# Deployment Checklist

Work through this before real staff and visitors start using the system.

## Security

- [ ] `/install` folder deleted or blocked at the web-server level
      (`install/installed.lock` alone is a safety net, not a substitute)
- [ ] HTTPS certificate installed and *Force HTTPS* enabled in
      Settings → Security
- [ ] `config/config.php` is not readable over the web (test:
      `https://yourdomain.com/config/config.php` should NOT return PHP
      source — if your host serves `.php` files as source instead of
      executing them for any reason, fix that first)
- [ ] Default Super Admin password changed from whatever was set during
      install, if it was ever typed anywhere insecure
- [ ] Password policy reviewed under Settings → Security (minimum length,
      complexity)
- [ ] Session timeout, failed-login limit and account-lock duration
      reviewed under Settings → Security
- [ ] Every staff account has the narrowest role that lets them do their
      job — avoid handing out Super Admin/Admin beyond the people who
      actually administer the system
- [ ] `storage/` and `config/` are not directly browsable (no directory
      listing) — most hosts disable this by default, confirm with your host
      if unsure

## Data & Organization Setup

- [ ] Real company profile, branches/locations and departments entered
      (Organization menu)
- [ ] Employee directory populated (Organization → Employees) — the
      visitor form pulls the "Employee to Meet" list from here
- [ ] Approval workflow(s) configured to match your organization's actual
      sign-off chain (Administration is generic; the two seeded examples —
      VIP and Interview Candidate — are illustrative, not mandatory)
- [ ] Visitor card inventory matches your physical badge stock (Cards →
      Card Management) — add/remove from the 30 starter cards as needed
- [ ] Visitor types reviewed (Organization → Visitor Types) — add any
      your organization needs beyond the 13 seeded defaults
- [ ] Custom registration fields added if your organization needs
      information beyond the built-in fields (System → Form Builder)
- [ ] GUI theme selected (System → Templates & Appearance) and logo
      uploaded

## Operational Readiness

- [ ] At least one backup taken (System → Backup & Restore) after real
      organization data is in place
- [ ] Backup download tested end-to-end at least once
- [ ] Reception staff walked through the full lifecycle at least once:
      register → approve → check-in → card issue → monitor → check-out →
      card return
- [ ] "Who Is Inside Now" (Security → Emergency List) print layout
      confirmed to actually print cleanly on the printer/paper size your
      front desk uses
- [ ] Visitor self-registration URL (`/visit/`) tested from an actual
      phone/tablet on your network, including camera permission prompts,
      over HTTPS
- [ ] QR code linking to the registration URL generated/printed for
      reception if you intend to use QR-based check-in
- [ ] Notification channels configured if SMS/Email sending will be used
      (System → Notifications) — sending is stubbed until a real
      SMS/SMTP provider is wired in; verify this matches your expectations
      before staff rely on it

## Ongoing

- [ ] A recurring reminder (calendar, not built into the app) to take
      backups on a schedule that matches your organization's risk
      tolerance — backups are on-demand, not automatic, out of the box
- [ ] Retention policy settings (Settings → Privacy: photo, ID document,
      visit history retention days) reviewed against your organization's
      actual data-retention policy or legal requirements
- [ ] Periodic review of Administration → Audit Logs and
      Administration → Deleted Records, especially after any incident
- [ ] Roles & Permissions reviewed periodically as staff join/leave —
      deactivate accounts rather than deleting them where an audit trail
      of past actions should be preserved