One office, one desk
A receptionist signs people in, and a fire drill where the wardens' phones already hold the names, the companies and the hosts.
Features Reception
Most of the year a sign-in system is a courtesy. For about four minutes it is the only record of which visitors are inside a building, held by somebody standing outside it. Everything here is built backwards from those four minutes.
The guestbook needs a commercial plan — no rung of the home ladder reaches it — and it stays off until somebody switches it on. Permits belong to reception; the settings and the blocked list are the owner's alone. A company login in a shared building sees none of them.
It hangs off the emergency broadcast — the one choke point every route goes through, whether that is the button in the portal, the API a fire panel calls, or the panic button on a screen. Emergencies only, so a broadcast saying the lifts are out mails nobody. It is not waited on either, so a dozen wardens' email cannot hold up the alarm reaching the glass.
What arrives is plain text, because it is read on a phone, outdoors, by somebody who is not calm. The site name. "Taken at 15:42. This list does not change." The scope in capitals — THIS COVERS SIGNED-IN VISITORS ONLY — and underneath it, that staff are not on the list because staff do not sign in to this system. Then the count, then the people: company, host, time in. Then work authorised and not signed off, with anything lapsed first in the line. Then the people believed to have left that nobody saw go, under the heading they deserve, NOT CONFIRMED, and the sentence "Check for these people as well."
It is the only email in the product that ignores the unsubscribe list. Somebody who once opted out of a Mirra email still receives the list of people inside a burning building.
A screen on a stand by the door, authenticated by the device's own secret rather than by anybody being signed in — nobody is logged in at a kiosk. It asks, in order: the kind of visit, when the site offers more than one; the name, which is the only required field; the company; who they are here to see, with a Not sure option; what the visit is for, if the site asks at all; and the site briefing last — fire exits, no photography, where the hard hats are — once somebody has committed to coming in. That order lives in one list, used forwards and backwards, so Back cannot disagree with Next.
Any step other than the first resets after ninety seconds of nobody touching it, and the thank-you clears after eight. A visitor's name is not left on a lobby wall, and the next person cannot add their details to somebody else's half-finished form.
The booth also takes a six-character arrival code from an invitation, and a badge number for signing out. Both give the same deliberately vague failure, so the glass cannot be used to work out who is expected, or who is inside, by trying values.
The reception page opens with who is in the building, before anything else. A row is a name, a company, the host and the company they are here for with its floor, the time in and how long, the purpose, a due-to-leave pill once past the expected duration, and buttons for Badge, Permit and Sign out. Beneath it: the not-confirmed list, open permits, who is expected today with their arrival codes readable at the desk, an invite form, and a sign-in form whose only required field is a name.
The compliance check narrows; a person decides. A failed check never refuses the visit — it refuses the self-service path. The booth shows one sentence and never the reason. Reception gets the reason in words, any blocked reason, the documents on file, a form to record the certificate the person is standing there holding, and a box for why they are signing them in anyway that cannot be left empty.
An override is recorded twice: on the visit, and as an event in the log alongside it. The row is the current state and the log is the history, and after an incident somebody reads the history.
A document on file is a kind — insurance, RAMS, competence — with a name and an expiry that may be empty, because a signed NDA genuinely does not lapse. Reception adds them, since the person holding the certificate is the person at the desk. A document within thirty days of its date is marked as expiring where it is shown, and one valid document of a kind is enough even if a lapsed one sits beside it. There is no delete route, on purpose: a document that was on file when somebody was let in is part of why they were let in.
A permit to work is issued against a visit — hot works, working at height, confined space, electrical isolation, or something else the building names — with a location, what is being done, and a required time it runs out. An open-ended permit is refused. Closing one is a positive act by a named person: reception signs it off, and the permit records who did and when.
Open permits go on the roll call under the people. Lapsed ones — open and past their time — go first in the line, and into the subject of the building's copy, because for hot works that gap is the fire watch and somebody reading on a phone outside may not scroll.
One Mirra account is one building, and the companies in it are occupiers: a name, a floor in the building's own words, a contact address, their own fire-warden list. A visit takes its company from its host, never from the visitor — nobody arriving is asked which of eleven companies they meant. A tenancy that ends is dated rather than deleted, so every historic visit still says who it was for.
When the alarm goes, the roll call goes out several times and the copies do not collide. The building's copy is grouped by company, alphabetical, with anybody not attached to one last. It goes first and alone, and the addresses it reached are withheld from the company copies, so nobody is handed a list of three and a list of thirty in the same car park. Each company then gets its own copy of its own people, and is told so in the subject line and again at the top: this is not the building's roll call, others are inside for other companies, and the building holds the full list.
A company can have its own logins. They see their own occupancy, their own expected arrivals and their own badges, and can sign in, sign out and invite against their own people, plus keep their own warden list current — which nobody else can do for them. They do not see the permits, the contractor documents, the blocked list or the visitor directory. A sign-out against another company's visit returns exactly what a second tap returns, because a distinct refusal would confirm the visit exists.
Any two dates, and what that period looked like: visits, people, when they arrive, which day is busiest, who is most visited, where visitors come from, and in a shared building a breakdown by company.
The number worth reading twice is the typical visit length, because of what it leaves out. A duration is counted only from visits somebody actually signed out of; everything closed by the end-of-day sweep is excluded, and the count of those exclusions is printed beside the average. A building where two thirds of people never sign out is told that, rather than handed the other third's average as though it were everybody's. Below about twenty visits nothing claims a pattern at all.
A search by date, name, company or state exports as a branded PDF, a CSV that opens cleanly in Excel, or JSON. The PDF opens with what the document covers and does not, because it is the copy that ends up with an insurer.
There are four roles, and the restricted ones are allow-lists of what may be reached rather than lists of what is forbidden — so a misspelt role, or one added next year, resolves to less access rather than more. A receptionist can sign people in all day and cannot change the retention window, edit the building's fire-warden list, block a person, search the visitor directory or unpair the lobby screen.
"May this person call this route?" is answered at the edge, from a path list with no database behind it. "May this person see this row?" is answered separately, as a scope the route has to apply. The two halves cannot see each other, and a test asserts they agree — which means a route nobody has converted yet refuses a company login by default, rather than by somebody remembering to.
Every visit carries an append-only event log: signed in, signed out, presumed left, invited, host notified, badge opened, override, permit issued, permit closed. Past the retention window — a year by default — closed visits are separated from the people in them: the times, the type, the state and the screen that signed them in survive, the name and the phone number do not. Open visits are never anonymised, because taking the name off somebody the building believes is inside would remove them from the roll call by the back door.
A receptionist signs people in, and a fire drill where the wardens' phones already hold the names, the companies and the hosts.
One booth in the lobby. The building gets the whole list grouped by company; each company gets its own, and is told plainly that it is not the whole list.
Insurance and RAMS on file, a hot-works permit with a time it runs out, and the word LAPSED at the front of the line if that time passes while the work is still open.
No. Nobody on the payroll signs in, and the roll call says so in capitals in the subject and again at the top of the body. A marshal who believes the list is everybody is worse off than one with no list at all.
Every owner and every reception account, plus any addresses you add by hand — wardens are very often not users of the software at all. In a shared building each company also gets its own copy of its own visitors, sent to that company's own warden list.
If you switch it on. The booth always shows a badge number on screen; with printing enabled it also prints the badge — the same page reception prints, at 62mm for a continuous label roll, so a reprint matches the card somebody is wearing. It is off by default, because a machine that has not been set up to print silently will show a visitor a dialog nobody dismisses.
At the site's close-out time the visit becomes presumed left, with "(end of day — not observed leaving)" against it. It is counted separately, shown in its own section, and named as a guess on the roll call for twenty-four hours after they arrived. It is never quietly folded into signed out.
No. The retention window and the building's fire-warden list are owner-only, refused by the path list and again inside the route. Saving replaces every field at once, which is why the form always sends all of them: a request that left the warden list out would clear it, and nobody would find out until an evacuation.
Start free on one screen. No card until you add a second.