Access Management · Secure Environments
The vestibule runs on paper
because nothing better existed.
Now one does.
Visitor records in folders. Contractor authorisations on separate sheets. Device declarations on a third sheet. Under pressure, that spread asks more of staff than it was built for. Vestibule brings it into one place — real-time, searchable, and inspection-ready.
HM Inspectorate of Prisons visit — demo data
A process that works.
These are the gaps
it leaves.
The paper process has worked because staff make it work. I've stood where your staff stand — processed the same folders, made the same calls. Vestibule closes those gaps.
01
Inspection-ready records, available immediately
Access decisions, ID checks, and authorisations spread across paper folders. Pulling together a complete picture takes time the process doesn't easily provide. Vestibule holds the full record in one place — searchable, permanently logged, and available on demand.
02
Visitor data handled to the standard compliance expects
As data compliance expectations develop, personal data in physical folders is increasingly difficult to account for. Digital records with proper access controls are becoming the expectation — and Vestibule meets it from day one.
03
The vestibule is the establishment's first impression
Legal representatives, contractors, and oversight bodies form a view at the front door. A system that's fast, organised, and clearly professional reflects well on the establishment and on the staff running it.
04
Time in the process is time away from everything else
Searching for records, re-entering information, making calls to confirm what should already be documented — this is recoverable time. Vestibule handles the process so staff can focus on the desk.
47 visits processed. 13.3 hours of staff time freed. The system doing that is live now — no login required.
The same scenarios.
Opposite outcomes.
Searching through paper folders takes time — and when the visit was weeks ago, the full picture may be incomplete.
The full record is pulled up instantly — ID confirmed, arrived, departed, by whom, at what time. Inspectors get answers in seconds.
Staff search for the authorisation form. Device details are on a separate sheet. No one is certain what was approved or by whom.
The contractor's record shows device type, one-time auth code, escort officer, and job location — all logged at the point of authorisation.
Staff manually search folders, confirm identity verbally, write arrival time by hand. The process takes time — for staff, and for the person waiting at the desk.
Record is on screen before they reach the desk. ID confirmed and arrival logged in two taps. Professional, fast, and documented.
Reconstructing events from paper records takes time, and entries may be incomplete. Establishing exactly what happened, by whom, and when becomes a difficult exercise — for the officer involved, for management, and for any investigation.
Every action is permanently logged with the staff member's name and timestamp. The record protects staff and management alike.
The refusal is noted by hand — reason, return details, possibly on a separate sheet. If a question is raised later, reconstructing what happened means searching through what was written at the time.
Reason, delivery company, and officer's name logged at the point of refusal. The record exists before a question is asked.
Every function
that matters.
A complete replacement for the paper vestibule process. Built around what operational staff need and the establishment requires.
ID Confirmation
Every visitor and contractor confirmed by name, role, and timestamp. When a decision is later questioned, the record answers.
Arrival & Departure Logging
A live record of everyone on site — arrived, active, or departed. Updated in real time on every device. No end-of-shift reconciliation.
Inspection-Ready Audit Trail
Every action — ID check, arrival, departure, authorisation — permanently logged with the staff member's name and time. When an inspector asks, the answer is immediate and complete.
Staff See What They Need
Operational staff see visitor and contractor records. Management functions are PIN-protected — authorisations, user approvals, and account settings require a separate code. No accidental changes, no unauthorised access.
Contractor & Tool Authorisation
Escort officer, authorised devices, tool declarations, PCD codes — all logged against the visit record at point of entry. If it's brought in, it's documented.
Data Retained, Secured and Exportable
12-month retention, full audit log, and subject access request export. All data encrypted in transit and at rest (AES-256), stored within the EEA. A Data Processing Agreement is in place with all data processors.
Six things
a trial demonstrates.
Personal data moved from paper folders on a public desk to access-controlled digital records. Only authorised, logged-in users can see visitor and contractor information — and every access is traceable.
Escort requirements flagged automatically on every record. Staff know before the visitor reaches the gate whether an escort is confirmed — or whether one is missing and something needs to happen.
Every decision — ID confirmed, arrived, departed, authorised by whom — permanently logged with the officer's name and timestamp. When a decision is questioned, the record speaks clearly and protects the staff who made it.
A complete, inspection-ready audit trail available on demand. For managers, inspectors, or subject access requests — nothing to reconstruct, nothing to search for, nothing missing because a folder was misfiled.
The vestibule is the establishment's public face. A system that runs cleanly, moves people through efficiently, and documents everything says something about how the establishment is run — and about the staff running it.
Designed and built independently, in my own time — because the problem was there every shift. A working system, ready to trial, without waiting for a solution to be commissioned.
What it looks like
on the desk.
Access Management
Expected arrivals, who's on site, and departures — on one screen before the first visitor arrives. No searching. No calls.
The full visitor and contractor record, filterable by status. Escort requirements and device authorisations visible without opening a record.
PPT confirmed. Escort arranged. Device authorised. Every action logged with the officer's name and timestamp. When a question is asked, the record answers it.
Escort not arranged — surfaced before the visitor reaches the gate. Staff are covered. The record shows exactly when the gap was identified.
47 visits processed. 13.3 hours of staff time freed. 5.5 hours of visitor waiting time eliminated — calculated automatically, every month.
Visits and contractor access planned ahead on the calendar. Staff know what's coming before it arrives — no surprises at the desk.
Mail & deliveries
Mail and deliveries.
Tracked digitally.
Logged twice by hand — then called at post to check.
Mail and delivery information written twice into separate folders by hand — then the same staff called mid-shift by colleagues asking where something is, leaving the desk to search through what they already recorded.
One digital entry. Accessible instantly by authorised staff. Folders, manual searching, double logging, phone calls — eliminated in one tab.
Today's letter count and tracked items logged once. Searchable from any screen — no mid-shift calls chasing parcels already recorded at the door.
Prisoner and staff parcels in clearly separated lists, delivery company recorded at the door. Five folders and a spreadsheet, replaced.
Refused parcels logged with reason — returned to sender, GL code not confirmed. The record exists before a question is asked.
Delivery company, driver details, and every parcel logged in one form. One entry. No duplicate folders. No second sheet for reception.
06 — Next Steps
If this looks like
what you need —
the demo is live.
I'm Jamie. I built Vestibule in my own time because I identify problems and like building systems to solve them. I'm easy to reach.
Encrypted in transit and at rest, stored within the EEA. Login required for all access. A Data Processing Agreement is in place with all data processors. Data held on Supabase — ISO 27001 & SOC 2 Type II certified.