The first step has a price

AU$8,000. That is the number the finance lead at a 40-person civil contractor needs before anything else, because it decides whether the pilot is a purchase they can approve or a proposal that goes to the next board meeting. Until this week the pricing page opened on the Free plan and the pilot had no number on it, so the first conversation with a project manager who wanted to try Demiton ended with the question nobody in the room could answer. The project manager could see the variation windows closing on their own jobs. The person who signs the cheque could not see what the first step cost. A pilot starts when someone can say yes to it without a meeting.

The pilot, priced

The pilot is six weeks on your own mail. Demiton installs the Outlook add-in for the whole organisation, at least five named people use it on live jobs, and at week six you get a plan.

In Ireland the pilot is EUR 4,650 ex tax, and in New Zealand NZ$8,700 ex tax. The fee credits against the implementation, never the licence. The pricing page also says what the implementation does not cover and is quoted separately: a new adapter, a standard outside the library's release, data cleanup, training and travel. The Free plan stays, for one job under AU$2M, and is now the second way in rather than the first. The details are on the pilot page.

Demiton for Outlook went to Microsoft

Last week's update listed four things between the listing and Microsoft's review. On 19 October the listing, Demiton for Outlook, was submitted, and it is now waiting on Microsoft's certification. When it is approved, anyone in an organisation that allows store add-ins can add it from Outlook, and the date goes here. Until then, an organisation's Microsoft 365 admin installs it from Demiton's manifest link. Ask us for it.

699 obligations, each checked as it stood on the day you signed

The library holds 699 obligations from 126 instruments, up from 447 from 88 a week ago.

• The SWMS duties in the last three. The 12 October update added the safe work method statement duties of five states and territories and said the other three were next. The WHS Regulations of Western Australia, Tasmania and the Northern Territory are in, 30 obligations with their high risk work licence duties, so every state and territory is covered. Like the other five, they cannot be checked yet: no register Demiton reads holds a safe work method statement.
• Rail. The Rail Safety National Law, 26 obligations.
• CLOCS-A Bronze. CLOCS-A grows from 14 obligations to 30 with the Bronze requirements on operators.
• CLOCS for England. The CLOCS Standard, version 5, 25 obligations, for jobs in England whose contract names it.
• Germany, France and Washington State. 155 obligations from their construction contract, payment and site safety law. A job cannot be placed in those three yet; the law is read first.

Regulations change partway through jobs. A job signed in March is bound by the version of a duty in force in March, even if the regulation changed in June, and checking it against the June version raises alerts it cannot act on. Demiton now holds each version of an obligation with the date it came into force, and measures a job against the version in force on its contract date. Where an event starts the duty, the event's date decides. If the contract date is not on the job, Demiton says that date is missing instead of picking one. A job is measured against the rules it signed up to.

Library releases now ship when they are ready, not on the first Monday of a quarter. An obligation the library does not hold, and you did not add, is not protected.

Ask Demiton says what it left out

On a job with 252 site diaries, asking for every diary date returned 14 rows, and the answer did not say any were missing. That is fixed, along with the other ways an answer could look complete when it was not:

• A summary says it is one, and lists every date it covers.
• A named person or machine that the records cannot be filtered by returns no rows and a suggestion to search by name. Before, it could return 40 diaries about other people.
• A search matches every word, in any order.
• A slow question stops at 20 seconds and says the answer is partial. An empty partial answer does not mean the thing is not there.

Also this week

• A practice run before a connection fills anything. When you connect a system, the success screen now offers to read one register and save nothing. It reports done, failed, timed out or nothing to read. A slow source shows as timed out, not failed, and a source that hides an error behind an empty reply shows as failed, not as a quiet success with zero records.
• Tablets. The app runs on iPad, Android tablets and unfolded foldables, with the chat list pinned beside the conversation. Phones stay portrait. The iPad layout reaches the App Store with the next release.
• Signed approvals know a person, not a login. You enrol your mobile with a six-digit code sent by SMS, good once and for ten minutes. Evidence submitted under one login and approved under another by the same person is refused, so four eyes means two people.
• Every amount carries its currency. Your organisation records the currency it works in, and totals are kept per currency, never added across currencies.
• New guides on demiton.io: the SWMS builder, which assembles a scaffold for any state or territory from the library's own rows and leaves the controls and site details blank; the CLOCS-A hub with its Bronze chapter, CLOCS-A against TS 00088, the heavy vehicle pre-start checklist and the traffic and logistics management plans; CLOCS for England; and the Australian rail safety chapters.
• How it works, rebuilt around contract, obligation, protection, register and system, on one TMR clause.

Fixes and security

• Audit findings closed. The 63 findings from two rounds of tenant-isolation and account-safety audits are fixed in production, and so are the nine leads a third round confirmed.
• Alerts while an attack is under way. Five security alerts now reach Demiton's operator in real time, among them bursts of probing requests, unusual role grants and newly registered OAuth clients.
• Public signup. Signup can be closed with one switch, Demiton records which version of the terms each person accepted, and you can delete your account from the web profile. An organisation's sole owner hands over ownership first.
• A public status page. status.demiton.io is live with four components and email subscriptions. Its incidents are written to Demiton's own record, which availability is measured against.
• Row-level security policies are on every customer table in the database. They become the enforced boundary when the application switches to its restricted database role.

For integrators

If you call Demiton's API directly, three changes matter. Ask Demiton through Claude or another AI assistant is not affected.

• One catalogue. GET /api/v1/ontology lists 17 verbs, 481 resources and 105 actions. The hand-written routes it replaced are gone.
• Amounts no longer name a currency. A field such as value_aud is now value, with a currency field beside it.
• Registers have their own paths. /api/v1/registers/* replaces /api/v1/shelves/*. The old paths still answer, with a Sunset date of 21 January 2027.

What's next

Microsoft's certification of Demiton for Outlook. iPad screenshots and the next App Store release. A register for safe work method statements, so the SWMS duties in all eight states and territories can be checked.

And still the one this series is waiting to report: a protection that fires on a live job, catches something real, and is signed off with cash recovered. The pilot is how that job gets connected. It now costs AU$8,000 and six weeks, and one person can say yes to it.