Key Takeaway
How UK fire and security installers automate maintenance contracts, BAFE paperwork, and recurring billing in 2026. Software guide with Xero integration.
Three false activations in a rolling twelve months and the police stop attending your customer's alarm. That is the NPCC Security Systems Policy, applied by every force in the country, and it does not care that the third one was a cleaner with a new key fob.
What matters commercially is what happens next. The URN is suspended. The customer rings you, not the police. You send an engineer, prove the cause was found and fixed, and apply for reinstatement. Somewhere in that chain you need to produce the site's device history, the last two service visit records and the engineer's certification — on demand, for a force control room and possibly an insurer. If that history lives in a lever-arch file in the back office and a WhatsApp thread with the engineer, you will find it. Eventually. Long after the customer has decided you are hard work.
This is the shape of a fire and security business. You are not really selling installations. You are selling a promise to remember things — every detector head, every camera, every panel, every six-month service date, every certificate — across hundreds of sites, for years. The firms that grow past three vans are the ones that stop remembering by hand.
Your Business Is an Asset Register With a Van Attached
Most trades in this series manage jobs. You manage assets.
A decorator finishes a hallway and the relationship is over until the customer redecorates. You fit a Grade 2 intruder system in a corner shop and you have a permanent obligation: an annual service under PD 6662 and BS EN 50131, and a signalling path that must stay alive. Add a monitoring contract if there is a URN, and a customer who will ring you at 2am when the panel throws a tamper fault.
Multiply that by 300 sites. Now add the fire side. BS 5839-1 recommends a minimum of two inspection and test visits a year for most non-domestic systems, roughly six months apart. Not both crammed into the same quarter, and not more than nine months apart. At least one of those visits must constitute the full annual inspection described in Clause 45.
So the real unit of work in your business is not the job. It is the device on the site on the contract, and the date it next needs touching. Miss it and you have not merely lost a day's revenue. You have handed the Responsible Person a gap in the record they are legally obliged to keep under the Regulatory Reform (Fire Safety) Order 2005.
There is no spreadsheet that survives this. There is only a system that holds an asset register and generates the diary from it.
The Stack, Built Around the Contract Rather Than the Job
Service Management: Uptick, Joblogic or AlarmMaster Pro
This is the layer that makes or breaks the firm, and it is the one place where generic trade software genuinely fails you. Tradify and ServiceM8 are excellent at "job in, invoice out." Neither has a concept of a panel with fourteen detector heads, each with an install date and a replacement cycle, sitting under a contract that renews in March.
Uptick is built for fire inspection rounds. It charges a per-user monthly fee across desk and field users, with customer and subcontractor licences unlimited and free — which matters if you give facilities managers portal access to their own certificates. Pricing is quote-only, invoiced monthly with no lock-in and no annual payment up front, which tends to suit firms already past the owner-plus-two stage.
Joblogic starts at £45 per user per month billed annually on its Standard tier, with Premium and Enterprise quoted. It is multi-trade and contract-led, with UK compliance built in — useful if you also carry F-Gas, gas or SFG20 work alongside fire and security.
AlarmMaster Pro is the specialist. It is the cloud successor to Alarm Master, built specifically around fire and security workflows, and ships with NSI, SSAIB and BAFE compliance out of the box. Its contract-billing engine will invoice hundreds of maintenance agreements in one run with automated uplifts and asset-based pricing. Pricing is quote-based — the website routes you to a demo booking rather than a price list. It syncs to Xero and Sage.
The comparison gets its own article. The principle does not: pick the one whose data model is an asset register, not a job list.
The Signalling Layer: Evalink and the ARC Handshake
Every monitored system needs a signalling path to an alarm receiving centre, and the migration away from legacy BT Redcare signalling has pushed a great deal of the market onto dual-path IP and roaming-SIM devices. That migration is chargeable work, but it is also an administrative trap: each swap means a new device, a new commissioning record, a re-test with the ARC and an updated line on the customer's contract.
Platforms like Evalink let installers commission sites, connect panels to the receiving centre and run transmission tests from one portal instead of a phone call to the ARC's engineering desk. The point is not the portal. It is that the commissioning event should write itself back into the asset register, so the device on the wall and the device on your system are never two different things.
The Certification Layer: BAFE, NSI and SSAIB Audit Trails
Third-party certification is where your competitors are eliminated at tender stage, and where your admin burden concentrates.
BAFE SP203-1 is the fire detection and alarm scheme, and it is modular — you are assessed only on the parts you actually do. You pay no fee to BAFE directly; the cost sits with the UKAS-accredited certification body running your audit, and the licensed bodies for SP203-1 include BSI, NICEIC (Certsure), NSI, SSAIB and Independent European Certification. Get a quote from two of them, because the modular scope changes the number.
On the security side, NSI and SSAIB are both UKAS-accredited certification bodies rather than trade associations — you do not join by subscription, you are audited. NSI's higher tiers involve two annual inspection visits and more documented management system rigour, which is why the larger commercial contracts and some insurers ask for it by name. SSAIB certifies a very large number of capable regional installers and is common among independents.
What every one of these audits wants is the same thing: evidence, retrievable, per site, per visit. Your service management system either produces that as a by-product of engineers doing their jobs, or you spend a fortnight a year building it retrospectively.
The Ledger: Xero and the Problem of Money You Haven't Earned Yet
Xero UK sits at £33 a month for Standard and £37 for Growing, both excluding VAT. A price rise is scheduled from 1 September 2026, so budget on the higher figure.
The fire and security wrinkle is deferred income. When a customer pays £480 in April for twelve months of monitoring and two service visits, you have not earned £480 in April. You have earned £40. The rest is a liability until you deliver. Firms that book the whole lot as revenue on receipt show a wonderful spring, a miserable autumn, and a distorted picture every time they try to work out whether the contract book is actually growing.
Set up a deferred income account in Xero, post contract receipts to it, and release to revenue monthly. It is ten minutes of chart-of-accounts work and it is the difference between knowing your recurring margin and guessing at it.
Receipts and Van Stock: Dext
Detector heads, break-glass units, PIRs, cable drums, batteries — a security firm's material spend is high-frequency, low-value, and spread across two or three wholesalers plus whatever the engineer grabbed from a counter at 8am. Dext's capture-and-code workflow is the standard answer. The discipline that makes it work is tagging each receipt to the site, not just the supplier, so warranty replacement stock does not quietly get charged to a customer twice.
Collecting the Annuity: GoCardless
On the standard plan, collecting a £45 monthly monitoring and maintenance charge costs 65p. Collecting the same contract annually in advance, at £540, costs £4, because the fee caps there. No monthly platform fee sits underneath either figure.
For your trade, Direct Debit is not a convenience. It is the mechanism that turns a maintenance contract into an annuity. An invoiced annual maintenance charge is a decision your customer gets to make every twelve months. A monthly Direct Debit is a decision they made once. The churn difference between those two billing models is the single largest lever on the value of your business, and it costs pennies per collection.
From Detector Head to Bank Account: The Chain
Here is the flow, in the order the data moves.
The asset register in your service management system holds every device on every site, with install dates and service frequencies. It generates the planned preventive maintenance diary automatically — six-monthly for BS 5839-1 fire systems, annually for most intruder installations — rather than someone reading last year's calendar.
The engineer arrives, works the visit on a mobile device, and captures the asset condition against each item. That record becomes the service certificate, which is filed to the site's history and made available to the customer without anyone typing it out.
Contract billing runs on a schedule, not a reminder. The system raises the maintenance invoices for the period in one batch, pushes them to Xero, and GoCardless collects the Direct Debits. Xero posts the receipt to deferred income and releases the earned portion monthly.
Dext feeds the material costs back in, tagged to sites. Now — and only now — you can ask the question that matters: which contracts are profitable? A £600-a-year contract on a site that swallows four emergency callouts is losing money, and until asset costs and contract income meet in the same ledger, you cannot see it.
What Changes When the Diary Builds Itself
The single biggest gain is not time saved. It is missed visits going to zero.
A firm running 200 maintenance contracts owes something in the region of 350 to 400 planned visits a year once the fire six-monthlies and the intruder annuals are added together. Managed manually, a slippage rate of even five per cent means twenty sites a year whose compliance record has a hole in it. Every one of those is a certification audit finding waiting to happen, an insurer question, or a customer who churns to the firm that turned up.
The second gain is billing accuracy. Contract uplifts are the most commonly forgotten money in this trade. A three per cent annual increase across a £180,000 contract book is £5,400 that requires precisely no additional work. It is only collected if the system applies it automatically at renewal, rather than relying on someone remembering to reprice 200 agreements.
The third is speed of certificate delivery. When a facilities manager can pull their own service records from a portal at 9pm, they stop ringing your office at 9am.
The Number That Decides What Your Firm Is Worth
Every other trade in this series is valued roughly on profit. Yours is not.
Recurring revenue
transforms firm valuation — a contract-based fire and security business is worth multiples more than a reactive one
Fire and security businesses are bought and sold on the recurring contract book — the monitoring and maintenance income that arrives whether or not anyone sells anything this month. Buyers want to see it documented: contract by contract, with start dates, renewal terms, billing method and churn history. A book collected by Direct Debit with clean service records and no missed visits is a different asset from the same revenue collected by annual invoice with gaps in the history.
That is the real argument for the stack above. Every hour of admin it removes is worth having. But the reason to build it properly is that it turns a pile of obligations into a documented, transferable, valuable book. You cannot retrofit three years of clean service history the week before a buyer's due diligence.
What the Next Nine Articles Cover
2. Uptick vs Joblogic vs AlarmMaster Pro — the service management comparison, priced and tested against fire and security workflows.
3. Getting paid on a contract book — deferred income, Direct Debit migration, and how to move 200 customers from annual invoice to monthly collection without losing them.
4. The back office — certification renewals, engineer competence records and the audit pack that builds itself.
5. The integration map — connecting your service platform, Xero, GoCardless and Dext, field by field.
6. AI for fire and security firms — where Claude and ChatGPT genuinely help with system specifications, false alarm analysis and quotations.
7. The prompt playbook — twelve prompts for fire risk wording, variation letters and customer-facing service reports.
8. Building an AI assistant — a step-by-step setup for a fire and security business.
9. Automating the compliance clock — connecting AI to your PPM diary and URN incident records.
10. The case study — one firm, twelve months, from paper service sheets to an automated contract book.
Related guides: If you found this useful, see our guide on How to Connect Tradify, Xero, GoCardless, Stripe and Dext: The Complete Electrical Integration Map (2026) and AI Automation for Electricians: 3 No-Code Workflows That Connect ChatGPT to Tradify, Xero and Your Inbox (UK 2026).
How many of your maintenance contracts are still billed by annual invoice rather than monthly Direct Debit? And could you tell me right now, without opening anything, how many BS 5839-1 service visits you owe in the next thirty days?
If you work alongside gas engineers, see our guide to gas certificate software for UK Gas Safe engineers.