GuardCore · Lone worker safety
Lone worker safety for the guard on their own at 3am
A welfare interval that escalates when it lapses, a duress alarm that records and keeps re-sending until someone acknowledges it, and five escalation levels that advance themselves.
The problem this solves
A lone worker feature is worth exactly as much as what happens when nobody is watching. A panic button that writes a row, a welfare check that shows amber on a screen nobody has open, an escalation policy that needs a person to trigger the next level — each of those is a feature that fails in the only situation it exists for.
That failure is not hypothetical here. GuardCore’s welfare logic and its escalation chain both used to run only when the console asked them to, and the console never did. A guard who stopped checking in was noticed by nobody. Both are background jobs now, running on a leased schedule in a separate worker process, which is the difference between a policy and a control.
Duress is built the same way round. The alarm writes a critical notification that requires acknowledgement and re-sends itself every five minutes until it gets one, mails the organisation’s duress list, and tells the device how many seconds to record. The clip comes back as evidence filed against the alert.
The honest limits are here too, because a guard finding them out on shift is worse than a buyer reading them now: the field app is a mobile web page, the browser cannot deliver location or a welfare prompt in the background, and the welfare timer starts at the first check-in or when operations sets one rather than automatically at sign-on.
Worked example
A guard checks in at 01:00 on a thirty-minute interval, and then does not.
- 1
01:30 passes
The timer is overdue. Nothing on anybody’s screen has to be open for this to matter.
- 2
The worker picks it up
A background sweep selects every active timer past due, increments the miss and stamps the escalation — the selection, the write and the rules all inside one transaction per timer.
- 3
Level one fires
The organisation’s welfare rules run: the role named at level one is notified on the channels it names.
- 4
Level one is not acknowledged
A second sweep advances the chain to level two on its own, and keeps going up to five. An alarm nobody answers climbs instead of sitting.
The guard is missed by the system at 01:30 rather than by a colleague at 07:00.
Capabilities
What lone worker safety gives you
5 of these 7 are in the product today; the rest carry a badge saying what they actually are. Each one names what it is built on.
Welfare checks with a lapse that is noticed
LiveA check-in interval per guard from five minutes to four hours, and a background sweep that picks up every overdue timer, counts the miss and starts the escalation chain. The timer begins at the first check-in or when operations sets one.
Duress that reaches a person
LiveAn SOS stores the fix, fires the organisation’s duress rules and writes a critical notification that keeps re-sending every five minutes until somebody acknowledges it — and it lands at the top of the command centre, above everything else.
The clip the alarm carries
LiveThe server tells the device how many seconds to record, and the audio or video comes back as evidence filed against the alert itself — so the control room hears what happened rather than reading that something did.
Five escalation levels that advance themselves
LiveEach level names a role, a delay and its channels; level one fires at once and a level left unacknowledged is advanced by a background sweep, so an alarm nobody answers climbs rather than sitting.
Location only while on shift
LiveA guard’s position is accepted only while they have an active shift today, resolved from their session rather than from the request — off duty the fix is refused and nothing is stored.
Escalation by SMS or push
RoadmapThe channel vocabulary carries SMS and push and both default to off, because there is no provider behind either. In-app and email are what actually deliver today.
On the roadmap. It is not built, not scheduled, and not something to plan a contract around.
A native app for the guard
RoadmapThe field runner is a mobile web page today. Native iOS and Android is an accepted architecture decision and not shipped code — which is also why background location and a background welfare prompt are not claimed anywhere on this site.
On the roadmap. It is not built, not scheduled, and not something to plan a contract around.
What backs these claims
Each capability names the decision record, module, route or table it is built on. Ask us for any of them in an evaluation and we will walk you through the code.
- Welfare checks with a lapse that is noticed
- src/server/imss-guard-safety.ts welfareOverdue parseInterval · src/server/imss-jobs/welfare.ts sweepWelfareTimers · imss_welfare_timers · /imss/mobile-app
- Duress that reaches a person
- ADR 0046 · src/server/imss-duress.ts notifyDuress · imss_sos_alerts · /imss/command-centre
- The clip the alarm carries
- ADR 0046 · POST /api/imss/sos-recording · src/lib/duress-recording.ts · src/server/imss-duress.ts fileDuressRecording
- Five escalation levels that advance themselves
- src/server/imss-escalation.ts escalate MAX_LEVELS · src/server/imss-jobs/escalation.ts sweepEscalationLevels · POST /api/imss/escalation-events · /imss/escalation · imss_escalation_rules
- Location only while on shift
- ADR 0022 · src/server/api/imss/guard-locations/POST.ts · imss_guard_locations
- Escalation by SMS or push
- src/server/imss-notification-resend.ts · src/server/imss-channel-settings.ts
- A native app for the guard
- ADR 0038 · docs/adr/0038-react-native-field-app.md · imss_mobile_offline_actions · v3 mobile_device · v3 offline_action
Where this sits
Back to
GuardCore — every capability in one place
The whole module: what is live, and what is only on the roadmap.
Read next
A control room screen for the shift actually in progress
Unresolved duress at the top, who is on duty from the roster, the open incidents, the patrols under way — and dispatch orders that move through six states, each stamping its own time.
Twenty minutes on a real contract.
Real data, four logins, nothing typed on the day — including the parts we have not built, which we will point out ourselves.