Safety and wellbeing protocols: what your establishment should already have in place

A serious establishment is recognised less by what it says about itself and more by what it has already worked out for the moment something goes off script. Safety protocols and wellbeing procedures are exactly that: written agreements, known by the whole team, with a clearly named person in charge, defining what happens in each situation. This is not bureaucracy. It is what lets a manager respond with facts — to their team, to a client or to an authority — instead of improvising.

This is the minimum set that should be in place and documented.

Access control and entry logs

Everyone who enters the establishment should be logged: time in, time out and, where applicable, an ID document verified at the door. This serves two purposes. The first is preventive: a venue known to keep records filters out, on its own, anyone who would rather not be identified. The second is reconstructive: if a fact has to be clarified later, there is a verifiable timeline instead of scattered recollections.

The same principle applies internally through shift check-in and check-out. The business should know at all times who is on site, from what time and until when. A shift that begins when someone sends a WhatsApp message and ends when someone remembers to send another is not a control: it is an assumption. Clocking in and out of a shift protects the person (their working hours are documented) and protects the business (it knows exactly who was present at any given moment).

Identity and age verification: the non-negotiable point

No one should start work without documented verification of identity and legal age. No exceptions, no "I'll bring it next time," no taking a third party's word for it. Original document, cross-check, filed copy and date of verification.

It is worth being direct about this: it is not a best practice, it is an inescapable legal obligation. Verifying that the person is of legal age and works freely and voluntarily, without coercion from anyone, is the line between a lawful activity and a serious crime. No administrative record, no contract and no industry custom changes that.

For the same reason, any indication that a person is being coerced, held, forced into debt or pressured by a third party must be reported to the authorities. In Colombia there is a free national human trafficking hotline run by the Ministry of the Interior, 018000 522020, available 24 hours a day, alongside the ordinary reporting channels at the Attorney General's Office and the Police.

A discreet alert signal, and who responds

Every room or booth should have a way to call for help that does not depend on shouting or leaving the space: a physical button, a bell, a code in the app or an agreed keyword. The technology matters least. What determines whether the protocol works is the response.

That means having the following set down in writing:

Who responds on each shift, by name and not only by job title.
How long it should take for someone to reach the location.
What they do on arrival: interrupt the service, escort the person to a safe area, remove the client or call the Police.
What happens next: who takes over follow-up and logging of the event.

A panic button with no one assigned to it is a decorative button. And it is worth testing: an occasional drill reveals in minutes whether the protocol actually works.

Incident log

Every out-of-the-ordinary event should be logged with four pieces of information: what happened, when, who intervened and how it was resolved. From an argument with a client to an activation of the alert signal.

This log has two uses. Internally, it makes patterns visible — the same client reappearing across several reports, a time of night or a space where incidents cluster — so they can be corrected before they escalate. Externally, it is the only way to show an authority that the establishment spotted the situation, acted on it and left a record.

There must be a clear route for reporting uncomfortable situations — involving a client, a colleague or a supervisor — with a named person responsible and an explicit guarantee of no retaliation. Whoever reports does not lose shifts, does not lose assignments and is not marked out. Where that channel exists and is respected, problems surface early and the team stays: high turnover almost always starts with situations nobody felt able to report.

Along the same lines, the establishment should have a written consent policy: anyone can turn down a service or a client, at any time and without having to justify it, with no financial penalty and no consequence in how shifts are assigned. Putting it in writing and making sure everyone knows it stops the decision from depending on the judgement of whoever happens to be on duty that night.

How Foxxy does it

In Foxxy, shift check-in and check-out, room assignment and the history of each booking are recorded automatically as the business is run inside the system. That produces, with no extra work, a verifiable timeline of who was present and when — the foundation any protocol rests on. Identity and verification records for staff are attached to each profile rather than scattered across folders.

You can see how this is structured in the product section, or review the use cases for the type of establishment you manage.

This content is informational and does not constitute legal advice, nor does it replace the requirements set by the competent local authority.