Thermova: bulk EPC matching, live savings calculators and a surveyor booking engine

The bottleneck

Thermova installs heat pumps, solar and battery, insulation, EPC compliance and air tightness testing nationwide from a Blackpool base, and its founder spent over a decade installing renewables before that. Two very different jobs sit inside the same business, and neither had the tooling it needed.

On the consumer side, homeowners and landlords researching heat pumps, solar and insulation were being served by a generic site that quoted vague savings ranges and never said what applied to their house. The £7,500 Boiler Upgrade Scheme grant is advertised across the whole sector and almost never tied to a specific property's eligibility.

On the landlord side, portfolios. An agent with a hundred properties had to look each one up in the national EPC register by hand, copy the band across and decide what to do next. Roughly a day of work, and it was stale the moment a property was upgraded. The UK government has proposed a higher energy performance standard for privately rented homes by 2030, with the detail still dependent on legislation, so portfolios only need auditing more often, not less.

And underneath both, the survey operation. Bookings, routes, surveyor days, capacity, the spreadsheet the business actually runs on, callbacks and reminders. All of it manual, and all of it the thing that decides whether an installer can take on more work or has to stop selling.

What I built

One platform on Supabase, doing three jobs: the public site, the portfolio EPC engine, and the operational engine that schedules the work.

The consumer site and the calculators

Service pages for air source heat pumps, solar, battery storage, landlord services, the Boiler Upgrade Scheme and airtightness testing, plus nine town-level landing pages and three dedicated EPC-C pages covering Blackpool, Preston and Lancashire. A savings calculator is fed by live fuel prices rather than fixed assumptions: unit rates from the Ofgem price cap, a kerosene daily average and the LPG refill price, each pulled by its own scheduled function. If a source fails, the failure is alerted and the last known values are retained, so the calculator never publishes a broken number. Grant eligibility is surfaced against the property in front of the visitor, and the scheme rules are stated plainly: one grant per property, £7,500 towards an air source or ground source heat pump, and an additional £1,500 until March 2027 for off-gas oil and LPG homes, subject to the current scheme rules.

The EPC engine

Upload a CSV of properties and the platform matches every row against the national EPC register, scoring candidates with Jaccard string similarity and layering house-number and street checks on top so that a long, over-specified input cannot outscore the correct short one. Rows missing a postcode borrow one from a sibling row with the same house and street. Each result carries a confidence tier: high, medium, low or not-found. Confident matches surface the current band, SAP score, floor area and inspection date; everything else is queued for a human instead of being quietly accepted. The file is processed concurrently, so a portfolio that took a day takes minutes.

The engine has already survived one forced migration. The public EPC service it originally called was retired in May 2026, which broke the checker silently. It was rebuilt against the GOV.UK register API sharing a single matcher with the single-property lookup, so there is one scoring implementation rather than two that can drift apart.

The corrected-EPC workflow

An EPC's default calculation assumes a level of air tightness rather than measuring it, and that assumption can cost a property its band. Where a property is close to a threshold, the platform runs the corrected-EPC route end to end: a Pulse air permeability test booked with an ATTMA Level 1 accredited operator, the measured value fed back into an RdSAP 10 calculation, the certificate lodged for building control and issued within 24 hours, and a customer-facing report. Assessment, calculation, lodgement and reporting are one pipeline instead of four separate tools.

Booking and routing

This is the part that decides whether the business scales.

• Blocks create themselves. The first enquiry in a postcode district creates that district's block and assigns it to the nearer team base by measured drive time. Nobody seeds them by hand.
• Capacity is owned. Each block-day has a ceiling and belongs to a named surveyor, and the ledger is structural: a day cannot exist without an owner, and it cannot name an owner the diary puts out of reach.
• One way to claim a slot. Every booking, whether it comes from the website chat, the phone, the dashboard or an external system, claims capacity through a single database routine. That is the choke point that makes double-selling a slot impossible rather than unlikely.
• Drive time is real. Properties are geocoded and screened against actual travel time, not straight-line distance, so an offer is one a surveyor can keep. A stay-over day, where the block is more than three hours from its own base, starts the route from the previous day's last job rather than from base.
• The day planner. Once a day fills, the platform orders the visits by travel time, assigns times, keeps morning before afternoon, and holds survey length as a dashboard-editable setting. A job that would land after the configured latest appointment is flagged for a human rather than booked late, and a long-distance day carrying too few jobs is flagged rather than confirmed, even though its slots have already been offered.
• Traffic is opt-in and contained. The optimiser can use a live traffic routing layer, behind its own key and its own kill switch, deliberately separate from the slot path's routing configuration so that enabling live traffic for route ordering can never disturb availability. It also caches traffic per day so a re-run does not re-buy the same queries.
• Filling the gaps. The day plan finds the hole in a surveyor's afternoon and the jobs that could fill it, then rings several of them at once, first come first served, with the offers expiring on their own.

The spreadsheet the business already runs on

The operations lead runs scheduling from a Google Sheet, and the platform treats that as the source of truth rather than asking the business to change how it works. The sheet is pulled into read-only mirror tables on a schedule, including both of the diary's job lanes and the way cancellations are recorded in place. The booking engine reads those mirrors for capacity and reach, and confirmed bookings are written back into the Booking Calendar. The write-back is protected by a single-writer lease and atomic row claims, our own rows are de-duplicated so they are not counted twice, and a re-optimisation only queues a row when something that belongs in the sheet has genuinely changed. New leads are queued into the sheet in the same database transaction that stores the lead, so delivery of a person into the leads tab does not depend on a background job succeeding.

The customer conversations

• A website concierge that can actually book. A chat agent answers, checks suitability and offers appointment slots, with the booking authority held server-side rather than in the model, a stricter suitability gate than the human-facing flow, per-visitor rate limits and a daily token budget with an operator kill switch.
• One event log for the CRM. Every inbound webhook lands in a single deduplicated event table, with stale events rejected on timestamp and retried writes queued, so a retry storm cannot double-book anything.
• Two-way SMS into the dashboard. Inbound messages become dashboard-readable rows idempotently, and where a landlord introduces a property in the conversation, the property is captured and validated against the same rules as a form submission.
• Callbacks with provenance. A callback can only be created from an inbound message the customer genuinely sent and the system has stored. That single rule is why importing historical mail cannot invent a callback. Reminders are per contact per appointment day, sent from the location's number, with failures recorded.
• Reactivation, human-approved. Dormant leads can be worked by a campaign that a person approves first, that only sends on UK weekdays inside sending hours, that caps jobs per tick, and that passes the same consent and do-not-contact gates as everything else. The targeting is computed inside the database rather than by paging an API, so it cannot silently truncate the audience.

The internal surface

• An operations assistant for the team. A separate internal assistant, JWT-gated, that can read the day plan and claim the same route-aware gaps the team sees. Anything it wants to send lands as a pending draft that a human has to confirm, which is enforced by the store rather than promised in a prompt.
• A surveyor app for the field. On-site surveys with a room taxonomy, GPS and EXIF-stamped photographs uploaded straight to storage, and surveyor availability handled separately from system permissions.
• A publishing subsystem. Case studies and blog articles are written in an internal editor, parsed and rendered to static HTML by a function that commits the result to the site repository directly, so publishing an article is a database action rather than a developer task.
• Observability that raises its hand. Nightly reconciliation between the CRM, the database and the sheet with flags for anything that does not add up, per-tab delivery evidence for sheet writes, watchdogs on the webhook path, and SMS alerts when an external data source stops returning what it should.

What changed

For the portfolio side of the business:

• Bulk audits in minutes instead of a day per hundred properties, with match confidence attached to every row.
• Ambiguity routed to humans, so a wrong band never reaches a landlord dressed up as a result.
• A regulated workflow in one pipeline, from the Pulse air test through RdSAP 10 to a lodged ATTMA certificate and a customer-facing report.

For consumer traffic:

• Property-specific savings numbers driven by live fuel prices rather than a vendor-generic range.
• Grant eligibility tied to the actual property, with the scheme rules stated and re-checked at application.
• A concierge that converts, answering the question and offering a real appointment rather than collecting an email address.

For the operation itself:

• Capacity that cannot be double-sold, because one database routine owns every claim.
• Routes that a surveyor can actually drive, built from real travel times, with long-distance days flagged before they are confirmed rather than after.
• The spreadsheet stays, as the system of record the team already trusts, with the platform reading it and writing back to it safely.
• Nothing sends itself. Reminders, callbacks and reactivation campaigns all sit behind consent, do-not-contact and, for reactivation, human approval.