DayaSentry — vendor sentry for Indonesian employers

1. One-liner

Checks whether your outsourcing vendor really filed the contract Disnaker punishes you for missing.

2. Trend signal — why now?

On 30 April 2026 Indonesia’s Manpower Ministry promulgated Permenaker No. 7 Tahun 2026 on Pekerjaan Alih Daya (outsourcing). I pulled the gazetted PDF from the ministry’s own JDIH portal and read it end to end. Three articles matter, and together they create a liability asymmetry that nobody sells software against:

• Pasal 5(2): the vendor (Perusahaan Alih Daya) must apply to register the outsourcing agreement with the district/city Disnaker within 3 working days of signature.
• Pasal 5(4): Disnaker may suspend issuing the registration receipt (bukti pencatatan) if the agreement fails the permitted-work test in Pasal 3(2) or the mandatory-clause list in Pasal 4.
• Pasal 8: but the administrative sanction for breaching Pasal 3 lands on the Perusahaan Pemberi Pekerjaan — the client. Escalating from written warning to restriction of business activity, defined in Pasal 8(3) as limits on production capacity and/or withholding of business permits at one or several project sites.

Read that again. The vendor holds the filing pen. The client’s production capacity is the collateral.

Pasal 4(3) tightens the screw further: the client is responsible for ensuring the vendor actually delivers wages, overtime, leave, BPJS, THR and severance. This is not a passive duty — Tier-1 firms read it as an active monitoring obligation.

Two more things make this the right moment rather than a 2028 problem. First, Pasal 10(b) gives a two-year window to 30 April 2028 to re-classify existing work types — which sounds far away until you notice a revision is already drafted. Presidential labour adviser Said Iqbal said on 22 July 2026 that the revision is final and awaiting the President, and the reported direction cuts Pasal 3(2) from six categories to four, deleting “layanan penunjang operasional” — the vague catch-all most clients currently park their contracts under. Every contract sitting in that category is about to be reclassified by someone else.

Second, the ambiguity is publicly conceded. Assegaf Hamzah & Partners writes that “the inclusion of ‘operational support services’ introduces flexibility, but also interpretive risk,” and warns companies not to assume a function qualifies by label — they prescribe “a functional analysis, namely whether the activity is genuinely ancillary to the user company’s core business.”

That firm then published, for free, a seven-point checklist telling clients to verify permitted scope, audit the operational-support classification, check mandatory clauses, confirm agreements have been registered with local manpower offices, add indemnity and compliance-monitoring clauses, assess legacy structures, and review durations. That is a product specification, written by a law firm, addressed to a customer who has no tool to execute it and no budget for the firm to execute it monthly.

Provenance:

• Signal 1 (demand): Permenaker 7/2026 Pasal 8 puts production-capacity and permit sanctions on the client for a filing the vendor controls; Apindo publicly warns on business impact and unions demand revision — https://jdih.kemnaker.go.id/asset/data_puu/2026pmnaker007.pdf — 2026-04-30
• Signal 2 (feasibility): Rajah & Tann and Assegaf Hamzah publish the exact monitoring checklist user companies must run, conceding “interpretive risk” in operational-support classification — https://www.ahp.id/indonesias-new-outsourcing-rules-minister-of-manpower-regulation-no-7-of-2026-and-what-it-means-for-employers/ — 2026-05
• Signal 3 (economic): 2.2M outsourced workers across ~68,000 firms; Indonesian HRIS seats already sell at Rp 12,500–50,000/employee/month, while compliance audits quote Rp 50–500 juta — https://pesonacipta.co.id/articles/detail/Fakta-Outsourcing-22-Juta-Pekerja-di-Indonesia-dari-68-Ribu-Perusahaan — 2026 Category: Regulatory arbitrage

3. The opportunity

This is a buy-side/sell-side gap, and it is unusually clean.

Every existing tool in this market serves the vendor. Indonesian HRIS platforms — Talenta, Gadjian, SunFish, GreatDay — sell payroll, attendance and BPJS calculation to whoever employs the worker. In an outsourcing arrangement, that is the vendor. The vendor’s HRIS produces the payroll. The vendor files the pencatatan. The vendor holds the evidence.

The client company gets nothing. It carries Pasal 8 sanctions and Pasal 4(3) responsibility, and its only instrument is a PDF contract in a shared drive and a vendor’s verbal assurance that everything was filed.

The specific failure this exploits: the client cannot see the vendor’s filing. Pasal 5(2)‘s three-working-day clock runs on the vendor’s side. Pasal 5(4) lets Disnaker quietly suspend the receipt — no receipt is issued, no alarm sounds at the client, and the client discovers the gap only when a labour inspector (Pengawas Ketenagakerjaan, Pasal 7) arrives, or when a worker sues and joint liability drags the client in. This is the classic silent-failure shape: nothing breaks visibly until the penalty is already running.

The incumbent alternative is a law firm doing a manual contract review at Rp 50–500 juta. That is a one-off snapshot of a duty that is continuous and monthly. A mid-market manufacturer with four vendors and 300 outsourced heads cannot buy that quarterly, so it buys it never.

What a focused team does 10× better: turn a one-off legal audit into a standing monthly evidence file, for less than the cost of one lawyer-hour, in Bahasa Indonesia, without asking the client to migrate any system.

4. Target market

• Primary customer: HR Manager or Legal & Compliance Manager at an Indonesian company with 200–3,000 direct employees that uses 2–8 outsourcing vendors for cleaning, security, drivers, catering or operational support. Manufacturing, mining services, logistics, hospitals, hotels, shopping-centre operators, palm-oil estates. Concentrated in Jakarta, Bekasi/Cikarang, Surabaya, Medan, Batam, Balikpapan.
• Why they buy: They cannot answer a labour inspector’s simplest question — “show me the bukti pencatatan for this vendor’s current agreement.” They also can’t prove, per Pasal 4(3), that the vendor paid BPJS and THR for the people cleaning their factory floor. Apindo’s Bob Azam has publicly defended outsourcing as an operational-efficiency necessity, which tells you the practice isn’t going away — the paperwork burden is what’s new.
• Rough TAM reasoning: ~68,000 firms are documented in the outsourcing ecosystem covering 2.2M workers. Vendors are the minority of that count; the client side is larger. I’ll be conservative: if 15,000 Indonesian companies use outsourced labour at a scale where a compliance manager exists, and I need 400 of them at Rp 3.5 juta/month for $1M ARR, that’s 2.7% of a conservatively-drawn population. The math does not require optimism.
• Why now for them: The 30 April 2028 reclassification deadline is real but distant; the pending revision is what forces action. If the four-category revision lands, contracts filed under “layanan penunjang operasional” become non-compliant on someone else’s timetable, and Pasal 8 escalation starts with a written warning the client must respond to.

5. Product sketch (MVP)

• Vendor register — every outsourcing vendor, each active Perjanjian Alih Daya, its signature date, expiry, site location and headcount, in one list with a compliance status per row.
• Pencatatan clock — logs the signature date, starts the Pasal 5(2) three-working-day timer against the Indonesian working calendar, and chases the vendor for the bukti pencatatan until the receipt document is uploaded. Red status if nothing arrives.
• Pasal 4 clause checker — reads the uploaded agreement and flags which of the six mandatory clauses in Pasal 4(1) are missing or thin, especially the worker-rights clause 4(1)(e) covering wages, overtime, leave, K3, BPJS, THR and severance.
• Pasal 3(2) classification verdict — for each outsourced role, gives a verdict on which of the permitted categories it falls in, flags anything resting on “layanan penunjang operasional,” and models the exposure if the pending revision cuts that category.
• Monthly vendor evidence request — a scheduled WhatsApp/email request to each vendor for BPJS Kesehatan and Ketenagakerjaan payment proof, payroll summary and THR records; tracks who responded and who didn’t.
• Inspector packet — one-click PDF per vendor: agreement, bukti pencatatan, clause-coverage table, classification reasoning, and the monthly evidence trail with gaps shown honestly.
• Non-response ledger — a dated record of every unanswered evidence request, which is the client’s Pasal 4(3) defence: it demonstrates the client tried to ensure compliance.

6. AI angle — what’s load-bearing

Two jobs, both genuinely hard without a model.

Clause extraction against Pasal 4. Indonesian outsourcing contracts are non-standard, often scanned, and bury worker-rights terms across annexes. The model reads the document and maps its content onto the six statutory requirements, quoting the clause it matched and flagging the ones with no match. Keyword search fails here because the statute demands substance, not vocabulary — a contract can say “hak-hak normatif sesuai peraturan” and satisfy nothing.

Functional classification of the work. This is the load-bearing piece. AHP’s own guidance says the test is a functional analysis against the client’s core business, not a label. So the model takes the client’s stated core business and the actual job description, and reasons about whether the role is genuinely ancillary — then writes the justification paragraph that goes in the inspector packet. That paragraph is the deliverable a lawyer would otherwise bill for.

Remove the AI and this degrades to a spreadsheet with due-date reminders. Somebody would still buy that, but it wouldn’t be worth Rp 3.5 juta/month, and the classification verdict — the part that requires judgement — would be missing entirely.

7. Localization angle

This is Indonesia-native by construction, not by translation.

The regulation only exists in Bahasa Indonesia; pencatatan is filed at the kabupaten/kota Disnaker where the work is performed, so a client with plants in Cikarang and Balikpapan deals with two offices and two local practices. The product must speak Bahasa, understand the Indonesian working-day calendar for the three-day clock, and know BPJS Kesehatan and Ketenagakerjaan as separate proofs.

Distribution is local too. Vendor coordinators respond on WhatsApp, not email — so the monthly evidence request is a WhatsApp thread with document upload, not a portal login the vendor will never create. Pricing in rupiah, paid by bank transfer or virtual account, invoiced with proper faktur pajak.

A generic global vendor-management or GRC tool cannot be bent into this. It doesn’t know Pasal 4, doesn’t know the three-day clock, and would ask an Indonesian security-services vendor to log into an English SaaS portal.

8. Business model — path to $1M–$5M ARR

• Pricing: Rp 2 juta/month (up to 3 vendors), Rp 3.5 juta/month (up to 8 vendors), Rp 6 juta/month (unlimited vendors, multi-site, up to 15 locations). Roughly $120 / $210 / $360.
• ACV: Rp 42 juta ($2,500) on the mid tier.
• Rough math to $1M ARR: 400 customers × Rp 3.5 juta × 12 = Rp 16.8 miliar ≈ $1.02M.
• Rough math to $5M ARR: ~1,400 customers with mix shifted toward the multi-site tier, plus an Rp 1 juta/month vendor-side seat sold back into the vendor base once clients start demanding filings through the tool. Realistically this needs the second motion; the client-side alone plausibly reaches $2–2.5M.
• Expansion path: per-site pricing as multi-plant manufacturers add locations; per-vendor overage; an annual “inspection-readiness review” as a paid add-on at Rp 15 juta — undercutting the law-firm audit by an order of magnitude while being sold to the same buyer.
• Why the price holds: it sits between the HRIS seat spend the buyer already approves (300 heads × Rp 25,000 = Rp 7.5 juta/month) and the Rp 50–500 juta legal audit. It is the cheapest line item on the compliance budget and the only one aimed at Pasal 8.

9. Go-to-market wedge — first 100 customers

• The reclassification list. Pull companies from Kemnaker’s WLKP mandatory-reporting data and industrial-estate tenant directories (Jababeka, MM2100, EJIP, KIIC — these publish tenant lists). For each, the outsourced functions are guessable from the sector. Send a one-page Bahasa PDF: “Your security and cleaning contracts are probably filed under ‘layanan penunjang operasional’. That category is in the pending revision. Here’s what Pasal 8 does to your production capacity.” Target 800 tenants across six estates, expect 8–10% meeting rate on a fear-of-inspection message with a real citation.
• Ride the law firms’ free content. AHP, Rajah & Tann, SIP Law Firm and Hukumonline have all published client alerts with checklists and no tooling. Offer the mid-tier firms a referral arrangement: they keep the high-value advisory and hand off the monthly monitoring they don’t want to staff. Three firms with 40 corporate clients each is a 120-company warm pipeline.
• HR practitioner communities. HRD Forum, Indonesian HR groups on LinkedIn and the large WhatsApp practitioner groups. Run a free “Pasal 3(2) classification check” — upload one job description, get the verdict and the reasoning paragraph. This is the lead magnet and a live demo of the load-bearing AI. Careful here: my own catalogue notes that free diagnostics can cannibalise the paid number, so the free check covers one role and withholds the packet.
• ABADI and the vendor associations. The outsourcing association represents vendors, who currently get blamed when a client’s filing is missing. A tool that makes the client chase evidence in a structured way makes the good vendors look good. Co-marketing with ABADI reaches clients through the vendors already serving them.
• Inspection-triggered inbound. When labour inspectors sweep an estate, word travels within days. Rank Bahasa content on “bukti pencatatan perjanjian alih daya” and “sanksi Pasal 8 Permenaker 7/2026” — low-volume, extremely high-intent queries that no HRIS vendor is targeting.

10. Build complexity — justification

Low. The regulation is eleven articles and I have the gazetted text; the compliance logic is a small rules table, not a research problem. Document ingestion and clause extraction run on off-the-shelf vision and language models. The three-day clock is a working-day calculation. WhatsApp evidence collection uses the Business API, which is mature in Indonesia. There is no government API to integrate — the bukti pencatatan is a document the vendor uploads, which is exactly why this is buildable: I’m tracking evidence, not filing to a state system. A pair ships v1 in 8–10 weeks; the real work is the Bahasa classification prompt and getting the packet format to look like something an inspector accepts.

11. Gating checklist

Gate	Pass?	Note
Legal in target market	✅	Compliance record-keeping tool. No filing on the government’s behalf, no legal advice — verdicts are framed as findings with citations, with a lawyer-review recommendation.
Ethical — no harm / dark patterns	✅	Net effect is that outsourced workers’ BPJS and THR get verified monthly by a party with leverage. The compliance-fear marketing is honest: the sanctions are real and cited.
Market exists (evidence above)	✅	2.2M outsourced workers, 68k firms, live sanctions, law firms publishing checklists with no tooling behind them.
1–5 person team can build this	✅	Two builders plus an Indonesian labour-law advisor on retainer.
Launchable with <$50K / ₹40L	✅	~$15–20K: build, WhatsApp API, legal review of the classification logic, and estate-directory outreach.

All five pass.

12. Feasibility score

Axis	Weight	Score	Notes
Problem intensity	20	16/20	Sanctions reach production capacity and site permits — that is severe. Docked because escalation is staged (written warning first), so it’s an urgent-but-not-bleeding-today pain for most, and the 2028 transition lets procrastinators procrastinate.
Demand evidence	15	11/15	Strong regulatory and professional-services evidence: gazetted text, multiple Tier-1 firm alerts, Apindo commentary. Docked hard because I have no verbatim buyer complaints — no HR manager saying “I can’t get my vendor’s bukti pencatatan.” The demand is inferred from the duty, not observed in the customer’s voice.
Build feasibility	15	13/15	Eleven articles, off-the-shelf models, no state API. Bahasa document quality is the only real friction.
Distribution clarity	15	11/15	Industrial-estate tenant lists are a real, enumerable target list, and law-firm referral is a genuine warm channel. Docked because Indonesian mid-market B2B sales are relationship-led and slower than a cold-email spreadsheet suggests.
Revenue mechanics	15	11/15	Pricing is well-anchored between HRIS spend and legal-audit spend. 400 customers for $1M is achievable. Docked because $5M realistically needs the vendor-side motion, which is a second product.
Time to first revenue	10	8/10	Sellable pre-build off the gazetted text; a paid pilot with two estate tenants inside 8 weeks is credible.
Defensibility	10	4/10	Honest score. Eleven articles of public regulation is not a moat. The moat is accumulated filing history and vendor relationships at month 12, plus being the name inspectors recognise on the packet. An Indonesian HRIS incumbent could bolt this on — though they’d be selling against their own vendor customers, which is real friction.
Total	100	74/100

13. Qualitative modifiers

Founder-fit tags

domain-expertise-required · sales-heavy

You need an Indonesian labour-law advisor from day one — the classification verdict is the product, and getting it wrong is worse than not shipping. And this is sold in Bahasa, in person, to compliance managers in industrial estates. A remote solo founder without Indonesian ground presence should not attempt this.

Key assumptions to validate (3–5)

1. Assumption: Client companies genuinely cannot produce the bukti pencatatan for their current vendors on request. How to test: Ask 20 HR managers across three industrial estates one question — “can you show me the registration receipt for your cleaning vendor’s current agreement?” — and count how many produce it within 48 hours. This is the whole idea in one question.
2. Assumption: The pending revision lands and removes “layanan penunjang operasional.” How to test: Track Kemnaker JDIH and Berita Negara weekly. If it lands with the four-category cut, urgency spikes and the classification feature becomes the headline. If it lands widening the categories instead, the classification angle weakens sharply.
3. Assumption: Rp 3.5 juta/month clears the approval bar without a procurement cycle. How to test: Put the real price in front of 15 compliance managers and ask who signs and whether it needs a tender. Anything requiring tender kills the <90-day revenue path.
4. Assumption: Vendors will actually respond to monthly WhatsApp evidence requests. How to test: Run the request manually for one pilot client across its four vendors for two months and measure response rate. Below ~50% and the evidence file has holes — though the non-response ledger retains defensive value.

Risk flags

1. Regulatory volatility: A finalised revision is sitting with the President. My own catalogue has a rescinded-order case where an enacted duty was withdrawn. The core registration duty (Pasal 5) is very unlikely to disappear — but the classification feature is exposed to the category rewrite, and I’m pricing that into a Medium confidence rather than pretending otherwise.
2. Two-year transition dulls urgency: Pasal 10(b) runs to 30 April 2028. Buyers can rationally defer. The counter is the pencatatan clock, which is live now for every newly signed contract — lead with that, not the transition.
3. Incumbent bolt-on: Talenta or Gadjian could add a vendor-compliance module. Their conflict is that they sell to vendors, but that conflict is soft, not structural.
4. Evidence quality depends on a third party: The product’s value rests on vendors uploading real documents. A vendor that stonewalls leaves the client with a gap ledger rather than a clean file — defensible, but not what was sold. Set that expectation in the pitch or it becomes a churn reason.

14. Structured verdict

Score:                  74/100
Verdict:                GO
Confidence:             Medium
Best-fit builder:       Indonesia-based technical founder with a labour-law advisor
                        and willingness to sell in-person in industrial estates
Time to revenue:        8–12 weeks (paid pilot pre-full-build)
Capital to launch:      $15–20K (Rp 250–330 juta)
Top 3 assumptions to validate first:
  1. 20 HR managers asked for their vendor's bukti pencatatan — how many produce it in 48h
  2. Pending Permenaker revision lands and cuts the operational-support category (JDIH weekly watch)
  3. Rp 3.5 juta/month signs without a procurement tender (15 pricing conversations)
Kill criteria:
  - Abandon if >60% of 20 HR managers produce the bukti pencatatan within 48 hours
    (the gap I'm selling into doesn't exist)
  - Abandon if the revision lands widening permitted categories AND the pencatatan
    duty moves to the client — the vendor-visibility gap closes and this becomes a form-filler
  - Abandon if <3 of 15 pricing conversations can approve Rp 3.5 juta/month without tender
  - Abandon if a major HRIS ships a vendor-compliance module before v1

15. Next step — 1-week validation sprint

• Day 1–2: Build the target list. Pull tenant directories for Jababeka, MM2100, EJIP and KIIC; identify 60 companies in sectors that certainly use outsourced security and cleaning. Get the HR manager’s name for 30 of them via LinkedIn.
• Day 3–4: Ask the one question. Contact all 30 in Bahasa: “Under Permenaker 7/2026 Pasal 5, your vendor must register the agreement within 3 working days. Can you show me the bukti pencatatan for your current cleaning contract?” Log who produces it, who says the vendor has it, and who has never heard of it. No pitch, no demo — just the question.
• Day 5: Take the ten most confused respondents, run a manual version by hand — read their agreement against Pasal 4, classify the roles against Pasal 3(2), and hand back a two-page packet. Then ask for Rp 3.5 juta/month.

Falsifiable outcome: ≥12 of 30 cannot produce the receipt within 48 hours, and ≥3 of the 10 manual packets convert to a paid pilot commitment. Below either threshold, the duty exists but the felt pain doesn’t, and I move on. The first number is the real test — if Indonesian companies already have these receipts filed, there is no product here regardless of how sharp the regulation reads.