The logs were all filled in. That was the problem. — A case study
An assignment becomes a claim.
Before
Shifts were arranged by phone call and held in somebody's head or somebody's spreadsheet. The guard knew where to be because they had been told, and the company knew what had been agreed because it remembered. Neither side had a copy, so a dispute about what was assigned was a second argument sitting on top of the first.
Now
A manager assigns the shift remotely: a guard, a site, a window. The phone receives it, so the app already knows where the guard is supposed to be, when, and what evidence it is going to ask for when they get there. The assignment exists before the shift does, which is what makes it possible to notice the shift not happening.
- Manager assigns guard, site and time window from the roster
- The assignment reaches the guard's phone as the shift of record
- The app knows the site's boundary and the window before arrival
- A deadline is scheduled at the same moment the shift is
A claim becomes evidence.
Before
Checking in was a signature or a tap that said 'I am here'. It carried no information beyond the assertion itself, and the assertion was the thing in doubt. A guard could write down the time they were supposed to arrive rather than the time they did, and there was nothing in the record that disagreed.
Now
Check-in captures a live photograph from the camera together with the phone's position and an identity, and stamps it with a time issued by the server rather than read off the handset. The four arrive as one record and it is written once — a later correction is a new entry a supervisor puts their name to, never an edit of the original.
- A live photo from the camera, not a file chosen from the gallery
- Position captured and judged against the site's boundary
- Time issued by the server; the phone's clock is recorded, not trusted
- Written once — corrections are new records a supervisor signs
The shift nobody worked becomes the alert.
Before
Everything the company learned, it learned late. A missed shift showed up at payroll, weeks after the night it happened, by which point it had already been invoiced to a client and paid to a guard. The one moment when the information was worth anything — while there was still time to send somebody else — had passed unnoticed.
Now
An arrival notifies the supervisor as it happens. More importantly, so does a non-arrival: because the assignment scheduled its own deadline, the deadline passing with no check-in against it raises an alert on its own. The system's most valuable event is one that nobody performs, and it had to be built deliberately, because an absence emits nothing.
- Arrival, with its photo, pushed to supervisors in realtime
- The scheduled deadline fires when no check-in has answered it
- Late, wrong-site and short shifts classified by rule, not by reading
- Only exceptions are pushed; the roster carries the shifts that went fine
A security company was paying for shifts it could not prove had been worked. Guards arrived late and wrote down that they had not, or did not arrive at all and wrote down that they had — and because the timesheet was the only record, the timesheet won. We built the shift system that replaced it: managers assign shifts remotely, a guard checks in with a live photo at the gate, and a supervisor is told the moment somebody arrives — or the moment it becomes clear that nobody is going to.
The company's attendance record was complete, neat, and untrue. Every shift had hours against it because the person who worked the shift was the person who wrote down the hours, and nobody was at the site to say otherwise. That is not an oversight in the process; for the staff doing it, it was the process working exactly as they had learned to use it.
It surfaced as a payroll problem because payroll is where it cost money, but the operational exposure was larger. A security company sells presence. A guard who is an hour late is an hour the client paid for and did not get, and if the company only discovers it when the client complains, it has already lost the argument — it has no record of its own to check.
Auditing harder was not the answer. The timesheet cannot be audited into being true, because there is nothing to compare it against: it is the only artefact the shift produced. Any amount of supervision after the fact still ends in one person's account of where they were.
So the work was to make the shift produce a second artefact at the moment it happened, and to make that one hard to fabricate: a photograph taken by the phone's camera at the site, stamped with a time the phone did not choose, positioned by a location the phone reported and the server judged. A claimed shift and a worked shift become the same thing, and the argument stops being an argument.
The decisions
What was chosen, why it was chosen, and what it cost.
Time is issued by the server. The phone's clock is recorded, never trusted.
The engagement exists because logs were being falsified deliberately, and the device clock is the easiest thing on the phone to change. A timestamp the person being timed can set is not a timestamp.
The cost: It makes offline capture harder, because a phone with no signal has no server to ask. An offline check-in therefore carries two times — what the handset claimed and when the server received it — and a supervisor reviewing one has to understand the gap rather than read a single number.
The camera only. The app cannot open the photo library.
A photo picker is an invitation to submit a picture taken somewhere else, on some other day. Capture has to happen inside the app, at the moment of check-in, or the photograph proves nothing at all.
The cost: A guard whose camera fails cannot check in, and that is a real person standing at a real gate unable to start work. It needed a documented fallback that a supervisor authorises — which is a hole by design, kept narrow by making somebody put their name on it.
Location is evidence, not a gate.
GPS genuinely fails: underground car parks, metal-clad warehouses, tower blocks. Refusing a check-in on a poor fix punishes the guard for physics and teaches them the app is the obstacle rather than the job.
The cost: It means the system records a weak fix as weak instead of rejecting it, so the reviewing supervisor has to reason about confidence rather than read a yes or a no. Slightly more thinking for the reviewer, in exchange for an app the guards do not learn to resent.
The absence of a check-in is a first-class event, scheduled in advance.
The alert worth the most is for something that never happened, and nothing that never happens can emit anything. So assigning a shift also schedules the deadline that will go looking for it, which is why the roster and the alerting are one system rather than two.
The cost: A scheduler is now on the critical path, and a job that fails to fire is a missed alert — worse than a missed log, because everyone believes the silence means fine. Deadlines are reconciled by a periodic sweep as well as fired individually, so the system can be late but not blind.
Capture works offline. The sync queue is part of the design, not a fallback.
Night shifts, basements and remote sites are the normal case for this company, not the edge case. A guard who cannot check in because there is no signal stops trying within a week, and then the system is back to being a timesheet.
The cost: The queue is somewhere evidence sits on a device outside the company's control, so it is encrypted at rest and the delay is preserved in the record rather than smoothed away. A synced log is honest about having been a queued one.
Photographs at the start and end of a shift. Never during it.
The problem brought to us was attendance, not behaviour. Continuous monitoring answers a question nobody asked, and it buys legal exposure and a workforce that treats the app as an adversary — which is how a system like this actually fails.
The cost: It can prove a guard arrived and left. It cannot prove they stayed, and that is a genuine limit the company has to accept or address another way. Patrol checkpoints would cover the middle, and were deliberately not smuggled in under an attendance brief.
Alerts are per-exception. The dashboard carries everything that went fine.
A supervisor pushed a notification for each of forty guards arriving on time learns within days to dismiss the app without reading it — and then the one alert that mattered gets dismissed with the rest. Notification is a budget, and it is spent on exceptions.
The cost: On-time arrivals become invisible, so the supervisor loses the ambient sense that things are working. The roster view has to carry that reassurance instead, which means it has to be somewhere people actually look.
A guard can read their own record.
A monitoring system staff cannot inspect is one they will fight, and a workforce that believes the app is lying about them will find a way around it. Letting a guard see exactly what was recorded turns a dispute into a matter of evidence rather than of seniority — including when the evidence is on their side.
The cost: It removes the option of quietly correcting the record, which is occasionally what a manager wants. That is the point, and it was worth saying out loud during the build rather than discovering later.
Built on
- React Native
- The guard's app: assignments, camera check-in, and the offline queue behind it.
- Node.js & Express
- Shift assignment, evidence intake, the classification rules and the scheduled deadlines.
- MongoDB
- Guards, sites, assignments and the check-in records with their evidence.
- React
- The roster and the supervisor console.
- TypeScript
- Shared across the app, the API and the console, so a shift means one thing everywhere.
Talks to
- Push notifications
- SMS
- Payroll reporting
What changed
- A claimed shift and a worked shift are the same thing
- Managers assign shifts remotely instead of travelling to the site
- Falsifying a shift means defeating the camera, the site boundary and the server clock at once
- A missed shift raises an alert that night, not at payroll weeks later
- Supervisors learn about arrivals in time to send somebody else
- Guards on sites with no signal can still check in; the record keeps both times
- A dispute is settled by the record rather than by seniority
- Photographs are taken at the boundaries of a shift, not throughout it
- Staff can see exactly what is held about them
Somewhere in your business, a number is trusted because checking it would cost more than it saves.
That is the shape of this kind of engagement, and the fix is almost never a better audit. It is attaching the evidence at the moment the number is created, so there is nothing left to audit afterwards. Describe the number you cannot currently check, and you leave the first conversation with a scope, a budget and a ship date.