VCA file management software
VCA is not a legal requirement but a client requirement, and in practice it carries just as much weight: without a valid certificate, you won't get through the gate. Appfront builds the software that keeps the records an audit asks for: which diplomas are valid, which toolbox talks were held, who attended, and what was done with the findings.
What a VCA file needs to demonstrate
VCA stands for Veiligheid, gezondheid en milieu Checklist Aannemers (Safety, Health and Environment Checklist for Contractors) and is managed by SSVV. There are three certification levels: VCA* for companies that only carry out hands-on work, VCA** for companies that also use subcontractors and must demonstrate their own safety policy, and VCA Petrochemie for work in the petrochemical industry, which has additional requirements. Which level you need is determined by your client, not by you.
At individual level, the diplomas that apply are: B-VCA for operational staff, VOL-VCA for operational managers and self-employed people working as subcontractors, and VIL-VCU for intermediaries and managers at temporary employment agencies. These diplomas are valid for ten years and are registered in SSVV's Central Diploma Register, where their validity can be checked.
At the annual audit, things rarely go wrong with the policy and almost always with the records. The auditor asks you to demonstrate that the toolbox talks for the past year were held, who attended, that the staff involved held valid diplomas at the time they carried out the work, and what happened to any reports that came up in between. Anyone who has to dig that out of attendance sheets in folders will spend a week on it and will inevitably find gaps.
If foreign staff work on your site, there is a check that is separate from VCA: the notification under the WagwEU. See the app at the gate.
How we build your VCA file
We start with the question the auditor asks and work backwards to what needs to be recorded day to day. That way you don't end up with an archive, but with a file that answers the question.
We go through the checklist for your certification level and determine, point by point, what evidence you need to be able to show. This produces a short list of what genuinely needs recording, and often also a list of things you currently keep track of without anyone asking for them.
Alongside VCA diplomas, your people usually hold a handful of other certificates: forklift operation, first aid and fire safety (BHV), working at height, specific installation competencies. We model these as one set of qualifications with a validity period, because the audit looks at the combination and not at VCA alone.
We work in sprints and start with toolbox talk registration, because that is where most of the volume sits and the benefit is felt soonest. Your site operatives take part and use an interim version on a real worksite every sprint.
Before handover, we review your file against the questions an auditor asks. Anything that can't be shown in two clicks, we adjust. We then hand over to your KAM (quality, safety and environment) officer, including the export you'll use during the audit.
What the software actually does
Six components that together form the file. Which ones you need depends on your certification level and on how many people you have in the field.
Diplomas and qualifications per employee
For each person, which diplomas and certificates they hold, with issue date, validity period and the underlying evidence document. VCA diplomas are valid for ten years; other certificates are shorter. The system calculates this per item rather than applying a single term to everything.
Warnings before anything expires
Well before the expiry date, a signal goes to both the line manager and planning, because scheduling a course takes time. Expired certificates mean people who are, on paper, no longer deployable, and you'd much rather discover that before they reach the gate.
Signing off toolbox talks on site
Keep a toolbox talk register and have attendees sign on a phone or tablet, recording the topic, date and location. Anyone who was absent remains open so they can catch up. That is the difference between a simple attendance sheet and a watertight record.
Reports and incidents
Unsafe situations, near misses and incidents follow a fixed route: report, assess, act, close. The audit asks not only whether you receive reports but what you did with them, and it is often the follow-up that goes missing.
Subcontractors within the same file
For VCA** you also need to demonstrate that your subcontractors comply. A portal where they upload their own certificates and diplomas saves your HSE coordinator from chasing them and keeps validity up to date.
Audit export in one step
An overview per period of toolbox talks held, valid qualifications as of the reference date, reports and how they were handled. During the audit you show it on screen rather than walking to a folder.
Who we build for
Four situations where the file most quickly gets out of hand. Usually the trigger is an audit that did not go entirely smoothly.
Contractors and installers
Changing project sites and crews mean toolbox talks are held in scattered locations, and the attendance sheets only reach the office weeks later. This is often combined with a work order app that the same people already use.
Industrial services and petrochemicals
Work at client sites with their own gate rules, where besides VCA Petrochemie, client passes and installation-specific instructions also apply. The administration for these is usually heavier than the VCA itself.
Temporary staffing agencies and secondment providers
VIL-VCU and the question of whether your temporary agency workers can be deployed at the hirer. If this is linked to your placements, a planner can see straight away who may work and who may not.
Companies with an in-house technical department
Not a contractor, but still needing VCA because clients or insurers ask for it. The challenge here is mainly that safety is a task alongside regular work and therefore must cost as few steps as possible.
Test your idea first: a working prototype in 1 day
With OneDayBuild, we turn your idea into something tangible in one day for €1,150, so you can see whether further development is worth the investment. Decide to go ahead with the full build? Then we credit the full cost.
Explore OneDayBuild →Technology and integrations
SSVV's Central Diploma Register is designed to verify a diploma, not to feed business administration. We don't promise an automatic integration without first establishing what is actually available. Anything else we use depends on your situation.
For safety around the construction site, with inspections and versions of the plan, there is our construction safety plan app.
Why Appfront
Built around the audit
We design from what you need to be able to demonstrate, not from what is convenient to store. That avoids screens nobody completes and gaps where it matters.
Sign-off must be quicker than writing it down
A site manager who notes his toolbox talk on paper because it is faster has a point. Our benchmark is that the digital route must be shorter; if it isn't, the design is not finished.
One set of qualifications, not three lists
VCA, BHV, forklift and client passes in one model with validity periods. Your planning can then act on it, rather than someone keeping it beside them.
Honest about the boundary
We do not pass the audit for you, and we do not replace your HSE coordinator. What we deliver is the system that makes their work demonstrable; the substantive assessment remains human work.
Security and privacy
A VCA file contains personal data: names, certificates, attendance at meetings and, at times, incident reports in which an employee can be identified. For certificates and qualifications the legal basis is straightforward, as you need to demonstrate that someone is competent. Incident reports are more sensitive: they may concern conduct or injury, and in those cases restricted access is essential.
We therefore set it up with roles that follow from what each person needs to do: a site supervisor sees whether their crew is deployable, a KAM officer sees the file, and the handling of an incident involving injury runs through a separate, protected route. We keep toolbox attendance records only for as long as the audit requires and no longer. The portal for subcontractors gets its own role so they only see their own people. How we handle security ourselves is set out in our information security policy; reports from outside come through our vulnerability disclosure policy.
Your VCA file depends on the risk assessment beneath it: the measures that follow from it belong in an action plan with owners and deadlines. How we build that is covered under RI&E tool with action plan.
If your people also drive professionally, their driving licence and Code 95 sit alongside their VCA certificate in the same competence register. How that monitoring works is covered under driving licence and Code 95 monitoring.
Frequently asked questions about the VCA file
VCA* applies to companies that carry out purely operational work; the emphasis there is on the shop floor. VCA** applies to companies that also engage subcontractors and that must demonstrate their own safety policy, structure and improvement cycle. VCA Petrochemie adds requirements specific to working in the petrochemical industry. Which level you need is determined by your client; it is almost always stated in the tender specifications.
Ten years. After that, the employee must retake the examination at an accredited examination institute. That may seem long, but it also means expiry dates fall at random points through the year, so there is always someone due. You can verify validity in the Central Diploma Register of SSVV. We build in reminders well ahead of the expiry date, because scheduling a course and finding a place also takes time.
Holding periodic safety work meetings is part of the VCA requirements; the frequency follows from your own safety policy and from what your certification level requires. More important than the number is being able to show that they were held, with topic, date and attendees, and that anyone who was absent was brought up to speed. That last point is usually where things go wrong during audits.
The register was set up to verify an individual diploma, not as an interface for business software. We therefore don't promise an automatic integration until we have established what is actually available and under which conditions. What does work in any case is recording the diploma once with its issue date and supporting evidence, and then monitoring its validity period yourself.
Under VCA**, you need to demonstrate that you control safety across your supply chain, and that includes knowing whether your subcontractor's people are competent. In practice that means a portal where they upload their own certificates and where you can see what is missing. It is preferable to an email chain and keeps validity up to date without your own staff having to chase it.
Quite often, yes, and sometimes it's better to build it in. If you already run a quality management system with document control and nonconformity handling, the VCA file is an extension of that rather than a second system. During discovery we look at which route creates the least duplicate data entry.
That is the scenario this software exists for, and it is a planning problem dressed up as an administrative one. We therefore link qualifications to the schedule: someone whose certificate expires in two weeks can no longer be scheduled for work that requires it three weeks from now. That way the signal reaches the person who can act on it.
That mostly depends on the number of staff, whether subcontractors take part, and whether integrations with scheduling and HR are needed. Toolbox registration is usually the quickest to deliver and gives the most value; the subcontractor portal is the most work. We give a reasoned estimate after the discovery phase, not before.
Ready to build a VCA dossier?
Tell us which level of certification you hold and where your last audit got stuck, and we'll say which component will deliver the most value and what you can postpone. We build this as a standalone application or as part of a broader custom software development project or app development. For new builds in consequence class 1, the Wkb file is added; see competent authority file.