Design note

Which version of your visitor policy did they accept?

Written for whoever owns the site rules: the health and safety, quality or security manager who edits the wording a visitor accepts at reception. Months later an auditor, an investigator or a lawyer picks one visit and asks what that person agreed to. The rules have been changed twice since. This page is how the kiosk answers that question, and where the answer stops.

Try it yourself, no sign-up

Sign in on a demonstration kiosk, then open the fire roll call on your phone. Do not enter real details: everything typed is deleted within the hour.

Book a 15 minute call How it works

Part of the platform, £150 a month plus VAT, iPad and stand included.

The problem

A tick records that, not what

A paper book with a column headed “I have read the site rules” records a tick against a name. The rules themselves are on a laminated sheet at the desk, and when the sheet is reprinted the old one goes in the bin. The book can show that somebody agreed to something on a date. It cannot show the words.

The question

Asked about one visit, long afterwards

The useful answer is the exact text that was on the screen when that person accepted it, with the time, and some way to show the text has not been changed since. That is what the kiosk keeps.

How it works

Six steps from your wording to the visit record

A SHA-256 fingerprint is a 64 character code worked out from the text. The same text always gives the same code, and changing a single character gives a different one, so the fingerprint on a visit identifies exactly one wording.

The words are put together in one place
The text a visitor reads is your site’s wording, or your company’s if the site has none, followed by the kiosk’s own UK GDPR privacy notice, which states your retention period in days. One function builds it, so the text shown on the iPad and the text stored on the server are the same bytes.
It is stored before anybody can accept it
When the kiosk loads its screens, the server works out the SHA-256 fingerprint of that whole text and stores the text once under it. So by the time a visitor reads it, the wording they are about to accept is already on file.
The visitor reads it and chooses
The screen is headed Site Policy, with the text in a scrolling panel and two buttons, Go Back and I Accept. Go Back returns them to the form and records nothing. I Accept sends the sign in, carrying the fingerprint of the text that was on the screen.
The server records which words
A sign in that does not carry the acceptance is refused. The visit is stored with the acceptance, the fingerprint and a link to the stored text. The sign in time is the acceptance time, because pressing I Accept is what signs them in.
The Wi-Fi was down
If the iPad cannot reach the server, the sign in waits on the iPad with the fingerprint and the time it happened, and is sent when the connection comes back. The text was stored when the kiosk loaded it, so the fingerprint still leads to the wording that was on screen, even if somebody edited the policy while the sign in was waiting.
You change the wording
A new wording has a new fingerprint and is stored as a new document. Visitors who accepted the old wording keep pointing at the old wording. The table that holds the stored wordings refuses edits from every database role, ours included, and the retention schedule does not delete them, because they hold no personal data.

Reading it back

What you put in front of the person asking

Where you see itOn the dashboard’s History page, each visit has a button that opens the wording that visitor accepted: their name, “Accepted at check-in” with the date and time, the fingerprint, the date that wording came into use, and the full text.
When it cannot be shownA visit from before this record existed, or one signed in on an older kiosk build, may have no fingerprint. The screen then says the wording cannot be established. It never shows today’s wording in place of a missing one.
What the export holdsThe visitor register exports as a spreadsheet: name, company, host, signed in and signed out. The accepted wording is not a column of that file. It is opened per visit on screen.

The same record, for a visitor NDA Where the data is held, and who can reach it The visitor record against ALCOA+

Being straight with you

What this record is not

Not a signature. Nobody draws on the screen or types their name to accept. The record is the button, the time and the fingerprint of the wording. Signature capture exists in the product in one place, the Permit to Work module, and it is not part of this screen.
Not identity verification. The kiosk records the name the visitor typed. It does not check who they are. If your procedure needs photo ID seen, a person at the desk does that.
Not proof they read it. There is no scroll-to-the-end gate and no timer. The record shows that this person pressed I Accept with this wording on the screen at this time.
Not a set of questions. The screen shows one wording and records acceptance of it. It does not ask questions or store answers.
Not a guarantee of a link. If the server could not store a wording, or a kiosk sends no fingerprint, the visitor still signs in and is on the fire roll call; the visit is recorded as accepted with no link to the text. The design chooses a gap in this record over a visitor who cannot sign in.

The kiosk does not make a site compliant, certified or audit ready. It keeps a timestamped record of who accepted which wording, and whoever is asking decides what that record is worth.

Before you ask

Four questions about the accepted wording

Can we show which version of our site rules a visitor accepted after we have changed them?

Yes. Each wording is stored once, when it is served to the kiosk, under its SHA-256 fingerprint, and each visit carries the fingerprint of the wording that was on screen. Edit the text and the next visitor accepts a new document; earlier visits keep pointing at the earlier one. The dashboard shows the text, the fingerprint and the date that wording came into use.

What if the kiosk was offline when the visitor signed in?

The sign in waits on the iPad with the fingerprint of the text on screen and the time it happened, and is sent when the connection returns. Because the text was stored when the kiosk loaded it, the fingerprint still resolves to that wording even if the policy was edited in the meantime.

Is accepting the wording the same as signing it?

No. The visitor presses I Accept; there is no signature pad and no typed name in the visitor sign in. The record is who, when, and the fingerprint of the exact wording. Whether acceptance on a screen is enough for your purpose is a question for your own procedure or your adviser.

Can anyone edit a stored wording afterwards?

No. The table that holds the wordings refuses updates for every role, including ours. A change to your policy creates a new stored document rather than altering the old one.

Also asked of sites like yours

The other things somebody may ask you to evidence

Each of these is a page about one standard, one duty or one visitor, written the same way as this one: what it actually asks for, what an iPad at reception records towards it, and where it does not help.

Next step

Bring the wording you want accepted

Fifteen minutes on the phone. Tell us what visitors should agree to at your door, and we will tell you straight what the record will and will not show.

Book a 15 minute call

No site visit needed and nothing to install. If it is not a fit we will say so on the call.

Would rather email? [email protected]

Not the person who signs it off? Send them the one page business case

Which version of your visitor policy did they accept?

A tick records that, not what

Asked about one visit, long afterwards

Six steps from your wording to the visit record

The words are put together in one place

It is stored before anybody can accept it

The visitor reads it and chooses

The server records which words

The Wi-Fi was down

You change the wording