byASB Ankiit Singh Book a scoping week
LIVE2021–22

Humanitarian duty-of-care platform

A global humanitarian staffing organisation deploying personnel into fragile and conflict-affected countries
Safety-critical software for people in dangerous places. Built to work when the network doesn't. Still in production.
PlatformiOS + Android
Build~18 months
Live since2022
RoleEnd-to-end: architecture, build, handover
ComplianceGDPR
The constraint

The client couldn't find HR software built for the reality of a workforce deployed into fragile states. Off-the-shelf systems assume an office, a stable connection, and a staff member whose worst day is a payroll error. This workforce's worst day is an evacuation.

What I built

Built end to end over eighteen months: the full employee lifecycle for a distributed field workforce — profiles, timesheets, leave, expense and medical claims, performance, payroll data — plus a Safety module that is the point of the app.

A panic alarm that fires offline and delivers the moment connectivity returns. Movement-risk approvals routed through field security officers. Security-alert broadcasts with staff check-in and crisis-response monitoring. Geolocation and incident reporting.

Same discipline as the vision work elsewhere on this site, in a different domain: a system that has to be right in the field, under bad conditions, or someone gets hurt.

Under the surface
panic alarmoffline queue → retry on connectivity → escalation mail
movement riskFSO approval · warden assignment · risk category
security alertsbroadcast → staff check-in → crisis monitor
datapassport · banking · next-of-kin · GDPR controls
build18 months · handover to client team · still updated
exposure: field · connectivity: intermittent
Outcome
  • Live on both app stores since 2022.
  • Handed over to the client's own team; still being updated.
  • Client-published write-ups and store links available on request.
iOSAndroidOffline-first syncPush + escalation mailGDPR data controls
Workflow and evidence

Local capture and remote response are separate states.

The published panic-alarm workflow uses a durable local queue, retries when connectivity returns and escalation mail after delivery. An offline device can capture the action; remote recipients can act only after it reaches them. That distinction is central to an honest status display and to the operating process around the app.

Movement-risk requests involve field security officers, warden assignment and risk categories. Security broadcasts connect to staff check-ins and crisis-response monitoring. These are different workflows: recording a request locally is not the same as receiving an approval or confirming a person's safety.

What the published record establishes

The scope covers architecture, implementation, store launch and handover over approximately eighteen months. The client team continues operating and updating the platform. It is not a published guarantee of delivery time under every connectivity condition, and the private client protocols are not disclosed here.

For a comparable field system, begin by defining which actions can be captured offline, how pending work becomes visible and who handles an exception. The offline-first mobile architecture guide turns these into review questions and device tests. The architecture review checklist helps collect evidence before selecting a build approach.