OVI — Ophis Virtual Intelligence
A compliance readiness platform for NDIS providers that maps practice standards to the controls and evidence that meet them, keeps registers for incidents, complaints and actions current, and works out a readiness score from all of it. Auditors get a time-limited, read-only viewer with full access history. Built as a multi-tenant app with role-based memberships, invitations, and a staff area that doubles as a CRM, with data kept on Australian infrastructure.
Why it exists
NDIS providers are audited against complex, context-dependent practice standards, often with small, high-turnover teams, so audit preparation tends to be manual and gaps surface late. OVI keeps the requirements, the controls and evidence that meet them, and the registers an auditor reads in one place, and works out readiness from all of it.
What it does
- A compliance registry seeded with the NDIS Practice Standards modules, with organisation-level controls and evidence and a readiness score per framework.
- Documents, incidents, complaints, actions and risks registers, including reportable-incident clocks (24 hours or 5 business days) and versioned policies with review cycles and acknowledgements.
- Roles for admins, compliance managers, team leaders and auditors. Auditor access is read-only and always time-limited.
- Evidence-pack ZIP exports, register snapshots and an append-only change history of every insert, update and delete.
- A staff CRM covering leads through to customers: pipeline, contacts, playbook tasks, proposals priced from a price book, and token links where customers accept a proposal, which activates their organisation.
- Work queues, search, calendars, checklists, quick capture and in-app help, plus display settings for text size, spacing, muted colours and reduced motion.
How it's built
- A React 19 and TypeScript single-page app on Vite, with code-based TanStack Router routes and lazy-loaded chunks for everything past the marketing home page.
- Multi-tenant Supabase Postgres, with the schema declared one file per concern. Row-level security and column grants mean clients can only write the fields they own.
- Readiness is derived in the database from controls, evidence and register state, rather than stored as a number someone can edit.
- Schema tests run against a local PGlite database or a real project. Playwright covers desktop and mobile Chromium, alongside Vitest unit tests.
- Email goes out through an outbox on SMTP2GO's Australian API, so customer-facing messages never leave the country.