ACERO Beacon

14:065G

Beacon

Your team today

Messages · end-to-end encrypted

Today

Silent

Hold 2 seconds. Silent sends without any sound or screen change.

[ Principal app ]

The client sees their vehicle, their team and nothing else.

Calm, plain information for the person you protect. Location is shared only while a movement is active, and only with their own detail and your ops room.

Pickup checkBefore departure the client sees the vehicle, plate, driver and today's code word, so they never get into the wrong vehicle.
Live movementTheir vehicle and lead vehicle on the map, arrival time, and whether the convoy is on the planned route.
TeamNames and roles of today's detail and a direct line to the 24/7 ops room.
MessagesEncrypted chat with the team, with one-tap replies for common needs.
SOS and silent alertHold to send. Silent mode sends with no sound and no visible change, for when the client cannot be seen raising an alarm.
Cancel and duress PINA mistaken alert is cancelled with a PIN. If someone forces the client to cancel, a second duress PIN looks like a normal cancel but tells ops it is a real threat.
Larger textThe Aa button enlarges everything on screen for clients who prefer bigger type.

Try it: follow the numbered demo steps under the simulation bar. Then try a silent SOS, or cancel an alert with the duress PIN 9876 and watch the ops room.

14:065G

Beacon · Team On duty

Report to ops

Safe havens on this route

Principal · SPARROW

[ Protection team app ]

Everything the detail needs, on the move.

Issued to your officers and drivers. The phone shares its location only while on duty, and the team leader sees the principal's status at all times.

TaskingToday's movement, primary and alternate routes, the lead vehicle's position and the principal's arrival time.
AlertsAn SOS from the principal takes over the screen with one button to acknowledge. The principal sees who responded.
Check-insTimed welfare check-ins. Ops sees anyone who is overdue and can ping them.
Quick reportsAll clear, delay and backup requests reach the ops room with time and position attached.
Safe havensNearest hospital and police station with live distance from the principal's vehicle.

Try it: press Traffic hold for about 10 seconds. The ops room raises a stationary-vehicle alert after 90 seconds of simulated time.

Operations

24/7 · Live Ops controller S. Novak · 14:06

Active details

Alerts

Log

Check-ins · every 15 min

14:065G

Beacon Status only

Updates today

Itinerary

What this account can see

✓Arrival and departure updates
✓Today's itinerary
–Live location or route
–Team names and messages

Set by ACERO with Mr. Laurent's agreement. Ask your ACERO contact to change it.

Questions or concerns

24ACERO operations
Answered 24/7

[ Family & PA access ]

Peace of mind without exposing the movement.

Family members and assistants know the principal is safe without ever seeing a live location, a route or the team. That keeps the detail's plan inside the circle that needs it.

Status, not tracking"Left home", "On the move with the ACERO team", "Arrived safely". No map.
ItineraryA PA sees the day's schedule so they can plan around it.
Ops decides on alertsAn SOS does not alarm the family automatically. The ops room decides when and how to tell them.
Permissions per personEach family member or PA gets their own access level, which you can change or revoke at any time.

Try it: send an SOS, then in the Ops room press Notify family. Come back here to see the message the family receives.

One private channel between your clients and your team, hosted by ACERO.

Who sees what

Four roles, four levels of access

The main difference from consumer apps like Life360 is that nobody sees more than their role needs. The principal never sees other clients, family never sees a live location, and only the ops room sees every detail.

	Principal	Protection team	Ops room	Family & PA
Live vehicle location	Own movement	Their detail	All details	No
Arrival time and route status	Yes	Yes	Yes	Arrived / departed only
Team names, vehicle, code word	Yes	Yes	Yes	No
Encrypted messages	With their team	With their principal	All threads	No
SOS / silent alert	Sends	Receives, acknowledges, sends	Receives, escalates, resolves	Told by ops if needed
Check-ins and reports	No	Sends	Monitors, pings	No
Location history	Own trips, 30 days	Current task only	Full, per retention policy	No

Security model

Built for clients who cannot be tracked by anyone else

Self-hostedClient, location and message data stays on ACERO servers in a region you choose. No Firebase or other outside backend. The map provider is a separate decision, see below.

Shared only on dutyPrincipal location is sent only during an active movement or an SOS. Outside that, the app shares nothing.

End-to-end encryptionMessages are encrypted on the phone (Signal protocol or MLS). The server cannot read them.

Silent pushApple and Google notifications carry no names, places or text, only a signal for the app to fetch the update securely.

Strong sign-inPasskeys plus Face ID or fingerprint. Lost phones are revoked and wiped remotely from the ops room.

Short retentionLocation history is deleted automatically after 30 days unless kept for an incident.

No third-party trackingNo ad, analytics or crash SDKs that send data to outside companies.

Full audit logEvery view of a client's location is recorded, so you can show clients exactly who saw what.

Duress PINA client forced to cancel an alert can enter a second PIN. Their screen shows a normal cancel while ops and the team treat it as an active threat.

Automatic escalationAn alert nobody acknowledges within 60 seconds goes to the duty manager by phone and SMS.

Tested before launchAn ACERO RED penetration test of the apps and servers before any client goes live.

Private distributionNot listed publicly in the App Store or Google Play. Clients get it through Apple custom app distribution and managed Google Play.

Architecture

How the pieces fit

On the phones

One iOS and Android app (React Native) with three modes: principal, team, family
Ops dashboard in a web browser
Background GPS only while on duty or on a movement
Encrypted local storage, passkey sign-in

→ encrypted connection (TLS 1.3, certificate pinning)

ACERO server · self-hosted

API and real-time service (WebSocket)
PostgreSQL with PostGIS for movements, routes and geofences
Alert engine: SOS, geofence, stationary vehicle, overdue check-in
Encrypted messaging service
Map: Google Maps, or a self-hosted OpenStreetMap map styled to look like Google (decision below)
Audit log and encrypted backups

Outside services · minimal

Apple and Google push: wake-up signal only, no content
Google Maps, if chosen: map display, routing and traffic. Google receives the map areas viewed and the routes requested
SMS and voice fallback for SOS when there is no data signal (optional provider)
Later: in-vehicle GPS trackers and hardware panic buttons

Build plan

From prototype to live clients

[01]

Prototype

Now · 1–2 weeks

This page. Agree the screens, roles and alert rules with your team and one or two trusted clients.

[02]

MVP

About 3–4 months

iOS and Android app, ops dashboard, live movements, SOS, messages, check-ins and family status, on your own server.

[03]

Pilot

4–6 weeks

Two or three clients on real details. Penetration test and fixes before wider rollout.

[04]

Extend

Ongoing

Vehicle trackers, watch SOS, low-signal and satellite fallback, flight and itinerary sync.

Time estimates are rough and assume a small team: two developers and a part-time designer.

Decisions for ACERO

Questions to settle before the MVP

Map provider. Google Maps is familiar to clients and has the best live traffic and routing. In exchange, Google receives every map view and route request, which can reveal where a client is going. A self-hosted OpenStreetMap map can be styled to look like Google and keeps all of that private, but has weaker traffic data. The prototype shows both: the Google-style drawn map, and real Google Maps in the local version.
Hosting region and provider. Which country client data must stay in, and whether you run your own hardware or a private cloud.
Client phones. Clients use their own phone, or ACERO issues a dedicated, managed device.
SOS escalation. Who is alerted, in what order, and when local emergency services are called.
Retention. How long movement history is kept, and who can hold it for an incident.
Family access. What each family member or PA may see, and who approves it.
Legal. Consent and privacy notices under the laws where your clients live, for example PIPEDA in Canada or GDPR in Europe.