Knowledge Base & Technical Documentation
Answers to frequently asked questions about PMWEB, implementation, hosting, Business Intelligence and Digital Adoption — from HKA Tech's support team. If you cannot find what you need here, our team is available to help.
No matching questions found
Try a different search term, or browse all topics by selecting "All Topics" above.
Talk to Our Team
PMWEB is built specifically for owners of buildings and infrastructure to manage the full capital works lifecycle: Plan, Build and Operate. There are many competitor tools that provide glossy high-level reporting, some with associated functions like scheduling or generic PMIS capabilities. PMWEB incorporates all elements needed for successful fully integrated project services, including cost control (budgets, contracts, change orders, forecasting), document management, workflow and approval routing, day-to-day construction management (where needed), asset management and lease management — all in a single configurable platform. There is no need to integrate separate cost, contract and document management tools – although PMWEB allows integration with such systems if that is a Client requirement.
The net result for owners is not just glossy dashboards and reports that appear to check all the right boxes – but also numbers that have substance, audited and validated from fully-integrated project systems at every level.
Although containing the tools for detailed day-to-day construction delivery, PMWEB is designed from the ground up from the owner's perspective — the organization commissioning the capital work — rather than the contractor or project manager delivering it. This distinction is important for government agencies, health authorities, universities and infrastructure bodies whose primary needs are program visibility and governance.
The current version is PMWEB 2026, which introduced enhanced AI-assisted forecasting, improved dashboard capabilities and new mobile features for field teams. HKA Tech provides full upgrade support for all clients moving from any prior version.
For clients on managed SaaS or hosted environments, upgrades are coordinated by HKA Tech as part of the service arrangement. For on-premise deployments, upgrades are planned as a project with defined scope, testing and sign-off phases. Version histories and release summaries for versions 5.0 through 9.0 (PMWEB 2025) are available on the What's New page.
If you are evaluating whether to upgrade, our team can provide a version comparison and cost/benefit assessment specific to your current configuration.
Yes. PMWEB is a true zero-footprint application — it runs from any modern browser on iPad, iPhone, Android tablet, or smartphone with no app installation required. Field teams can submit forms, update workflows and access project documents directly from site without any specialist software.
The responsive interface adapts to screen size. Administrative and configuration functions are best performed on desktop, but core project management, workflow approvals and document access are fully functional on mobile devices.
PMWEB also has an optional mobile app – PMWEB Mobile – that Clients can use where there is no Internet connectivity. This can include remote areas, but can also include urban areas when working in tunnels etc. PMWEB Mobile allows the operation of specific PMWEB out-of-the-box features – in offline mode. PMWEB Mobile will also automatically re-synch data from the field with data in the main system when the device is back in Internet range.
Plan: Planning, estimating and procurement — including portfolio planning and prioritisation against available resources, including funds; scope development; conceptual and detailed estimating; program budget setup; vendor evaluation; online bidding; and procurement workflows. PMWEB’s planning features work in conjunction with other out-of-the-box tools, such as scheduling and stage gates
Build: Cost controls, contract management, change management, program and project management, quality assurance, document and data control, workflow, scheduling and mobile field access. PMWEB’s extensive functionality in the Build phase allows Owners to exercise integrated project controls in the manner appropriate to its delivery of each project – including the features needed for effective monitoring and reporting at all levels.
Operate: : Asset management (tracking, maintenance, work requests, work orders), lease management (cost and revenue leases, suite linking, charge calculations) and ongoing facility management. Operate functions connect directly to the Build phase data, providing continuity from construction to operations.
For detailed information on each phase, see the PMWEB Overview and Platform Features pages.
PMWEB includes a drag-and-drop workflow builder that allows organizations to define document routing and review/approval chains within their delegated authorities – without custom development. Workflows can be configured at the organization, program, or project level, and can include conditional branching (e.g. route to a different approver if an invoice or change order exceeds a threshold or has specific characteristics).
Workflow applies across all PMWEB documents — cost documents, RFIs, submittals, change orders, invoices and more. Each step records the approver, timestamp and any comments, creating a full audit trail. Delegation and automatic escalation rules can be configured to handle absent approvers without disrupting the process. PMWEB’s responsive design allows approvers to review and respond to workflows from any mobile device.
PMWEB connects to a wide range of enterprise systems through its use of Microsoft PowerShell, SQL Server tools including SSIS and modern middleware. PMWEB also has an optional API and Integration Manager utility when needed. Common integrations include enterprise systems such as for finance and ERP (SAP, Oracle, TechnologyOne, Microsoft Dynamics), document/records management, HR and GIS. Optional PMWEB integration tools include BIM, Bluebeam and LDAP/SAML for Single Sign On (SSO).
HKA Tech has established integration frameworks for the most common enterprise systems used by government and infrastructure organizations. For custom integration requirements, our team builds bespoke interfaces where standard connectors do not apply. See the Integrations page for more detail.
Implementation timelines vary significantly based on the scope of configuration; the complexity of existing data to be migrated; the number of integrations required; and the size of the organization. We have completed implementations within weeks. As a general guide, a standard Build-phase implementation for a single organization ranges from three to six months. Multi-agency or enterprise-wide deployments covering Plan, Build and Operate functions across multiple programs typically take six months to twelve months.
An important influencing factor is the willingness of each Client to consider changes to its existing processes. Some clients will seek to use as much of the out-of-the-box processes as possible. Other clients will require all of their existing processes to be configured within PMWEB. Most Clients will take an approach that falls somewhere in between. Client decisions on release to end users will also impact Go Live. Some Clients will not want a formal Go Live until everything has been configured. Other Clients prefer progressive Go Lives – options including release of some functionality to a selected user group; release of some functionality to all users; release of all functionality to a selected user group; and release of all functionality to all users (“big bang”).
HKA Tech also offers Quick Start Packages for organizations that want an accelerated path to a productive PMWEB environment. PMWEB’s out-of-the-box SaaS features can be fully operational in less than a week. Go Live to end users, after initial set-up to organisation’s specifics, can take anywhere between two weeks and twelve weeks, depending on availability of the organization’s personnel to confirm instructions and receive training.
Our Implementation approach provides a detailed overview of the phases and deliverables involved in a standard deployment.
Yes. Data migration is a formal, structured phase in every HKA Tech implementation. We have migrated data from many different source locations, ranging from Excel spreadsheets to complete enterprise systems. Migration begins with the Client’s initial decision on what will be migrated. Some Clients will start with only new projects in PMWEB – this being the simplest approach. Most Clients, however, have in-flight projects that need to be migrated, as well as projects that are in planning/development. Other Clients want an extensive migration that includes historical projects.
We recommend a data audit to assess the quality and structure of existing data, including an assessment of any cleansing and validation that will need to be completed before import, according to the quality of the source data. A migration plan is developed, including mapping to PMWEB's data model; any staging approach needed; and client sign-off at each stage. For complex migrations, we run parallel systems during a transition period to ensure data integrity before decommissioning the legacy system.
Data migration is also available as a standalone engagement for organizations that have already deployed PMWEB but need historical data consolidated into the platform.
HKA Tech delivers training as part of every implementation engagement, tailored to the roles within your organization — project managers, cost controllers, contract administrators, finance teams and system administrators each receive role-specific training relevant to their actual daily workflows in the configured system.
Training can be delivered in-person at client offices, remotely, or as a blended approach. Most training nowadays is conducted online using tools such as Microsoft Teams. PMWEB also provided online training resources such as PMWEB Learn and PMWEB University. For large-scale rollouts, we can deploy WalkMe in-application guidance through our Digital Adoption (DAP) service — providing on-screen walkthroughs that support users at the point of need after Go Live, reducing reliance on formal training sessions.
Training is a key component of Organisational Change Management (OCM), as described on our OCM page
PMWEB SaaS includes full vendor technical support at no additional cost, including live operators during local business hours and a 24/7/365 online support portal. HKA Tech provides structured post-implementation support through its dedicated support team. Support arrangements are defined at the outset of each engagement and include definition of how support relates to an organization’s existing support structure (e.g., its IT Help Desk). Typically, HKA’s support role relates to the changes that a Client may have instructed during implementation; the familiarity gained by HKA Tech’s team with specific Client business processes through that implementation; and Client plans for continuous improvement – requiring ongoing configuration enhancements and support during system upgrades. HKA Tech also includes a named account manager for escalation and strategic advice.
For clients seeking a more formalized advisory relationship, our Capital Works Advisory service provides access to experienced practitioners who can assist with program delivery challenges beyond system support.
PMWEB’s out-of-the-box SaaS features can be fully operational in less than a week. From that point, configuration is undertaken to meet the specifics of each Client. The Quick Start approach is designed to achieve early start and involve the Client’s personnel in working with the system. In the final analysis, there is virtually nothing that we do in an implementation that our Client’s own personnel cannot do after they have been trained. This is a key feature of PMWEB – it is designed for user configuration, so there is no need to bring back an army of consultants in future if the Client’s processes and approaches change over time. The Client can undertake its own configurations as it pursues continuous improvement. It is common to also include Provisional Sums where the detail of requirements is yet to be confirmed, or a separate fixed price is possible for defined areas of the work.
Go Live to end users - after initial set-up to organization’s specifics - can take anywhere between two weeks and twelve weeks, depending on availability of the organization’s personnel to confirm instructions and receive training.
Read more on the HKA Tech Quick Start approach.
Third party specialists can be engaged to perform network penetration tests and application vulnerability testing. The tools they use are Nmap, Metasploit pro, skipfish, etc.. This testing is typically performed at least yearly and with every major release of the software.
Load and performance testing is also performed with software called LoadComplete and a distributed cloud setup.
Application / usability testing is done via dedicated testing staff, IT support team staff and automation tools such as TestComplete, Telerik Test Studio and Microsoft Visual Studio Test Professional.
In virtualized configurations, workload monitoring is done with standard tools for the infrastructure. Thresholds and alerts are set and when reached, additional hardware resources are added promptly.
Upon termination of the contract for hosting/SaaS services, PMWEB will, on Client request, provide a backup of all Client data including databases containing transaction and file storage data, custom reports, etc. The backup consists of standard MS SQL databases and SSRS reports. A fee is charged for this database copy, depending on the delivery method (electronic, physical or both). For electronic delivery, the fee is under $1,000. Physical will depend on the media chosen by the Client (Hard Drive(s), Tape(s), etc); and the method of delivery (e.g., bonded courier).
Data Destruction
The Client may request that all data held by PMWEB be destroyed. The destruction process will use a secure-erase method that complies with Military standards for data wiping (min 3-pass, erase - overwrite). The process is documented and this documentation is sent to the Client.
Three tools are typically used for this, assuming the Client has copied the provided database to its own instance of SQL Server and PMWEB software is no longer available:
- SSRS Reports
- SchemaSpy
- Microsoft bcp utility.
SQL Server Reporting Services (SSRS) – all PMWEB reports are written in SSRS. The Client can use the SQL SSRS viewer – not the PMWEB BI viewer – to access any existing report or dashboard. These reports/dashboards can then be output in various formats including Excel, Word, PPT and .pdf.
SchemaSpy - this is a Java-based free and open-source tool distributed under the terms of the Lesser GNU Public License 2.1. It will allow the Client to view the database schema from various perspectives.
bcp utility for document extraction – This is a Microsoft Windows SQL Server tool used to extract blobs from MS SQL Databases. This utility requires SQL knowledge and understanding of how blobs work in a SQL database. If that knowledge is not available, HKA can assist on a fee-for-service basis. Note that from PMWEB v8.2 onwards, SQL Filestream is utilised, with the Filestream files embedded as blobs in the handover database. Clients may also request copies of Filestream documents directly from the PMWEB Windows file structure.
Data Destruction
The Client may request that all data held by PMWeb be destroyed. The destruction process will use a secure-erase method that complies with Military standards for data wiping (min 3-pass, erase - overwrite). The process is documented and this documentation is sent to the Client.
Yes – both PMWEB and HKA provide an Archive Tool. We recommend the HKA Tool for a number of reasons, including both functionality and cost. This requires Archiving prior to expiry of the SaaS (not so much of an issue with self-hosted instances, where the Client holds a perpetual licence). The location of the archive is on the server itself by default (i.e., in standard folders created by the Client), with the Client then moving the records to their final location. It is possible to automate where the archive records go (e.g., directly to an EDMS) but this would be a customization at additional cost – quoted once details of the end-location, network and constraints are known. The archive is also set to do one PMWeb project at a time. The initial design for clients was to archive projects/contracts as they completed. Some clients have asked for a mass export of all projects This can be quoted if required. A short (under 8 minutes) video on the operation of the HKA PMWeb Archive Tool is available here.
Software as a Service (SaaS) is the most popular option. PMWEB utilises Amazon Web Services (AWS), with data hosted in AWS data centers. SaaS is appropriate for the majority of clients and provides managed infrastructure, automatic backups, patching and version management as part of the service.
Two additional options are also available: managed hosting, where PMWEB manages a dedicated environment on your behalf on nominated infrastructure; and on-premise deployment, where PMWEB is installed on your own infrastructure and managed by your internal team with HKA Tech support. On-premise and managed hosting are used where a Client has procured perpetual licences for PMWEB, rather than the renewable annual licences within SaaS.
For most government and infrastructure clients, the AWS SaaS model fully addresses data sovereignty requirements through the AWS data center Regions. For agencies with specific legislative obligations, HKA Tech can provide a technical assessment. See the Hosting & SaaS page for full details
For SaaS deployments, all client data is stored in AWS data centers located in the AWS Region chosen by the Client. AWS has many Regions in the Americas, UK, EMEA and APAC - see AWS Regions and Availability Zones. No matter what Region is chosen, no data is routed through or stored in another Region unless explicitly requested and agreed.
Security is closely managed both through the infrastructure provision and within PMWEB. The Accreditations page provides details, including independent certifications against international standards including ISO/IEC 27001 (Information Security Management Systems) Security documentation, data processing agreements and privacy policy information are available on request and as part of the procurement process.
Individual access controls, user permissions and audit logging within PMWEB are configured as part of the implementation to align with your organization's security policy.
SaaS service level agreements covering uptime, backup frequency, recovery point objectives (RPO) and recovery time objectives (RTO) are specified in the individual service agreement for each client. Standard SaaS arrangements include daily automated backups with a minimum retention period and a defined restoration process.
Planned maintenance windows are communicated in advance and are scheduled to minimize impact during standard local business hours. Incident response procedures and escalation paths are defined in the service agreement.
For specific SLA terms relevant to your requirements — including any uplift for critical government services — please contact our team during the procurement or renewal process.
The software is built to be true enterprise and with a light footprint. PMWEB uses load-on-demand lists throughout the application and AJAX is used extensively to off-load the data validation, etc… to the client when possible. The only limit on the number of users is the hardware configuration used. PMWEB software is also built to support scaling via Network load balancing and SQL clustering; and can be fully virtualized and spread across multiple hardware/servers to scale it for a large number of users. PMWEB software can scale up by adding additional resources (CPUs/CPU Cores, memory, etc…) and scale out by using Hardware-based or OS-based network load balancing for the web front-end and by using SQL Server Clustering for the database back-end.
PMWEB contracts (in its SaaS delivery) to deliver 99.9% availability during a Client’s Business Hours. Typically, this is 8am to 6pm Monday to Friday excluding public holidays.
The application fully supports network load balancing and SQL-Server clustering for both front-end and back-end scalability. PMWEB is built to support scaling via Network load balancing and SQL clustering; and can be fully virtualized and spread across multiple hardware/servers to scale it for a large number of users.
Yes. Standard manual MS SQL backup or scheduled backups occur in the background and do not disrupt the live use of the system.
Yes, archived databases can be made active (read-only if desired) either directly through the PMWeb interface or via MS SQL Server Reporting Services (SSRS). SSRS reports are an integrated feature of PMWEB and can run reports on both live production data and archived data all from the same interface. Incremental recovery is no problem, using standard MS SQL administrative functionality.
Typically a 2-layer firewall setup (hardware/ software) with anti-virus/anti-spam/and intrusion detection on both layers. The application is forced to use SSL transport for all communications and is only web-facing via port 443 including the Integration Manager web services. In addition, SSL / IPSec VPNs and URL/IP authentication can be used for additional security if desired. PMWEB SaaS utilises Microsoft Defender in conjunction with Crowdstrike Falcon for advanced endpoint security.
All data in transit is encrypted over HTTPS with TLS 1.2 or higher and SSL certificates; 4096 bit key length; Certificates managed by PMWEB IT, TLS uses ECDHE Key algorithm. All data at rest including backups is encrypted with AES 256 encryption. All keys are managed by PMWEB IT using AWS KMS (https://aws.amazon.com/kms/). Clients are also permitted to manage their own keys by special arrangement. Files/documents are stored securely inside the SQL database for additional security.
SQL is typically installed using the default instance with all the default ports. If SQL is installed with named instances you can change/specify the ports according to which items are installed and to be used for that database - e.g.,
- SQL Server: 1433
- SQL Browser: 1434
- SQL Analysis Services: 2382
- PMWeb & SQL Reporting Services: 80 and/or 443
The only required ports to run PMWEB are port 1433, 80 and/or 443.
The application is entirely self-contained. Integration uses Windows Web Services to export/import files. The services use HTTP/HTTPS and SOAP. In addition to PMWEB's Integration Manager, the PMWEB API also facilitates data exchange; and is enabled for both SOAP and REST. PMWEB has been integrated in the past with a number of middleware solutions, including MuleSoft, JBOSS and the Boomi AtomSphere Platform.
Yes. VM Ware, Microsoft Hyper-V and Xen have all been tested and are used in PMWEB production environments.
No, the application is built with GUID keys and it does not have any such limitations. Also, it is fully web based and uses only ports 80/443 so it fully supports network load balancing via hardware/software and SSL/XML acceleration.
Reports are run mostly in SSRS (SQL Server Reporting Services) and can be run on a separate server or cluster of servers. In addition, if further enhancement is required, you can create a separate SQL database for reporting and keep the data updated using either replication or log shipping.
Both transactional data and file storage is stored in SQL Server databases. You can use the SQL server backup facilities or other programs such as netbackup or Idera SQL Backup or SQL agents for backup exec and Acronis products. SaaS delivery via AWS also uses AMIs (Amazon Machine Images) for full-system backups.
The application is zero-footprint and does not require any plugins such as ActiveX, Java or Silverlight, etc… All components including the viewer, etc.. run server-side. The only port that needs to be open through the firewall is port 443 for SSL. In addition, extra security can be obtained by using IPSec or SSL VPN, URL-authentication and IP-authentication. PMWEB SaaS utilizes Crowdstrike and Microsoft Defender for advanced endpoint protection.
PMWEB conducts annual penetration testing and will make the results of the latest penetration test available to a Client on request. Should the Client wish to conduct additional penetration testing, PMWEB will cooperate. Any penetration testing by the Client would be at the Client’s cost.
The supporting platform (Operating Systems, Web Server, SQL Server) is primarily tied to the Microsoft suite of server products. Since its inception, PMWEB has been upgrading to the latest proven releases of Microsoft operating systems, web and database servers and will continue to do so. Major PMWEB product releases occur annually. Minor releases occur every 3-6 months. Patches or quick fixes occur on an as needed basis according to the criticality of the issue.
Patch policy
All Systems owned and operated by PMWEB must be manufacturer supported and have up-to-date security patches installed to protect the asset from known vulnerabilities. Critical vulnerabilities will be patched within 1 week of identification.
PMWEB IT will manage the patching needs for all software, firmware, middleware, servers, workstations, firewalls, switches and routers on the network; and is responsible for routinely assessing compliance with the PMWEB patching policy, as well as providing guidance to Clients in issues of security and patch management.
PMWEB’s active patching teams are required to compile and maintain reporting metrics that summarize the outcome of each patching cycle. These reports are used to evaluate the current patching levels of all systems and to assess the current level of risk.
Upgrades
Although it is recommended that clients upgrade regularly, as new releases become available, these upgrades are not mandatory. The Client may decide whether it wishes to upgrade or not. If the Client decides to not upgrade, PMWEB continues its support services.
Upgrade is initially completed in the non-Production environment. Sometimes clients ask HKA to become involved in the upgrade process, conducting required testing etc. Other clients will have an internal PMWEB application support team that they will task to coordinate the upgrade with PMWEB and do the necessary testing. In these cases, we typically supply a checklist to assist in the test process.
Once the upgraded non-Production site has been tested – including any system integration testing – a window is scheduled to upgrade the Production site. A similar testing process is recommended after this upgrade.
Advance Notice
All system maintenance including application patches and OS/infrastructure patching is automatically done at scheduled maintenance windows. The Client’s designated contact(s) will be notified in advance of these windows, which are client-specific and scheduled to occur outside business hours based on the client’s preference.
- Major Maintenance windows will be scheduled events and the Client will be provided a minimum of 60 days advance notice.
- Routine maintenance, patches and Windows/SQL updates will be scheduled events and the Client will be provided 15-30 days advance notice.
- Upgrades are scheduled in consultation with the Client to determine the appropriate time for both any initial upgrade to non-Production; followed by upgrade of the Production instance.
- Emergency patches such as high-risk security risks (zero-day vulnerabilities), will be scheduled as emergency events and the Client will be provided 1-3 days advanced notice.
PMWEB IT and support staff have access to systems via Active Directory Authentication via security groups and two-factor authentication; least privilege permissions applied. Accounts are registered with staff in person. PMWEB maintains a standard checklist for its staff to undertake each registration. Provisioning and deprovisioning is managed via the PMWEB ticket system, with all accounts being deprovisioned immediately upon staff termination.
PMWEB maintains a list of its authorized personnel, managing this via their Freshdesk ticketing system.
The Client can specify procedures for access. For example, some clients prefer to have all access via an online meeting convened and monitored by their team.
No physical access is involved for our team. Physical (on site) security is managed by AWS as follows:
AWS provides physical data center access only to approved employees. All employees who need data center access must first apply for access and provide a valid business justification. These requests are granted based on the principle of least privilege, where requests must specify to which layer of the data center the individual needs access and are time-bound. Requests are reviewed and approved by authorized personnel and access is revoked after the requested time expires. Once granted admittance, individuals are restricted to areas specified in their permissions. Anyone granted visitor badge access (i.e., to a data center not owned by AWS) must present identification when arriving on site; and are signed in and escorted by authorized staff.
Further information on AWS physical access
PMWEB includes native dashboards and reporting that give project-level and portfolio/program-level visibility within the platform. HKA Tech's Business Intelligence service extends this by building custom analytical dashboards that can aggregate data from PMWEB and other enterprise systems — finance, ERP, asset management and more — into a unified reporting layer.
This is a separate service from HKA Tech, independent of PMWEB licensing. Organizations that use other PMIS platforms alongside PMWEB, or that need executive dashboards drawing on multiple data sources, benefit from BI as a standalone engagement. The BI service also applies AI-enhanced capabilities to surface anomalies, generate narrative summaries and automate periodic reporting that would otherwise require manual preparation.
A Digital Adoption Platform overlays on-screen guidance — walkthroughs, tooltips, task lists and help panels — directly within a software application, guiding users through processes at the point of need without leaving the system. WalkMe is the primary DAP tool that HKA Tech deploys.
For PMWEB, WalkMe walkthroughs can be configured for specific workflows — for example, guiding a cost controller through their first change order submission, or walking a new project manager through the budget setup process. This significantly reduces the volume of helpdesk queries after go-live and accelerates user proficiency, particularly for large rollouts where one-to-one training is not practicable.
HKA Tech's DAP service also extends beyond PMWEB — WalkMe can be deployed on any web-based enterprise application, making it applicable to finance systems, document management tools and other platforms in use across your organization. See the DAP page for more information.
HKA Tech applies AI capabilities across each of its technology service lines, with a focus on practical, substantiated outcomes rather than speculative use cases.
In PMWEB, AI-assisted cost forecasting and schedule risk analysis surfaces within PMWEB portfolio workflows, helping project controls teams identify emerging budget variances earlier. In Business Intelligence, AI-enhanced dashboards detect anomalies in cost and schedule data; and generate automated narrative summaries for executive reporting. In Digital Adoption, AI-driven WalkMe guidance personalizes in-application walkthroughs based on user behavior and proficiency, adapting the level of guidance as users become more confident.
HKA Tech is receiving increasing queries about AI capabilities from tender processes and existing clients. Our Artificial Intelligence page provides additional information. If you have specific requirements or questions about AI applicability to your programs, contact our team for a direct conversation.
Yes. As part of the Digital Adoption service, HKA Tech can deploy UserWay for enhanced WCAG (Web Content Accessibility Guidelines) compliance on web-based enterprise applications. UserWay adds an accessibility widget that allows end users to adjust font sizes, color contrast, navigation modes and other accessibility settings to meet their individual requirements.
UserWay is an optional service, as PMWEB already complies with WCAG 2.2 Level AA, which is the most widely adopted standard for web accessibility. For government agencies with mandatory accessibility obligations in excess of this standard, UserWay can be applied to the PMWEB interface and other enterprise tools as part of an accessibility compliance program.
PMWEB AI is a conversational assistant built into the platform: users ask questions in plain English and receive answers grounded in their own live PMWEB data — project status, budgets vs. actuals, open RFIs/change orders/submittals, documents and summaries — with every answer linked back to the real record. It can also create new records (RFIs, submittals, change orders, daily logs, punch lists, meeting minutes) and build adaptive forms conversationally, but only after showing the user exactly what it will do and receiving confirmation; it never edits or deletes existing records. All of it runs under the user's existing PMWEB permissions and the PMWEB Intelligence Control Framework, so answers are computed from real data rather than guessed; and every action is auditable.
Yes, each Customer has its own LLM virtual key stored in Secrets Manager. The Customer can turn off the AI platform and the model choice is gated. The End User's own PMWEB bearer token flows end to end, so it enforces ACLs natively. KMS encryption at rest. No cross-customer data is used for training.
No. AI is included in the standard PMWEB SaaS subscription fees. As AI is rapidly evolving and new features continue to be added, including the features/pricing from third-party AI suppliers, there may be future changes to the pricing model – please ask HKA for the latest pricing information on AI.
Yes. Refusal patterns are versioned directly in the prompt, not left to model judgment. Retrieved content (documents, records) is sandboxed and treated strictly as data, never as instructions, which blocks attempts to use uploaded content to redirect the model into producing something it shouldn't. Scope guardrails keep it out of legal, medical, HR/compensation and speculative financial territory entirely — it reports data rather than opining in those domains. Additionally, since it can't edit or delete anything and needs explicit confirmation before creating any record, a bad output can't turn into a bad action on its own.
Yes. The AI platform has its own retention and deletion policies, separate from PMWEB's application policies since it stores different kinds of data (such as audit logs, feedback scores, action plans and cached document text). Each of those data types has its own configurable retention window and automatically runs to remove the data based on those configurations, along with tools to export or erase a specific customer's or user's data on request.
Yes. Retrieval isolation is layered: records are tagged per row at index time with tenant, project and role information; and every search also applies a permission filter at query time that checks those tags before anything is returned to the user. So permissions are enforced twice, once when data is indexed and again on every single query; and the filter is fail-closed, meaning if it can't confirm access it excludes the data rather than showing it. Every user's requests run under their own bearer token, so there is no shared service account making queries on their behalf. PMWEB also tested and validated the AI features against GDPR and CCPA requirements for privacy.
Continuous nightly testing of a suite of tests checks for degradation. Exact models (i.e., versions) are not able to be upgraded by the user and only by PMWEB; with substantial eval testing to validate that results from prior versions are delivered with the same high predictability as newer released versions. The actual data is computed in the product, the AI just represents that data and does not compute.
Private VPC environment with no public ingress, behind a WAF.
Optional; can be turned on/off.
PMWEB AI splits generation from computation by design: an LLM (GPT-4o by default, with Anthropic available and model choice configurable per tenant) writes the prose and can phrase the same answer differently each time, which is why the eval suite explicitly tolerates a rotating 5–10% retry tail on live, judged test cases. Anything checkable — budget vs. actual figures, formatted numbers, tool routing on the first turn, search-result display, filename matching and refusal/guardrail behavior — is computed deterministically in code; and the model is only allowed to quote it, never calculate or improvise it. That split is enforced by a strict, single-shot promotion gate (deterministic mock data, one failure is final) plus a 50+ case red-team suite gating every CI run. Net effect: wording varies, but the facts, numbers and safety behavior don't.
The AI model is reached via an external API call, not run in-process or on-prem/sovereign-cloud. It is accessed through a private model-routing gateway (LiteLLM) rather than direct inference. Everything around that model call — retrieval, audit logging, data storage — runs in a private, in-VPC environment with no public ingress, sitting behind an AWS WAF.
All records reference links back to an actual PMWEB record to help answers cite the exact page/section and figure. Every answer is logged with the exact model and prompt/instruction that producted it. All items are stored in the audit trail for traceability.
There is no computation of figures, the model just quotes them. Document and record content is treated as data and not instructions thus preventing prompt injection. Answers are generated from the PMWEB data rather than your model's memory.
PMWEB supports OpenAI GPT4.0 and Anthropic Sonnet 4.6.
PMWEB is hosted in Amazon Web Services (AWS) infrastructure. All customers share the same underlying LLM deployments (OpenAI GPT-4o and Anthropic Claude Sonnet 4.6) behind PMWEB’s own private LiteLLM gateway, so there isn’t a separate model per customer. Instead, isolation is enforced at the data and access layer. Each customer receives its own LiteLLM virtual key with a per-customer record to keep separate. Each customer also has its own physically separate search and vector-store indexes, not just row-level filtering. Every request carries the end user’s own PMWEB bearer token, so results are always scoped to what that user is actually allowed to see. Nothing crosses between customers’ isolated stores.
HKA Tech operates globally. As part of HKA Global, locations include more than 45 offices across six continents. This global network supports our clients with access to specialist expertise in capital works, advisory and project intelligence.
HKA Tech's primary offices are in Sacramento, California; London, UK; and Sydney, Australia. Office contact details and addresses are available in the Contact section and in the site footer. Contact details for our other offices are available here.
HKA Tech is the technology division of HKA Global — the world's leading claims, disputes and advisory firm for the construction, manufacturing, technology and engineering sectors. HKA Global operates across 45+ offices and six continents, providing expert witness, dispute resolution and project advisory services on some of the world's largest infrastructure and construction programs
The HKA Tech team draws on this organisational depth — including access to Crux Insight, HKA's proprietary construction dispute intelligence platform — to provide capital works technology and advisory services that go beyond what a pure technology company can offer. The combination of software implementation expertise and hands-on project delivery knowledge is a core differentiator for HKA Tech in the market.
For general enquiries, technical support, or to discuss a new engagement, the best way to reach the HKA Tech team is via the Contact Us page. Existing clients with active support arrangements should use the support contact and escalation paths defined in their service agreement. If you are unsure who to contact, the general enquiry route above will direct your request to the right team.
For organizations considering PMWEB or any of HKA Tech's services, we recommend an initial conversation to discuss your requirements before proposing a specific scope. There is no expectation that you have detailed requirements at the first contact — our team can help you identify the right starting point.
PMWEB licensing is subscription-based and is priced according to the number of users, the modules enabled and the hosting arrangement (SaaS, managed, or on-premise). As implementation partner, HKA Tech arranges PMWEB licensing directly as part of the engagement.
Implementation services — configuration, data migration, integrations, training and support — are quoted based on the specific scope of each engagement. Quick Start Packages have a defined scope and are quoted as a fixed-price arrangement. Business Intelligence, DAP and Advisory services are each quoted separately based on Client requirements. See our Pricing page for more information.
HKA Tech does not publish pricing schedules publicly, as engagement scope varies considerably across the client base. To discuss pricing for your specific situation, please contact our team — we can provide a high-level indication quickly once we understand the broad scope.
Yes. HKA Tech is registered to supply its services and PMWEB software with parties such as Omnia - please see details on the Accreditations page. These organizations enable eligible government agencies to procure PMWEB implementation and related services directly, without a separate open tender process. Panel participation and current accreditation status can be confirmed by our team during your procurement planning phase.
PMWeb’s zero footprint client access removes the requirement to download installation packages, which reduces the initial high level bandwidth required in other systems that download client software when launching the system.
Broadband speeds are recommended for best user experience - DSL/Cable, Fiber Optic, T1/T3. Recommended minimums are 1Mbps upload and download. This requirement is based on accessing the various modules, running reports and uploading/downloading documents in a typical active session.
In addition, PMWeb has been designed and optimized to deliver excellent response times from screen to screen. The software is built to be true enterprise and with a light footprint. PMWeb uses load-on-demand lists throughout the application and AJAX is used extensively to off-load the data validation and other processing tasks to the client when possible.
The system can easily handle 3,000-5,000 users with 1,000 concurrent users logged in and actively using the application. A properly configured load-balanced setup can easily handle 70,000-100,000 transactions per hour. The only limitations on concurrent users are the hardware limitations such as CPU, memory and speed of the storage. Large PMWEB Clients have more than 10,000 users.
Yes - PMWEB is 100% web based and does not require Citrix. If users are required to use Citrix for their desktop environments, then they can simply launch a browser in the Citrix session and access PMWEB with no impact on that Citrix session.
Business rules are handled through conditional APM and workflow rules; and can be created via a GUI-based interface with drag-and-drop. The rules are stored in the database and can be edited in the application or using standard MS SQL database tools.
PMWeb supports from MS SQL 2008 R2 Standard through to MS SQL 2019. All new SaaS instances are delivered using MS SQL 2019, as this is the first SQL version that has AI / machine learning capabilities. Later versions of MS SQL (i.e., post MS SQL 2019) are routinely tested and evaluated - check with your HKA advisor for the latest information.
Collation must be SQL_Latin1_General_CP1_CI_AS. Analysis Services collation must match
The software is written for the .Net Framework with extensive use of AJAX. The languages used are industry-standard VB.net, C#, Javascript and HTML5. The user interface is aligned with Angular.
PMWEB provides built-in identity management including configurable password expiration; and history and complexity settings that can be expanded with Active Directory/LDAP integration and/or SAML support.
Active Directory (AD) authentication can be achieved with PMWEB’s LDAP Integration utility. This utility allows for AD users to be integrated into PMWEB’s login page thus activating single sign-on (SSO) functionality.
PMWEB similarly supports the OASIS-ratified SAML 2.0 standard.
PMWEB’s “out of the box” functionality includes an extensive security module which limits what actions each user or user group can perform. Security levels can be set for individuals or for various user groups by combinations of:
- System – Program – Project
- Feature (view or no view)
- Record (Add, View, Delete, Update)
- Field (view, update).
The security is also tied to the Document Manager Folders where users can be limited on whether they can Upload, View, Redline, etc. individual folders.
A single user can maintain multiple roles, to allow for functional needs, hierarchy, or matrix organizational roles. This can be achieved at both user security level, where the user can be assigned to multiple groups with differing access permissions; and in all Workflows, where a user’s workflow roles can be multiple at all levels.
PMWeb uses industry standards for email system integration. For outbound emails, PMWeb integrates with SMTP Servers, allowing for options to change the port, set as asynchronous, the outbound email address, authentication credentials and enabling of SSL. For inbound emails, PMWeb uses POP3 with options to change Port, enable SSL and allocated project for different email addresses. PMWEB SaaS can include M365 email functionality or can be integrated with a Client’s email system, according to each Client’s requirements.
The Data store is fully normalized and built with relationship-enforcement. In addition the business logic uses transactions for record updates and deletions. The transactions can be rolled back in case of interruption to ensure data integrity.
Passwords are encrypted using SHA-2 256-bit encryption.
All Client data remains the property of the Client.
PMWEB uses SSRS for Business Intelligence (BI) reporting. This is one of the most advanced reporting engines available on the market. MS SQL Server is Number 1 globally for Business Intelligence and Analytics Platforms – Gartner Report, 2026. All currency values and unit values are stored in the database to 5 decimal points to ensure accurate calculations (i.e., eliminate rounding errors) in reports and within the system itself.
In order to produce “data accuracy in reports” in any business process, defined standards must first be set to produce the desired output (i.e., reports). Our standard process is to first determine the key performance indicators and other analytics desired by subject matter experts and other stakeholders. Secondly, we work backwards to determine the data entry required to produce the desired report and dashboards. Setting of required fields and reviews using PMWEB Visual Workflow provides additional standards and cross-checking data before a record or document is approved. Ultimately, service levels are determined by multiple factors:
- the type of business process
- the standards configured to conform to the accepted business practices
- the individual(s) performing the work.
PMWEB captures latitude/longitude coordinates to 14 decimal places. Only 7 decimal places are required for 10cm accuracy (6 decimal places is 11.08cm accurate).
Still have a question?
If you can't find what you need in the Knowledge Base, our team is available to help — whether it's a technical question, a procurement query, or an initial conversation about your requirements.
Ready to Discuss Your Requirements?
Whether you are evaluating PMWEB, considering an upgrade, or exploring AI, BI, DAP, or Advisory services — our team can help you find the right starting point.