What to Build for Security and Surveillance Services in the UAE

Published by CodeNicely, the product studio founded by Meghal Agrawal and Ujjwal Agrawal in 2017

For: Owner or COO of a licensed UAE security services company with 200–2,000 guards on contract, who is losing margin to manual scheduling, client reporting disputes, and SIRA audit prep that currently takes the ops team two weeks every cycle

If you run a licensed UAE security company with 200–2,000 guards on contract, the single highest-ROI system to build first is a geo-fenced guard attendance and incident log that produces a timestamped, client-exportable PDF — not scheduling, not CCTV analytics, not a mobile app for supervisors. Everything else sits on top of that audit trail, because the two things eating your margin — client SLA penalty claims and SIRA audit prep — both trace back to the same missing evidence layer. This post lays out what to build, in what order, and what each piece changes operationally.

The context matters. The UAE manned guarding market is on track from USD 4.94 billion in 2026 to USD 8.49 billion by 2034, service-based guarding is roughly 70% of that revenue, and there are now about 1,300 licensed firms competing. Margin is not going to come from winning more RFPs. It comes from not bleeding it on three specific operational failures.

The three operational problems that actually cost you money

1. Unverifiable guard-post attendance

Your contract says a guard will be at Gate 3 of a logistics compound from 22:00 to 06:00. The client's facility manager claims the post was empty between 02:00 and 04:00 last Tuesday. You have a paper attendance register signed at shift start, a WhatsApp message from the supervisor saying everything was fine, and a guard who swears he was there. You cannot prove it. The SLA clause triggers. You eat the penalty, or you argue and strain the relationship on a contract you need to renew.

Multiply this across 40–80 posts and you have an invisible monthly leak of 2–6% of contract value. No scheduling SaaS fixes this, because the scheduling tool does not know whether the human was physically at the coordinates in the contract.

2. The weekly client reporting exercise

For every mid-size and enterprise client, someone on your ops team spends four to eight hours a week assembling a report: incidents logged, patrol rounds completed, deviations, photos from supervisor visits. Half of it is copy-paste from WhatsApp groups. The report is late, the format differs by client, and nothing in it is independently verifiable. Facility managers do not trust it, which is why they call you about Gate 3 instead of checking the report.

3. SIRA audit prep that burns two weeks every cycle

Every guard file must contain a current Emirates ID, passport, visa, SIRA card, and training certificates, with refresher training required every two years. SIRA treats each guard as a separately licensed unit, not just the company. With 800 guards, that is 800 folders with five documents each, 4,000 expiry dates to track. Non-compliance can result in fines or company licence cancellation. Most firms track this in a spreadsheet maintained by one person. Every audit cycle, two ops people disappear for two weeks to reconcile it.

Notice what these three problems have in common. They are all evidence problems. The product you build is not a workforce app. It is an evidence system.

What to build, in order

Phase 1: Geo-fenced attendance and incident log (the foundation)

This is the only thing worth building first. Everything else depends on it.

What it does:

• Each guard clocks in and out via a mobile app with GPS and, where device trust is weak, a QR or NFC tag physically installed at the post. Both signals are captured — GPS alone is spoofable, NFC alone fails when the tag is damaged.
• Patrol rounds are logged by NFC tap at defined checkpoints with timestamp, geo-coordinate, and optional photo.
• Incidents are logged in-app with structured fields (type, location, time, photo, action taken), not free text in WhatsApp.
• Supervisors do site visits that are themselves logged the same way.
• Everything writes to an append-only log. Edits are versioned. The audit trail cannot be rewritten after the fact — this is the point.

What changes once it exists: When a client disputes a post, you export a PDF showing every clock event, every patrol tap, and every supervisor visit for that post for the disputed window, with coordinates and photos. The dispute ends in one email. SLA penalties drop materially. The same log feeds the SIRA audit — you can show inspectors who was deployed where, when, with what training certificate on file, in minutes.

What drives the build cost and timeline: number of post types and shift patterns to model, whether you need iOS plus Android plus a ruggedised device profile, offline sync requirements (most UAE sites are fine but underground parking and remote industrial yards are not), integration with existing payroll, and whether the client-facing report PDF needs white-labelling per client. A two-platform mobile app with offline sync, supervisor web console, and a client PDF export is a very different build from a single-platform pilot for 50 guards on one contract. Both are legitimate starting points.

What this is bad at: It will not reduce your guard turnover, which the industry is still fighting at 88.6% in 2024. It will not win you RFPs on its own. And in the first 60 days after rollout, your supervisors will hate it, because it exposes posts that were previously unverified.

Phase 2: Client-facing report portal

Once the log exists, the weekly report writes itself. Build a client portal that gives each facility manager a live dashboard of their own posts: attendance compliance %, patrols completed vs. required, incidents by category, supervisor visit frequency. One-click monthly PDF in the format the contract specifies.

What changes: The four-to-eight-hour report assembly per client per week disappears. More importantly, clients stop calling your ops team to ask what happened at Gate 3, because they can see it. Renewals get easier because the client has a tangible record of what they are paying for, every day, not just when something goes wrong.

What drives the cost: number of distinct client report formats you need to support, SSO requirements for enterprise clients, whether you want the portal multi-tenant from day one, and whether clients want API access to pull data into their own facility management systems. A single-format portal for ten clients is a few weeks. A multi-tenant portal with per-client branding, SSO, and an API is a different conversation.

Phase 3: SIRA compliance and guard lifecycle system

Now you digitise the guard file. Every guard record holds Emirates ID, passport, visa, SIRA card, training certificates, refresher dates, medical, and contract. The system tracks expiry on every document and warns the compliance officer 60, 30, and 7 days before each. New hire onboarding runs through a checklist that will not let a guard be deployed to a post without a valid SIRA card on file.

What changes: The two-week audit prep becomes a two-day review. More importantly, you stop deploying guards whose SIRA card expired last Thursday, which is the finding that actually triggers penalties. With Emiratization requirements raising recruitment and training costs, having a clean lifecycle system also makes it tractable to track Emirati headcount ratios against your 50+ skilled employee obligation.

What drives the cost: integration with your HR or payroll system, whether you want OCR on uploaded documents to auto-extract expiry dates, and whether you need an inspector-mode view that lets a SIRA auditor sit at a terminal and self-serve. The lawyer or compliance auditor you work with should review the data retention and PII handling design — this is not a place to improvise.

Phase 4: Scheduling and workforce optimisation

This is where most vendors want to start. Build it fourth. Scheduling that is aware of guard SIRA licence status, training certifications, post requirements, overtime rules, and leave balances is genuinely useful — but only after the attendance log has told you what is actually happening versus what you scheduled. Without the log, you are optimising fiction.

What changes: Shift fill rates go up, overtime goes down, and the WhatsApp-based last-minute shift swap vanishes. Modest margin recovery, but real.

Phase 5 (optional, often not worth it yet): CCTV analytics and AI incident detection

Vendors will pitch you AI video analytics — perimeter breach detection, loitering, PPE compliance. For most UAE guarding firms with 200–2,000 guards on physical post contracts, this is premature. You do not own the cameras at your client's sites. Even where you do, the ROI is thin compared to Phases 1–3. Revisit this when you move into monitored remote guarding as a service line, not before.

The build order summarised

How to think about cost and timeline

There is no honest flat price for this because the build is driven by variables only you can answer:

• Guard count and post count. 300 guards on 25 posts for three clients is a different system from 1,800 guards on 180 posts for 40 clients.
• Device strategy. BYOD on guard phones is cheap but creates support load; company-issued ruggedised devices change the hardware line item and the app's offline behaviour.
• Integration surface. If you are integrating with an existing payroll system, an HR system, and client FM platforms, each integration is a scoped piece of work.
• Compliance depth. Phase 3 can be a document vault with expiry reminders, or it can be a system that enforces deployment rules in real time. Order-of-magnitude difference.
• Rollout model. Big-bang across all contracts versus pilot on two contracts and expand — the second is almost always cheaper to get right.

As an illustrative shape only: a Phase 1 pilot covering one platform, one client, 100–200 guards, basic offline sync, and a single PDF export format is a very different engagement from a full multi-phase build across your entire operation. To turn either into a real quote, three specifics are what matter: (1) guard and post counts you want live in the first release, (2) the integrations in and out, and (3) whether the client-facing portal is multi-tenant from day one. Those three answers move the number more than anything else. For scoping that against your contracts, talk to CodeNicely in Dubai.

How CodeNicely can help

We build custom operational software where the core value is a verifiable audit trail — the same shape as what a UAE guarding firm needs. Our work with Vahak, India's largest logistics marketplace, is the closest analogue: Vahak needed real-time tracking, verifiable trip events, and dispute-grade proof of what happened when, across tens of thousands of drivers who were not sitting at desks. The hard problems — offline-first mobile capture, geo-event integrity, exportable records that stand up to a counterparty's challenge, and a dashboard non-technical operators actually use — are the same problems your guard attendance system has to solve. We also know what not to build on day one, which matters more than the feature list.

If you want the broader picture of how we approach legacy modernisation and operational AI, or the services overview, those pages give the shape. For a UAE guarding operation specifically, the conversation starts with your contract SLAs and your current audit workflow — not a demo.

Frequently Asked Questions

Can we just use an off-the-shelf guard tour app?

For a 50-guard single-contract pilot, yes — several exist. The reason firms outgrow them is the client-facing side: enterprise facility managers want branded portals, specific report formats, SSO, and sometimes API access, and off-the-shelf tools treat the client as a read-only afterthought. The second reason is SIRA integration — generic apps are built for global markets and do not model the SIRA card as a first-class deployment prerequisite. If you are at 200+ guards and your contracts have SLA penalty clauses, custom is usually the cheaper path within 18 months.

How long before Phase 1 pays for itself?

The payback math is driven by three numbers only you know: your current SLA penalty exposure as a percentage of contract value, hours per week spent on manual client reporting across the ops team, and the realistic reduction in both after rollout. We have seen the shape of the return land inside the first year for firms where SLA disputes were a recurring line item, and longer where disputes were rare but reporting labour was the main drain. The honest answer requires looking at your last twelve months of penalty debits and ops payroll.

Will SIRA accept a digital guard file during audit?

SIRA's compliance model requires the documents to be present, current, and producible on request — the medium is not the barrier, the completeness is. In practice, a well-designed digital file makes audit faster because expiries are tracked proactively. That said, confirm the specifics of document retention and inspector-access protocol with your compliance consultant or lawyer before you finalise the data model. This is not a place to rely on a blog post.

What about guards without smartphones?

A real design question. Three options: company-issued devices (cleanest, highest capex), BYOD with a lightweight app (cheapest, inconsistent), or NFC-tag-plus-supervisor-device (works where guards do not carry phones but supervisors do rounds). Most 500+ guard firms end up on a hybrid: company devices for fixed posts, NFC-plus-supervisor for mobile patrols. The right split depends on your post mix.

Should we build this ourselves or commission it?

If you have a product manager with security-industry context and two senior engineers available for 12+ months, building it in-house is defensible. Most guarding firms do not — their technology team, if it exists, is running IT support. Commissioning a custom build with full IP ownership and no vendor lock-in gives you the software asset without having to become a software company. The failure mode to avoid either way is building Phase 4 before Phase 1.

Regulatory details, SIRA requirements, and penalty structures referenced in this post are drawn from publicly available sources cited inline. Specifics for your licence class and contract portfolio should be reviewed with a qualified compliance consultant or lawyer.