Documented visitor flows
Who was in the building when, invited by whom, with which briefing – exportable for audits.
Traceability, access and audit readiness
In financial services the functional scope matters less than whether every statement can be evidenced.
In short
Banks and insurers assess workplace software mainly through an outsourcing and audit lens: who processes which data where, how long it is retained, who has access and how that is documented. Door James provides role-based access, configurable retention and anonymization periods for booking, visitor and issue data, documented subprocessors and traceable visitor flows.
- Access
- RBAC with organization and location scope
- Retention
- configurable separately per data type
- Visitors
- complete check-in/check-out documentation
- Evidence
- DPA, TOMs and testing documented
Features
Access by role and location
Reception, location and organization roles with different views; CGI access through approved accounts.
Retention as specified
Periods for booking, visitor and ticket data configurable separately, including anonymization.
Documentation for outsourcing reviews
DPA with named subprocessors, TOM appendix, architecture description, statements on testing and backups.
Audit readiness comes from precision
In outsourcing reviews the most common weakness is not a missing feature but an imprecise statement. That is why we consistently separate the hosting variants, internal quality targets from contractual commitments, and documented from to-be-verified integrations. For auditors that property matters more than any additional feature.
Typical priorities in this sector
Visitor management usually comes before desk sharing: documented access for external people is a compliance topic, space optimization an economic one. Room booking with Outlook integration follows, and finally occupancy analytics as a basis for site decisions.
Frequently asked questions
Can we export visitor data for audits?
Yes. Visitor and meeting lists can be viewed and exported in the Admin Panel, and retention and anonymization periods are configurable per data type. One limit worth stating: administrative access to the Admin Panel is logged, but that log is kept for 30 days and the period is not configurable. If your audit requires longer retention of administrative access records, raise it early – it is a development item, not a setting.
How is CGI access controlled?
Administrative access runs through approved accounts and whitelisting; staff switch into the respective organization context rather than seeing a mixed data pool.
Is a dedicated instance possible?
Not in the standard model. Door James is public cloud SaaS with logical separation; a different topology would need separate technical and commercial assessment.
What statements exist on backups?
For the GCP architecture the compliance FAQ describes point-in-time recovery over seven days, hourly full backups retained seven days and weekly ones retained fourteen days. For IONOS we confirm the values separately.
Every industry breaks a booking tool differently
Shift patterns, sites, compliance, who is allowed to sit where. Bring the constraint you think is unusual; it usually is not.