For a workplace site
The phones already in the building, agreeing with each other.
No wiring, no sensors on the wall, nothing to retrofit. The handsets already on the floor listen for gunfire, compare notes with each other, and tell the people in the room before they tell anybody outside it.
Book 30 minutes What this cannot do yet
This module is being built. It is not deployed at any site, nobody is running it, and alerting stays switched off until this programme's own false-alarm measurement says otherwise — see how it performs.
02 — How it works
Heard, agreed, confirmed, told.
Four steps, and the order of the last one is the design: the people standing where the sound was heard are told before anybody who is not.
A sound
A phone recognises an impulsive sound on its own, in the moment. It decides in memory and forgets. Nothing recorded, nothing sent.
On Android todayTwo phones agree
A slammed door fools one phone. It does not fool two, fifteen metres apart or more once each one’s own position accuracy is taken off the distance between them, hearing the same thing in the same second.
On Android todayA person confirms
The handsets that heard it ask the people holding them one question. Only a person’s answer earns the word confirmed; no machine’s answer ever does.
Being builtThe right people are told
Everyone on the floor first. Then the manager on duty. Then — only if a person there releases it — a police agency.
Being built03 — Placement
Three ways to place a phone.
A family cannot buy more ears. A site can, and that is the reason the geometry works better in an office than it does in a house.
Anchor
A handset that never moves, bolted to a wall on mains power, doing nothing but listening.
- Position
- Surveyed — measured once off the floor plan and typed in by the installer, not read from satellites
- Power
- Mains, always on
- Prompt
- Never — nobody is holding it to answer one
- For
- Coverage that does not depend on who happens to be standing there
Deployed
The same thing, temporarily: put out for a shift, an event or a floor under fit-out, and taken in again.
- Position
- Surveyed at set-up, re-surveyed when it moves
- Power
- Battery, a shift
- Prompt
- Never
- For
- A footprint that is not the same next week
Roaming
Somebody’s own phone, in their own pocket, during the hours they agreed to.
- Position
- The phone’s own, which is the least certain of the three
- Power
- Battery, managed around the screen
- Prompt
- Yes — a person is holding it
- For
- The ears that are there anyway
A phone that never moves can have its position measured once and typed in — and it can then quote an accuracy that a phone reading its own position cannot.
That is not a detail. Before two devices are allowed to agree, each one’s quoted accuracy is subtracted from the distance between them, and only what is left is tested against the fifteen-metre separation rule. Two devices that know where they are clear a gate that two devices guessing can fail while standing well clear of it. It is why a site can be told something useful about where a sound came from, and a pair of handsets in a house often cannot.
04 — The ledger
What a manager sees. What a manager never sees.
A safety system that demonstrably cannot follow staff is easier to introduce to the people it covers — and to their union, and to a data-protection officer — than one that can and promises not to.
What a manager sees
- Whether each device is listening, now.
- Whether a device reports itself as being at the site — which is a yes or a no, not a place.
- Whether a microphone has gone deaf. A microphone taken by another app keeps returning success and silence, so the app watches for it and says so.
- Whether the site as a whole is covered, below its plan, or not covered — and which devices are carrying it.
- Which fixed device has been offline, in which zone, since when.
- Every incident and every drill, who was reached, and who acknowledged.
What a manager never sees
- Where a member is. Not on a map, not in a list, not in an export.
- A position published because somebody walked through the door, or because the agreed hours started, or because a manager opened the app.
- A trail. No history of positions is kept anywhere, because none is collected.
- An arrival or a departure note. This is not an attendance system, and it cannot be turned into one without the change being visible in the software.
- A private window in which one person’s phone reports to another’s. The family app has one, disclosed and notice-bearing; this module has none, in either direction.
A manager sees that you are covered. A manager never sees where you are.
Not by default, not at a higher price, and not by turning something on. A member’s position is published only while a corroborated incident is open, and only so that the sound can be placed. The rule is written into this module’s specification rather than into a settings screen, and the test that guards it asserts that no path exists — not that a switch is off. A switch is something a customer can eventually buy their way past.
05 — Floors and zones
An office is a stack of floors, and a coordinate does not say which.
This is the one thing a building has that a campus does not, and it is the largest single difference between this module and the family one.
What a responder can act on
3F East, near the north stairwell
A floor, a zone, and a name somebody typed in because they know the building. It goes into the broadcast, the manager’s card, the spoken brief and the incident record.
What a coordinate gives them
14.5995° N, 120.9842° E
Correct, and close to useless to somebody already running up a stairwell and choosing which door to open.
A floor is voted, not solved.
Phones cannot resolve height. The distances between them are sideways and the timing budget is spent on the sideways answer, so the floor reported for an incident is the floor label of the devices that heard it, weighted by how loudly each one heard it. It is a vote over labels an installer typed in, not a measurement, and a tie is reported as a tie rather than broken.
Two consequences a site is entitled to before it buys anything. A site whose devices all sit on one floor gets no floor information at all — the vote has one candidate, and the placement plan says so in the survey rather than after the invoice. And the vote is untested in a real building: a concrete slab between two devices is the case that decides whether it survives, and nobody has run it.
06 — SitePack
A site can buy ears. That is the whole advantage.
The hardest unsolved problem in this programme is density: agreement needs two devices that both heard the sound and stand far enough apart. A family cannot buy that. A floor can.
- Refurbished Android handsets, set up as anchors, chosen against published criteria rather than against whatever was cheap.
- Wall mounts and mains adapters, one per anchor.
- Printed labels — ANCHOR 1 — 3F EAST — because an unlabelled device on a wall is a device nobody maintains.
- A quick-start card for the person on the ladder.
- A placement plan, drawn from your own floor plan. Where each anchor goes so that any point on the floor is heard by two of them, standing far enough apart, with geometry good enough to be worth solving — and, in the same drawing, the part of the floor where only a ring is achievable rather than a point. A plan that drew only the good news would be a sales document.
The handset criteria are published rather than kept in a sales conversation: a floor for the Android version, support for the newer kind of Bluetooth advertising — this programme has already lost an afternoon to a scanner that quietly defaulted to the older kind — and a calibration row for that model, because microphone sensitivity differs between handsets and nothing in the pipeline knows it unless somebody measures it. A model with no calibration row is sold as degraded, not as covered. A site may bring its own retired handsets against the same list.
07 — Drills and readiness
The half of this that does not rest on the detector.
A drill exercises the roster, the broadcasts, the escalation timers, the readiness state and the spoken brief to police — none of which depends on how good the classifier is.
- A manager starts a drill. It runs the whole ladder end to end and is labelled DRILL on every surface it touches, including the record and anything sent onward.
- It ends in a report: who was reached, how fast, who acknowledged, which devices contributed. That is the artefact a facilities manager shows an insurer, and it is worth having on its own.
- Drills run monthly by default, and a site cannot be marked live until one has been run. The drill report is the acceptance test.
- A readiness digest goes to the manager only when the site is not ready. A daily everything-is-fine notice is how notifications get muted, and this programme has already learned that lesson the expensive way.
This is the part being built first, and the ordering is deliberate rather than modest. It is useful before the detector is good enough to be trusted, and it is useful whether or not the detector ever gets there.
08 — Privacy
Written for the people being covered, not for the person signing.
An employee has just been told their employer is putting listening devices in the building. These are the answers, blunt end first.
Audio never leaves the phone, and the reason is structural
The part of the software that touches sound cannot open a file and cannot open a network connection. That is not a policy: a test fails the build on any import that would let it. There is no recording of an incident to request, to produce or to disclose, and the only audio storage in the product is a buffer in memory that overwrites itself.
Two gaps in that test are named rather than glossed. It does not scan the Android app module — which is where the phone’s audio actually lives, and which already contains a network client outside the audio path — and it reads only Kotlin sources. Both are written down, and closing the first is a precondition for anything that would ever send a summary of a sound off a handset.
Consent is individual, and refusing is free
A member is an adult in an employment relationship, not a child with a guardian, so consent is theirs to give and theirs to withdraw. What refusing costs is coverage, and nothing else. Their phone does not become a device that listens; they are simply not one of the ears. A refusal appears on the roster as a refusal, not as a fault.
The employer is the controller of this data, not this programme. A notice to post, a data-sharing agreement, an employee FAQ and a briefing note for a data-protection officer come with the deployment, and they are short because the design in section 4 is what makes them short.
No location outside an open incident
Section 4 in one line: a member’s position is published only while a corroborated incident is open, and only so the sound can be placed. There is no routine publishing, no trail, no arrival note and no view of where anybody is.
Visitors, who never agreed to anything
A fixed device on a wall hears whoever is in the room, and a visitor cannot be asked in advance. A notice at the entrance is how they are told — and it is exactly why the audio design above matters more than the consent form. The guarantee that has to hold for somebody who never signed anything is that there is nothing to overhear with.
09 — The honest part
What this cannot do yet.
Everything above is what the module is for. This is what it is not, today, and it sits here rather than in a footer because it is the part that decides whether the rest is worth reading.
- Alerting is not switched on, for anybody. This programme set itself a false-alarm criterion before it wrote any of this, and its own measurement of the model the app ships is far above that criterion — not marginally, and not arguably. Two figures exist for it; they are two columns of one table rather than two rival results, and each is published with its column named on how it performs. Alerting stays off until the measurement says otherwise.
- No alert has ever fired from a real event. Not one, anywhere, in this programme’s history. Everything anybody has seen this system do, it did in a drill or in a test.
- The measurement cannot yet resolve the target. The library of real impulsive recordings the model is scored against is not big enough to tell the rate the criterion needs apart from a worse one. The programme can fail to rule the criterion out; it cannot demonstrate it. What fixes that is more real recordings of doors, hammers, dropped chairs and firecrackers — not more arithmetic. It is stated beside the figures on how it performs.
- The human confirmation step has not been measured. It is the largest single bet in the plan and it is a hypothesis until somebody prices it. Nothing on this page depends on it being right, and no wording here treats it as settled.
- Floor reporting is untested in a real building. See section 5. A concrete slab between two devices is the case that decides it.
- Battery drain has not been published. The measurement is planned work, not finished work. Do not accept an estimate from anybody, this programme included, until it appears with its method beside it.
- Nothing here is deployed. No site is running this module. There is no pilot to visit and no customer to telephone, and any page that implied otherwise would be worth less than this one.
10 — Who it is for
Dense floors, known plans, somebody already paid to worry.
The geometry favours places where people are close together, the floor plan exists, an ear can be put on mains power, and there is already a person whose job includes what happens next.
- Shared-service and BPO floors
- Hospital wings and emergency departments
- Hotels and casinos
- Malls and mixed-use retail
- Industrial parks and logistics yards
- Private schools and universities
- Houses of worship
- Guard-service companies, across their sites
Market sizes are deliberately absent from this page. Nobody has counted the floors, and a number nobody measured would be the only unmeasured number on this site.
11 — Questions
The ones that get asked in the first meeting.
Will it drain the battery?
Some. The honest answer today is that nobody has published a figure — the measurement is planned work rather than completed work, and it will appear on how it performs with the method beside it. Until it does, do not accept an estimate from anybody, including from us.
Anchors do not have the problem: they are on mains power and do nothing else.
Do employees have to agree?
Yes, individually, and they may withdraw later. Refusing costs coverage and nothing else: their phone does not listen, they are simply not one of the ears, and the roster shows a refusal as a refusal rather than as a fault. Section 8, and the employee FAQ in the deployment pack, say it in the same words.
Can we use the handsets we already have?
Retired handsets are the intended hardware, and the criteria are published rather than negotiated: a floor for the Android version, support for the newer kind of Bluetooth advertising, and a calibration row for that model. A model with no calibration row is sold as degraded rather than as covered, and the app says so on its own readiness display instead of quietly assuming a default.
What happens if the wifi dies?
The agreeing does not need it. Devices compare notes with each other directly over Bluetooth, which is why the detection half of this works in a building with no network at all. Delivery between two handsets has been measured, in both directions. Delivery at range, and with more than two handsets in the room, has not.
What does need a network is telling somebody who is not in the building.
What if a phone’s microphone is taken by something else?
Then it returns success and silence, which is the worst shape a failure can have. The app watches for exactly that and shows it as a state with a word, a dashed track and a shield glyph — never as a colour alone. A dead process and a changed network are handled the same way, for the same reason: all three failures return no error.
A site that believes it is covered while its devices are deaf is the worst thing this product could do, and the readiness state exists because of it.
Who ends up calling the police?
A person. The app never speaks to an emergency service on anybody’s behalf, and that is a refusal rather than a missing feature. A manager holding an incident sees a four-line brief written to be read aloud by a frightened person, and a ladder of local, regional and national numbers each carrying the date it was last checked by a human. They dial from their own phone.
At the false-alarm rate published on how it performs, an automated call into an emergency line would be an abuse vector before it was a feature, and in many places an offence.
Does this replace a guard?
No. It is a different thing that costs less, and the comparison a facilities manager makes is worth making honestly: a guard can walk towards a noise, ask a question and lock a door. This cannot do any of those.
Can we buy it today?
No. The module is being built and no site is running it. What can be booked is a conversation and a survey: your floor plan in, an honest read of what the geometry can and cannot do on it, and where only a ring is achievable rather than a point.
Start here
Start with a survey, not a signup.
Half an hour, your floor plan, and a straight answer about what the geometry can do in your building — including the parts of it where the answer is a ring rather than a point, and including the parts of the product that are not built.
Book 30 minutes How it performs
Pilot pricing, per device per month, with the hardware at cost — see pricing.