Visitor access control · by Eighty Eight Technologies
Know who is in your building. Exactly.
A visitor registers from a link. Their host vouches for them, security clears them, and a signed QR pass governs every crossing of the gate — in and out — with a live list of everyone inside, ready to print the moment an alarm sounds.
Sarah registers from a link. No app, no account, a minute of typing.
The employee she named gets one email and taps one button. That is their whole job.
Security clears her — a signed pass lands in her inbox within seconds.
One scan at the gate checks her in. She is on the live board.
The same code scans her out. A third scan is refused — the pass is spent.
- Scans to admit a visitor
- 1
- Hardware to buy
- None
- People who approve a visit
- 2
The book by the door
A paper visitor book cannot tell you who is still inside
It is filled in on the way in and forgotten on the way out. Half the names are illegible. Nobody signs out. When the fire alarm goes and the warden asks who is unaccounted for, the honest answer is that nobody knows — and that is the one moment the book existed for.
Guard Dash replaces it with something that closes the loop: a pass that has to be scanned to get in, and scanned again to get out.
- Who is inside right now?
- The one question an alarm asks, and the one a book cannot answer, because nobody signs out.
- Who was inside last Tuesday?
- The question an incident asks, or a customer audit. Illegible handwriting is not a record.
- Did anyone check they were expected?
- The question nobody asks until afterwards. A name written in a book has been verified by no one.
Who it is for
Sites where a stranger walking in unrecorded is a real problem
Manufacturing plants
Contractors on the line, suppliers at the goods door, auditors in the office — three gates and three kinds of visitor, all on one board.
Semiconductor and electronics
Where customer audits are routine and being able to produce last quarter's visitor record is part of keeping the account.
Warehouses and logistics
High volume, mostly drivers, mostly repeat. Registration once, then a pass at the barrier that takes a second to scan.
Corporate offices
Fewer visitors, higher expectations. A pass in their inbox before they arrive, and a lobby that does not hand them a clipboard.
How it works
Five stations, two human approvals, one unbroken loop
Tap a station to see what happens there and who does it.
Step 1 of 5 · visitor
They register from a link
Printed on your gate signage, on your website, or sent by whoever invited them. No app, no account, no password — a minute of typing on their own phone. Nothing is approved yet: no pass exists, and nothing can open a gate.
The idea
The guard never chooses a direction, so the guard can never choose wrong
A scan does not mean check in, and it does not mean check out. It means advance this pass, and the system decides which from the state the pass is already in. That single decision removes a whole class of mistakes: nobody is checked in twice, nobody is checked out before they arrived, and a pass that has already been used to enter and leave simply stops working.
One thing is deliberately never refused: leaving. A visitor who overstays their window can always scan out. Refusing that would only mean your board claims somebody is inside when they are already in the car park.
What you get
Built as a security system, not a sign-in sheet
Evacuation roll-call
One tap prints everyone currently inside, with their host and phone number. For a plant floor this alone is worth the licence.
Nothing to install
The scanner runs in a browser. Any phone or wall tablet becomes a gate reader. No readers to buy, no app to roll out.
A pass that cannot be shared
Every QR is signed, time-boxed, and single-visit. A forwarded screenshot fails at the desk, and the guard is told why.
ID checked at the desk
A valid QR proves somebody holds the pass. Confirming the last four digits of their IC proves it is them.
An audit log that resists editing
Every approval, scan, and refusal is chained by hash. Removing or altering an entry breaks every entry after it.
PDPA handled
Versioned consent captured at registration, and personal data anonymised automatically once your retention period is up.
Duty of care
The visitor book is not an admin habit. It is evidence you are required to produce.
Everyone who walks through your gate is somebody you owe a duty to, and every framework that governs your site — the Act, your certification, your customers’ audits — eventually asks the same thing: show us the record. These are the four that come up.
Your duty does not stop at your own staff
An employer must ensure, so far as is practicable, that people who are not their employees are not exposed to risk — visitors, contractors, delivery drivers. Since the 2022 amendment came into force in June 2024 the Act reaches every workplace in Malaysia, and the penalty ceiling is RM 500,000.
Emergency planning has to include the people passing through
Auditors look for a planned response that accounts for everyone who may be on site — contractors and visitors included, not only the payroll. A roll-call you can produce during the drill is the evidence; a book somebody has to run back into the building for is not.
A visitor book is a data protection problem on a counter
Names, phone numbers and IC digits, legible to everyone who signs in after them, kept forever in a drawer. Consent here is captured against a versioned notice and personal data is anonymised automatically once your retention period ends.
Somebody will ask you to evidence this
Multinational customers audit their suppliers on health and safety, and sustainability reporting asks the same questions of listed companies. Both want records, dates and a chain of approval — not an assurance that the guardhouse is careful.
To be plain about it: no software makes anybody compliant, and we will not tell you otherwise. What this does is produce the record — dated, ordered, and hard to alter after the fact — that each of the above asks you to have. The rest is your safety officer’s job, and they will tell you the record is the part that is usually missing.
Try it
Walk into a working system, mid-afternoon
Not a video and not a slideshow. It is the real product, with visitors already on site, passes waiting to be scanned, and a queue that needs a decision. Arrive as a visitor, work the gate, or go through the books — the passwords are printed below.
Or use it yourself, from whichever end you like:
Put your own address in and the confirmation really arrives. You are shown the email their host gets, too, so you can approve it exactly as the employee would — from a link, without signing in.
Open the formsecurity@harbourpoint.exampleguard-dash-demoadmin@harbourpoint.exampleguard-dash-demoNotice who is missing: the employee being visited. They never sign in — a link in their email, one tap, done. That is why this is priced on visitors a day and not on how many people work for you. Everyone shares one sandbox, so it rebuilds itself every couple of hours.
Pricing
Priced on visitors a day, never on the people you employ
You are never charged per employee. Every member of staff should be available as a host — that is the step that makes the system secure, and charging for it would only discourage you from using it.
Roll-call, the audit log and PDPA consent are in every plan. Whether an evacuation list prints is not a thing anybody should be upsold.
Gate
- Visitors a day
- Up to 20
- Sites
- 1 site
The whole loop, at one gate. Everything a guardhouse needs on the first morning.
- Registration, host confirmation, security clearance
- Signed QR passes, scanned in and scanned out
- Live site board and evacuation roll-call
- Hash-chained audit log and PDPA consent
- Two-factor authentication on every staff account
- Visitor history exported as CSV
- Email support, next working day
Plant
Most chosen- Visitors a day
- Up to 100
- Sites
- Up to 3 sites
Where most factories land. More gates, more sites, and the report your auditor asks for by name.
- Everything in Gate, at up to three sites
- As many gates at each site as you have doors
- Visitor reports, filtered and exported as PDF or CSV
- Last month's report emailed to you automatically
- Twelve months of visit history kept
- Priority support, four-hour response
Group
- Visitors a day
- Unlimited
- Sites
- Unlimited
For a group of plants — or one site that cannot put its visitor record in somebody else's cloud.
- Single sign-on and directory sync
- Your own domain — visitors.yourcompany.com
- Turnstile and door controller integration
- A dedicated database, or an on-premise install
- Retention set to your own policy, not ours
- A named account manager and a written SLA
Monthly in advance or yearly with two months off, payable by bank transfer on 30-day terms. Go over your daily number and the system tells you — it never stops issuing passes. A gate that stops working over an invoice is not a gate anybody should buy.
There is nothing to buy besides the licence. The scanner runs in a browser, so the tablet already on your security desk is the reader — no kiosk, no card printer, no MyKad terminal, and nothing to replace in three years.
Questions
What people ask before they say yes
Do our employees need accounts or training?
No. The person being visited never signs in. They get an email asking whether they are expecting somebody, they tap one button, and that is their entire involvement. That is why the price is set on visitors a day and not on how many people you employ.
What happens when the fire alarm goes?
One tap prints everyone currently inside, with the person they came to see and a mobile number for each of them. It is a live list, not last night's export, because it is built from the same scans that let them through the gate.
Do we have to buy hardware?
No. The scanner runs in a web browser, so the tablet already on your security desk is the reader. No kiosk, no card printer, no MyKad terminal, and nothing that needs replacing in three years.
Can a visitor forward their QR code to somebody else?
They can send it, but it will not work twice. Every pass is signed, time-boxed to the visit window, and single-use in each direction — and the officer at the desk is told exactly why a refused pass was refused. Confirming the last four digits of their IC proves the person holding it is the person it was issued to.
What about PDPA?
Consent is captured at registration against a versioned notice, so you can prove which text a given visitor agreed to. Personal details are overwritten automatically once your retention period is up, while the visit and scan history stays intact for security reporting. A paper book on a counter, which every arrival can read, is the thing PDPA has a problem with.
What if the camera will not read the code?
Every pass carries an eight-digit number under the QR that the officer can type instead. For a site that cannot depend on an internet connection at the gate at all, the system can be installed on your own server inside the plant.
See it with your own gate in mind
Thirty minutes, your lobby, your questions. We will show you the parts that matter for how your site actually runs.
Book a walkthrough