SOP and GO
SOP management made simple.
A high-integrity, self-hosted SOP system for labs and small research teams — where procedures matter, but full-scale QMS software is unnecessary, expensive, or obstructive.
New here? Ask your admin for an account, then use the sign-in or invite link they share with you.
At a glance
- SOPs Versioned Markdown, immutable history, search and organization.
- Proof Acknowledgments tied to exact published versions — not moving targets.
- Host One stack you run yourself; content stays on disk in readable files.
Built for how labs actually work
sopandgo treats SOPs as structured, versioned documents with explicit acknowledgment, auditability, and cryptographic integrity checks — while staying lightweight, transparent, and entirely self-hosted. It is for teams that need traceability without taking on a full quality management suite.
Simple SOPs
All standard operating procedures in one place. Versions are immutable and searchable. Acknowledgments are tied to exact versions — not moving targets after someone edits a file share.
Complete control
No cloud dependency or proprietary format lock-in. Content lives on disk as Markdown and assets you can read without the app. Style and structure procedures with Markdown, then export, back up, or migrate on your schedule.
Built for traceability
Tamper-evident, hash-chained audit logs; SHA-256 verification for version and asset files; explicit acknowledgment tracking per version with role-based access control enforced on the server.
Simple deployment
Run with Docker Compose: one application image (Caddy, Go API, SvelteKit), optional Gotenberg for PDF, one published port, and one data directory. See the deployment guide for the full environment reference.
Security-first architecture
The stack combines fast, stateless verification for routine API calls with server-tracked sessions so administrators can revoke access on realistic timelines. Identity stays local — invite-based onboarding, bcrypt password hashes, strict rate limits on auth endpoints, and role-based permissions evaluated only on the server.
- Short-lived access tokens plus refresh tokens tied to SQLite session rows.
- Administrative revocation within roughly five minutes via the refresh boundary.
- Optional SMTP delivery or manual invite links when email is not available.
Read the security model for assumptions, guarantees, and limits.
Your data stays yours
If the application is removed, SOP Markdown and assets remain ordinary files on disk. SQLite holds metadata, sessions, audit entries, and acknowledgments — all covered by the built-in backup export so you can validate archives and stage restores when you are ready for a controlled migration.
Capabilities today
The project ships a broad slice of day-two operations work already: from authoring and PDF export to admin mail modes and staged restores. Highlights from the current README status:
- Authentication, sessions, and password reset flows
- Role-based access control for editors, readers, auditors, and admins
- SOP lifecycle, Markdown editor, and asset uploads
- Version immutability with content hashes
- Signatures and acknowledgment tracking
- Tags, favorites, and list filters
- Audit dashboard with tamper-evident hash chains
- Mail service with SMTP or manual invite links
- Backup export, validation, and staged restore
- PDF export via optional Gotenberg sidecar
- Word import (.docx) into the draft workflow
Architecture, deployment variables, and API notes live alongside the code in the repository docs.
Inside the application
Product screens from the SOP library, versioned procedures, and administration tools as they appear in the application today.
Browse and organize
Find procedures quickly with search, tags, and per-user favorites — then open any SOP from a single library view.
Versions and acknowledgments
Each version is immutable; tags and assets stay with the procedure, and acknowledgments align to the version people actually read.
Administration and backups
Manage users, roles, and invites from built-in admin tools, alongside mail, sessions, and backup exports for day-two operations.