Lone worker for the office: escalation contacts, the board and answering an alarm

When somebody works alone, they start a lone worker session on their phone and check in as they go. If they stop answering, or press Get help, Maliru alerts the people your workspace has chosen, one after another, by push notification, text message or phone call, until somebody says they have it. This article is the office side: setting that up, watching the board and answering an alarm. The worker's side is in Working alone: start a session and check in.

Switching it on

Lone worker is a feature of the Time & timesheets module, under Global settings › Modules. It is on by default. Switched off, the card disappears from workers' phones and the tab from Timesheets.

Journey monitoring, beside it, is off by default and needs Lone worker on. It lets a worker record where they go between check-ins — see Journey monitoring below.

What your plan includes

The alarm itself, and this board, are on every plan.

• Free alerts contacts by push notification.
• Team adds alarm texts.
• Crew adds the monitored service: alarm calls and test calls, calling the worker first, check-in and duress codes, the worker's emergency contact, journey monitoring and three words (what3words).

A contact set to Text or Call on a plan that doesn't include it is alerted by push instead. The list stays as you saved it, so moving up a plan brings the texts and calls back. An alarm is never dropped for want of a plan.

Who can see the board

The board lives at Timesheets › Lone worker and needs the Manage lone worker permission. It is its own permission because the board shows a colleague's location.

• Owners always have it.
• Supervisors and office admins added from now on get it with their access profile. People who already had those profiles keep the permissions they had — check them.
• Anyone else can be given it in Users: open the person, edit their access, and tick Manage lone worker under Forms and compliance.

Every escalation contact needs it. Somebody who is alerted but can't open the board can't take or close the alarm.

Lone worker settings

Everything the workspace decides about lone working is in one place: on Timesheets › Lone worker, choose Settings. It has two parts, Sessions and Escalation contacts, and one Save button that stays in view at the bottom (Unsaved changes shows beside it until you save — "Lone worker settings saved."). Changing any of it needs Manage lone worker, and every change is recorded in the audit trail.

At the top, Settings shows the number alarm calls and texts come from: "Calls and alarm texts come from …". Ask every contact, and every worker if you call workers first, to save it in their phone as Maliru alarm. A phone that silences unknown callers sends the alarm to voicemail otherwise.

Sessions

• Check-in interval — "The longest a worker can go between check-ins." From 5 minutes to 12 hours; 30 minutes until you change it. When a worker starts a session they can pick a shorter interval, never a longer one.
• Grace before alerting — from None to an hour; 5 minutes until you change it. "The worker is reminded as soon as a check-in is missed. The first contact is alerted once this has passed too." The grace is counted from that reminder, so the worker always gets all of it.
• Start a session when someone clocks in — off to begin with. Turn it on and everyone who clocks in is put on the interval above until they end the session themselves; clocking out doesn't end it. "Nothing starts while there are no escalation contacts." A worker who already has a session running keeps theirs.
• Call the worker first when they miss a check-in — off to begin with. Maliru rings the worker before anybody else is disturbed, and they check in on the call with their own code. See Calling the worker first below.
• Call a worker's emergency contact as the last resort — off to begin with. See The worker's emergency contact below.

These apply to sessions started after you save. Sessions already running keep the interval and grace they started with.

Escalation contacts

Until at least one contact is saved, nobody in your workspace can start a session — their phone says "Nobody in your workspace is set up to be alerted, so a session would not protect you." A session that would wake nobody would only give false confidence, so Maliru refuses it. An empty list reads "No one would be alerted."

1. Add a contact adds a row. Pick the person — the list is everyone in the workspace, searchable, because the person who answers at night is whoever is on call, not a job title. Nobody can be on the list twice. You can also choose The worker's manager — see below.
2. Choose Push, Text, Call or any mix. At least one must stay on.
3. Add more contacts in the order they should be tried. A list can hold up to ten.
4. For each contact after the first, choose their wait — after 5 min to begin with, anything from 1 minute to 4 hours.
5. Save.

The first contact is Alerted at once — the moment an alarm is raised. Each one after them is alerted only if the alarm is still unanswered once their wait has passed since the contact before. Changes to the contacts and their waits take effect straight away, even for an alarm already climbing, from the next contact it reaches.

The worker's manager is whoever is set under Reports to on the worker's record in Users, worked out at each alarm. A crew in one depot reaches their own supervisor instead of one person named for the whole workspace. It can be on the list once.

• A worker with no manager set, or whose manager is no longer active, skips this contact, and the alarm goes straight on to the next. The row counts how many people have no manager set.
• If the manager is also named further down the list, they are alerted only once.
• A worker the list can't reach anybody at work for can't start a session, and is told why. A contact counts when Push is on and they've signed in to Maliru, or when Text or Call is on and there's a number to use, in international format such as +44 7700 900123. So a list of only The worker's manager stops a worker with no manager set, and a list whose only contact is called with no number stops everyone.

Test call appears on a named contact with Call on, once your changes are saved. The worker's manager can't be test-called from here, because who that is depends on the worker; test-call the managers as named contacts instead, or check their numbers in Users. It rings them now with a test alarm call — "No one needs help." — which ends by asking them to save the number as Maliru alarm. Use it to check the number works and their phone lets the call through. Each contact can be test-called three times an hour.

Two warnings on a row are worth fixing now, while it is quiet:

• No number to text or No number to call — the contact is set to Text or Call but has no phone number on their record. "Add one, or turn the text off."
• Cannot be reached — there's no number to text or call, and Push is off or the person hasn't signed in to Maliru yet, so no alarm could reach them. The list won't save until you add a number, or switch on Push for someone who has signed in.
• Cannot take the alarm — "They will be alerted, but without Manage lone worker they cannot mark an alarm as handled or close it. Give it to them in Users."

How an alarm climbs

1. A check-in is missed. The session turns Late and the worker gets a "Check in now" notification. Nobody else is disturbed yet — most missed check-ins are someone with their hands full. If your workspace calls the worker first, their phone rings now too, and the list waits for that call (see Calling the worker first).
2. The grace period runs out. The alarm is raised and the first contact is alerted. The push reads "Aisha Khan missed a check-in", with what she said she was doing and her last known position as coordinates. A text reads "MALIRU ALARM: Aisha Khan missed a check-in. … Open Maliru to respond." A call is described under Alarm calls below.
3. Nobody answers. After each contact's wait, the next one is alerted. A contact the alarm can't reach at all, such as one set to Push only who has never signed in to Maliru, counts as failed, and the next contact is alerted straight away.
4. The list runs out. The alarm stays open on the board as No answer. Maliru has no one left to try; phone the worker and follow your own emergency procedure.

Maliru checks for missed check-ins on a schedule, so allow a few minutes either side of these times.

The Lone worker notifications can't be muted in anybody's notification settings. The alarm itself gets through even when somebody has paused all push notifications, and so do the worker's own "Check in now" reminder and any text the worker sends to the alarm line. The quieter notices, that somebody is handling the alarm or that it has closed, follow the pause. Texts and calls go regardless, which is a good reason to give every contact a text or a call as well.

If the worker checks in, asks for longer or ends their session at any point, the alarm closes by itself and everyone the alarm has reached is told "Aisha Khan is safe".

Alarm calls

A contact with Call on is rung at the same moment as their push and text. A ringing phone gets through where a notification is missed, and it works with the app closed.

• Nothing about the worker is said until a key is pressed. The call opens with "This is a Maliru safety alarm for Acme Civils. Press any key to hear it." A voicemail or a wrong number hears nothing about your colleague, and a call nobody presses a key on doesn't count as reaching anyone.
• After a key press it says who and what happened — "Aisha Khan missed a check-in due at 2:30 pm." — and what they said they were doing. It then says their last location was sent by text, when it was, or to open Maliru to see it. With what3words on, it reads out the three words (see Where they are, in three words). Coordinates are never read out.
• Press 1 to take the alarm. It is the same as I have this in the app: the list stops, and everyone already alerted is told.
• Press 2, on a missed check-in only, takes the alarm and puts you straight through to the worker's phone. It is never offered on a panic or a duress alarm, because a worker in danger may not want their phone to ring.
• Press 9 to hear it again.
• Hang up without pressing 1 and the alarm carries on to the next contact after their wait, as it would after a push.

If the contact doesn't answer, Maliru rings again straight away: on many phones a second call from the same number within a few minutes gets through Do Not Disturb. If that one goes unanswered too, or the call fails, the next contact is alerted at once, without waiting.

If the alarm is taken or closed while a call is still ringing, Maliru ends the call; answered in that moment, it says "This alarm has already been taken by Sam Reid. No action is needed."

A contact who missed the call and rings the number back is told "We'll ring you straight back.", and is rung back with the alarm at the number on their record. Maliru never takes an alarm from a call it receives, because the caller's number can be faked.

When a worker presses Get help

A worker with a session running can tap Get help on their card and confirm with Send alarm. That skips the timer: the alarm is raised at once and the first contact is alerted straight away, without waiting for a missed check-in or for Maliru's next scheduled check. The list then climbs exactly as above.

• The push reads "Aisha Khan pressed the panic button", a text "MALIRU ALARM: Aisha Khan pressed the panic button. … Open Maliru to respond.", and a call "Aisha Khan pressed the panic button at 2:32 pm."
• It carries the worker's location when they pressed it, or the last one their phone sent if it couldn't get a fix — as coordinates, or no location if the phone never sent one.
• On the board the status is Panic, and What happened shows Panic button pressed.
• A press on an alarm that is already under way — a missed check-in, one somebody has taken with I have this, or one whose list has run out — turns it into a Panic and starts again from the first contact, so everyone hears that the worker asked for help.
• A press made with no signal is kept on the worker's phone and sent when it reconnects, once, however many times the phone retries. The message and the log then say so: "Pressed with no signal; it reached Maliru 12 min later." Read the location as where they were at the press, not where they are now.

If nobody is on the list — or nobody on it could be reached — the worker's phone tells them "Nobody was alerted" and to phone for help directly.

Calling the worker first

Switch on Call the worker first when they miss a check-in in Settings and Maliru rings the worker's own phone the moment a check-in is missed, before anybody else is disturbed. It rings the phone number on their record in Users; a worker with no number there isn't called, and the alarm goes up after the grace period as usual. Most missed check-ins are someone who never saw the notification, and a ringing phone gets through.

• Each worker sets their own 4-digit check-in code on their phone. On the call they enter it and are checked in, exactly as if they had tapped I'm OK. The log reads Checked in by phone.
• The list waits for that call. If it ends without a check-in and the grace period has passed, the alarm is raised at once. A call that never reports back is let go after three minutes.
• A worker with no code set hears "Open Maliru and tap I'm OK." The call reminds them but can't check them in. While the switch is on, Settings counts how many people haven't set a code yet.
• Three wrong codes, or no answer, and the alarm goes up as it would have anyway.
• What happened records each call: Called the worker: checked in by phone, no answer, wrong code three times or no check-in code set, told to open Maliru.

A worker's codes are their own. Only they can set them, from their phone, and nobody can read them back, the office included.

The duress code

A worker can also set a duress code, for when somebody is making them check in. On the call it sounds exactly like their check-in code, and their phone shows them checked in. Behind it, a silent alarm goes straight to the first contact and climbs like a panic:

• On the board it is Duress, at the top above every other alarm, and What happened reads Entered their DURESS code.
• The push, text and call say "Aisha Khan entered their duress code", and that "They may not be free to talk. Do not call their phone." Calls don't offer Press 2, and the worker's emergency contact is never rung.
• The worker can't cancel it. Checking in or ending their session doesn't close it, and the session stays on the board until someone in the office closes the alarm.

The worker's emergency contact

Switch on Call a worker's emergency contact as the last resort in Settings, then add The worker's emergency contact as the last contact on the list, after at least one person at work.

• It is the Emergency contact on the worker's record in Users, worked out at each alarm. They are only ever called, never pushed or texted, and the row says "Only ever called. They cannot take or close the alarm."
• They are rung only once everyone at work has had their turn and nobody has taken the alarm. The call opens "This is a safety call from Maliru for Acme Civils." After a key press, it says Acme Civils hasn't been able to reach the worker and is looking for them, and asks them to press 1 if they know the worker is safe, or 2 if they don't.
• Either answer goes on the log and is pushed to everyone already alerted. Neither stops or closes the alarm; only someone in your workspace can.
• They are never rung for a duress alarm.
• Each worker is told on their phone before it can happen: "If nobody at Acme Civils answers an alarm, Maliru will call Alex Hale, your emergency contact."
• The board shows them as Emergency contact, never by name.

The board

Lone workers lists every live session, worst first: alarms, then anyone late, then everyone working. When something is wrong, a band at the top counts the alarms and those late checking in.

• Worker
• Status — Working, Late, No answer, Panic, Duress, Being handled or Ended.
• Doing — what they said they were doing when they started.
• Check-in — in 12 min, due now or 8 min late.
• Last seen — when the phone last reached Maliru.

Show history adds sessions that have ended; Show live only goes back. Settings opens the lone worker settings above. With nobody out, the board reads "Nobody is working alone."

The board shows what was true when you opened it. Leave the tab and come back to refresh it.

Answering an alarm

Open the row. The session shows Doing, Check-in, Every (their interval), Last seen, Last known position — as three words when your workspace uses what3words, otherwise as coordinates; there is no map — and Battery when the phone sent it.

• Who was contacted lists every alert: the contact, their place on the list, where it went and when — or Not sent with the reason, such as a missing number. "Sent" means Maliru handed it to the phone network or the push service, not that the person read it. A call says how it ended — took the alarm, heard it, no answer or call failed — and whether it was a second try or a ring-back.
• What happened is the session's log: started, checked in, asked for longer, check-in missed, alarm raised, panic button pressed, who took it, who closed it. It also shows calls to the worker, a contact put through to the worker, the worker tapping their own Call button and the emergency contact's answer.

Then:

• I have this stops the list climbing. Pressing 1 on an alarm call does the same. The status turns Being handled and everyone else the alarm has reached is told "{your name} is handling the alarm", so two people don't both drive out. It doesn't close the alarm — the worker still hasn't been heard from. If the worker then presses Get help, the alarm goes back to Panic and starts again from the first contact.
• Close alarm asks "How did it end?" — The worker is safe, There was an incident or False alarm. Closing the alarm also ends the session, and everyone the alarm reached is told how it ended.

Record false alarms as false alarms. If most of yours are, the check-in interval is too short for the work, and that only shows up if they are counted honestly.

Close alarm only appears while there is an alarm. The office can't end a quiet session; the worker ends it from their phone.

The audit trail

Every step is written to the audit trail: a session started, each check-in, asking for longer, ending, Get help, I have this and Close alarm with how it ended, and every call placed and how it ended. Those lines record whether a location came with the step, never where, and never a phone number — coordinates, what the worker said they were doing and closing notes stay on the board, behind Manage lone worker. Opening a session is recorded too, so your workspace can see who looked at a colleague's location and when.

From a notification, and on a phone

In the office, an alarm notification opens Timesheets › Lone worker, with the alarm at the top.

In the field app, a contact with Manage lone worker who taps an alarm notification lands on the lone worker board, and can take or close the alarm from there. The board is also under Me › My time, on the Lone worker tab. Someone without the permission lands on Today.

Journey monitoring

With Journey monitoring on, a worker can switch on Share my route when they start a session. Their phone then records where they go until the session ends, including while their phone is locked. It needs their location permission — While using the app is enough — and the phone shows it is recording for as long as it runs. If their phone can't record, their card tells them why and how to fix it.

The session shows how many route points were recorded — "Recorded between check-ins while journey monitoring was on." There is no map of the route on the board yet.

Without journey monitoring, Maliru only knows where a lone worker was at the moments they started, checked in, asked for longer, pressed Get help or ended — never in between.

Where they are, in three words

A workspace can switch on Location in three words (what3words) under Time & timesheets, beside Lone worker. It starts off, because it sends the position of a worker in an alarm to what3words.

With it on, an alarm says where the worker was as a what3words address, such as ///filled.count.soap, with the place it is near. Three words are far easier to read out and write down than coordinates, and many emergency services accept them.

• The alarm text reads "Last seen 14:02, within 12 m of ///filled.count.soap near Bayswater, London.", with a link to the what3words map on a line of its own. The push notification says the same.
• The alarm call reads the three words out twice, after you press a key, with the place they are near. Press 3 to hear them again.
• The board shows the words with a copy button and a link to the map, how accurate the position was, the time it was taken, and whether it came from the worker's shared route.
• The emergency contact, when your workspace calls them, hears the words only if they press 2 to say they don't know the worker is safe, and is told to give them to the emergency services.

The words always come with how old and how accurate the position is. A phone's position can be hundreds of metres out, and an approximate or old position is labelled as one.

If the words can't be looked up in time, the alarm goes out exactly as before, with coordinates: it never waits for them. The words and the coordinates are never shown together, because what3words doesn't allow it.

While an alarm is open and the worker is sharing their route, the words are for the newest point on their route when that is newer than their last check-in. The audit trail records whether an alarm carried the words, never what they were.