Visitor Log

A visitor log is the record of every non-employee who enters your building: who they were, when they arrived and left, who they came to see, and what they agreed to on the way in. It can be a clipboard at reception or a database behind a sign-in kiosk. Offices keep one for three practical reasons: security teams need to know who’s on site, safety wardens need a headcount in an evacuation, and auditors in regulated industries ask for it.

What is a visitor log?

The log is the output of the sign-in process. A paper visitor sign in sheet captures a name, a time, and a signature, and that’s where its usefulness ends; the page stays in the lobby, every previous guest’s name is visible to the next one, and nobody can search it. A digital visitor log captures the same core details plus a photo, a signed document, and a sign-out time, and stores them where security, facilities, and compliance staff can search and export them.

The log is also where your visitor management rules get enforced. If the policy says contractors sign a safety briefing, the log shows who did and who didn’t. If it says a candidate’s record is deleted after 30 days, the log is where that deletion happens. Teams that treat the whole visit as guest management, from invite to follow-up, still rely on the log as the system of record.

Fields every visitor log should capture

Record enough to answer “who was here, why, and who’s responsible for them,” and nothing you can’t justify keeping:

Skip ID numbers, dates of birth, and home addresses unless a regulation requires them. Every extra field is one more piece of personal data you’re responsible for protecting.

Visitor log retention and data privacy rules

No single rule says how long to keep a visitor log, so the retention period comes from your visitor management policy, shaped by the rules that apply to your sector and the countries you operate in.

A workable default for an ordinary office is 90 days to a year, longer where a sector rule requires it, with photos and signed documents deleted on the same schedule. Write the period down, tell visitors at sign-in what you collect and how long you keep it, and restrict who can view the log. A paper sheet in the lobby fails the last point by design.

Using visitor log data for emergencies and audits

The log earns its keep on two occasions: when the alarm sounds and when the auditor arrives.

Evacuations. OSHA’s emergency action plan standard requires procedures to account for all employees after an evacuation. It doesn’t mention visitors, which is why most companies extend the headcount to guests by policy, and the visitor log is the only list of who was in the building. A digital log gives the fire warden a live list of signed-in guests on a phone at the assembly point; a clipboard is still at reception.

Security incidents. When a laptop goes missing or a door alarm fires, the log plus badge events shows who was on that floor at that time. The BLS recorded 57,610 workplace violence cases involving days away from work in 2021 and 2022, and a searchable visitor record is often the first thing investigators ask for.

Audits. An auditor checking physical access controls wants to see that every visitor was logged, hosted, and signed out, and that records were kept and deleted according to policy. Exporting a date range from a digital log takes minutes; reconstructing it from paper sheets takes days.

Gable’s visitor management keeps the log as a searchable record with the photo, signed documents, and host attached to each visit, so an evacuation list or an audit export is a filter and a download.

FAQ

Which industries must keep a visitor log?

Healthcare organizations covered by HIPAA need to show they control and validate visitor access. Defense contractors under ITAR must document foreign visitors’ access to controlled items. Data centers, labs, and firms going through SOC 2 audits are expected to show physical access records. Everyone else keeps one for safety and security rather than a legal mandate.

How often should a visitor log be reviewed?

Daily for open records, to catch guests who never signed out, and monthly for retention, to delete entries past their period. Security teams also review the log after any incident and before an audit. A digital system automates both routine checks, flagging stale sign-ins and purging expired records on schedule.

Should contractors and deliveries go in the visitor log?

Yes, as their own visitor types. Contractors usually get a longer form with a safety briefing and the areas they’re cleared for. Deliveries need only a name, company, and time stamp, often captured at a mailroom or dock kiosk rather than the lobby. Keeping them separate from guests makes reporting and headcounts cleaner.

How do you sign out visitors from the log?

The guest taps “Sign out” on the kiosk, the host closes the visit from their phone, or the system auto-closes it at a set time such as the end of the business day. Auto-closing keeps the log tidy but marks the record as unconfirmed, so reception should check those entries against who’s still in the building.

What happens if a visitor refuses to sign in?

They don’t come in. Sign-in is the condition of entry, and the host should explain that before the visit. If the objection is to a specific field, such as a photo or an ID scan, the policy can allow a receptionist to record a manual visit with an escort. The log should still show that the person entered.