ZoneTrace

01 · Problem

A data centre cannot prove where its visitors actually went. Movement is manually escorted and loosely controlled: between escorts there are blind spots, no live view of the floor, and no reliable record after the fact. The escort remembers the visit; nothing measures it.

That gap is now a liability. SOC 2, ISO 27001, PCI-DSS and the Uptime Institute all expect controlled, evidenced physical access, and “trust the escort” does not survive an audit. Unescorted proximity to live racks is a real intrusion and sabotage vector, and every unverifiable visit is exposure: failed audits, contractual penalties, incident liability.

The constraint that shaped everything: the location data can never leave the building. Where a visitor stood inside a data centre is exactly the kind of record a data centre cannot ship to someone else’s cloud.

02 · Approach

Put every visitor on the map, in real time. Each visitor wears a tamper-evident wristband that broadcasts a secure Bluetooth signal; ceiling-mounted Angle-of-Arrival anchors measure that signal’s bearing, and an on-site engine fuses the bearings into a sub-metre position.

Two choices drive the whole design:

• Angle-of-Arrival, not room-level beacons. Proximity beacons tell you which room; AoA tells you where in the room, to roughly half a metre. On a data-centre floor, “near rack row 3” and “between rows 2 and 3” are different security events.
• A band, not a badge. A wristband ties identity to position continuously, and detecting its removal is itself a signal. A badge tapped at a door tells you about the door, once.

03 · How it works

Four steps, and the data never leaves the floor.

#	Stage	What happens
01	Wristband	Each visitor’s band broadcasts a secure BLE signal
02	AoA anchors	Per-zone ceiling anchors measure the signal’s angle of arrival
03	On-prem engine	An on-site positioning engine computes sub-metre location at 1 Hz
04	Live dashboard	Operators see every visitor, zone and alarm in real time

The positioning engine runs fully on-premises: no cloud dependency, no visitor-location data crossing the building line. It integrates outward into the systems a facility already runs: CCTV, SIEM, and access control.

04 · What it enforces

Once every visitor is a live coordinate, control stops being a manual act:

• Zone authorization: auditors, contractors and tour groups each get their own allowed area, enforced automatically rather than escorted by memory.
• Dwell-time & path history: how long each visitor spent in every zone, logged to the second, with the complete route replayable for audit or incident review.
• Safety on the band: tamper-detect (removal raises an instant alarm with last-known location), an SOS panic press, man-down / no-motion detection, and escort-pairing that alarms if a visitor and their escort separate beyond range.
• Alarm pipeline: detect → classify by severity → notify (dashboard, SMS, email, SOC/SIEM webhook) → acknowledge & escalate → resolve, every step timestamped. Alarms can slew the nearest cameras to the zone automatically, and one tap turns the live floor into an evacuation muster list.

Every visit becomes immutable, timestamped evidence, so a compliance audit is a one-click export, not a fire drill.

05 · Status

Active R&D. The sensing approach and specs are settled (sub-metre AoA positioning at 1 Hz, on an on-prem engine), and the program is built to prove out in stages: a Phase 1 pilot instruments a single restricted zone on a real floor, validating accuracy, alarms and the operator workflow before anything scales site-wide.

Every deployment is tuned to a specific floor plan, zone map and security policy. Facilities that want controlled, evidenced physical access can start a conversation.