Compliance & Industry Standards
Last updated: 24 September 2026
GuardFlow is built specifically for the UK private security industry and is designed to help operators meet their statutory obligations.
SIA (Security Industry Authority)
The platform records SIA licence numbers, expiry dates and licence types for every operative, and checks that a licence number has the correct 16 digit format when it is uploaded. Approved Contractor Scheme (ACS) record-keeping is supported. The customer remains responsible for verifying every licence on the official SIA Register: GuardFlow opens the register with the licence number ready to copy and records each check the customer makes (who checked, when, and whether it was confirmed valid or a discrepancy was found). GuardFlow does not query the register itself.
Right to Work
Right-to-work evidence (a British or Irish passport, an eVisa share code, or an Employer Checking Service result) can be uploaded with a declaration signed by the uploader. The employer then records its own check: for a share code, GuardFlow opens the Home Office service with the share code and date of birth ready to copy. Each check is kept as a dated, named record with the method, the outcome, optional evidence and, for time-limited permission, a follow-up date. A statutory excuse under the Immigration, Asylum and Nationality Act 2006 depends on the employer carrying out the prescribed check correctly; GuardFlow records the check but does not carry it out. The Home Office expects these records to be kept for the duration of employment plus 2 years; GuardFlow keeps them until you delete them or anonymise the operative.
Working Time Regulations 1998
GuardFlow records scheduled and actual hours for every operative, with clock-in/clock-out evidence, so the data needed to evidence Working Time compliance is captured and exportable.
When a shift is booked, moved or copied, the rota checks the rest between that shift and the officer's shifts either side, including overnight shifts, against a minimum the company sets (11 hours by default, the daily rest in the Regulations). Each company chooses whether a short rest is a warning a manager can override with a reason, which is kept in the audit log, or a hard block. The rota also warns about approved or requested leave, days an officer has said they cannot work, and hours above an officer's recorded weekly maximum.
GuardFlow does not currently calculate the 48-hour average over the 17-week reference period or track signed opt-outs. These checks help managers spot problems; they are not a legal determination, and monitoring and enforcement remain the operator's responsibility.
HMRC & payroll
Timesheet exports include all data required for PAYE / RTI and CIS reporting. Records are retained for 6 years per HMRC requirements.
BS 7858 (screening)
Vetting documents, including proof of address, photo identity, references, DBS certificates and training records, can be uploaded and stored against each operative's profile with expiry tracking, and a manager can record that an operative's screening has been signed off. GuardFlow does not currently provide a structured BS 7858 screening workflow (5-year employment-history reconciliation, gap analysis, automated reference chasing). Screening is carried out by the operator or their screening provider; GuardFlow is the record store for the resulting evidence.
Information security
- TLS 1.2+ in transit, AES-256 at rest.
- Row-level security enforced at the database layer.
- Audit log of all admin actions.
- Daily encrypted backups taken by our database host. You can additionally export your own data at any time from the Export Centre.
Reporting concerns
Compliance concerns can be raised at support@guardflowapp.com. Whistle-blowing disclosures are handled confidentially.