Scanning IDs on staff phones: a personal-device policy

Staff phones, venue phones or both

Staff-owned phones avoid a hardware purchase when employees already have supported devices. Venue phones cost money up front, but they stay in the building, charge overnight and pass to the next person at the end of a shift without anyone's personal phone involved.

A mix works too: a venue phone at the front door, with staff phones at the bar or as spares.

Whichever you choose, the phone has to run the app. AgeShield runs on an iPhone or iPad on iOS 15.5 or later, or an Android phone or tablet on Android 8.0 or later. Whether an app suits the venue at all, rather than a handheld scanner, is covered in how to choose an ID scanner for a bar.

Which phones are signed in

A phone becomes a scanner when it is signed in to the venue. In AgeShield, staff install AgeShield ID Scanner from the App Store or Google Play and the phone scans a QR code from the hub. A policy can keep that step with the manager, so the code is not passed around a group chat.

Keep a short list of the phones signed in: whose phone it is, whether it is personal or the venue's and the date it was added. Each phone on the list carries the venue's Banned, VIP and Regulars lists, so a short list is easier to account for than one that grows with every new hire.

How many phones scan at once is its own question, covered in how many ID scanners a bar needs. On AgeShield every plan covers three devices scanning at once, and each device past three is a slot added from Billing in the hub.

Phones on the list also need looking after. The Cybersecurity and Infrastructure Security Agency's advice to small businesses includes installing security updates promptly, and a policy can ask staff to do the same on a signed-in personal phone. It can also ask for a screen lock on every signed-in phone, since a personal phone leaves the building after every shift.

Cybersecurity and Infrastructure Security Agency (CISA), Secure Your Business

How staff sign in

A signed-in phone is not the same as a signed-in person. With staff sign-in turned on in AgeShield, each scan records who made it by personal PIN, and the visit record also shows which device it came from.

That only works while each PIN stays with one person. A policy line that PINs are never shared, and never written on the phone or its case, keeps the record worth having.

Roles decide what a person can do. Scan-only staff sign in with a PIN on the phone and scan, with no hub access. Staff can also open a guest's details, and the access log records who opened them, when and from which device.

Owners and managers change venue settings, and staff see them read-only. A venue can also set the lowest scan mode its devices may use, and a new device starts in Standard.

What stays on the phone

The phone works out each result itself, from the lists it already has. The Banned, VIP and Regulars lists are on every phone, and the Banned list is the copy the phone last downloaded. That is what lets scanning keep going without a signal.

Visits and staff decisions made without a signal wait on the phone and sync once it is back online. While they wait, a banner reads "Offline · preliminary, syncs when online", so a policy can ask that the banner is gone before a phone leaves the building at the end of a shift. When the signal drops shows the rest.

The venue's privacy controls determine what a phone shows. Fields the venue excludes are dropped on the phone as the ID is read, so they are never shown, sent or stored. Staff still see the name, the age and the expiry on the phone, whatever the venue excludes.

How long details are kept afterward is a venue setting too, described on privacy controls.

A lost, broken or replaced phone

Write down what staff do when a signed-in phone goes missing: tell the manager on duty the same shift, and say which phone it was and when it was last used at the door. The manager notes it on the list of signed-in phones.

Then the door needs a working phone. In AgeShield, if a phone breaks, another one is set up with a sign-in QR code from the hub. Until it is, staff check by hand. The routine in how to check IDs at the door covers the gap.

A personal phone adds a step, because the staff member may need to replace their own phone first. Until then they can scan on a venue phone or the spare, if the venue keeps one.

When someone leaves

Leaving is where a personal-phone policy gets tested, because the phone walks out with its owner. Four steps on the last shift close it out:

1. 1

   Let the phone sync

   The phone goes back online and the offline banner clears, so every visit from the shift reaches the hub.

2. 2

   Return the phone or remove the app

   A venue phone is handed back. On a personal phone, the AgeShield app comes off before the person leaves.

3. 3

   End their access

   The policy names who ends a leaver's access the same day, rather than at the next schedule change.

4. 4

   Update the list

   The phone comes off the list of signed-in phones, with the date it was removed.

Battery and charging at the door

A phone at the door runs its camera and screen for hours. A policy can ask for phones charged before the shift, a charger and cable at the door station and a spare, which also covers the night someone arrives with a nearly flat personal phone.

Cold matters at an outdoor door too. Apple designs iPhone for use between 32 and 95 degrees Fahrenheit, and says that in very cold conditions outside that range an iPhone's battery can run down sooner for a while, the iPhone can turn off and it might not charge. A policy for a winter line such as college winter break can keep phones in a pocket between scans and charge them indoors.

A weak signal is a separate problem. AgeShield keeps scanning offline and syncs once the phone reconnects, and if the Banned list has not synced for 30 minutes the app warns "Ban list may be out of date · verify manually" so staff check by hand.

Apple Support, If your iPhone or iPad gets too hot or too cold

Writing it into the door policy

The device rules add a few lines to the house's door policy:

• Who decides between staff phones, venue phones or both
• The list of signed-in phones, who keeps it and who signs a new phone in
• One PIN per person, never shared or written down
• A screen lock and current updates on every signed-in phone
• A lost phone: who is told and what takes over at the door
• Someone leaving: the four last-shift steps
• Charging: phones charged before the shift, a charger at the door and a spare