powered by
Live · new
Contracts & compliance
cw.costusworx.co.za
The notice date, not the end date
A contracts register for South African businesses. Every contract keeps its signed copy, its owner and the people who need to know — and ContractWorx calculates the date that actually matters: the last day to give notice. The company’s statutory obligations sit in the same register, with the same reminders — alongside who is formally appointed with each regulator, and an assurance dashboard that tests the controls and issues attested audit packs, which can be emailed or opened by the auditor through a time-limited link. One-off checklists, such as a bank KYC refresh, run as projects.
Notice-deadline alertsAuto-renewal roll-forwardSigned copies on fileOwner · IT · Legal21 SA compliance templates8 industry packsRegulatory appointmentsAttested audit packsEmail a pack to the auditorAuditor linksProjects & bank KYC refreshSection accessPDF & CSV register
90/60/30/7day remindersplus once when overdue
1accountable ownerper contract and obligation
21SA compliance templatesCIPC, SARS, B-BBEE, POPIA…
0duplicate emailsidempotent daily job
The problem
What ContractWorx is for
Businesses rarely lose money on the contracts they negotiate. They lose it on the ones that roll over quietly — the licence that auto-renewed because nobody gave sixty days’ notice, the lease option that lapsed. Statutory filings fail the same way: the owner left, or the reminder lived in one person’s calendar. ContractWorx makes those dates structural.
Capabilities
What it does
Counts down to the notice date
- Cancellation-notice deadline = end date minus notice period, recalculated on every change
- Fixed-term, auto-renewing and evergreen contracts
- Auto-renewing contracts roll forward a term by themselves
- Evergreen agreements (NDAs, DPAs) flagged for an annual review
The signed copy, where everyone can find it
- Signed contract, amendments and addenda against the record
- PDF, Word, Excel and images up to 20 MB, checked by content
- Stored outside the web root, served only to that company’s users
- A dashboard tile for active contracts with no signed copy
People on every item
- Exactly one accountable owner per contract and obligation
- Stakeholders, IT and Legal — colleagues or outside advisers
- Everyone tagged gets the reminders for that item
- If an owner leaves, the administrators are alerted instead
South African statutory obligations
- CIPC annual return, B-BBEE certificate, SARS tax compliance PIN
- VAT201, EMP201, EMP501, UIF and COIDA return of earnings
- POPIA Information Officer and PAIA manual
- Insurance, municipal licence and fire certificate — all editable
Evidence per period
- Mark a period complete with notes and proof attached
- The next due date rolls forward by the frequency
- Completion and its evidence succeed or fail together
- A full history of completed periods for the auditors
- Upload up to 10 files at once, 20 MB each; if one is wrong, none go in and the message names it
Alerts that cannot double-send
- Daily job at the company’s own reminder offsets
- One email per person per stage; missed days catch up once
- Failed deliveries retried and flagged to administrators
- Weekly digest to each owner and the administrators
Regulatory appointments
- Who acts for the company with SARS, CIPC, the Information Regulator, COIDA, UIF and more
- Public Officer, directors, company secretary, auditor, Information Officer, s16(2), vehicle proxy (NaTIS)
- Obligations can follow a role: a new vehicle proxy takes over car registrations and licence renewals
- Proof of appointment, regulator reference and a full history of who held each role
- Alerts when a required role is vacant, a term ends or the holder leaves
Industry packs
- Eight packs: road freight, medical devices, medical practices, construction, private security, pharmacy, motor dealers and food
- Each adds the obligation templates, regulators, appointment roles and supplier documents for that industry
- Medical practices: HPCSA fees and CPD, BHF practice number, dispensing, X-ray licence and quality control, healthcare waste, OHSC readiness
- Switched on per company in Settings on Business and Enterprise; every template arrives off until you set its first date
- Drafts until an industry consultant has reviewed them
Assurance & audit packs
- Ten controls tested over every record, rated and scored for the period
- Every exception listed and linked to the record that caused it
- Exco, internal audit, external audit and per-regulator PDF packs
- Attested and frozen: SHA-256 fingerprint on every page, verifiable on demand
- On-time filing by person: due, on time, late and a 12-month record, credited to whoever owned each filing
Email an audit pack
- Administrators send an issued pack from Assurance: one locked PDF, report first, then the evidence in index order
- The password follows in a second email
- FICA ID documents, Word and Excel files and anything the sender cannot open are left out and listed, with the fingerprint where one exists
- Large packs split into parts of up to 10 MB; every send is logged on the Sent page and in the audit log
Auditor link to one pack
- Enter the auditor’s email and choose 7, 14, 30 or 90 days; the invitation carries no code and no document names
- The auditor asks for a 6-digit code by email: valid for 10 minutes, used once, and wrong guesses lock the link
- A read-only page for that one pack: the signed report and each evidence document, opened on its own
- Admins see status, last opened, views and downloads, and the activity log; revoke or resend at any time
Projects: one-off checklists
- “Bank KYC / FICA refresh” template, based on a major bank’s published company FICA list, with a line for every director, signatory and beneficial owner
- Attaches the FICA documents already held and flags stale ones “Out of date: replace”
- Each line has a status, owner, due date and documents; add from ContractWorx or upload, and progress shows as “9 of 13 provided”
- Owners are reminded 7 days before and when overdue; “Send to the bank” bundles a cover checklist and every document into one locked PDF
Section access
- Split compliance into sections, so finance and HR each run their own items
- Everyone still sees a status for the rest: due date, on time or overdue, last filed, owner
- Notes, evidence and names stay with the section that owns them, and admins follow the same rule
- Set up in Settings in minutes; a small company that never creates a section sees no change
Dashboard & register
- Ending in 90 days, notice dates this month, overdue compliance
- A 90-day deadline timeline and “my items”
- Register as PDF for the board and CSV for finance
- Every tile opens a list with exactly that count
Multi-tenancy & administration
- One isolated register per company; groups run one per entity
- Administrator, editor and read-only roles
- Company-wide reminder schedule and timezone
- Cross-company access refused at the query, not the interface
In practice
How a contract runs
01CaptureRecord the contract, its notice period and upload the signed copy
02AssignName the owner, stakeholders, IT and Legal
03RemindEveryone is emailed at 90, 60, 30 and 7 days before the notice date
04DecideRenew, renegotiate or give notice — on time
05EvidenceThe register and its documents export on demand
Under the hood
- PHP 8.x + MariaDB on cPanel shared hosting — no framework, no daemons
- Notice deadline stored as a generated column; all date maths in one tested class
- Idempotent alert log — a missed or doubled cron never loses or repeats an email
- Server-side PDF register; files keyed by SHA-256
- 35 automated suites, 4,102 checks, including tenant and section isolation over HTTP
Security & compliance
- Tenant scope taken only from the signed-in user, never from the request
- CSRF on every change, strict Content-Security-Policy, no inline script
- Uploads checked by extension and content, stored outside the web root
- Login throttling, forced first-login password change, full audit trail
- POPIA lawful basis recorded per company; data hosted in South Africa
Who it is for
- Company secretaries and financial controllers of SMEs and mid-size firms
- Procurement and operations managers who own supplier contracts
- Groups with several legal entities, each needing its own register
- Accounting practices tracking statutory deadlines for clients
- Internal and external auditors, and the Exco and boards they report to
On the roadmap
AI contract reader — dates, notice period and parties from the PDF
Clause obligations, renewal approval workflow and bulk import
ERP / procurement sync API and a calendar feed
See it running, not in a slide
Live demo — a logistics company, a medical device distributor and a medical practice