The scan says the guard was there.
Who checked?

Every checkpoint scan is judged on the server against the checkpoint, the guard, the tag secret, the distance and the duplicate window — and the result the device claims is ignored.

A checkpoint’s secret, its coordinates and its radius are excluded from every read a phone can reach, and the comparison is constant-time, so the tag cannot be cloned from the app that scans it.

A fabricated or out-of-place scan is refused as proof and kept as an attempt, with an alert raised for someone to acknowledge — because the interesting thing about a bad scan is that somebody tried it.

The phone reads the tag itself — NFC on Android, the camera anywhere, or the printed code typed by hand on iPhone, where the browser has no NFC — and captures a high-accuracy fix with it.

A scheduled tour that produced no patrol leaves no row to notice, so a background sweep grades every settled occurrence on time, late or missed and notifies the site’s supervisors and the customer’s own portal users.

Every patrol with its site, its guard, its start and finish and the exceptions raised against it, filterable and exportable — the register someone opens when a client asks about last Tuesday.

Circles and polygons per site, typed as boundary, restricted, patrol or parking, each with its own entry and exit action — and an exit set to escalate starts the escalation chain rather than writing a line nobody reads.

Sequencing checkpoints into a route with an expected offset and a window per stop. The table exists and only the data importer writes it, so a route can be migrated in and not yet built on screen.

On the roadmap. It is not built, not scheduled, and not something to plan a contract around.

A check-in interval per guard from five minutes to four hours, and a background sweep that picks up every overdue timer, counts the miss and starts the escalation chain. The timer begins at the first check-in or when operations sets one.

An SOS stores the fix, fires the organisation’s duress rules and writes a critical notification that keeps re-sending every five minutes until somebody acknowledges it — and it lands at the top of the command centre, above everything else.

The server tells the device how many seconds to record, and the audio or video comes back as evidence filed against the alert itself — so the control room hears what happened rather than reading that something did.

Each level names a role, a delay and its channels; level one fires at once and a level left unacknowledged is advanced by a background sweep, so an alarm nobody answers climbs rather than sitting.

A guard’s position is accepted only while they have an active shift today, resolved from their session rather than from the request — off duty the fix is refused and nothing is stored.

The channel vocabulary carries SMS and push and both default to off, because there is no provider behind either. In-app and email are what actually deliver today.

On the roadmap. It is not built, not scheduled, and not something to plan a contract around.

The field runner is a mobile web page today. Native iOS and Android is an accepted architecture decision and not shipped code — which is also why background location and a background welfare prompt are not claimed anywhere on this site.

On the roadmap. It is not built, not scheduled, and not something to plan a contract around.

Every incident with its severity, site, status and the guard who raised it, over quick filters and a saved-view expression — and a client role is served a narrower column list in the query rather than a hidden column in the page.

INC-0001 upward, sequential per organisation, allocated under the organisation’s own row lock in the same transaction as the incident and its audit event — so two control-room operators cannot mint the same number.

An acknowledgement clock and a response clock, each scaled by severity — a critical incident gets half the time, a low one four times — measured against the site’s own response minutes rather than one organisation-wide number.

Only the assigned investigator, the guard it belongs to, or an administrator may acknowledge — anybody else is refused, a second acknowledgement is harmless, and an incident already resolved cannot be acknowledged at all.

Nine fields of the account of record are refused once an incident is closed, and it cannot be moved back out of closed — only the flag deciding whether the customer sees it stays editable.

Evidence is uploaded to a server-only directory behind a type allowlist, EXIF stripped, and read back only through one authenticated route scoped to the organisation — never from a public path a link could leak.

A letterhead PDF per incident and a filtered summary built from the same filters as the register, plus the Daily Activity Report that compiles a whole shift — the patrols, the welfare check-ins, the pass-down and any duress.

A named approver signing off a closed incident. The fields exist and the record page shows them unfilled, because the approval step itself is not built.

On the roadmap. It is not built, not scheduled, and not something to plan a contract around.

Unresolved duress first, then who is on duty from the roster, the open incidents, the patrols under way and a counted summary — refreshed on its own rather than when somebody remembers to reload.

Pending, dispatched, acknowledged, en route, arrived, completed — each transition stamping its own time, each refusal named, and order numbers sequential per organisation per year. The available-guards list excludes anyone already on a live order.

On-duty guards on a map, with the latest fix per guard inside a fifteen-minute freshness window, and an on-duty list beside it that works when the map cannot.

Every domain write already lands in an event outbox; a signal rule watches it for a named event and a set of conditions, and raises a reviewable item — dismissed, or turned into an incident, by hand or automatically.

Handovers, occurrences, visitors, alarms, maintenance and instructions entered by the guard on the phone, and compiled into the shift’s Daily Activity Report rather than left in a notebook at the desk.

Five attempts on a one, five, thirty, one-hundred-and-twenty, seven-hundred-and-twenty minute ladder, signed, then dead-lettered — with private addresses and the cloud metadata endpoint refused on every attempt, not only the first.

Name, company, purpose, host, vehicle registration and badge on the way in; signed out, no-showed or denied on the way out. Pre-registration requires an expected arrival, so a booked visitor is a row rather than an email.

Judged against the expected departure when one was given and against the site’s maximum hours when it was not, by a sweep that notifies once per visit — so the evacuation list is the list of people actually here.

Access zones with their own rules, credentials issued as card, fob, PIN or mobile to a guard, a contractor worker or a visitor, each suspended or revoked with the time it happened — and an ingested event that matches a rule can raise an incident by itself.

Repeated denials on one credential inside a window, and the same credential granted at two zones closer together than anyone could travel — two sequences a single access event cannot reveal, found by a sweep and raised for review.

Events arrive today through an authenticated call carrying the head end’s own event id, which is how a middleware or a scheduled push feeds them. A shipped adapter for a named panel vendor is not built, and every provider starts as not connected.

On the roadmap. It is not built, not scheduled, and not something to plan a contract around.

A weekly template generates shifts across a horizon you set, overnight shifts included, and generates them unassigned — because deciding who works is a person’s job and generating a name is how a roster stops being trusted.

Eligibility is worked out live for the shift date from the licences on file, never from a stored score that could be stale — and where the shift asks for a licence class, the guard must hold that class and not merely a licence.

Five configurable rules — double booking, which is always on; minimum rest; expired licence; required licence class; incomplete onboarding — refusing the save, with a warning-level rule overridable only with a reason the audit event then carries.

An unfilled shift offered to a group, applied for, and filled — and a swap between two guards written as one transaction where both legs are checked against the gates before either is saved.

Three windows per shift, separately retained, so a correction changes what will be paid without overwriting what happened — and the variance between rostered and actual is typed per direction rather than flagged as "different".

Approved hours export to a nine-column CSV under a lock: the period can only export once, each hour is marked exported in the same transaction, and every line keeps its own snapshot. There is no award interpreter — this records time worked and hands it over.

A guard cannot clock on at a site with an approved post order they have not acknowledged. The refusal names the document, so the fix is reading it rather than finding a supervisor.

Every licence with its number, issuer, class and expiry, and a dashboard that counts what has expired and what expires inside thirty, sixty and ninety days — filterable to the site the guards are rostered at.

A platform-wide catalogue of security licence classes across eight Australian jurisdictions, named against their actual regulators — and any entry whose code could not be confirmed is marked as a placeholder to correct, not stated as fact.

Four exclusive bands swept in the background, one notification per item per band, idempotent — so a licence expiring is noticed four times before it lapses rather than once after.

Licences, qualifications, training, police checks, working-with-children checks, right to work, vehicle registration, contractor insurance and site certificates all satisfy a requirement through one evaluator — and a requirement marked blocking is the one the roster enforces.

Organisation, site, client, role, contractor, refresher and return-to-work inductions in one register covering employees, contractor workers and office staff alike, each with its coverage state rather than a tick.

A safe work method statement and a safe work procedure are carried apart, because most security work is not construction work — and a new version moves the pointer, so yesterday’s sign-on stops satisfying today’s requirement.

Policies, procedures and post orders versioned, issued, acknowledged — and the receipt records a hash of the object the person was shown rather than the label they signed, so "I signed a different version" is answerable.

A patrol vehicle’s walk-around filed from the phone, where the pass or fail is derived on the server from the answers rather than sent by the client — and a failed safety-critical line raises a work order in the same transaction.

Every write sequenced and chained per organisation under a uniqueness constraint that makes a forked chain impossible, with the actor and the credential inside the hash — so an attribution cannot be rewritten afterwards either.

Nineteen tables holding employment, pay, recruitment and background-check records log who read them, enforced in the data layer rather than per screen — so a privacy question has an answer that is not "probably nobody".

Who is on site, the patrols and tours, their incidents, their visitors — and the service line is enforced at the door rather than in the menu, so a customer who buys only cleaning cannot reach a security screen by typing its address.

A visitor pre-registered by the customer in their own portal lands in the same register the gate works from, so reception is not transcribing an email at eight in the morning.

Six datasets, each fixing its own field allowlist and its own client profile: incidents are filtered to the client-visible ones with the narrative and the guard removed, and timesheets and licences are not client-readable at all.

Daily, weekly, fortnightly, monthly or quarterly, at a time you set, rendered by the background worker — and the run row survives the retention window even after its output is deleted, so the history of what was sent stays.

Nine security calculators over one build-up — guard hours by day type, a static post, a mobile patrol run allocated across its sites, alarm response, event crowd control, control-room monitoring, equipment, mobilisation and a licence-class premium.

One engine, two domains, and an estimate must declare which — the line types differ, and an accepted security estimate writes a static-guard contract on the security service line rather than something a person retypes.

Contract rates typed by service — static guard, mobile patrol, alarm response, event — and by rate type, effective-dated and overridable per site, so a rate rise is a new row rather than an edit to history.

Approved hours priced by rate type, one line per rate, with the rate resolved site, then contract, then organisation — and an unresolvable rate producing a named refusal rather than a line that quietly costs nothing.

Each invoice line keeps the hours it was built from, and an attempt to bill them again is refused with the instruction to raise a credit note against the earlier invoice — which is the difference between a billing system and a spreadsheet.

One schedule per contract, in the same cadence vocabulary the report schedules use, drafted by the background worker — so a monthly invoice is not a recurring diary entry for a person.

The import layouts those two products actually accept, column for column, with the account and tax codes resolved from your own mapping — a file you upload, not a connection we do not have credentials for.