story than a spreadsheet-plus-side-project maintained by whoever built it before they left.
xAuditor familiarity: external certification bodies have seen the commercial tools and know what to click
xImmutable, tamper-evident audit logging and controlled document sign-off, which is the whole point of the category
xA field-usable mobile app for incident and near-miss reporting with photos, offline
xPrebuilt ISO 9001 / 14001 / 45001 / 27001 templates, risk matrices and clause mappings you would otherwise write from scratch
xSomeone else being accountable when the system fails during an audit or a serious incident investigation
Nothing worth pointing at. That's why the prompt exists.
Can I vibecode Qooling?
Not really. Qooling's value is not the code: The moat is compliance-regulatory: auditor-accepted evidence trails, controlled document sign-off, and a vendor who stands behind them. See the honest breakdown above.
How much does Qooling cost?
Qooling's pricing is usage-based or varies by plan · Vendor pricing page lists Starter / Advanced / Enterprise with feature descriptions and Sign up buttons but no figures. Third-party directories (Capterra, GetApp) list Light EUR 12.00, Starter EUR 67.00, Advanced EUR 87.00 per user per month, Enterprise on request; those figures are unverified against the vendor and the tier names only partly match..
What do I lose by replacing Qooling?
Honestly: Auditor familiarity: external certification bodies have seen the commercial tools and know what to click; Immutable, tamper-evident audit logging and controlled document sign-off, which is the whole point of the category; A field-usable mobile app for incident and near-miss reporting with photos, offline; Prebuilt ISO 9001 / 14001 / 45001 / 27001 templates, risk matrices and clause mappings you would otherwise write from scratch; Someone else being accountable when the system fails during an audit or a serious incident investigation. If any of those are load-bearing for you, keep paying.
Is there an open-source alternative to Qooling?
No mature open-source alternative worth pointing at, which is exactly why the one-shot prompt on this page exists.