What it does Worked example Trust Integrations Contact Send us your scenario
Cordon · Control-room incident intelligence · By Eyona Software Development

When Zone C lights up, your operator should not be piecing the story together.

Cordon brings alarms, cameras, access logs, WhatsApp messages, radio notes and the occurrence book into one live incident, then guides the operator through the estate's SOP and produces the audit trail, report and shift handover.

Sits above the tools already on site. Assists the operator, does not replace guards · In development, pilot partners welcome

Every signal, one incidentScattered alerts across screens, radio and the book become a single, correlated incident.
Guided by your SOPThe operator is prompted through the estate's own procedure, with every action logged.
A defensible answerWhen the estate asks what happened, the report is a source-backed record, not a guess.
Scroll to explore

See Cordon in action.

A short walkthrough of a single incident, from the first alarm to the report a client can defend.

Representative walkthrough with fictional data · narrated overview, about 80 seconds

The information is not missing. It is scattered.

At 2:07am, a perimeter alarm fires on Zone C. Seconds later camera analytics flag movement on that fence, access control shows a contractor foot-tag with no work order, a resident messages that the dogs are going mad, and a guard radios in a sound near the substation.

Today that is five things on five screens, plus radio and a scribbled occurrence book. One tired operator has to connect the dots under pressure, then write it up from memory. The problem is not a lack of information. It is that the incident is scattered.

Perimeter alarm
Fence energiser, Zone C, panel 7 - tamper / zone fault.
CCTV analytics
Camera C-12 flags a person loitering on the fence line.
Access control
Foot-tag at the Zone C service gate, no active work order.
Approved WhatsApp
A resident reports the dogs going mad near the C-section wall.
Radio note / occurrence book
Roving 2 calls in a sound near the substation, typed by the operator.

One incident, not five alerts.

Cordon correlates the signals by time and location into a single live incident, then carries the operator through the response and the write-up.

01

One live incident

The scattered signals are fused into a single incident with one timeline, one classification and one location, with a clear confidence reason rather than an unexplained score.

Signal fusionLive timeline
02

SOP prompts, step by step

The estate's own procedure loads against the incident type. The operator is prompted through each step - verify on camera, dispatch the nearest unit, notify the supervisor, confirm the resident is safe.

Guided responseEstate SOP
03

Escalation and dispatch

Dispatch the nearest patrol, notify the supervisor and record acknowledgement and arrival times. Overrides and delays are surfaced, not hidden, so the record is honest.

Dispatch logEscalation
04

Evidence kept in order

Each item is stamped with its original event time and its ingestion time, with source references kept together - ready for a dispute, an insurance claim or a contract review.

Evidence packSource-backed
05

The report writes itself

As the operator works, the incident report builds in the background - header, classification, source timeline, SOP block, dispatch log, exceptions and outcome - ready for sign-off.

Incident reportSign-off
06

Shift handover, inherited

The next shift inherits the incident record, not a guess. The handover note carries what is still open and what the day team needs to watch.

Handover noteContinuity

What the estate actually receives.

One Zone C incident, taken all the way through to the report and the evidence pack a client can defend. This is a representative example built by Eyona Software Development, with fictional data.

Cordon incident report - a representative worked example with fictional data, showing the incident header, classification with confidence reason, source timeline, SOP execution, dispatch log, exceptions, outcome and shift handover
Representative example · fictional data

The incident report

A source-backed timeline with original event time and received time, the SOP steps completed, delayed or overridden, the dispatch log, the exceptions, the outcome and a supervisor sign-off. The kind of report that stands up the morning after.

Cordon evidence pack - a representative worked example with fictional data, showing a POPIA-aware bundle with original and ingestion timestamps, integrity hashes, redaction status, an export and access log, and chain-of-custody and retention statements
Representative example · fictional data

The evidence pack

A POPIA-aware bundle: each item with its original and ingestion times, integrity hashes, redaction status, an export and access log, and chain-of-custody and retention statements. Tamper-evident, not vague claims of immutability.

Representative example · fictional data Where every incident comes from
  1. 1
    It reads the systems already on site
    Perimeter alarms and fence panels, CCTV and VMS analytics, access control tags and gates, approved resident WhatsApp, and radio notes typed into the occurrence book. All of it stays exactly where it is. No rip-and-replace.
  2. 2
    It correlates by time and location
    Five separate signals inside one 54-second window on Zone C are recognised as a single event, not five things to chase across five screens.
  3. 3
    It becomes one ranked incident
    A suspected perimeter breach on Zone C, high severity, high correlation. One incident the operator can actually act on, with a clear confidence reason rather than a bare score.
  4. 4
    It produces a defensible record
    A signed-off incident report, a POPIA-aware evidence pack and a shift handover note, ready for the morning after.

Where every incident comes from

The perimeter alarm, the cameras, the access control, the WhatsApp line and the occurrence book all stay exactly where they are. Cordon reads from them, correlates by time and location into one incident, and produces the records a client can defend. Cordon sits above the tools already on site. No rip-and-replace.

Representative scenario created by Eyona Software Development to show the intended Cordon workflow. Names, timestamps, locations, logs and evidence references are fictionalised. The examples show outcomes and source categories only.

It assists the operator. It does not replace the guard.

Cordon runs on the estate's own standard operating procedure. When an incident type fires, the matching checklist loads and the operator is prompted through it. Every step is timestamped against who did it, and an operator can delay or override a step with a reason. The judgement stays with the operator and the supervisor. Cordon prompts, records and assists.

1
Verify on camera
Confirm what the analytics flagged before acting.
2
Dispatch the nearest unit
Send the closest patrol and log acknowledgement and arrival.
3
Notify the supervisor
Escalate per the estate's rules and record the acknowledgement.
4
Confirm household safety
Call the resident back where the SOP requires it.
5
Log the outcome
Close the incident with a result, follow-ups and an owner.

No. The operator stays accountable.

Cordon is built for a conservative control room. It is there to make the operator faster and the record defensible, not to take the human out of the loop.

The operator decides

Cordon prompts, records and assists. It does not act on its own, and it does not make the call. Every step is taken by a named operator or supervisor.

It does not replace guards

Cordon makes the people you already have sharper. The roving units, the supervisor and the control-room team stay exactly where they are.

POPIA-aware ingestion

Approved, controlled WhatsApp intake, not scraping private chats. Personal information is masked at source, with consent, retention and redaction handled by design.

It sits above your stack, not in place of it.

Designed to integrate with your existing control-room stack. Confirmed connectors are scoped per site and may be quoted separately. No guesswork, no rip-and-replace.

Available - tested in a live environment Scoped - confirmed and quotable per site Custom - built to your environment Roadmap - on the path
Easy inputs Available

Manual import, email forward, CSV and export, screenshots and approved WhatsApp. Zero-integration start, fast proof.

Perimeter and alarms Scoped

Fence energisers and zone alarm panels. Confirmed and quoted against your specific environment.

CCTV and VMS analytics Scoped

Camera detection events from your video management and analytics platform, scoped per site.

Access control Scoped

Tags, gates and work orders, reconciled against incidents and contractor movements.

Visitor management and LPR Custom

Visitor logs and licence-plate recognition, built to your environment where the feed exists.

Live radio intelligence Roadmap

We launch with radio notes and operator capture. Live radio intelligence is on the path, not promised yet.

We only represent a connector as available once it has been tested against that estate's environment. Everything else is scoped, custom or on the roadmap - so you always know exactly what is live and what is not.

The morning-after answer, not a guess.

At 07:12 the estate manager calls, asking why the night occurrence book reads "false alarm" while residents are circulating messages about an intruder. The operator opens the incident and, in under two minutes, sends a source-backed timeline showing exactly what was detected, what was done, when, and by whom.

The estate gets a defensible answer. That is what keeps the security firm's contract.

Every action timestamped against the operator or supervisor who took it.
Original event time and received time both kept, because they differ and the record should show both.
Exceptions and overrides surfaced, not swept away - stale GPS, late acknowledgement, a manual correction.
Tamper-evident, not "immutable" - changes are versioned and attributable, with the prior version retained.
Where it is going

From the incident timeline to the live estate map.

The incident intelligence is the product today. The trajectory is situational awareness: a live estate map where camera positions, fence-line zones, alarms and guard positions come together on one view, so an operator can see an incident unfold in space, not just on a timeline.

This is the direction of travel, not a claim of what ships today. We build it on real estate layouts, the right way, rather than a drawn-on picture.

Fence-line zones that light up as detection events land
Camera positions and coverage on the estate layout
Guard GPS positions and patrol movement
Optional drone and GIS imagery overlays over time

Send us the incident you want your control room to handle better.

Tell us your estate type, the systems you already run, and one recurring incident scenario - the kind that gets challenged the next morning. We will reply by email with a practical first deployment path for your control room.

Prefer email directly? info@eyonasoftware.co.za · Typically replies same day