Records that hold up under audit.
Overseer digitizes your organization’s records: patients, staff, customers, suppliers and operations. The difference is structural: every entry is cryptographically sealed the moment it is created. When someone demands proof, the proof is already there.
- A dedicated database per company
- SHA-256 chain verifiable without the vendor
- NOM-004 · NOM-024 · ISO 9001
- Mexican technology
Paper and spreadsheets prove nothing.
Organizations that manage clinical, employment, operational or commercial records all run into the same pattern: the information exists, but it does not withstand scrutiny.
Fragile evidence
An entry in Excel can be edited without leaving a trace. A paper signature can be lost. In front of an auditor, a judge or the health authority, "that is how we recorded it" is not proof.
Audits that bring work to a halt
Weeks spent assembling binders, reconciling versions and chasing signatures every time an ISO certification, a COFEPRIS inspection or an internal review comes around.
Data without sovereignty
In generic SaaS, your information shares a database with other companies, and leaving the vendor becomes a project of its own.
Scattered information
The record is spread across folders, spreadsheets, emails and chats. Pulling it together when someone asks takes days, and nobody can be sure it is complete.
Processes with no clear owner
The task was done or it was not, but nothing records whose turn it was, who reviewed it or who authorized the exception.
Corrections that leave no trace
A value corrected over the previous one erases the history. Later, nobody can say what it used to say, who changed it or why.
Compliance by design, not by procedure manual.
Overseer does not ask your team to follow the rules: the system makes them structurally unavoidable.
Real immutability
Critical entries are never edited or deleted: they are corrected going forward through addenda and formal records. Nobody, not even the institution itself, can rewrite the past without it being mathematically detectable.
Isolation by company
A database-per-tenant architecture: each client runs on its own database and its own file repository. Your information is yours, including the day you decide to take it with you.
One engine, several verticals
The same core serves clinical records, employment records, B2B commercial records and industrial operations, switched on module by module according to each company’s configuration.
Rules that enforce themselves
A medical signature is blocked without a professional license number. Inventory does not allow over-issuing. A patient’s supplies cannot be invoiced twice. These are engine constraints, not recommendations.
What changes when the evidence produces itself.
| Today, without a system | With Overseer |
|---|---|
| Records spread across folders, Excel and email | One record per person or entity, with its full history |
| Evidence in WhatsApp and loose photos | Evidence captured in forms with a number, an author and a date |
| Supervision by asking around | Tasks with an owner by position, a deadline and a review inbox |
| Audits that force you to reconstruct what happened | A sealed history you can consult from day one |
| Corrections written over the original data | Forward corrections, with author and reason |
| Transcribing from paper into the system | A single capture point, validated at the source |
Audits without panic
Preparation stops being a project: the evidence is already ordered, sealed and available from the first day of operation.
Regulatory risk contained
Controls that today depend on staff discipline become impossible to skip.
Supplies used get billed
Every issue from the warehouse creates its charge on the spot, reconciled against your ERP by unique identifier.
Inventory that balances
Atomic stock levels down to the dose: whatever is missing shows up with its owner, time and reason.
Less re-keying
A single capture point per activity, validated at the source. No more transcribing from paper.
Leaving without hostages
Your database and your files are yours, and integrity verification works without us.
What you will be able to measure from daily operations
One person, one record, their whole history.
Each record brings together validated identification, documents, structured history, operational entries and a complete movement log, with a timeline, relationships between entities and access control by link.
- Dual identity: what a user can do (their role) is independent from which records belong to them (their link). An employee can also be a patient, without duplicating the person.
- Traceability and timeline: every creation, edit, read and entry is logged with author, date, IP address and location.
- History and relationships: operational entries are linked to the right entity (patient, employee, customer or supplier) and can be consulted from its profile.
- View/edit pattern: records open read only. Editing is an explicit, audited act with before and after differences.
The entire record lifecycle, on a single platform.
Dashboard
Indicators, alerts and recent activity that change according to your company’s vertical.
Employees
Employment records with documents, an OCR assistant for ID documents and change control.
Patients
NOM-004 clinical records: identification, structured clinical history and documents.
Consultations
Immutable medical notes with ICD-10 coding, signing conditioned on a professional license, and addenda.
Consent forms
Versioned templates, digitized signatures, revocation and tamper verification.
Forms
Your operating forms, each entry with its own number, evidence and seal.
Customers
B2B commercial records with documents and linked service entries.
Suppliers
The same documentary rigor for your supply chain.
Auditing
Activity, changes with before and after differences, and a chain integrity panel.
Users
Accounts created from the record itself, roles and approvals with sign-off.
Portal
Record holders consult and print what is theirs, and fill in the forms you enable.
Configuration
Tax identity, per-company branding and built-in SAT and SEPOMEX catalogs.
My work
The personal workflow: what each person owes today, with a deadline indicator and a form finder.
Org chart
Responsibility is declared by position, not by person. Change who holds it and the chain of command adjusts itself.
Supervision
The area manager signs off or rejects with a comment, without being able to alter what was captured.
Analysis
Cross type, mode, compliance or owner. Each person sees only the scope that belongs to them.
These sixteen are the core modules. The official functional documentation describes 38 operational modules, each with its actors, business rules, validations and exception scenarios.
The same forms you always used, now with verifiable evidence.
Turn any form in your operation (inspections, work permits, checklists, formal records, visits) into a digital form with rules, server-side validation and sequential numbering. No programming required.
- 9 field types: text, number with ranges, date, time, selection, checkboxes, long text, photograph and handwritten signature.
- A double timestamp (the one declared and the server’s), plus IP address and geolocation on every entry.
- Versioned structures: historical entries keep the form layout they were created with.
- Field capture through Telegram: the bot guides the user step by step with a GPS tolerance radius, photographs and validated data.
- Multi-step jobs: what is requested, received and used is grouped in a folder with its progress, without any single entry losing its independence.
Knowing it was done is not enough. You need to know it was done on time.
Every scheduled task is born with a deadline: a normal window and a grace period. Anything recorded inside the window counts as on time. Inside the grace period, the system requires a written reason. Past the deadline, the task cancels itself and leaves a record. Nobody has to chase anyone to find out.
- It measures, it does not judge: the system records the fact, the reason and who authorized each exception. The judgment is left to you.
- Authorized late entry: anything overdue is only recorded with a supervisor’s sign-off, within 48 hours, and is flagged as such. Never as on time.
- Absences without stoppages: register a stand-in with their dates and whoever covers exercises the authority of the position for as long as it lasts, without reassigning task by task.
- Supervision by exception: the forms you flag wait for the area manager’s sign-off, and they can be rejected with a comment. Correcting means entering again: the previous entry is not deleted.
Every entry, chained with SHA-256.
When a critical entry is saved, Overseer computes a cryptographic seal that incorporates the seal of the previous entry. Altering any past data breaks the chain at that exact point, and verification exposes it.
sha256("GENESIS|company")
= 3f1a…c29eprevious: 3f1a…c29e
hash: 8d47…b1f3previous: 8d47…b1f3
hash: a90c…77e4previous: a90c…77e4
hash: e5b2…04daVerifiable even without us.
Verification requires no proprietary software: with a dump of the audit table and standard SHA-256, any expert witness can reproduce the entire chain. It is the definitive answer to "what if the vendor disappears?".
- Creations, reads, master data changes and domain actions are all audited.
- Automatic nightly verification, plus a permanent status panel.
- Changes show before and after differences field by field.
previous = sha256("GENESIS|" + company_id)
for each block in order:
check block.hash == sha256(previous + block.payload)
previous = block.hash
Your patients and customers see what is theirs. Only what is theirs.
Patients, employees, customers and suppliers reach a read-only portal with their documents, ready to print with their number and seal. Access is resolved from the authenticated user’s identity, never from parameters anyone could tamper with. And every consultation is logged.
- The LFPDPPP right of access, with no extra load on your staff.
- Self-service capture: forms the record holder fills in, sealed like everything else.
- PDF printing of notes, consent forms and entries.
Mexican regulations, turned into system controls.
Overseer does not certify your organization or replace your compliance officer. What it does is implement specific technical controls that support specific requirements of each framework. This table says which ones.
| Reference framework | Control Overseer implements | Status |
|---|---|---|
| NOM-004-SSA3 · Clinical records | Immutable notes, signing blocked without a professional license number, corrections through addenda, structured clinical history and transfer referrals. | Control implemented |
| NOM-004 §10.1 · Informed consent | Versioned templates, signatures from the patient, physician and witnesses, revocation that is added without erasing what came before and documentary tamper verification. | Control implemented |
| NOM-024-SSA3 · Information integrity | A SHA-256 chain per company, read seals, nightly verification and offline reproducibility by third parties. | Control implemented |
| ISO 9001:2015 · Traceability | Before and after differences on master data, a movement log with IP address and location, and versioned documents and structures. | Control implemented |
| LFPDPPP · Personal data | A record holder access portal, audited reads, physical isolation per company and files served only to authenticated users. | Control implemented (right of access) |
| NOM-024-SSA3 · The entry as a receipt | Each sealed entry freezes who answered for it that day: the responsible position, who supervised whoever recorded it, and who the task was assigned to. It is treated like a tax receipt: it does not change even if the people change later. | Control implemented |
| ISO 9001:2015 · Compliance over time | A window with a normal period and a grace period per task, a mandatory reason on anything recorded late, and an identified authorization on anything overdue. The system measures the fact. The judgment stays with the organization. | Control implemented |
| Controlled supplies · Operational support | Dose-level custody of the patient’s medication, losses with photographic evidence, and closing records with a witness, an authorized manager and a notification reference. | Control implemented |
How to read this table. “Control implemented” means the function exists and operates in the product. Full compliance with a standard also depends on each organization’s processes and people and, where applicable, on a third party’s assessment: Overseer does not issue certifications or formal opinions. The SHA-256 seal makes it possible to verify that an entry has not changed since it was sealed and which authenticated user recorded it. It does not, on its own, establish that the original data was true.
Everyone sees exactly what belongs to them.
Role-based access control is checked before any module runs, plus fine-grained permissions by function, such as medication custody, reserved for the designated officer. And a second axis that avoids the permissions screen nobody maintains: who answers for whom is declared once, in the org chart, and from there the authorizations, the review queues and the scope of every report follow on their own.
Administrator
Configures the company, governs access and approvals, and watches over integrity. Full control of their tenant.
Operating staff
Physicians, nursing, supervisors, HR and reception run their modules with no access to configuration. Profiles can be tuned with function flags.
External record holders
Patients, customers and suppliers enter a read-only portal with their own information and self-service capture enabled.
By org chart
Whoever holds a position with people reporting to them authorizes their area and sees its reports. If they are away, a stand-in is registered with dates and whoever covers exercises that authority only for as long as it lasts.
Real screens from the system.
What you see is the real Overseer interface with data from the demonstration environment. These are not mockups.
Designed first for three kinds of operation.
These are usage scenarios for the product, not customer testimonials. Everything mentioned exists in the system today.
Healthcare and hospitals
Hospitals, clinics and residential care homes that must stand behind their records before the health authority.
- Clinical records with notes signed with a professional license number
- Informed consent signed by patient, physician and witnesses
- Dose-level medication custody
- A pre-discharge account connected to your ERP
Industry and manufacturing
Plants that need to show every check was done, on time and by the right person.
- Inspections and work permits, each with its own number
- Shift openings
- ISO findings with evidence
- Measurable compliance per task: on time, within the grace period or late
Construction and services
Field teams that must demonstrate the work done to their customer.
- Site evidence from a phone: GPS location and photographs
- A step-by-step checklist guided by the field bot
- Service orders with the customer’s sign-off signature
- Surveys the customer answers directly
It can also be configured for
Company
Staff, customer and supplier records with documents up to date and evidence of every action taken.
Medical office
Notes signed with a professional license number, structured clinical history and a portal where the patient can consult their own record.
Laboratory
Process forms with their own number and evidence, releases and change traceability for certification.
Human Resources
Onboarding, training, equipment handovers and formal records. Every signature in its place, permanently.
The technical detail is complete and close at hand: open only what you need to review.
Architecture
How the platform is built
For your IT team: channels, access control, business engine and data integrity.
Built to pass your IT team’s review. Deliberately restrained technology: server-side rendering, no fragile frameworks, a minimal attack surface and one central decision: one database per company.
Channels
A responsive web application, a record holder portal, a Telegram field bot and an API for corporate systems.
Access control
Hardened sessions, RBAC checked before any module runs, CSRF protection on every write and anti-impersonation by link.
Business engine
Server-side validation as the single authority, concurrency-proof sequential numbering and atomic stock levels.
Integrity layer
A chained SHA-256 seal written inside the same transaction as the data. Automatic nightly verification, plus on demand.
Security
Security decisions, not promises.
Isolation per company, sessions, file validation, encryption and entries that cannot be edited.
Physical isolation
One database and one file repository per company, with credentials scoped to each client.
Hardened sessions
Session regeneration on sign-in, non-enumerable access messages and CSRF protection on every write.
File validation
The real content type is verified (not the extension), with size limits and downloads always authenticated.
Anti-impersonation
Records are resolved from the authenticated user’s link, never from identifiers in the URL.
Prepared statements
100% of data access uses prepared statements against SQL injection.
Encryption in transit
HTTPS with managed certificates and automatic renewal.
No editing, no deleting
Critical entries have no edit or delete paths at the application level.
Transparency
Known gaps are documented with their plan. A policy of honesty in the face of an audit.
Integrations
It lives alongside the systems you already run.
An API for your ERP and field capture over Telegram.
An API for your ERP
A REST API authenticated with a service token: your ERP consumes clinical supply inventory, movements and the patient account, and confirms invoicing with reconciliation by unique identifier.
Telegram (field capture)
A corporate bot that assigns tasks and guides evidence capture step by step: GPS location with a tolerance radius, photographs and validated data. Everything ends up sealed in its entry.
Documentation
A serious product shows in its documents.
39 documents: playbooks, role guides, the auditor’s manual and the implementation methodology.
Overseer ships with an Enterprise-grade documentation corpus, governed with change control and versioning, just like the system itself.
15 playbooks
Product, functional (38 modules), architecture, security, compliance, administration, support, QA, deployment, API, auditing, sales, executive, implementation and end user.
21 role guides
From the administrator to the custody officer, each profile with its processes, daily, weekly and monthly checklists, indicators and frequently asked questions.
Auditor’s manual
Includes the forensic procedure for offline verification of the SHA-256 chain, eleven audit scripts and the declared limits of the seal, including what the system proves and what is left to the organization’s judgment.
Implementation methodology
Six phases with deliverables and exit criteria: planning, configuration, reconciled migration, pilot, role-based training and go-live with support.
The questions serious teams ask us.
Where does our data live?
In a database exclusive to your company and a separate file repository, inside managed infrastructure. They share no tables and no storage with other clients, and when the relationship ends everything is handed over to you intact.
What happens if the vendor disappears?
You keep your database and your files, and integrity verification is reproducible with standard SHA-256 by any third party, without software of ours. Verifying the integrity of your information does not depend on our existence.
Is the electronic signature the Mexican e.firma (FIEL)?
No, and we say so plainly: it is a digitized handwritten signature plus a cryptographic integrity seal with an authenticated author, timestamp and origin. For most clinical and operational acts it is suitable. PKI integration is planned as an evolution.
Can an entry recorded by mistake be deleted or edited?
No. Critical entries are corrected going forward (addenda, returns, formal records) and everything stays traced. That impossibility is precisely what makes your records withstand scrutiny.
If the system flags an entry as "late", is it pointing a finger at my people?
It is recording a fact, not passing judgment. Every task has a deadline you define, and the system notes whether it was met inside the window, inside the grace period or outside it, with the written reason and who authorized each exception. Whether the delay was justified is your call. In our experience, if everything comes out late, the problem is almost always badly calibrated deadlines, not the people.
If the head of an area changes, do permissions have to be reconfigured?
No. Responsibility is declared by position, not by person: when the holder changes, the chain of command, the authorizations and the review queues adjust themselves. And what was already captured is untouched: each entry keeps who answered for it the day it was made, like a tax receipt.
Do we build the forms, or do you?
We build them, and that is deliberate: it is how server-side validation, sealing and sequential numbering end up correct from day one. You request them from inside the system itself, describing the process, who records it and what data you need, and you follow the status of your request right there. What you do configure is the behavior: who answers for each form, whether it requires review, how it is numbered and who may fill it in.
How does it integrate with our ERP?
Through a REST API authenticated with a service token: your ERP consumes inventory, movements and the patient account, and confirms invoicing with a reconciliation identifier. The technical documentation is delivered during implementation.
How long does an implementation take?
It depends on scope, but the methodology is fixed: six phases (planning, configuration, migration with physical reconciliation, a pilot with real users, role-based training and go-live with support), each with its own exit criteria.
Does it work on phones and tablets?
Yes: the application is responsive for capture on the floor, and field work also has a Telegram bot that guides evidence with GPS and photographs.
Who can see a record?
Only staff authorized by role, and every read is logged with name, date and origin. External record holders reach only their own information, through the portal.
See it running on your own processes.
Book a 30 minute guided demonstration on the real system, with no slides. Bring us your hardest form: we record it, seal it and show it to you in the audit panel, live.
Write to us directly at irodriguez@datamine.com.mx · WhatsApp · Already a client: sign in