Four surfaces. One live truth underneath.
Control Room is where a duress is worked. Command Centre is where an estate is governed. Mobile puts responders inside the operational picture. Kiosk brings visitors into it. Different rooms, different hands, the same five questions answered on every screen.
Built for the person on shift at 3am
The staffed live-operations workspace inside Guardian. A ranked live alarm queue, an incident detail drawer and a live zone map in three-way sync. Select in one, and the other two follow.
Push, never polling
The queue, drawer and map are fed over server-sent events. The screen changes because the world changed, not because a timer expired. If the connection drops, the client back-fills on reconnect, so an operator returns to a complete picture, not a picture with a hole where the outage was.
Dark theme by default. Control rooms and clinical night shifts run in low light, where a bright interface is a physical hazard, not a style choice. Every surface is keyboard-reachable, with shortcuts on the action set and a visible focus ring.
What happens when a duress is raised →One adaptive shell hosts the live, dashboard and admin workspaces. They are not separate applications.
The command palette
Experienced operators drive by keyboard. The palette reaches the action set in a few keystrokes, and its own footer states the rule: commands never commit, you confirm in the drawer. Speed never buys a shortcut past a human decision.
Administration on the record
Configuration changes are drafted, confirmed and applied, never edited live, and every step lands on the tamper-evident audit trail. The version of anything that fired is recoverable from the incident it fired in.
Dashboards that state their limits
A capability without a backend shows a visible gap, never a plausible figure. On a life-safety platform a convincing invented number is worse than a question. A gap prompts one; a fake number prevents one.
Your estate, run by you
The console your organisation logs into to run its own estate of sites, self-service, up to licensed capacity. WillowCreek doesn't build sites for anyone; you won't need us to.
Governance above, operations below
Command Centre holds what belongs to the estate: sites, policy, standards, users and roll-up reporting. It holds nothing an alarm depends on. Governance lives here, but a duress at any site never waits on it. Stand up a new site, apply estate standards, and watch it report back, without a services engagement in between.
Where Command Centre sits in the platform →- Sites. Create and configure your own sites, self-service, up to licensed capacity.
- Policy and standards. Set them once at the estate; see each site's compliance reported upward.
- Users and roles. Role-based access, extended by context: on-shift and own-ward permits, out-of-hours denies.
- Roll-up reporting. Estate-wide visibility without estate-wide coupling.
The responder is part of the picture
The native iOS and Android staff app. Raise duress on the move, respond to incidents, see the live map, and carry your own position with you, so dispatch decisions see responders, not just the event.
Enrolment by code, against your own site
A staff member enrols the app with a short code issued by their site. No account ceremony, no provider in the loop. From that moment the handset is a duress device and a response tool in one: a raise from the handset is priority one at origination, exactly like every other duress.
Mobile also works with dedicated hardware handsets, including models with a physical duress button. In an emergency, a button you can find by feel beats an app you have to look at.
The escalation ladder behind every raise →Prime
Entering a risky situation, say a difficult room or a lone-worker task, staff prime an escalation with one action.
Trigger
One further action raises the duress. There is no time limit between the two: primed is primed until stood down.
Respond
Responders acknowledge, see the incident and its location, and appear on the map themselves as they move.
Visitors join the picture at the front door
The kiosk service turns visitor check-in into operational coverage: not a name in a paper book, but a tracked, supervised subject.
Check in
A visitor checks in at the kiosk and the platform publishes a tracked subject, an identity the operational picture can reason about from that moment.
Tag issued and bound
The kiosk issues a tag and binds it to the visitor. Identity-first, like everything else on the platform: operators see a person, never a device ID.
Supervision armed
Supervision is armed on the bound tag. The platform's own liveness clock now covers the visitor, the same way it covers staff and assets.
See all four surfaces working from one live event
One duress, followed from the handset to the queue to the map to the record. It takes an hour.