Most visitor sign-in systems bill you every single month for the privilege of logging who walked in your front door. Envoy, SwipedOn, Sign In App, Proxyclick (now Eptura), Greetly, iLobby. Pick any of them and you’re renting a feature set forever, and your visitor records live in someone else’s cloud. We built a manufacturing client a system that does the same job, runs on hardware they already owned, and costs nothing per month. Here’s exactly how it works, so you can build your own or have us do it.
What visitor-management software actually costs
The big names all run the same playbook: a per-location subscription that scales with every site and climbs at renewal. The tier most companies actually want, the one with custom branding, NDA capture, host notifications, and badge printing, lands somewhere between about $1,500 and $6,000 a year, per location. Two front desks means two subscriptions. Ten sites means ten. And it never stops.
Beyond the money, there are two problems with renting this:
- Your visitor data lives in the vendor’s cloud. Names, companies, who they came to see, signed NDAs. That’s your record of who was inside your building, and you’re trusting it to a third party’s retention, export, and breach policies.
- You’re locked in. Your badge layout, your NDA wording, your notification rules, all shaped by whatever the vendor’s tier happens to allow. Want something they don’t offer? Too bad.
For a lot of front desks, that’s a fine trade. For anyone with an IT team and infrastructure they already own, it’s paying rent on a house you could build.
What we built
A wall-mounted tablet sits in the lobby running a check-in page. A visitor walks up and, in under a minute:
- Enters their name, company, and email.
- Picks the person they’re there to see from a searchable list. That list comes straight from the company’s Microsoft 365 directory, so it’s always current. Nobody maintains a spreadsheet.
- Signs a legally binding NDA and safety acknowledgment right there on the screen. A signed PDF gets generated and filed as the record of who agreed to what, and when.
- Triggers an automatic notification to their host in Microsoft Teams and by email: your visitor is here.
- Gets a printed visitor badge, an adhesive sticker for their shirt, with their name, company, host, and date, straight off a thermal label printer at the desk.
Optionally, the same system can hand the visitor a temporary door PIN that expires on its own at the end of the day. Every piece of that runs on infrastructure the client already owned. Zero new monthly bills.
Why self-host instead of subscribe
The pitch for a self-hosted visitor management system comes down to five things:
- You own your visitor data. Records and signed NDAs stay on your network, under your retention rules, not a vendor’s.
- No per-seat, per-site, or monthly fees. You build it once. Adding a second location is the price of another tablet and printer, not another subscription.
- No vendor lock-in. Nobody can raise your price at renewal, sunset a feature you depend on, or hold your data hostage on the way out.
- Full customization. Your branding, your exact NDA text, your notification logic. Not a tier’s worth of it, all of it.
- It runs on what you already own. Microsoft 365, an e-signature tool, a networking stack. The parts are probably already in your building.
How it actually works
This is the part most write-ups skip. Here’s the real shape of the build. None of it is exotic, and a capable IT person can reproduce it from what’s below.
A locked-down tablet running a web page
The kiosk is a single web page. Any tablet works: an iPad in Guided Access mode, or an Android tablet with Fully Kiosk Browser, locked to one app so a visitor can’t wander off into a browser. The page collects input and shows status. That’s the whole job. It holds no passwords, no API keys, nothing sensitive.
That matters more than it sounds. The kiosk sits in your lobby, the single most physically exposed spot in the building. Anyone can walk up and open developer tools. So the page is built to know nothing worth stealing.
A small back-office service that does the real work
Behind the page, on a server on your own network, runs a small service. We wrote ours in Node.js and run it in a Docker container behind Nginx Proxy Manager, but the language doesn’t matter. This is the piece that holds the secrets and makes every privileged call: it talks to the e-signature service, the directory, the printer, and the door system. The tablet only ever talks to this service. Think of the tablet as the front counter and this as the back office that holds the keys.
There are two hard reasons it has to work this way, not just a preference:
- API tokens can’t live in a browser. Anything in the page’s JavaScript is readable by anyone who opens it. A token sitting in a lobby kiosk is a credential you’ve handed to every visitor.
- Browsers block most of these calls anyway. The directory and e-sign APIs don’t return CORS headers for arbitrary web pages, and on-prem devices often use self-signed certificates a browser flatly refuses to talk to. A server has no such hangups.
The employee directory, straight from Microsoft 365
“Who are you here to see?” gets answered live from the company’s Microsoft 365 and Entra directory. We pull the enabled users with a Power Automate flow, though a direct Microsoft Graph call does the same job, so when someone’s hired or leaves, the list updates itself. No CSV to maintain, no vendor sync to babysit. The search matches first name, last name, full name, or email, so however a visitor types it, the right host comes up.
The NDA and safety acknowledgment, signed on the glass
Plenty of manufacturing and warehouse sites need every visitor on record agreeing to an NDA or a safety briefing before they set foot on the floor. We handled that with an embedded e-sign kiosk flow. The NDA is built once as a template. Each visit generates a prefilled copy, with the visitor’s name, company, host, and date already filled in, the visitor signs it right in the kiosk, and the signed PDF gets emailed to them and to reception and kept as the record. We used Zoho Sign because the client already had it in their Zoho One subscription. DocuSign, or an open-source signing tool, would drop into the same slot.
Host notifications the moment someone checks in
The second a visitor picks their host, that host gets a Microsoft Teams message and an email. No walking to the front, no overhead page, no visitor standing around wondering if anyone knows they’re there. We used a Power Automate flow to post the Teams message, which means there’s no chat bot to build, host, and maintain.
A real visitor badge, printed on the spot
Visitor badge printing runs off a networked thermal label printer. We used a Brother QL, they’re cheap and reliable, and it prints an adhesive badge with the visitor’s name, company, host, and date. Peel and stick. Thermal means no ink cartridges, ever, just label rolls that cost pennies.
Optional: a temporary, auto-expiring door credential
If your access-control system has an API, the same back-office service can issue a visitor a door PIN that expires on its own at the end of the visit. We did this with UniFi Access, but anything with an API works the same way. Don’t need it? Skip it, and reception just hands over the printed badge.
The security posture, briefly
This is the part cheap DIY builds usually get wrong, so it’s worth being explicit:
- Every secret lives server-side. The kiosk holds nothing. Tokens and OAuth secrets never leave the back-office service.
- Nothing is exposed to the internet. The service only makes outbound calls. There’s no inbound webhook and no public endpoint, so there’s nothing out front to scan or attack.
- Your data stays home. Visitor records and signed NDAs live on your network, not a vendor’s cloud.
What it cost, which is the whole point
Hardware, one time:
| Item | Rough cost |
|---|---|
| Tablet (or reuse one you already have) | $0 to $430 |
| Secure kiosk stand | $180 |
| Thermal label printer (Brother QL series) | $200 |
| Label rolls, mount, visitor cards | $90 |
| Total, once | about $500 to $900 |
Software: $0 a month. It runs on the Microsoft 365, e-signature, and networking tools the client was already paying for.
Now compare that to a subscription running $1,500 to $6,000 a year, per location, forever. Over five years, the SaaS route costs somewhere between roughly $7,500 and $30,000 for a single front desk, and more at each renewal. Our client’s number after the one-time build is basically flat. They save thousands every year, every year, and they own the system outright. Want a second site? That’s another tablet and printer, not another line on the invoice.
Build it yourself, or we’ll build it for you
Everything above is the actual recipe. If you’ve got a capable IT person, they can put this together: a locked-down tablet, a small service on a box on your LAN, your Microsoft 365 directory, an e-sign API you probably already pay for, and a label printer. If that sounds like a good project, go build it and drop the subscription for good. That’s the honest advice.
If you’d rather have it done, done right, and handed to you working, that’s what we do at ByteMe Networks. We’ll stand up a self-hosted visitor check-in system on your own infrastructure, branded to you, with the NDA capture, host alerts, badge printing, and directory sync all wired in, and you’ll never see a per-location invoice for it. When you own your visitor data and the system that captures it, the only bill is the one-time one.
Want one? Reach us at bytemenetworks.com/contact or call (254) 845-6012.