Trust, safety and security
Letting someone into your home is the whole ask.
So the mechanisms are worth describing precisely — including the ones that are not switched on yet, and why.
Access window
Your codes exist for one visit, then stop existing.
Android capture blocked · this view is logged
Available at any time, including mid-visit.
Revoking takes effect at the next read, does not cancel the visit, and does not charge you.
Access windows
Your gate and alarm codes are a timed release, not saved data a Xooter can browse. They unlock 45 minutes before the visit and lock again when it completes.
- Encrypted at rest under a key that is different on every environment
- Released to one Xooter, for one visit
- Deleted seven days after the visit
Deployed and encrypted. Not yet proven by a code stored and read back through the app, which is the only test that counts.
Screenshots blocked
Android prevents capture of the access-details screen. iOS detects capture. The screen blanks when the app goes to the background or into the app switcher.
- Android: capture is prevented outright
- iOS: capture is detected and logged, and you are told
- The screen blanks on backgrounding on both
Honest limit: on iOS the platform allows detection, not prevention, and no software stops a second phone photographing a screen. This is one layer — the seven-day deletion and the revoke switch are the ones that matter.
Revoke access, instantly
One switch in the app cuts a Xooter's access to your details immediately — mid-visit if you need it. No support call, no waiting.
- Takes effect at the next read, not at the next sync
- The Xooter is told access was withdrawn, not why
- Revoking does not cancel the visit, and does not charge you
SOS — for both sides
Hold the button and your live location goes to the Xoot safety team, with a direct line to emergency services. It is on the Xooter's screen as well as yours.
- A lone worker in a stranger's home is the person most exposed here
- A cancel PIN is required once an alert has dispatched
- The Xooter can end a visit and leave, without penalty, at any time
Deliberately switched off. It turns on when 112 has been dialled from a real handset and an ops person has confirmed they received the alert — not before. Every step has a failure mode where the button looks like it works, and a person in trouble pressing something that does nothing is worse than no button.
Nobody swaps phone numbers
Messages are tied to your booking. Masked calling is built but remains switched off until real call acceptance checks pass.
- Chat is tied to the booking and ends with it
- No recording and no transcription, by default and by design
- Reportable in one tap, read by a person
Vetted before the first door
A South African ID or a passport with a valid work permit, proof of residence under three months old, bank details in their own name, a criminal record check, and required training completed.
- Documents are certified and re-checked, not collected once
- Bank details must match the person — we do not pay third parties
- Training is a gate on accepting work, not a suggestion
The screening pipeline is built and the queues exist. No Xooter has been through it yet, so this reads as what will be required rather than as a record we can point to.
For the personal information we hold, how it is used and how to request access or deletion, read our privacy policy and POPIA notice.