Building Safety Act Compliance Documentation Pipeline: Automate the Golden Thread

Fieldwire

Procore

Commusoft

Google Workspace

n8n

What the golden thread actually is

The golden thread is a single digital chain of safety information, design, build, operate, demolish.

The golden thread is the record that proves a higher-risk building is safe. Section 88 of the Building Safety Act 2022 sets the legal basis, and the Higher-Risk Buildings (Keeping and Provision of Information etc.) (England) Regulations 2024 set what has to be in it. A higher-risk building means residential blocks of 18 metres or more, or seven storeys, with at least two dwellings.

The information has to be electronic, structured, transferable between dutyholders and tamper-evident. Every change needs a name and a date attached. The chain runs from RIBA Stage 0 through to demolition, and the accountable person has to hand it to the next owner intact.

What it actually contains is more practical than the legal language suggests. Fire safety strategy, structural calculations, RAMS for hot works, MEP commissioning records, building control approvals, certificates of compliance for every regulated trade, change requests, photographs at key construction stages, and ongoing maintenance and inspection logs after occupation. The Building Safety Regulator can request any of it at any time. When it comes to enforcement, the BSR has not been shy.

Why manual document control fails

The temptation is to keep doing what the industry has always done. Shared drives, email chains, the engineer takes a photo, sends it to the supervisor, the supervisor saves it in a folder, the folder gets renamed three months later and the photo cannot be found. Multiply that across 18 months of construction and you end up with the situation Matt Voyce at Quintain described as challenging, frustrating and costly.

The Building Safety Regulator publishes its Gateway 2 statistics and the picture is brutal. Between October 2023 and March 2025, 1,089 decisions were made. Only 31 percent were approved. Forty four percent were rejected as invalid before assessment even started. Thirteen percent were rejected on review. Eleven percent were withdrawn. The single biggest reason for invalidation is not bad design. It is what the BSR calls evidence architecture, how information is assembled, attributed, sequenced and submitted.

A paper-first approach scales badly. The golden thread is built once, then maintained for 15 years.

The pattern repeats itself across the rejected applications. Drawings without revision numbers. Risk assessments signed by a director who left the company two years ago. Inspection photographs with no GPS tag, no date stamp and no link back to the work package. Commissioning records held by a subcontractor who has since gone into administration. Fire stopping records sat on an engineer's phone.

The data captured on site is usually fine. The problem is what happens to it next. Field photos sit in WhatsApp groups. Certificates get printed, signed, scanned and emailed. Risk assessments live in version twelve of a Word document that nobody is sure is the latest. A pipeline fixes this by removing the human gap between capture and archive. The engineer takes the photo in Fieldwire, it appears in Procore tagged to the right drawing, the inspection record syncs to Commusoft, and a copy of everything lands in a structured Google Drive that mirrors the BSR's expected format. You do the data entry once, in the field, on the device you already have.

If you want to understand the wider regulatory and cost picture before reading this guide, the Building Safety Act compliance requirements article covers dutyholder duties, gateway fees and the Building Safety Levy. That is the strategy piece. This article is the plumbing.

The four-tool stack

Every platform in this pipeline does one job, and one job only. Trying to make any single tool do all of them is where most teams come unstuck.

Fieldwire handles the field. Plans on a tablet, snags pinned to drawings, photographs with location metadata, tasks assigned to specific operatives. It is the layer the engineer actually touches. Fieldwire was acquired by Hilti in 2018, so the integration roadmap is good and the mobile app is one of the better ones on the market. UK pricing in 2026 is £33 per user per month on Pro, £50 on Business, £67 on Business Plus.

Each platform earns its place. Fieldwire for capture, Procore for control, Commusoft for service, Google Workspace for archive.

Procore is the master document store. Drawings, RFIs, submittals, change orders, all version-controlled with an audit trail that the BSR will accept as evidence architecture. Procore is expensive. Small contractors with around £4M turnover typically pay between £6,000 and £12,000 a year. Larger general contractors easily clear £25,000. You are paying for unlimited users, which matters because the golden thread has to be visible to clients, designers, subcontractors and inspectors, not just your own staff.

Commusoft covers the service side. Once the building is occupied, the golden thread has to keep growing. Every fire door inspection, sprinkler service, lift maintenance visit and gas safety check needs to land in the record. Commusoft starts at £59 per office user per month in the UK, with engineer licences on top. Daily and monthly rolling licences are available for subcontractors, which is useful for the principal contractor model.

Google Workspace is the archive of record. Business Standard at £11.80 per user per month gives 2TB of pooled storage and the Shared Drives that make the 15-year retention requirement manageable. You are not relying on Google as the source of truth, but it is the place that holds the immutable, time-stamped copy of everything the BSR could ever ask for. VAT at 20 percent is on top.

n8n is the connective tissue. Self-hosted on a £5 a month VPS or n8n Cloud Pro at £20 a month, n8n moves data between the four platforms on a schedule and tags every transfer with a structured filename, a timestamp and an audit log. The whole automation layer costs less than one Procore licence.

Prerequisites and accounts you need

Before the integration work begins, check the following.

• Active Fieldwire Business or Business Plus subscription. Pro will not give you the API access you need.
• Active Procore subscription with the API marketplace enabled. Speak to your Procore success manager to get an API client ID and secret created.
• Commusoft account on the Customer Journey or Automation plan. The base Go Paperless plan does not include the open API.
• Google Workspace Business Standard or above on a UK domain. Business Starter only gives you 30GB per user, which will run out by month four.
• n8n instance. Either self-hosted on a Hetzner or Digital Ocean VPS, or n8n Cloud. The Starter Cloud plan at around £15 a month is enough to begin with.
• An accountable person nominated in writing. The BSR Regulations require this. Without it the pipeline has no legal hook.
• A document control policy that maps to your folder structure. Two pages is plenty. Write it before you build anything.

Setup step 1: Fieldwire as the field capture layer

Fieldwire is the layer that engineers will use every day. The setup decisions you make here propagate through the whole pipeline, so spend an extra hour getting it right.

Create a project per building. Inside the project, upload the latest revision of every drawing you have. Fieldwire automatically generates a hyperlinked plan view, which becomes the canvas for every snag, task and inspection point. Tag each drawing with its revision number and date in the file metadata. The BSR will check this.

Fieldwire on the tablet is the layer that engineers actually touch. Capture happens once, in the field.

Configure your task templates. For a higher-risk building you need at least the following: fire stopping inspection, structural fixings sign-off, MEP commissioning record, RAMS sign-on, hot works permit, and snag closure. Each template should have mandatory fields for the photographs, the date, the operative name, and the drawing reference. If a field is blank, the task cannot be marked complete. This is the single biggest behavioural lever you have.

Generate the API key under Settings, Integrations, Developer. Copy it somewhere safe and never put it in a shared spreadsheet. Note the workspace ID and the project IDs you want to connect, the IDs are needed for the n8n nodes later.

Enable the photo metadata feature. Every photograph captured in Fieldwire gets a GPS coordinate, a timestamp and the operative ID embedded in the EXIF data. This metadata is what makes the photograph admissible as evidence. Turn off the option to allow gallery uploads, photographs taken in the moment carry the metadata, photographs sourced from the gallery do not.

Setup step 2: Procore as the master document store

Procore is the single source of truth for drawings and contractual documents. You configure it to match the folder structure the BSR expects to see, and you let it do version control automatically.

Build your document folder tree to mirror the BSR's golden thread index. The structure I use is: 01 Design Information, 02 Construction Plans, 03 Risk Assessments and Method Statements, 04 Inspections and Sign-offs, 05 Test and Commissioning Records, 06 Building Control and Approvals, 07 Certificates and Declarations, 08 Handover Information, 09 Operations and Maintenance, 10 Change Control. Inside each folder, subfolders by RIBA stage or by trade. Keep the numbering. It makes the structured archive intelligible to an inspector who has never seen your project before.

Set the document permission scheme so that only the document controller can move or rename files. Engineers and site staff get upload-only rights to their relevant folders. This stops the most common cause of evidence loss, an operative accidentally overwriting a file with an earlier version.

Turn on the change log. Procore automatically records who uploaded what and when, which is the audit trail you need. Export the change log monthly to your Google Drive as a CSV. The n8n workflow will handle this automatically once it is built.

Generate the Procore API client. Go to Company Admin, Apps and Integrations, Developer Settings. Create an OAuth 2.0 client with read and write access to the documents and projects endpoints. Note the client ID, client secret, and the company ID. These three values are what n8n needs to authenticate.

Setup step 3: Commusoft for service and handover records

Commusoft is the layer that keeps the golden thread alive after handover. The BSR Regulations are explicit that the record has to keep growing for the life of the building. Every six-monthly fire door inspection, every annual fire alarm test, every quarterly emergency lighting check needs to be logged with a date, an operative and a result.

After handover the record keeps growing. Every inspection, every service visit, every certificate.

Configure custom job types for each golden thread category. At minimum: fire door inspection, sprinkler service, dry riser test, emergency lighting test, fire alarm service, lift LOLER inspection, gas safety check, electrical periodic inspection. Each job type carries a custom form with the BSR-mandated fields and produces a PDF certificate at completion.

Enable the customer database link to your Procore building records. Each building in Commusoft should reference the project ID in Procore. This is what allows n8n to copy a service certificate into the right Procore folder automatically. If your service team and your construction team use different naming conventions, fix that now. The pipeline will not fix it for you.

Generate the API key under Settings, Integrations, API Access. Commusoft's API uses key-based authentication, which is simpler than OAuth but means you need to rotate keys every 12 months as a security policy. Diary that.

If you want a wider view of how Commusoft connects into broader business reporting, the Commusoft, Sage and n8n profit and loss dashboard guide is worth a read once you have the compliance pipeline running. It uses the same API and the same n8n patterns.

Setup step 4: Google Workspace as the archive of record

Google Workspace is the immutable, off-platform copy. If a contractor goes bust, if Procore changes its pricing model, if a key staff member walks out with their laptop, the archive is what survives. The golden thread duty does not allow you to lose information because a supplier failed.

Create a Shared Drive per building. Shared Drives differ from a personal My Drive in two important ways. The content does not disappear if the creator leaves the company, and you can apply organisation-wide retention policies through Google Vault. Both matter for a 15-year record.

Mirror your Procore folder structure inside the Shared Drive. Same numbering, same naming convention. The n8n workflow will create the folders automatically, but agree the structure first so you can spot any drift.

Set up a service account in the Google Cloud Console. Enable the Google Drive API and the Google Sheets API. Generate a JSON credentials file. This is what n8n uses to authenticate, and it gets stored once in n8n credentials and never seen again.

Add Google Vault retention rules. Set the rule to retain everything in the building's Shared Drive for the duration of the regulatory period, plus a buffer. I usually set 20 years just to be safe. Vault is included in Business Standard and above.

Setup step 5: n8n as the connective tissue

n8n is where the pipeline actually lives. The previous four steps were about preparing the platforms. This step wires them together.

n8n is the connective tissue. Each node moves a specific document or record from one platform to the next, with an audit log at every hop.

Spin up an n8n instance. I prefer self-hosted on a £5 Hetzner CX11 VPS with Docker, which costs roughly £60 a year and gives you unlimited workflows. n8n Cloud Starter at around £15 a month is simpler if you do not want to maintain a server. Both work for this pipeline.

Add your four sets of credentials. Fieldwire as a generic API key in Header Auth, Procore as OAuth 2.0 with the client ID, client secret and OAuth URL from their developer docs, Commusoft as a generic API key, Google Workspace as a service account JSON. Store nothing in plain text inside a workflow node.

Now build the four core workflows. Each one runs on its own schedule and has its own audit log.

Workflow 1, Fieldwire to Procore. Every 15 minutes, n8n polls the Fieldwire API for new tasks marked complete. For each task it pulls the attached photographs, downloads them with their EXIF metadata intact, and uploads them to the matching Procore folder. The Procore filename follows the agreed convention, including the task ID, the drawing reference and the date. A log entry is written to a Google Sheet so you have a record of every transfer.

Workflow 2, Procore to Google Drive. Every hour, n8n queries Procore's document change log. New or updated files get copied to the matching Shared Drive folder, with the Procore version number appended to the filename. The Google Drive copy is immutable by permission scheme. Even the document controller cannot overwrite it.

Workflow 3, Commusoft to Procore and Google Drive. Every two hours, n8n pulls completed service jobs from Commusoft. The PDF certificate gets uploaded to both Procore (folder 09 Operations and Maintenance) and the Google Drive archive. The Commusoft job ID is appended to the filename for traceability.

Workflow 4, the daily integrity check. At 02:00 every morning, n8n runs a reconciliation. It counts records in each platform and compares them. If Procore has 412 documents in folder 04 and Google Drive has 410, n8n flags the gap, identifies the missing files, and writes them across. If a file exists in Google Drive but not in Procore, that is logged separately, because it suggests someone has bypassed the pipeline and uploaded directly to the archive.

The complete workflow, end to end

Walk through what happens when an engineer completes a fire stopping inspection on site.

1. Engineer opens Fieldwire on the tablet, navigates to the fire stopping task pinned to drawing A-105.
2. Engineer captures four photographs of the completed sleeving, including a tag close-up showing the manufacturer and CE mark. The photographs carry GPS, timestamp and operative ID in EXIF.
3. Engineer fills the mandatory inspection form. The form will not submit if any field is blank.
4. Engineer marks the task complete and signs digitally.
5. Within 15 minutes, n8n picks up the completed task. It pulls the photographs and the inspection form, renames them per the convention, and uploads them to Procore folder 04 Inspections and Sign-offs, in the Fire Stopping subfolder, linked to drawing A-105.
6. Procore logs the upload, the document controller gets a notification.
7. Within an hour, n8n pushes a copy of the inspection record to the Google Drive Shared Drive, into the matching folder. The Google Drive copy is read-only.
8. The Google Sheet audit log records: task ID, time of completion, operative ID, file count, total size, target folders, success flag.
9. If anything fails at any step, n8n sends a Slack alert to the document controller and writes the error to the audit log.

Total elapsed time from photograph captured to immutable archive copy stored: under 75 minutes. Total human touches after capture: zero. Total opportunity for someone to lose the file, save it to their personal drive, or rename it: zero.

Testing the pipeline before you trust it

Do not go live across a real building until you have stress tested the pipeline. Use a sandbox project in Fieldwire and a test Procore project for a week.

Create 50 test tasks across different types. Complete them on a real tablet, in the actual location where engineers will use the system. Fast wifi in the office is not a realistic test, walk down to the ground floor of an underground car park if you can. Capture genuine photographs, not screenshots of a brick wall.

After 24 hours, run the integrity check manually. Every Fieldwire task that was marked complete should have a corresponding Procore document. Every Procore document should have a corresponding Google Drive copy. Every transfer should have a Google Sheet log entry. If any of those numbers do not match, find the failure point and fix it before you scale up.

Force errors deliberately. Disconnect the tablet wifi after submitting a task. Submit a task with an oversized photograph (above 25 MB). Submit ten tasks within the same second. The pipeline should handle all of these without losing data. If it loses data on a deliberate stress test, it will lose data on a real Tuesday afternoon when nobody is watching.

Once you are happy, document the entire pipeline in your document control policy. Include the workflow IDs, the schedule frequencies, the audit log location, and the named person responsible for monitoring. The BSR will ask for this.

Troubleshooting the common failures

Cost analysis versus a manual approach

Run the numbers on a 50-unit higher-risk residential block built over 18 months by a contractor with 12 site staff.

Manual approach. A full-time document controller at £45,000 a year, plus 25 percent of an engineer's time per week on documentation admin across 12 engineers, plus the cost of rework when documents are lost. Direct cost over 18 months: roughly £67,500 for the document controller, plus £93,600 in engineer time at £40 per hour, plus an estimated £15,000 in rework. Total: £176,100. And a 69 percent chance the Gateway 2 submission gets bounced first time, which adds three to five months of programme delay at thousands per day.

Pipeline approach. Fieldwire Business at £50 per user across 12 users for 18 months: £10,800. Procore at the mid-tier for a small contractor: roughly £14,000 over 18 months. Commusoft for the service and handover phase, six engineers at £59 per month for six months: £2,124. Google Workspace Business Standard at £11.80 per user across 14 users for 18 months: £2,973. n8n self-hosted: £90. Setup labour, two days of an integration specialist at £600 per day: £1,200. Total: £31,187.

The pipeline approach saves £144,913 over the build, on the basis of direct cost alone. The bigger saving is the one that does not appear on a spreadsheet, the avoided rejection at Gateway 2 and Gateway 3.

What people in the industry are saying

Recommended videos

Golden thread webinar (April 2024)

Building Safety Regulator and the Construction Leadership Council

BSR Conference 2024: What is the golden thread of information?

Building Safety Regulator

Building Safety Webinar 2: Information Gathering and The Golden Thread

Ben Blackwood and Dr Brian Cox

Fieldwire Review and Demo: Best Construction Management App?

Construction software review

Construction Documentation Collaboration in Procore

Procore Technologies

Commusoft Tutorial for Beginners: Master Field Service Management

Commusoft

Frequently asked questions

My verdict