San Francisco's Civil Service Commission voted 4-1 Thursday to allow the city to keep its $28.5 million permitting software contract with OpenGov alive — even as city workers' union reps testified the software runs on a framework so outdated it puts residents' personal data at risk.

The vote is the latest institutional benediction for the most contested tech contract of Mayor Daniel Lurie's tenure: a no-bid deal with a vendor whose founders donated to his nonprofit and whose selection city staff objected to. Every institutional check on this contract — the city's own Budget and Legislative Analyst, and now a divided Civil Service Commission — has found problems. Each time, the contract has survived anyway. The next and potentially final hurdle is the Board of Supervisors.

At a two-hour hearing Thursday, the Civil Service Commission cleared a formal regulatory barrier for Lurie's PermitSF overhaul, voting 4-1 to authorize the city to contract out IT work to OpenGov, the SF-based software firm at the center of an escalating fight between City Hall and its own employees.

The approval came with conditions. City leaders agreed to include a labor intermediary to ensure worker protections remain in place and to continue negotiations with IFPTE Local 21, the union representing city IT employees. The Planning Department must also report back to the commission every six months — an oversight mechanism that suggests even the majority wasn't fully confident in what it was approving.

Commissioner Adam Wood, who cast the lone dissenting vote, was less diplomatic. He called the implementation of OpenGov's software "half-baked" and "rushed" — language that echoes a finding by the city's Budget and Legislative Analyst, which released a report earlier this month concluding that the OpenGov selection process "did not follow best practices" and that it "could not be assured that an unfair advantage was not given" to the vendor.

A Security Warning the Commission Did Not Fully Resolve

The sharpest exchange at Thursday's hearing involved not the price of the software but the safety of the data flowing through it. Emily Wallace, a staff representative with IFPTE Local 21, testified that OpenGov's underlying software framework reached "end of life" in 2022 — meaning it no longer receives security patches or updates. That, she said, leaves the personal information of San Franciscans who submit permit applications through the system potentially exposed.

Wallace also alleged a chilling effect on city workers who raised concerns internally. Staff members who spoke critically of PermitSF in feedback sessions were pulled from the project, she said, quoting a message reportedly relayed to those employees: "They were told 'you have too much information, and it threatens to undermine what we are trying to do.'"

Planning Department leadership defended the project and its personnel decisions, calling the task of assigning staff "complex and ongoing." Executive Director Sarah Dennis Phillips cast the software overhaul as a matter of economic urgency. "We're midstream in our economic recovery," she said. "We don't want permits to hold up our jobs or small businesses."

The mayor's office, which referred The Standard to the Office of Small Business for comment, offered support without engaging the security allegations directly. "We are looking forward to continuing the vital work to modernize San Francisco's permitting, in close partnership with city staff whose hard work every day makes it possible," said spokesperson Michelle Reynolds.

The Money and What's Left

The commission's vote clears a hurdle for a contract that carries a $6.5 million professional services fee and an additional $22 million in OpenGov licensing costs over five years — a total exposure of $28.5 million for a system that, by the Planning Department's own admission at Thursday's hearing, has not yet hit its original implementation targets.

Lurie launched PermitSF in February 2025 and hired OpenGov that summer without issuing a competitive bid — a decision that drew scrutiny because the company's founders had donated to Lurie's former nonprofit, Tipping Point Community, and because city staff had preferred a different vendor. The original go-live date of February 2026 was missed.

The commission's approval does not end the fight. The OpenGov contract still requires a vote by the Board of Supervisors, where scrutiny of Lurie's contracting practices has been sharpest. Supervisor Jackie Fielder called for the BLA investigation that found process failures; that report is now part of the formal record supervisors will consider.

The commission's vote was not a ringing endorsement. It was a conditional pass by a body that heard credible security concerns, was told by its own dissenting member that the rollout was "rushed," and still said yes — with a promise to check back in six months. Whether the Board will apply the same logic or demand more is the next question.