The visitor book was never the problem
Replacing a paper book with a tablet at the guardhouse just moves the queue. What removes it is the visitor arriving with a credential that already works — a rotating QR on their phone, or a plate the barrier recognises before they reach it.
What a guardhouse stops doing
- Copying plate numbers
- The invitation carries the plate; the barrier reads it
- Phoning the host
- The host is notified automatically on arrival
- Issuing cards
- The credential is already on the visitor's phone
- Chasing badges back
- Nothing physical is handed over, so nothing goes missing
- Guessing at a roll call
- Entry and exit are real events against real records
From invitation to sign-out
Six steps, and the visitor only consciously participates in two of them.
Invite
A host invites a visitor from the console or from their phone. They set the window, the zones, and whether a vehicle is coming. A pass type does most of this for them.
Deliver
The visitor receives a link by WhatsApp or email. No app, no account, no password. Opening it shows their pass and, on the day, a live rotating QR code.
Arrive
If they drove, the barrier reads the plate on the invitation and lifts without a conversation. If they walked, the QR opens the lobby turnstile.
Check In
The kiosk confirms the visit, captures a face for the return trip if the visitor consents, and prints a badge if the site wants one. The host is notified that their guest has arrived.
Move
The lift offers only the floors the pass permits, and interior doors on the way accept the same code. The visitor is never handed a card they have to remember to bring back.
Sign Out
Exit is an event like any other, so the on-site roll call is accurate. A pass that is never signed out is flagged rather than quietly forgotten.
Contractors are not guests
A guest is here for two hours and needs one floor. A contractor is here for six weeks, needs the plant room, has to acknowledge a site induction, and must not be able to get in on a Sunday. Treating both as “visitors” is why most visitor systems end up bypassed.
Pass types carry those differences. Build the contractor template once — zones, schedule, induction requirement, expiry — and every contractor pass issued from it inherits the lot. Change the template and the passes already issued follow.
Evacuation is the real test
Every visitor system claims a roll call. The question is whether it is right at 14:32 on a Tuesday when the alarm sounds.
It is right here because it is not a separate list. It is the same event stream that opens the doors — entries and exits recorded at the point they happen, by the same readers, against the same holder records. There is no nightly reconciliation for it to be out of date since.
Privacy is part of the product, not a policy document
A visitor face capture is optional, consented at the kiosk, stored as an irreversible template rather than a photograph, and deleted when the pass expires unless the visitor is re-invited. Their phone number is used to deliver the pass and is not retained for marketing. These are behaviours of the system, which is what makes them auditable.
Frequently asked questions
Does a visitor need to install an app?
No. The visitor receives a link by WhatsApp or email and opens a mobile web page. The dynamic QR code is on screen with its countdown ring. Nothing is installed and no account is created.
How does a visitor pass expire?
Two ways at once. The individual QR code rotates every few seconds, and the pass itself has a validity window set at invitation time — typically the appointment plus a margin. Once the window closes, no code minted from that pass is accepted.
Can a visitor be checked in by face instead?
Yes. A visitor can consent to a face capture at the kiosk on first arrival, which makes return visits hands-free. The template is deleted when their pass expires unless they are re-invited.
How do I know who is in the building right now?
The on-site roll call is live because every entry and exit is a real event against a real holder record. In an evacuation the list is current rather than a printout from the morning.
Can contractors be handled differently from guests?
Yes — that is what pass types are for. A contractor pass can require an induction acknowledgement, be restricted to specific zones and a weekday window, and last for the length of the job, while a guest pass lasts two hours and reaches the meeting-room floor only.
What happens at the barrier if a visitor drives in?
The invitation can carry a vehicle plate. UltraPASS-Vehicle reads it at the boom gate and clears the car against the same pass that will let the visitor through the lobby, so the guardhouse is not copying plate numbers by hand.
See a visitor pass mint itself
The demo lab shows the rotating code and its countdown, exactly as a visitor sees it.