How We Built a Workforce Platform Running 6,500+ Guards Across 900+ Sites

Our client runs guarding and facility services for banks, factories, campuses and offices across 19 states. When we met, attendance arrived as photos of paper muster rolls on WhatsApp. Payroll lived in one set of spreadsheets, invoices in another, and the two were reconciled by hand every month. Uniforms were tracked in registers, and field officers' visits existed only as call logs.

The owner's ask was blunt: I want to know, on the 26th, that every site is approved, every guard is paid right, and every client is billed — without a war room.

We connected organisations and sites, contracts, onboarding, attendance, payroll, invoicing, compliance, uniforms, Radar, fleet and assets, role-based access, and mobile apps in one data model. Each module shares the same people, sites, contracts and approved operational records.

We refused to let payroll or invoicing read anything except approved attendance. A sheet moves Draft → Submitted → Approved, and once approved it locks. If a correction is needed after salaries are paid, it becomes an amendment: version 2 is approved, and payroll posts only the difference. This single rule eliminated the most common class of month-end dispute.

Payroll windows, the payroll-days basis, attendance codes, allowance heads, cost components, PT slabs, LWF schedules and billing types all live in configuration masters, not in code. When a state revises its Professional Tax, the finance team edits a slab. No release needed.

A contract on a fixed-26 basis cannot have 28 present days. We enforce this in the database so no import, script or bulk edit can break it. Surplus days convert to Extra Duty. Row-level security means a field officer's phone can only read the guards and sites mapped to them, while approve rights stay separate from edit rights.

Guards and field officers work on phones with patchy networks; HR and Finance work on large screens with big tables. We shipped native iOS and Android apps with biometric login and push notifications for the field, and a dense desktop console for the office — one codebase, one backend.

Month-end became a checklist, not a war room. Billing leakage became visible while the month was open. PF, ESIC, PT and LWF registers filled themselves from processed payroll. Forty-plus field officers became visible on a live map, with client-rated visits and kilometres feeding travel reimbursement.

Model the month-end first; screens come later. Put legal limits in the database, not the form. Design reject, reopen and amend paths as carefully as the happy path. Give each role the smallest possible app. Ship to a real site in week six, not month six — production data finds the rules nobody wrote down.