Clypeus · the shield side of school safety · perimeter, access, and the record
Who is in the building, who is allowed to take a child home, and a record of both that cannot be quietly rewritten.
Clypeus is the perimeter-and-access member of a school-safety platform. It is deliberately narrow: it does not watch students, it does not read what they write, and it does not run a tip line. It answers three questions a school has to be able to answer at any minute of the day — who came through the front door, who is out of a classroom right now, and which adult a court or a parent has actually authorised to collect this child — and it keeps a hash-chained record of every answer.
Everything named on this page is code that exists and is registered in the platform at the commit this page was written against. Everything that is a partner dependency or an unbuilt connector is named as one, in the present tense, in the band directly below — before any of the good parts.
The whole safety surface sits behind a single per-school module switch. On a school that has not enabled it, every endpoint on this page returns a plain 404. That is today’s behaviour on every tenant, and it is the first thing this page tells you rather than the last.
What is dark on this product today
This band is first on purpose. A safety vendor that leads with its capabilities and buries its gaps is asking a district to discover the gap during an incident. Each row below is the present tense of a real switch or a real absence, not a plan with the date filed off.
| The thing | State today | Why, plainly |
|---|---|---|
| The entire surface, on a school that has not enabled the safety module | Dark | Every route named on this page is registered behind one module gate. A school without the module gets a 404 from all of them — identical to an address that does not exist. Enabling it is the school’s decision and ours to configure, and it is not a checkbox this page can talk anyone past. |
| Screening a visitor against an external offender list | Not built | The connector into an outside offender-list service is a partner and subject-matter dependency. It does not exist in this platform. What runs is screening against the school’s own watchlist. This is the single most-oversold claim in the category and we are declining to make it. |
| The silent-panic button itself | Partner hardware | The physical device a state statute may name is made by someone else. This platform records the alert, its status transitions, and the named actor behind each one. We sell the record, not the button, and we say which is which. |
| Face recognition, of anyone, anywhere | Absent | There is no face capability on this surface. We are not claiming to have it and we are not claiming a policy against it either — an absolute is a claim, and this page has nothing to base one on. |
| Any AI reading student content | Not this product | The one content-safety model in the wider family is gated twice: the route refuses to record a model-produced signal unless the model is healthy and counsel has cleared it. That belongs to the sibling watch brand. Clypeus contains no model and makes no AI claim. |
| A price | Honest-off | No price, no pricing table, no checkout, no charge on this page or behind it. Money is off across this estate until it is deliberately turned on. |
What runs
Every card below is a set of registered routes in the platform, not a roadmap item and not a mock. “Module-gated” on a card means exactly what the band above says: on a school without the safety module enabled, that capability answers 404 like every other. Nothing here is described as available to a school that has not switched it on.
Front-door visitors
A visitor signs in against the school’s own watchlist and signs out against the same visit record, so an unclosed visit is a visible fact rather than a gap in a paper book. The screen runs on the school’s list — the names a school entered because it had a reason to — and reports a match to the person at the desk without publishing why the name is on it. Built · module-gated
Hall passes, and who is out right now
A pass is issued and returned against a student and a destination, and a single read answers the question that actually matters during a lockdown: which students are out of a classroom at this moment, and where they were headed. It is the same data an office keeps on a clipboard, in a form that can be read in one query when nobody has time to walk the halls. Built · module-gated
Custody directives
A court order or a parental directive about who may collect a child is recorded against that student, read back by student, and revoked as a first-class act rather than a deletion. The revocation is an event, so the record shows that a directive existed and when it stopped applying — which is what a district gets asked about later. Built · module-gated
Dismissal and the carline
A standing dismissal assignment, a same-day change, and a release are three separate recorded acts, plus a live carline status read for the school. Same-day changes are where dismissal actually goes wrong; making one its own event, rather than an edit to the standing plan, is the whole point. Built · module-gated
Drills, logged as they happen
A drill is created and then logged against, so the compliance artifact a state asks for at the end of the year is assembled from what was recorded on the day rather than reconstructed in June from memory and a sign-in sheet. Built · module-gated
Panic alerts, as a record
An alert is raised and its status is transitioned by a named human actor at every step. The hardware belongs to a partner; the chain of who asserted what, and when, belongs here. A status that changed with no actor attached is not a state this record can hold. Built · hardware is a partner
Accountability and reunification
During an incident, students are marked accounted-for and an accountability board shows who is still outstanding. Reunification is its own set of acts: a release to a named adult that is checked against the custody directives on file and recorded without a signature, a reunification board, and an optional step where a safety officer can e-sign the text of the release record. That signature is kept with the incident and is not linked to the release record. The hardest half-hour of a school’s worst day is the half-hour a paper process fails, and it is the half-hour this is built for. Built · module-gated
A tamper-evident safety ledger
Safety events are written into a hash chain, and a verification read re-derives the chain and reports whether every link still holds. See the section below — this is the part of the product a district’s counsel should care about most. Built · verifiable
Who this is for, and what the first week actually looks like
The buyer is a district safety director or a multi-site operations lead — someone responsible for more than one building, who currently reconciles a visitor log from one vendor, a dismissal spreadsheet from the front office, and custody paperwork from a filing cabinet, and who has been asked at least once to prove what happened on a specific afternoon.
The daily users are front-office staff, and they are the reason this is built the way it is. A front-office professional at 7:50 in the morning is the busiest person in the building. Nothing on this surface asks them to learn a new vocabulary: a visitor signs in, a pass is issued, a child is released to a named adult.
| Week one | What happens | What it depends on |
|---|---|---|
| Day 1 | The safety module is enabled for one school — deliberately one, not a district — and the front desk signs its first visitor in and out. Nothing else is switched on. | A named school and a decision to enable the module. Until that decision, every route is 404 and there is nothing to look at. |
| Days 2–3 | The school’s own watchlist is loaded, by the school, from what it already keeps. Front-office staff see a screen result at sign-in the same day. | The school’s list. There is no external list to subscribe to here, and we do not pretend one arrives with us. |
| Days 3–4 | Hall passes go live in one grade band, so the “who is out right now” read has real data in it before anyone depends on it during a drill. | Nothing beyond the module. This is the cheapest capability to trust because it proves itself within a day. |
| Day 5 | Existing custody directives are entered for the students who have them — typically a small number per school — and dismissal assignments are imported for one dismissal window. | The paperwork the school already holds, and an administrator with the role to enter it. This is the step that takes real hours, and we would rather say so than describe it as an import. |
| End of week | Run the ledger verification read once, on a week of real events, and look at the result. If it does not verify, that is the product failing its own test in front of you in week one, which is when you want to find out. | A week of recorded events. The verification is a read anyone with the role can run; it is not a report we generate and send you. |
What is deliberately not in this week: drills, panic recording, and reunification. They are built, and they are the capabilities a school reaches for under stress — which is exactly why they should be turned on after the front desk has a week of ordinary days behind it, not during the same week.
The objections a safety director actually raises
These are the six that decide this category. Two of them we lose on.
“We already have a visitor system. Why would we change it?”
Most districts do, and the honest answer is that a visitor system alone is not what this is. The reason to move is that the visitor log, the hall pass, the custody directive, the dismissal change, and the incident accountability board are the same question asked five times — where is this child and who is with them — and in most districts they live in five systems that cannot answer it together. If your visitor system is working and nothing else needs to join it, keep it.
“Your competitor screens against the national offender registry and you do not.”
Correct, and we have put that in the second band of this page rather than letting you find it in procurement. If an external offender-list scan is the deciding capability for your district, we are not the shortlist. We would rather lose on a capability we do not have than win on a sentence that implies we do.
“Safety software gets bought and then never used by the office staff.”
That is the real failure mode in this category, and it is usually a design problem: the software was built for the buyer’s reporting needs and handed to the front desk. The first-week sequence above is deliberately ordered around the desk — visitors, then passes, then the paperwork — because the capabilities that prove themselves fastest are the ones that survive.
“How do we know a safety record was not changed after an incident?”
You verify it yourself. The ledger is a hash chain with a verification read that re-derives every link. This is the one claim on this page that does not ask you to trust us, and it is deliberately the one we lean on hardest.
“What happens to our data if we leave?”
It stays yours, and the tenancy model is the reason that is a technical statement rather than a policy one: reads are scoped to one school at the database level, not by an application role that an administrator could widen. Nothing on this surface is sold, brokered, or used for advertising, and no student photograph is handled here at all.
“This page has no customer logos, no numbers, no case studies.”
It does not, because we do not have real ones for this product and an invented one is the cheapest thing on the internet to manufacture. A district safety director evaluating a vendor should treat a page of unattributed statistics as a warning. When there is a real school with a real result to name, and their permission to name it, it will appear here with their name on it.
The record, and why it is the product
Every capability above produces the same artifact: a safety event with an actor attached. The value of that artifact is entirely a function of whether it can be trusted six months later, in front of a school board, a family’s lawyer, or a state investigator. A log that the vendor could have edited is worth very little in that room, and every vendor in this category promises they did not edit it.
So the ledger is built as a hash chain instead of a promise. Each entry commits to the one before it, and the platform exposes an administrator-tier verification read that walks the chain and re-derives it. An entry altered after the fact breaks the link at that point, and the verification reports where. The useful property is not that tampering is impossible — it is that tampering is evident, to you, on demand, without our cooperation.
Two limits, stated because a verified chain invites over-reading. First, a hash chain proves that what was written has not changed since it was written; it cannot prove that what was written was true at the time. A staffer who records the wrong adult’s name produces a faithfully chained wrong record. Second, verification is an administrator-tier read on this platform, not a public one — a district can check its own chain; the public cannot check it for them.
Run the verification read against a week of your own events. Either every link holds or the read tells you which one does not. We would rather hand a district that test than a paragraph about our integrity.
The data this touches, and how a minor’s record is gated
Almost everything here is about a child, which makes the gating the load-bearing part of the design rather than a compliance appendix.
Scoping is at the database, not the role. Every read runs inside a school-scoped tenancy binding, so a query for another school’s rows returns nothing — not because the application declined, but because the rows are not visible to that connection. The routes additionally return a clean refusal on the student-record lanes rather than a silently empty success, because an empty list and a denied read look identical to a caller and only one of them is honest.
The most sensitive content is redacted even from a consented staffer. A threat narrative or a monitoring context note is withheld on every list and dashboard view; only a single-record read by a school or district administrator returns it. A front-office staffer gets the operational answer — may this adult collect this child — without the case file behind it.
Consent is fail-closed. Where a capability turns on a specific student’s consent state, a missing, unverified, or withdrawn consent denies processing rather than defaulting to allow. A subject under a suppression or do-not-publish hold is not processed.
Nothing here is public. No part of this surface publishes a minor’s name, image, or movement to anyone outside the school. No student photograph is handled by this product at all — this page carries no photo claim because there is no photo capability to claim. Nothing is sold, brokered, or used for advertising.
How this fits its family, and where the family line is drawn
Clypeus belongs to a safety and health family that shares one temperament: calm authority. The incumbent visual language in this category is fear-forward — red, urgent, badge-heavy — and it is a sales tactic rather than a design decision. A product used at a front desk every morning and during the worst hour of a school’s decade should read the same way in both, which is why this page is quiet.
The family shares a navy ground, hairline rules, tabular figures for headcounts and times, and an abstracted containment form rather than a heraldic shield. Each member then carries exactly one accent of its own; this one is an antique bronze — the metal of the shield, with a patina rather than a shine.
The watch sibling
Tip lines, anonymous reporting, situational awareness, content monitoring. Where Clypeus encloses, the watch brand observes. The two are a deliberate pair — shield and sight — and they are deliberately not one product, because a school that wants an anonymous reporting line should not have to buy a visitor system to get it.
The health-office wing
Point-of-care nurse workflow and medication administration, which rides the core platform rather than standing as its own brand. It shares this family’s discipline about numerals and about calm, and none of its capability is claimed on this page.
The core student record
The single roster and student record every gate described on this page is ultimately scoped against. Clypeus does not keep a second copy of who a student is.
Money, in the present tense
There is no price on this page, no pricing table, no plan tiers, no checkout, and nothing behind this page takes a charge. That is the state of this estate today, not a negotiating posture.
We are a for-profit vendor and this product will be sold. What we are not doing is printing a number that has not been decided so that the page looks complete, or asking for a card behind a form. A conversation with a district works out what applies, and until this estate’s billing is deliberately switched on, that conversation is the only mechanism there is.
Questions we get asked
Is any of this running in a school today?
The routes are built and registered in the platform. Whether they answer at a given school is a per-school decision: the entire safety surface sits behind one module switch, and on a school that has not enabled it every one of these endpoints returns a plain 404 — the same answer as an address that was never built. There is no half-on state and no demo mode that pretends otherwise.
Do you check a visitor against the sex-offender registry?
No, and we are not going to imply it. What runs is screening against the school’s own watchlist — the names a school has entered because it has a reason to. A connector into an external offender-list service is a partner and subject-matter dependency we have not built. Every product in this category leans hard on that claim; ours does not make it.
Does Clypeus include the tip line?
No. The tip line, anonymous reporting, and situational awareness are the sibling brand’s product, not this one. Clypeus is the shield: presence, access, custody, and the record. The two share a platform and a family; they are not the same page wearing two names.
What happens if the panic button is pressed?
The platform records the alert, its status transitions, and who asserted each one, under a named actor. The button itself — the physical silent-panic hardware a state statute may require — is a partner’s device. We are the record and notification layer behind it, and we describe ourselves that way rather than selling you hardware we do not make.
Can a front-office staffer read a student’s custody file?
Reads are scoped to one school by database-level tenancy, not by a role check an administrator can waive, and the sensitive narrative content on these records is redacted even to a consented staffer on any list or dashboard view. Only a single-record, role-elevated read by a school or district administrator returns it. A staffer who needs to know whether a specific adult may collect a specific child gets that answer without getting the file behind it.
Is there any AI in this?
Not on this page and not in this product. There is one in-platform content-safety model elsewhere in the family, and it is gated twice over: the route refuses to record a model-produced signal unless the model is healthy and counsel has cleared it. That belongs to the sibling brand. Clypeus makes no AI claim of any kind, and no face-recognition claim of any kind.
How do I know the safety log was not edited after the fact?
Because you can re-derive it. The safety audit ledger is a hash chain, and the platform exposes a verification read that walks the chain and reports whether every link still holds. An entry altered after it was written breaks the chain at that link and the verification says so. That is a property you can check, not a promise we make about our own behaviour.
What does it cost?
There is no price on this page, no pricing table, and no checkout. Money is honest-off across this estate until it is turned on deliberately, and a page that invented a number to look finished would be the first thing a district safety director should distrust about us. A conversation works out what, if anything, applies.
The next concrete step
One school, one module switch, one week. Name a building, we enable the safety module on that building alone, and the front desk signs visitors in and out for five days. At the end of the week you run the ledger verification read yourself against your own events.
If the week goes badly, you have spent a week and switched a module off. That is the smallest honest first step this product has, and it is the one we would rather you take than a district-wide deployment on the strength of a page.
What this page is claiming, and what it is not
Clypeus is the perimeter and access side of a school-safety platform: visitor sign-in and sign-out screened against a school’s own watchlist, hall passes and a live who-is-out read, custody directives with revocation as a recorded act, dismissal assignments and same-day changes, drills logged as they happen, panic alerts recorded under a named actor, incident accountability, reunification releases recorded without a signature, an optional e-signature a safety officer can put on the text of the release record (kept with the incident and not linked to the release record), and a hash-chained safety ledger with a verification read. All of it is registered code in the platform. All of it is dark on a school that has not enabled the safety module, where every one of these endpoints returns 404. An external offender-list scan is not built. Only the school’s own watchlist is screened. The silent-panic hardware is a partner’s and we are the record layer behind it. There is no face capability and no AI on this product, and the tip line belongs to a sibling brand, not to this one. Reads are scoped to one school at the database level, sensitive narrative content is redacted even from a consented staffer on list views, consent is fail-closed, and no student photograph is handled here. Nothing is sold, brokered, or used for advertising. This is a for-profit vendor, not a charity. Money is honest-off: no price, no pricing table, no checkout, no charge. There are no invented statistics, adoption counts, or testimonials on this page, and no competitor is named.