Safety, patrols and the gate
A panic alert that needs one hold, incidents that keep their history, a patrol roster you declare yourself, and visitor passes a guard can check in by code or QR.
Safety is a module (Safety & patrols), available to estate, HOA and neighbourhood communities. It is deliberately conservative about what it claims: it records, notifies and timestamps; it does not dispatch armed response or replace a phone call to the police.
The safety page
/safety is the landing page for every member. It shows four numbers — open incidents, active alerts, patrols on duty and average response time — and puts the panic button in a red banner at the top. Nothing about a panic requires navigating deeper: a person in trouble should never be hunting for a menu.
If your community's plan does not include the safety module, this page renders a locked state rather than an empty dashboard, and the menu entry is absent.
Panic: one button, nothing to fill in
- Hold the button. "Hold to alert" becomes "Keep holding…" and then sends after two seconds. The hold exists to stop an accidental tap summoning the whole community at 3am.
- The alert goes out immediately. It is raised at emergency priority, which bypasses every notification preference — a member who has turned off alerts still receives a panic.
- Location is best-effort. If the browser grants a position within three seconds it is attached; if it is slow or refused the alert still sends, without a pin. A missing pin is not a failed alert.
Because a panic row can never be edited, cancelling one writes a new record with a reason and resolves the linked alert in the same transaction. The original trigger, who raised it and when, stays on the record for good.
Incidents
Any member can report an incident — there is no role gate on filing one. Protection leads and admins move it along. Incident numbers are sequential (INC-YYYY-NNNNN), and the type and escalation target come from lists your platform operators maintain, so "attempted burglary" means the same thing in every community.
| Status | Means | Where it can go next |
|---|---|---|
| Open | Reported, nobody has picked it up | Acknowledged, false alarm |
| Acknowledged | A lead has seen it and owns it | Responding |
| Responding | Someone is on the way | On scene |
| On scene | Attended | Resolved |
| Resolved | Dealt with, the record stays | Closed |
| Closed | Finished | — |
| False alarm | Nothing was there; kept rather than deleted | — |
The detail page carries a Next step panel with only the transitions that are legal from the current status. There is no edit page: an incident's status is a sequence of events, not a form to be corrected. A member can tick Report anonymously. The form says exactly what that means — "your name is hidden from other residents but visible to protection leads" — and the incident then shows "Anonymous" in place of the reporter's name. It is a shield from neighbours, not a secret ballot from the people who have to act on it.
Patrols and the patrol clock
The roster is self-declared. A patrol goes on duty because they said so on /safety/patrols, with an optional vehicle and route — it is a board the community can read, not a dispatch system. States are On duty, On break and Off duty; the page groups people by which of the three they are on.
/safety/clock is the paid-shift counterpart. A staff member clocks in, clocks out, or cancels a shift they started by mistake. GPS is captured when the browser allows it and skipped when it does not: an unlocated shift is not a rejected shift, it is shown to the lead with "No GPS captured (browser denied or unsupported)".
Patrol payroll
Every clocked shift lands in a queue at /safety/payroll for the protection lead, in three states: Pending, Approved, Rejected. Both outcomes are final.
- Check the hours. Approval shows the raw hours and lets the lead set Payable hours — the place to clip an unworked stretch.
- Approve or reject with a reason. A rejection always carries a note the staff member can read, so a missing payment is explainable without a phone call.
- Export the month. The CSV export produces
payroll-<community>-<from>-to-<to>.csvfor whatever payroll you already run.
Pay is payable hours × that staff member's hourly rate. Rates are set per person on the same page; deactivating someone removes them from the roster without erasing the shifts they have already worked.
The gate and visitor passes
Two surfaces, two audiences. Residents use Visitors (/visitors) to pre-authorise someone; gate staff use the Guardhouse (/gate) to let them in.
Resident: create a pass
A pass is a name, a purpose — Guest, Delivery, Contractor, Ride-hail or Other — and when it is expected. On saving it becomes a six-character code plus a QR of that same code. The alphabet deliberately omits I, L, O, 0 and 1, so a code read over a phone cannot be misheard.
Guard: check in, check out, deny
The board shows Expected today, On site now, Departed today and Denied today, with a single field at the top for the code. Typing a code and pressing Check in is the whole flow; the row also carries Deny and Check out. Every action writes to an activity log with the time and the guard who did it.
| Pass status | What it means |
|---|---|
| Expected | Issued and not yet used; the code and QR are live |
| On site | Checked in at the gate |
| Departed | Checked out |
| Expired | The expected window passed without a check-in |
| Cancelled | The resident withdrew it; the code stops working immediately |
The code and QR are shown only while a pass is live. That is the point of cancelling rather than forgetting: a cancelled pass cannot be presented at the gate a week later.
What safety does not do
- It does not call anyone. A panic notifies members inside the app, email and push; the call to the armed response or the police remains a call.
- It does not control gate hardware. No boom, no intercom, no camera — a guard works the board, and the pass is the credential.
- It does not track patrols in real time beyond the position captured when they clock in. There is no live map of where a patrol is this minute.
- It cannot unwrite. Incidents, panic events and patrol logs are append-only; the record of what happened is the product.