S4 is a multi-tenant SaaS platform for UK security companies, built end to end and running in production.
THE PROBLEM
Manned guarding still proves attendance with a paper book and a manager's word. That holds until a client disputes an invoice — and then nobody can show who stood at which door, or when. Existing systems answer this with hardware at every entrance, which most guarding contracts will not fund.
WHAT WE BUILT
Three applications on one API: a company console for operations, a guard app for the field, and a platform admin console for onboarding security firms.
Verified check-in. The server, never the client, decides whether a check-in is real — position tested against the site boundary in PostGIS, time stamped from the server clock, SIA licence re-checked at that moment, devices reporting mocked locations refused and recorded. Sites choose between GPS-only (no hardware), a printed QR code, or a rotating 90-second code, so the evidence matches what the contract will pay for.
Live operations map. Every guard on shift, drawn against their site geofence, with off-site guards flagged by distance. Tracking is bounded by the shift on both client and server, so the platform cannot collect location from an off-duty guard.
Patrol rounds. Checkpoints validated against their own secret and tolerance radius, producing coverage a client can read: four of five points reached, rear exit missed at 02:40.
Tamper-evident evidence. Arrival photographs hashed with SHA-256 at upload, with the reviewer warned if stored bytes ever stop matching. Attendance events are append-only at the database level and cannot be edited by anyone, including us. Every consequential action is written to a hash-chained audit log. Photographs purge automatically after 30 days.
Money derived from evidence. Timesheets are calculated from the check-in trail rather than typed in; a shift without a completed check-out produces no payable time at all. Approved timesheets bundle into invoices with fee and VAT, backed by a double-entry ledger that must balance.
Emergency cover. When a guard drops out, the platform ranks licensed available guards by distance, broadcasts the shift, and awards it to the first to accept — superseding every other offer so two guards never arrive for one door.
ENGINEERING NOTES
Strict multi-tenant isolation enforced at the object level, not just by query filter. Append-only tables backed by database triggers rather than application convention. 253 end-to-end tests covering the paths that matter: geofence spoofing, QR replay, cross-tenant access, double-booking, ledger balance.
RESULT
A platform a security company can put in front of its own client as proof of service delivered — which is the thing the paper book never was.