Before you choose a system
Visitor management requirements: a checklist, clause by clause
Write down what you need before anybody shows you a demo. This is 39 lines, grouped the way suppliers get asked, and where a standard asks for a line the clause is beside it in the document’s own words. Our own answer is in the last column, including the 13 lines where it is no. Print it and that column goes, so you can send the same sheet to every supplier.
Sign in on a demonstration kiosk, then open the fire roll call on your phone. Do not enter real details: everything typed is deleted within the hour.
No supplier is named on this page. We are not auditors or consultants, and a clause beside a line is what the document says, not advice on what your site needs.
The checklist
39 requirements, and who asks for each
A clause appears only where this site already has a page for that standard and the page quotes those words; each links to it. Where no standard on this site asks for a line by name, the cell says so, which makes that line your preference rather than an auditor’s. Our answers are what the kiosk does today, read from its code on 27 September 2026.
| Requirement | Asked for by | Noon Elite today | Supplier’s answer | Notes |
|---|---|---|---|---|
| The record | ||||
| Records each visitor’s name. | PCI DSS 9.3.4“The visitor’s name” | YesRequired on every sign in, as the visitor types it. | ||
| Records the company or organisation they represent. | PCI DSS 9.3.4“the organization represented” | YesRequired on every sign in. | ||
| Records who they came to see. | TAPA FSR 4.1.5“which individual will be visited” | YesRequired on every sign in, picked from your staff list where you have one. | ||
| Records the time they arrived. | CTPAT 10.2“Time of arrival” | YesStamped by the server on every sign in. A sign in taken while the Wi-Fi is down is held on the iPad and sent when it returns, with the time the person arrived. | ||
| Records the time they left. | CTPAT 10.2“Time of departure” | YesThe time they sign out at the kiosk, or are signed out by staff. Any visitor still signed in at 23:59 UTC is signed out automatically at that time, so a forgotten sign out shows 23:59, not when they left. | ||
| Records the purpose of the visit. | TAPA FSR 4.1.5“what is the reason for the visit” | NoNo field for it. The host is recorded; the reason is not. | ||
| Checks and records photo ID. | TAPA FSR 4.1.4“identified using government-issued photo-ID” | NoThe kiosk does not scan or check identity documents. Where your procedure needs ID seen, the person at the desk looks at it. | ||
| Keeps the record for a period you set, then deletes it. | PCI DSS 9.3.4“Retaining the log for at least three months, unless otherwise restricted by law.”UK GDPR 5(1)(e)“kept in a form which permits identification of data subjects for no longer than is necessary” | YesFor the retention period you set, one period for your company and every site in it, within the range in the DPA. Records are automatically and permanently deleted when it expires. The range is 1 to 730 days, 365 by default, so a document asking for longer than two years needs an export kept elsewhere. | ||
| Exports the register to a file that opens without the supplier’s software. | No standard on this site names it | YesA CSV of name, company, host, signed in and signed out, from the dashboard, at any time. | ||
| The declaration | ||||
| Shows every visitor your site rules before they go in. | BRCGS Food 4.1.4“Contractors and visitors, including drivers, shall be made aware of the procedures for access to the site.” | YesYour wording on screen with Go Back and I Accept. Nobody signs in without accepting it. | ||
| Keeps proof of the exact wording each person accepted, after the wording changes. | No standard on this site names it | YesThe sign in records the SHA-256 fingerprint of the text that was on the screen, and the stored text cannot be edited. The history shows, for any visitor, the wording they accepted, and says so where it cannot be established. | ||
| A different declaration for each type of visitor, such as contractors or drivers. | No standard on this site names it | NoOne wording per site, falling back to the company’s. Every visitor accepts the same text. | ||
| Asks questions at sign in and records the answers, such as a health questionnaire. | BRCGS Food 7.3.2“Where permitted by law, visitors shall be required to complete a health questionnaire or otherwise confirm that they are not suffering from any symptoms which may put product safety at risk” | NoNo questions and no stored answers in the visitor sign in. A health declaration can be the wording they accept, and the record keeps that they accepted it, not an account of anybody’s symptoms. | ||
| Takes the visitor’s signature. | No standard on this site names it | NoNo signature in the visitor sign in. The only signature pad is in the Permit to Work module. | ||
| Emergencies | ||||
| A live list of who is on site, readable at the assembly point. | Fire safety guide for factories and warehouses Part 2“Carry out a roll call as soon as possible at the designated assembly point(s)” | YesA live list per site that the marshal opens in a phone’s browser. It lists visitors and contractors signed in on the kiosk. A courier who only uses the delivery drop-off is logged but is not on it. | ||
| Several entrances feed the same list. | No standard on this site names it | YesA site can have more than one kiosk, and every sign in at that site is on the same list. A visitor can sign out at any of your kiosks. | ||
| Your own staff on the same list. | No standard on this site names it | NoThe roll call lists visitors and contractors, not employees. Your marshal still needs your staff list. | ||
| Badges | ||||
| Visitors are authorised by a member of staff before they go in. | PCI DSS 9.3.2“Visitors are authorized before entering.” | With a moduleWith Secure Badge and Approval, £150 a month plus VAT: the host enters a PIN on the kiosk and only then does the badge print. Approval happens at the kiosk only. | ||
| A printed badge that marks the wearer as a visitor. | PCI DSS 9.3.2“Visitor badges or other identification visibly distinguishes visitors from personnel.”TAPA FSR 4.1.7“All visitors visibly display badges or passes” | With a moduleWith Secure Badge and Approval, £150 a month plus VAT. The badge prints in black on a monochrome label. It carries a clearance word only if you set up clearance levels, and any colour coding is on the lanyard. | ||
| Records the badge being handed back. | PCI DSS 9.3.3“surrendered or deactivated before visitors leave the facility or at the date of expiration”TAPA FSR 4.1.6“All visitor badges must be reconciled as the visitor leaves the premises” | NoNot recorded. The sign out time is; the badge coming back is not. Collecting and reconciling it is reception’s job. | ||
| Contractors | ||||
| Contractors are given your site’s information before they start. | Management of Health and Safety at Work Regulations 1999 Regulation 12“comprehensible information” on risks, for people from an outside undertaking | YesOn the platform a contractor signs in as any visitor does and accepts your site’s wording, which is recorded. Anything more is your induction. | ||
| An induction video played before entry. | No standard on this site names it | NoThe kiosk plays no video. It shows text and records that it was accepted. | ||
| Permits to work raised, signed and closed on the same system as the sign in. | No standard on this site names it | Early accessThe Permit to Work module, £150 a month plus VAT. Permit to Work is in early access and has not yet run at a customer. | ||
| Contractor insurance, RAMS and qualifications checked before they arrive. | No standard on this site names it | Early accessOnly in the Permit to Work module: the contractor’s office uploads insurance, RAMS and other documents before the day, and your manager marks each one yes, no or not applicable and can send it back. Nothing checks a document automatically or tracks when it expires. Permit to Work is in early access and has not yet run at a customer. | ||
| Before they arrive | ||||
| Visitors invited or pre-registered before the day. | EU GMP Chapter 2, 2.13“they should be given information in advance” | NoNo pre-registration and no pre-visit email for visitors. A visitor is recorded when they sign in at the kiosk. The Permit to Work module is the exception, and emails a contractor’s office a link for their permit. | ||
| A non-disclosure agreement accepted before the visitor arrives. | TISAX VDA ISA 8.1.7“Documented non-disclosure obligation prior to access.” | NoNot before arrival: nothing is sent to a visitor. At the door, a non-disclosure wording can be the text they accept at sign in, with the acceptance recorded. | ||
| Notifications | ||||
| An arrival message to a shared channel. | No standard on this site names it | YesWhere you connect a channel, one message to your site’s Microsoft Teams or Slack channel on every sign in, with the visitor’s name, company, who they are visiting and the time. | ||
| A message to the named host, by email, text or direct message. | No standard on this site names it | NoThe message goes to one channel per site, not to a person. If the host is not watching the channel, the host is not told. | ||
| A message when the visitor leaves. | No standard on this site names it | NoNothing is sent when somebody signs out. The sign out time is on the record and the person leaves the roll call. | ||
| Data | ||||
| You know where the data is hosted. | No standard on this site names it | YesThe European Union, eu-west-1, Ireland, on ISO 27001 certified infrastructure. | ||
| A data processing agreement as standard. | No standard on this site names it | YesYes, provided as standard with every contract rather than on request. | ||
| A published list of sub-processors, with notice before it changes. | No standard on this site names it | YesPublished on the security page, with thirty days’ written notice of a change and a right to object. | ||
| The supplier holds a security certification of its own. | No standard on this site names it | NoNoon Elite Ltd does not hold ISO 27001, SOC 2 or Cyber Essentials Plus certification of its own. The infrastructure your data sits on is ISO 27001 certified. | ||
| Hardware | ||||
| The tablet and stand are included, not bought separately. | No standard on this site names it | YesThe iPad, the floor stand and its locking enclosure are included in the monthly price, and owned and managed by us. | ||
| The supplier installs it. | No standard on this site names it | YesAround the East Midlands we install in person; further afield it can be installed in person by arrangement. | ||
| The supplier replaces it if it fails. | No standard on this site names it | YesStandard hardware failure is covered and we ship a configured replacement at no cost. Accidental damage, loss and theft are the site’s responsibility. | ||
| Price | ||||
| The price is published, not quote only. | No standard on this site names it | Yes£150 a month plus VAT per site, modules £150 each, setup from £599, on the pricing page. | ||
| No charge per visitor or per user. | No standard on this site names it | YesThe price does not move with how busy your reception is, and you can name as many hosts and approvers as you like. | ||
| The minimum term is stated before you sign. | No standard on this site names it | YesTwelve months from the day the service starts, then monthly with thirty days’ notice, with a fourteen day evaluation period from signing. | ||
With a module means the line needs Secure Badge and Approval, £150 a month plus VAT on top of the platform. Early access means the Permit to Work module, £150 a month plus VAT, which is in early access and has not yet run at a customer. The kiosk does not make a site compliant or certified against anything; it keeps a record, and the auditor decides what the record is worth.
Every no, with what to do insteadReplacing a system you already have: the changeover, honestlyEvery standard on one pageWhich fields each standard namesHosting and sub-processors in full
Before you ask
Four questions about writing the specification
What should a visitor management system requirements list include?
At least the record (name, company, host, time in, time out, how long it is kept), what visitors are shown and what proof of acceptance is kept, the fire roll call, badges, contractors and permits, anything before arrival, notifications, where the data is hosted and under what agreement, the hardware, and the price. The checklist on this page groups them that way, with the clause beside each line where a standard asks for it.
Which requirements come from a standard, and which are preferences?
Where a line on this checklist has a clause beside it, a document asks for it and the clause is quoted in its words. Where it does not, no standard on this site asks for it by name and it is a preference of yours, which is a perfectly good reason to require it. Mixing the two in a specification is how a supplier ends up scored down for something no auditor will ask about.
Can we use this checklist for other suppliers?
Yes. Print it and it comes out as a blank form, with the Noon Elite column taken off and two empty columns for the supplier’s answer and your notes. No supplier is named on it.
Which lines does Noon Elite answer no to?
Pre-registration and invitations, photo ID checks, questions and answers at sign in, a visitor’s signature, an induction video, a message to a named host, recording a badge coming back, and a different declaration per visitor type, along with the others marked No in the table. Contractor document checks exist only inside the Permit to Work module, which is in early access and has not yet run at a customer. Each is stated as plainly as the yes lines, because a requirement you have that we do not meet is better found on this page than after a contract.
Next step
Send us your specification
Fifteen minutes on the phone, or send the list you have written. We will go through it line by line and tell you straight which lines we meet, which we do not, and which we would not want to promise.
Book a 15 minute callNo site visit needed and nothing to install. If it is not a fit we will say so on the call.
Would rather email? [email protected]
Not the person who signs it off? Send them the one page business case