How Site Security Works

This guide explains how it all fits together. For one job at a time, the short articles in this topic have the exact steps.

Watchlist

Screen visitors at check-in against your own list of people who need attention, and alert security quietly when there's a match.

The watchlist is your organisation's own list of people who need attention at the door: someone banned after an incident, a former contractor whose pass was withdrawn, or a person a court order keeps away. Agoo checks every check-in against it and, on a match, holds the check-in and tells security without a scene at the desk.

The watchlist is included on Growth, Pro and Enterprise.

How Matching Works

When a visit is created (an invitation, a pre-registration or a booking) and again at check-in, Agoo compares the visitor with every active watchlist entry for that site on:

• Name, with fuzzy matching, so "Kofi Boateng", "K. Boateng" and a misspelling are all caught;
• Phone number;
• ID number, when you capture IDs. ID numbers are compared using a secure hash, so the full number doesn't need to be stored or shown.

When the kiosk is offline

Kiosks and guard devices keep screening during a network or power cut, on plans with the watchlist. They hold only one-way fingerprints of the watchlist entries for their site: no names, phone numbers or ID numbers from your watchlist are on the device. With those, the device checks each check-in itself, with no connection:

• walk-ins on their name, phone number and any ID number recorded;
• expected visitors and passes on the visitor's name.

On a match, the device holds the check-in just as Agoo does online (below): the visitor sees a neutral message, the host isn't told, and reception and security are alerted when the check-in reaches Agoo, which screens it again.

Because a fingerprint can't catch a misspelt name, and a device can't know about an entry added since its last sync, Agoo screens every offline check-in again when it arrives, with fuzzy name matching. If that finds a match the device missed, the visitor is already inside: security is alerted at once, and the alert and the watchlist.matched webhook say the visitor entered while offline.

Each device reports how up to date its screening list is, and reception is told when a device's list is out of date (after 24 hours by default). Unpairing a device wipes its screening list, and your organisation's screening keys are replaced, so a lost device's copy is of no use. See Offline mode.

A match holds the visit: no pass is sent and the host isn't asked. If the person arrives, the check-in is recorded and security is told again. On the kiosk, the visitor sees a neutral "Please take a seat. Someone from reception will be with you shortly.", with no welcome and no host named, and the kiosk carries on as normal for everyone else. Nothing on screen tells the visitor or other people in the queue that they've been flagged.

Alerts

Security gets a silent alert straight away: first as a notification in the Workspace app, then by SMS, WhatsApp or email, as each person chooses, if the notification doesn't reach their phone. Every alert, in the app, by text, WhatsApp or email, says who is held and where, with a link to review it, so security can act at once. None ever says which entry they matched or why. If your organisation leaves names out (Settings → Notifications), alerts say "A visitor" instead. The app's notification comes even in quiet hours, and Review (after Face ID, Touch ID or the passcode; on Android, your fingerprint, face unlock or screen lock) opens the visit. The Console shows the entry, why it matched and where the person is, on the visit and under Security → Watchlist → Waiting for review. From there, security can:

• Refuse entry, which declines the visit (a visitor let in while a device was offline is checked out instead);
• Let them in, with a written reason, when it isn't them or they may come in: the visit carries on as it would have, so the host is asked or told;
• call security to the desk as you normally would.

Security can decide on their phone too. In the Workspace app, Desk → Inbox → Watchlist holds lists the visits held at their sites, with whether the person is here and what they matched; on the visit, Let them in or Deny entry, each with a reason.

Reception sees only that the check-in is on hold (Held for security, in the Console and on the Desk), and can't approve or cancel it until security has decided.

Every alert, decision and override is written to the audit trail with the person, time and device.

Add Someone to the Watchlist

1. 1

   Open Console → Security → Watchlist

   Choose Add entry. You can also add someone from a past visit, which copies their details across.

2. 2

   Enter what you know

   A name and at least one of phone number or ID number. The ID number is kept only as a secure fingerprint for matching. Adding a photo comes later.

3. 3

   Give a reason and an expiry date

   Every entry needs a reason, such as "Banned after damage to the lobby, 12 May". Set an expiry date unless there's a reason it should last indefinitely. Expired entries stop matching.

4. 4

   Choose the scope

   Apply the entry to one site, such as a site ban, or to every site in your organisation.

Fairness and Data Rules

A watchlist holds personal data about people who may not know they're on it, so treat it with care.

• A person decides. A match alerts a human; Agoo doesn't deny anyone automatically, and Agoo AI never adds or removes people.
• Keep entries specific and lawful. List people for something they did or a legal order, never for who they are. Don't use the watchlist to discriminate on ethnicity, religion, gender, disability or any other protected ground.
• Expire what's no longer needed. Review entries regularly, and delete entries you no longer need. Deleting erases the entry's personal data; the audit trail keeps that it existed and matched, without who it was.
• Every look is recorded. Each time someone opens or searches the watchlist, and each entry added or removed, is written to the audit trail with who did it.
• Limit who can see it. By default, only Owners, Admins and Security leads can view or edit the watchlist. Reception sees only that a check-in is on hold.
• Your watchlist is yours. It's never shared with or matched against other organisations.

• Front desk: What reception sees during a hold.
• Roles and permissions: Who can view and edit the watchlist.
• Audit trail: Every match, decision and override, recorded.

Vehicles at the Gate

Log vehicles in and out at the gate, read plates with the camera even offline, keep a list of known and barred vehicles, and see what's inside from the console.

The vehicle register is your gate's record of every vehicle that comes and goes: when it came in, what it was here for, who it was for, who logged it, and when it left. Guards keep it on the gate device in guard mode; security and admins see it live in the console.

The vehicle register is included on every plan, Free included.

At the Gate

In guard mode, tap Vehicles. The screen shows how many vehicles are inside, and which ones, with when each came in.

A vehicle coming in

1. Tap Vehicle in and point the camera at the plate. Agoo reads it on the device, with no network needed, and only takes a plate once it has read the same one twice. If the plate is dirty or the light is poor, type it instead.
2. Agoo tells you at once what it knows about the plate:

• A known vehicle: a staff member's or a resident's car, a contractor's van or one of your own vehicles, with its make and colour if you've added them.
• A visitor expected today: the host added the plate when they invited them, so you see who's in the car and who they're visiting.
• A barred vehicle: the screen turns red. See Barred vehicles.
• Already inside: the plate was logged in and never out. Log it in again only if it left without being logged out.
• Nothing: tap what it's here for (a visitor, a delivery, a contractor, a taxi or ride, staff, a resident, one of your own vehicles, or something else) and, if it helps, who or what it's for: "Gas for the kitchen", "Unit 14B", "Dr Ofori".

1. Add the driver's name and the number of passengers if you want to, then tap Let it in, or Turn it away.
2. If your organisation asks for a photo, take one of the front of the vehicle with the plate in view. When the photo is required, the guard can't skip it.

A vehicle going out

Tap Vehicle out and read the plate. Agoo finds its entry and logs it out. If the plate was never logged in (it came in before the register, or someone forgot), log it out anyway: the register keeps it as in and out at that moment, with a note saying so.

With no network

Everything at the gate works offline. The device keeps the known and barred vehicles for its site and the plates of today's expected visitors, reads plates itself, and keeps what the guard logs until the connection is back. Vehicles logged offline are marked as such in the register.

Barred Vehicles

Bar a plate in Console → Security → Vehicles → Known and barred, with the reason. When a barred plate comes to the gate:

• the guard sees Barred vehicle in red and is told not to let it in;
• security is told at once, on their phone with the Agoo Workspace app, or by SMS or email, even in quiet hours;
• if someone in charge says to let it in anyway, the guard taps Someone in charge said let it in and types their name and role. The vehicle is logged in, marked as barred, and the audit trail records who said so.

Barred plates are part of the vehicle register, so they work on every plan. To stop a person at the door, use the watchlist.

Plates On Invitations

When a host invites someone, they can add the plate of the car the visitor is coming in, in the console or in the Agoo Workspace app. The gate knows the car before it arrives, and the visit page shows when it came in and went out.

In the Console

Console → Security → Vehicles has three tabs:

At the top: vehicles inside now, in today, turned away this week, and inside for more than 12 hours (often one that left without being logged out).

You can also tap Log a vehicle in in the console, for a gate without a device.

Settings

• Photos of vehicles: No photo, Offer a photo (the guard can skip it) or Always a photo. Set it under At the gate in Console → Security → Vehicles → Known and barred.
• How long the register is kept: 30 days by default. Change it, from 1 day to 2 years, in retention under Vehicles at the gate. A vehicle still inside is kept until it leaves.

Who Can Do What

Site admins, security leads, guards and receptionists see the vehicles at their own sites. Console → Settings → Roles lists every permission.

Privacy

Plates and photos of vehicles are personal data where they identify someone. Agoo keeps them only as long as your retention setting says, and they're part of your organisation's full export. Erasing a visitor also removes the plate on their visits and their vehicle's time at the gate.

• Front desk and guards: Everything a guard does at the gate.
• Watchlist: Screen people, not plates, at check-in.
• Retention and deletion: How long each kind of data is kept.

Roll Call

Send an emergency alert to everyone on site, from the Console or a phone, and account for every visitor, contractor and clocked-in employee, even in a blackout.

When the alarm goes, an emergency alert starts a roll call at the site: one live list of everyone on site, visitors and contractors who are checked in and staff who are clocked in. Everyone on it gets an I'm safe link on their phone, marshals mark the rest at the assembly point, and you can see at a glance who is still to account for.

Emergency alerts and roll call are included on Starter, Growth, Pro and Enterprise.

Who Can Start an Alert

Whoever sees a fire or a threat first should be able to raise it, so the front desk can, as well as security and admins.

Receptionists and guards can start an alert unless you switch it off. In Console → Settings → Security → Emergency alerts, turn off Receptionists and guards can start an emergency alert, and only those who run roll calls can start one. The change is recorded in the audit trail. See Roles and permissions.

Before You Need It

1. 1

   Put Agoo on the right phones

   Receptionists, guards, security leads and whoever acts as a fire marshal install Agoo Workspace on their iPhone, iPad or Android phone or tablet and sign in. The app keeps who's on site at their sites on the phone, so the list is already there when the network or power goes. Make sure each of them is added to their site in Console → People.

2. 2

   Keep the on-site list accurate

   A roll call is only as good as your check-outs. Make sure visitors check out when they leave, use automatic end-of-day check-out, and ask staff to clock out. See Check-out.

3. 3

   Run a drill

   In Console → Security → Roll call, choose Start a roll call and Drill. It works exactly like a real one, and the record says drill. Leave Send everyone their link on to test the messages, or turn it off for a quiet drill counted at the desk. Drills are started by those who run roll calls: Owners, Admins, Site admins and Security leads.

During an Emergency

1. 1

   Start the alert

   On a phone: in the Workspace app, open Desk → Safety and tap Emergency alert. Choose the site, edit the message or pick a ready-made one, then press and hold Hold to send the alert for two seconds. Let go early and nothing is sent.

   In the Console: open Security → Roll call and choose Start an emergency alert (if you run roll calls, Start a roll call, then Emergency). Choose the site and add a short message if you like (it's sent with the link and may go by SMS), then confirm with Send the emergency alert.

   An alert covers one site. Each site has one roll call at a time: while one is running, open it instead of starting another.

2. 2

   Everyone gets an "I'm safe" link

   Agoo messages everyone on the list at once, with your message and a link. Staff with the Workspace app get it there first, as a Time Sensitive notification that breaks through Focus modes, with I'm safe on it: tapping it (after Face ID, Touch ID or the passcode; on Android, their fingerprint, face unlock or screen lock) marks them safe at once. If the notification hasn't reached their phone within a minute, or they don't have the app, it goes by SMS or email. Visitors get it the way their pass reached them. The link opens a page on your organisation's Agoo address with one large I'm safe button, with no app or sign-in needed. Tapping it marks them accounted for, and the page thanks them by name. If the roll call has already ended, the page says so and tells them to follow the marshals' instructions.

   Confirmations always use links, not SMS replies, so they work on every network and every phone that can open a link.

3. 3

   Everyone sees it

   The alert appears at once (within a second or two, without a refresh) at the top of every page of the Console, and on Home and the Desk in the Workspace app, for everyone at the site who sees roll calls: "Emergency at Ridge HQ", with how many are still to account for.

4. 4

   Marshals mark the rest

   At the assembly point, marshals open the roll call on their phone, from the banner. People still to account for come first, each with a call button when Agoo has their number. Tap Safe when you see someone, or Missing to undo a mark. In the Console, use Mark safe, and Find someone to search the list.

   Each person shows how they were accounted for: they said they're safe from their link or the app, or a marshal marked them. Marshals at different assembly points all see the same list as it changes, so nobody is counted twice.

5. 5

   End the roll call

   When everyone is accounted for, or the emergency services take over, someone who runs roll calls ends it: End the roll call in the app, or End the alert in the Console. Agoo records when it ended and who ended it, the links stop working, and the final list is kept.

Afterwards

Console → Security → Roll call → Recent roll calls lists drills and emergencies that have ended, newest first, with how many were accounted for. Open one to see its final list. Starting, marking and ending are all in the audit trail.

When the Network or Power Is Down

The Workspace app keeps the on-site list for the sites each person works at (visitors checked in and staff clocked in), and the roll call while it runs, with everyone's phone number so the call buttons work without data. Marshals can open the list and mark people safe or missing with no signal; their marks are sent as soon as the phone is back online.

Sending the alert itself needs a connection, from the phone or the Console, because the messages go from Agoo. Without one, raise the alarm on site the way you always would, and use the list on your phone. "I'm safe" links need the person's phone to have signal or data, so marshals should always mark anyone they can see.

Phone numbers are on marshals' phones only while a roll call runs, and are removed when it ends.

Agoo has asked Apple to let roll calls sound even when a phone is on silent (Critical Alerts). Until Apple agrees, a roll call notification sounds like any other Time Sensitive notification, so a phone on silent shows it without a sound. Marshals should still mark everyone they can see.

On Android, a roll call comes on Agoo's Emergencies kind of notification, as loud as Android lets an app be. To let it sound during Do Not Disturb, each person turns on Override Do Not Disturb for that kind in their phone's notification settings (the Workspace app on Android).

Audit Trail

A tamper-evident record of every action in your organisation, with a chain you can verify yourself.

The audit trail records who did what, when and from where: who approved which visitor, who exported a report, who changed a kiosk's settings. It's append-only, and each entry is linked to the one before it, so any change to history shows.

What's Recorded

Each entry stores the time, the person or device, the action, what it acted on, the device or app, and the IP address.

How Tamper Evidence Works

• Append-only. Entries can be added, never edited or deleted, by anyone, including Owners and Agoo staff.
• Hash-chained. Each entry stores a cryptographic hash of the entry before it. Changing or removing any entry breaks every link after it.
• Anchored every hour. Once an hour, Agoo records a checkpoint of the chain so far and keeps a copy outside the database. A checkpoint fixes history up to that point, so it can't be quietly rebuilt.

Verify the Chain

In Console → Security → Audit trail, choose how far back to check (the last day, week or month, or everything your plan shows) and choose Verify chain. Agoo recalculates every link in that period and compares each hourly checkpoint with its entry. You'll see either a confirmation that the chain is intact, with how many entries and checkpoints were checked, or the first entry where it breaks and why. The check itself is recorded in the trail.

If the chain is ever broken, contact Agoo support at once, and don't change anything until they've looked.

Search and Export

Entries are listed newest first, by day, on your organisation's clock. Filter by who acted (a person, device or API key), what happened (one action, or every action on something, such as every visit action), site and dates. Choose Export to download the filtered entries as CSV or Excel for your auditors; the export is itself an audited action. On Pro and Enterprise, you can also read the trail through the API.

The Auditor role can view and export the audit trail without being able to change anything else. See Roles and permissions.

How Long It's Kept

The audit trail has its own retention, separate from visitor data. Moving to a lower plan doesn't delete entries: the console and exports show the new plan's period, and older entries are kept, hidden, and come back when you move up. See Retention and deletion.

• Roles and permissions: Who can see the audit trail.
• Retention and deletion: How long each kind of data is kept.
• Watchlist: Matches and overrides, all recorded.