The controlled wiki.

The problem

Most companies run their controlled documents on a shared drive and a prayer. The handbook quotes an old version of the policy. The client was emailed revision 2 while revision 4 is current. Nobody can say who read what, and the auditor's first question ("show me your document control") starts a week of archaeology.

The system

Boko keeps one live version of every document, pushes controlled content downstream automatically, gates every action with database-enforced permissions, and records everything in an audit trail written by Postgres triggers that no application code can bypass. It is invite-only: internal staff and external clients each see exactly what they are granted, and external users can never see each other.

IN PRACTICEOne workspace holds the quality manual, HR policies, project documents and client deliverables. The auditor gets an evidence pack in one click. The client scans a QR code on a printout and lands on the live version.

The platform

Next.js 16 web application. One Supabase Postgres database per customer: fully isolated data, auth and storage, with Row-Level Security enforcing permissions at the database layer. A Windows desktop app (one installer, ARM64 and x64) with offline editing. Live in production with real tenants today.

The editor

Notion-style blocks: three heading levels, bullet, numbered and to-do lists, quotes with auto-styled attribution, code, tables with resizable columns (the toolbar switches to add-row and add-column when your cursor is inside one), images pasted or dragged straight in, links, alignment, font family and size, text colour, highlight, find and replace, footnotes, cover pages and tags. Autosave fires about a second after you stop typing; the badge shows Saved, Saving or Unsaved changes.

Moving at speed

Ctrl+K opens a quick switcher to any document by title. Type [[ to link to another document or section; headings carry stable, shareable URLs, and a backlinks panel shows what points here. Drag documents and folders around the sidebar tree; favourites and an active-document marker keep your place.

Templates

Reusable document structures, edited with the full editor. Start a new document from one, or hand one to a control section so generated children arrive with their own sections around the synced content. Any existing document can be captured as a template from its toolbar.

Comments, mentions and presence

Margin comments anchor to a passage. Mention a colleague and they get an email linking to the document; mail failures never block the comment. Avatars in the toolbar show who else is in the document right now. When someone else saves, your view refreshes if you have no unsaved edits; if you do, a warning offers their version so nobody silently overwrites anyone.

Attachments, gated at the storage layer

Files attach to a document in a private bucket. Downloads use short-lived signed URLs and the document's Read & Download permission gates them at the storage layer, not just in the interface. Every download is audit-logged. Inline images are access-controlled too: they load only for people who can read the document.

Import Word and PDF, with OCR

Import a .docx and its headings, tables and images carry across in place. A PDF with a text layer imports as text. A scanned PDF is read with OCR into editable text, with each page kept as an image afterwards so diagrams the OCR cannot read are not lost. Titles are tagged (editable) or (images only) so you can tell at a glance.

IN PRACTICEYour existing quality manual, sitting in eleven Word files and four scanned PDFs, becomes a searchable, controlled library in an afternoon.

Control sections: push

Select content in any document and click Control section. Name the child (and optionally give it a template). From then on, every save of the master creates the child if it does not exist, refreshes the child's blue locked regions with the marked content, and leaves everything else in the child untouched: its title, its own sections, anything its editors wrote.

One master can feed several children; several sections can feed one child. Chips above the master link to its children and a banner in each child links back. Unmark a section and it stops syncing; remove the last one and the child detaches into a normal document. Nothing is ever deleted automatically.

IN PRACTICELegal updates the indemnity clause in the master services agreement once. Every live client agreement built from it carries the new clause the moment the master is saved, and the audit log shows exactly when each child re-synced.

Section embeds: pull

Where control sections push, embeds pull. Type /embed, pick a source document and a heading, and the whole section drops in as a read-only block fetched live from the source every time the page opens. Edit the master and every embedding document updates. Embeds render inline in exported PDFs, so a controlled copy contains the real text.

IN PRACTICEA project overview pulls the Statement of Confidentiality, Scope and Stakeholders straight from the project master. Four documents quote those sections; none of them can drift.

Permissions, enforced where it counts

Every document and folder carries three independent rights: Read & Download, Edit, Delete. Each can be granted to all internal users, all external users, or named individuals. Folder permissions cascade to everything inside. External users start with nothing. The rules live in Postgres Row-Level Security, so they hold in the web app, the desktop app and the API alike.

Public share links mint read-only access without an account: 7 days, 30 days or no expiry, revocable at any time, with an unguessable token checked in the database.

IN PRACTICEThe M&A folder is visible to your legal team and the counterparty's named advisors. The counterparty's advisors cannot see, or even infer the existence of, your other external users.

Version history

Boko snapshots a document automatically when it changes, at most once every ten minutes. Preview any version and restore it in one click. Restoring snapshots the current state first, so a restore can itself be undone. Zero data lost, in any direction.

The round

Pick approvers per document, or apply a saved approval route such as Operational policies. Send for review locks the document and notifies each approver. Each one reads, types their name and clicks Approve. The moment the last signature lands, the document goes Effective. Any approver can reject with a comment; the owner can recall. Either reverts to Draft and clears prior signatures.

The log, with diffs

The approval log lists who edited and who approved since the round began. Every edit row has a Show changes button that opens a diff of exactly what changed in that save: added lines green, removed lines red, pulled from the version snapshot.

Periodic review

Effective documents carry a next-review date, flagged when overdue. Still current? Mark reviewed (no change) stamps who and when, advances the date by the review interval and writes the audit trail, without minting a needless new version.

An audit trail nothing can bypass

Every view, download, create, edit, delete, permission change, role change, approval and share is recorded by Postgres triggers at the database level. The audit table has no update and no delete policies: rows are immutable. Admins filter by person, action and document and export CSV; editors see recent activity at the foot of each document.

Acknowledgements

Mark a document Requires acknowledgement and, once effective, every reader sees a banner: "I have read and understood." Per document you see how many readers have signed and exactly who is outstanding, with anyone left on an older version flagged after re-approval. Recurring re-acknowledgement every N months is supported, and the weekly email reminds each person what they still owe.

IN PRACTICENew lifting-operations procedure goes Effective on Monday. By Friday you know 34 of 41 crew have signed, you have the seven names that have not, and the CSV for the safety file.

Attestation campaigns

Bundle documents with a due date and an audience: a quarterly policy refresh, an onboarding pack. People sign at the document itself, exactly as normal, so a campaign adds no extra ceremony. The detail page shows a completion matrix, an "X of Y targets complete" summary and an overdue badge; the weekly email chases with direct links.

The compliance dashboard and the evidence pack

Reviews overdue, lifecycle breakdown, approvals in progress, orientation completion, classification mix, acknowledgement coverage, usage. A per-person scorecard rolls up who owes what, sorted worst-first. One click produces the Evidence pack, a branded compliance PDF; a whole folder exports as a single branded document pack.

Risk register

Each risk scores likelihood × impact (1 to 25, heat-coloured) with a treatment, a residual score, an owner, a status and a review date. Link every risk to the documents that govern it, so the control and its policy stay connected. Project-level dashboards add a heat map, rating breakdown and priority bands. The register summary feeds the Evidence pack.

Incidents & CAPA

Log nonconformances, incidents and observations: severity 1 to 5, status from open to closed, reporter, owner, root cause. Attach corrective and preventive actions, each with its own kind, owner, due date and status, and track them to closure. Link incidents to the documents and risks they concern. Open incidents and overdue CAPA surface on the dashboard.

IN PRACTICEA near-miss on site becomes an incident, its root cause an out-of-date permit procedure, its corrective action a revision of that document, and the auditor can walk the whole loop in four clicks.

Gap analysis against a framework

Define a framework (ISO 9001, or your client's supplier code) as clauses with references and descriptions; bulk import supported. Run gap analysis and Boko matches every clause against your library by meaning, using the same semantic embeddings as search. Each clause lands as covered, partial or gap, with the best-matching documents linked in a coverage matrix that respects permissions.

Retention, legal hold, disposal

Set a retain-until date or a period in months (derived from the effective date). An admin can place a legal hold that blocks disposal, enforced in the database. Records past retention and not on hold queue in the disposal area; disposal is soft and fully audited, kept as evidence, never hard-deleted, and separate from the recycle bin.

Three kinds of search

Full-text: titles and the complete text of every document you can read, including the text inside attached files (Postgres tsvector, GIN index). Semantic: find documents by meaning, permission-scoped. Related documents: each document surfaces its nearest neighbours. Results never include a hit you could not open.

Sessions and lockdown

Settings lists every signed-in device: browser, OS, IP, last active, with an aal2 badge on two-factor sessions. Sign out any device or all others. Admins review anyone's sessions and sign them out everywhere; for an urgent lockout, deactivating the account blocks new sign-ins immediately.

Usage analytics

Per person: last login, sign-in frequency over 7, 30 and 90 days, active days, devices, words written, comments. A new-IP flag marks unfamiliar sign-in locations and a "needs attention" list names accounts gone quiet. Weekly-actives trend, login heatmap by day and hour, document and comment engagement, and a Monday digest email to admins.

Orientation, quizzes and performance

Structured onboarding reading lists with completion tracking, plus a quiz builder for comprehension checks. An optional performance module runs OKRs: objectives with measurable key results, role-suggested metrics, manager-locked targets (you cannot lock your own, enforced in the database) and check-ins with status. Modules switch on per tenant.

Desktop and offline

One Windows installer picks ARM64 or x64 automatically. Lose connection while editing and the badge switches to Offline, queued; edits store locally and flush the moment you are back online.

One deployment, isolated tenants

One codebase serves many companies, and every customer gets its own Supabase project: fully isolated Postgres, auth and storage, resolved from the request host. No shared tables, no cross-tenant risk, feature modules per tenant.

Ask Boko a question

A chat panel answers from the documents you personally are allowed to read, and cites the documents it drew the answer from. It is grounded: it answers from your library rather than from general knowledge, and says so when the library does not contain the answer. Separately, search offers a semantic mode that finds documents by meaning rather than keyword, so "what do we do if someone is hurt on site" finds the incident procedure even when it never uses those words.

It leaves the building properly

Export any document to Word or PDF, with section embeds resolved so a controlled copy contains the real text rather than a placeholder. Export a whole folder as a single branded pack with a cover and contents page, which is how a quality manual gets issued. Effective PDFs carry a QR code back to the live version, so a printed copy can always be checked against the current one.

Watermarks that state the document's status

Every exported PDF is stamped according to where the document actually stands: DRAFT before approval, CONFIDENTIAL or RESTRICTED on effective documents carrying that classification, and SUPERSEDED or OBSOLETE once retired. Effective PDFs close with an electronic approval signatures block listing each approver, their decision, and the timestamp. A document found on a desk can be judged on sight.

The document register

The register an auditor asks for by name: every document with its number, status, owner and review date, sortable, searchable and exportable to CSV. Alongside it, saved views built with a rule builder rather than code, so "every effective HSE document overdue for review" is a saved link you open, not a hunt you repeat each quarter.

What you owe, in one place

The home dashboard opens on Needs your attention: documents waiting on your signature, reviews you own that are due, orientation you have not acknowledged, and updates on documents you watch. An inbox collects mentions and notifications alongside it. Every Monday a digest email goes to each person listing only what is genuinely outstanding for them, and to admins a usage digest for the tenant. People who owe nothing are not emailed.

Superseded is a real state, not a label

When a replacement document is approved, the one it replaces is moved to superseded automatically, and the two are linked in both directions so the lineage is walkable. Retired documents become obsolete rather than vanishing. Deleting is never the same act as disposing of a record: everyday deletions go to a recycle bin recoverable for 60 days, entirely separate from the formal retention and disposal schedule.

Writing it is meant to be pleasant

A slash menu puts every block one keystroke away, the way a modern editor should. Comment threads can be resolved and reopened, and resolved threads stay attached to the document rather than disappearing. Drag the tree to reorganise, star what you use daily, and let the autosave handle the rest.

The forum that teaches the wiki

An internal Q&A forum with threads, replies and upvotes, so field knowledge has somewhere to land before it is polished. A human marks the best answer, and one click promotes it into a controlled document: deliberately the largest reputation reward in the forum, because turning a field answer into repo knowledge is the behaviour it exists to encourage. Promoted answers join the library that search indexes and Ask Boko cites, so the assistant learns only what a person has approved. Reputation is written server-side only; nobody can award themselves points. Internal today; opening the forum to external users is planned.

Live in production

Boko is not a prototype. It runs a multi-entity professional services group day to day, with external client users, live compliance workflows and audit-log export for regulatory review, across a growing estate of separate tenants.