Custom alarm company software in Baltimore: the county line runs through your database

One hundred and sixty-seven companies, and three in five have fewer than ten people

There is a version of this article that opens with the global physical security market and a compound annual growth rate quoted to two decimal places. It would tell a Baltimore alarm company nothing it can act on. So here is the local picture instead, counted rather than modeled, taken from the Census Bureau’s County Business Patterns file for 2023 — the most recent year published — downloaded and filtered by us on 1 September 2026.

The industry code is NAICS 561621, security systems services except locksmiths. It is the code that covers burglar alarm installation, fire alarm installation, monitoring, access control and the low‑voltage integration work that surrounds all three. Across Maryland the file reports 167 establishments with paid employees, 3,681 employees and $281,941,000 of annual payroll. The interesting part, as usual, is where those companies are and what they pay.

Two things in that table are worth stopping on, and the second one is the reason this article is about two different businesses wearing the same NAICS code.

The first is Baltimore City. Eleven establishments, one hundred and twenty‑four employees, and $45,000 of payroll per employee. That is the smallest count of any large jurisdiction in the state, and the city is not short of buildings that need alarms. The companies that protect Baltimore mostly do not have their offices in Baltimore — they sit in Baltimore County, in Anne Arundel, in Howard, and they drive in. Which matters a great deal later in this article, because the paperwork obligations we are going to describe are triggered by where the work happens, not by where the office is.

The second is Howard County. Seventeen establishments, seven hundred and twenty employees, and $105,082 of payroll per employee — more than double the city figure and 37% above the statewide average. Anne Arundel is close behind at $88,704 across fifty‑five employees per establishment, the largest average premises in the state. Those two counties sit around Fort Meade, and what the numbers are describing is not a burglar alarm trade at all. It is cleared‑facility physical security integration: access control, intrusion detection and video for federal and defense customers, done by engineers on federal rates. It shares a Census code with the two‑truck company that installs a keypad in a Hampden rowhouse, and it shares almost nothing else.

One industry code, two industries. A national alarm platform is built for whichever of the two had the bigger sales team when the product was designed, and the other one gets a text field called “notes.”

Put the same file’s guard‑company numbers beside it and the contrast gets sharper still. NAICS 561612, security guards and patrol services, reports 288 Maryland establishments, 22,089 employees and $710,102,000 of payroll — which is $32,147 per employee. An alarm company employee in Maryland is paid 2.38 times a guard company employee. And in Baltimore City the two trades are shaped in opposite directions: 111.2 employees per guard establishment against 11.3 per alarm establishment, a ratio of nearly ten to one.

That single comparison explains more about alarm software pricing than any market report. A guard company’s cost is people, so its software is sold per seat and per scheduled hour. An alarm company’s cost is accounts under contract — recurring monthly revenue held for years — and its software has to be sold against something else entirely. We will come back to what the leading product actually meters, because it turns out to meter five different things at once.

The size bands are the whole argument

County Business Patterns also publishes how many establishments fall in each employment band, and for this trade the distribution is the most useful number in the file.

Sixty percent of Maryland’s alarm companies have fewer than ten employees. Seventy‑eight percent have fewer than twenty. Not one has more than two hundred and forty‑nine. And every one of those sub‑ten‑person companies carries the same regulatory load as the hundred‑person one: a state agency license with its own renewal clock, an individual state registration for every field employee with a different renewal clock, a Baltimore City contractor registration, quite possibly a Baltimore City monitor registration, a separate Baltimore County permit on a separate term, a form filed within ten days of every job inside the city, and a monthly customer roster. The paperwork does not scale down. The person doing it does.

The compliance surface of a four‑person alarm company and a hundred‑person alarm company is identical. The difference is that the hundred‑person company has someone whose job it is, and the four‑person company has an owner doing it on Sunday night.

One caveat, and it matters more here than in most categories: County Business Patterns counts only establishments with paid employees. A one‑person alarm company where the owner is the only technician does not appear in that 167 at all. Maryland licenses the agency and registers the individual separately precisely because those two things come apart, and the state’s own roster of registrants — which §18‑202(b)(3) requires the Secretary of State Police to keep — is a much longer list than 3,681.

What the software costs, on the days anyone will say

We checked twenty‑two products on 1 September 2026 the same way we check every category: request the vendor’s own /pricing page directly, record the HTTP status code, and read the numbers off the page that comes back rather than off an aggregator’s summary of it. That last part is not pedantry. In three years of doing this we have repeatedly found universally quoted prices that turned out to be attached to pages which no longer exist.

This category produced the cleanest split we have seen. One product publishes everything, down to a working calculator. Four of the best‑known back‑office platforms in the alarm trade answer /pricing with a 404 while their home pages return a healthy 200. And three names that a dealer would have shortlisted a decade ago have been absorbed into other companies and now resolve to pages with no price on them at all.

The one that publishes everything

SecurityTrax is the most transparent product in this category by a wide margin, and it is worth describing carefully because the shape of its price is the interesting part. It does not sell seats. Its pricing page is headed “Usage‑based pricing” and it lists a $250 per month minimum, a $250 one‑time setup for new signups, and then three separate meters that count against that minimum:

The page goes further than almost anyone in this business does: it ships a calculator, and it publishes three worked examples. We reproduced all three from the stated rates and all three are exactly right. A “growing starter month” of 35 customer creates and 650 active customers is $202.50 of core usage; 35 × $3 is $105, and 650 × $0.15 is $97.50. A “storage‑heavy month” of 20 creates and 1,000 active is $210.00. An “Operations Plus team” of ten Ops Plus users, 20 creates and 600 active is $200.00. That is a vendor doing arithmetic in public and getting it right, which we would like to be less remarkable than it is.

The one item we would flag is the token allowance, because it carries a condition that is easy to miss. The page states that 5,000 monthly tokens are included, that the allowance refreshes each time you pay your monthly invoice in full, that it is good for 30 days, and that it does not roll over. So the artificial intelligence and automation budget is contingent on the accounts payable calendar. Pay late once and you lose that month’s allowance, not just your good standing.

The four that answer 404 on a live site

Now the other end. D‑Tools, the estimating and system‑design product that a large part of the integration trade runs its proposals through, returns 404 at /pricing. So does Solutions360, whose Q360 is one of the two or three genuine enterprise resource planning products written for this industry. So does Bold Group, which owns Manitou and is the name behind a large share of the central stations in North America. And so does SedonaOffice, which is the accounting and service platform that a great many alarm dealers have run on for twenty years.

In every one of those four cases the root domain returns a healthy 200. These are not dead companies or broken sites. They are live businesses that have made a deliberate decision that /pricing should not exist, which is a decision they are entitled to make and which we record without editorializing further than this: a trade in which sixty percent of firms have fewer than ten employees is a trade in which the owner doing the evaluation is also the owner doing the installs, and a phone call is an expensive way to find out whether something is in range.

Three names, one redirect, and no price

The third pattern is the one that says most about where this software market has gone. Wintac — for years the default answer when a small alarm or HVAC company asked what to run the office on — does not respond at all. Neither does Perennial Software, whose alarm‑industry products were a fixture of the trade shows. And Davisware, which acquired Wintac, now answers https://www.davisware.com/pricing with a redirect to ecisolutions.com/solutions/unlock-cashflow/ — a general marketing page at ECI Solutions, which acquired Davisware. Three brands, two acquisitions, and the pricing URL of the last one alive lands on a page about cash flow.

Alarm.com deserves a line of its own. It is the largest name in the category by some distance, and alarm.com/pricing returns a 404 that resolves to an international landing page. That is not evasiveness; Alarm.com sells through dealers rather than to end users, and a dealer’s cost per account is negotiated. But it is worth stating plainly for anyone building a budget: the platform your customers think they are buying does not publish what it costs you.

What the priceable stack actually comes to

To make the rest of this article concrete we need a company. Ours is a Baltimore alarm and integration company with nine employees, six registered technicians, three trucks, 1,400 monitored accounts, about 30 net new accounts a month, and six people who would need the Operations Plus bundle. Just under half its work is inside Baltimore City and the rest is spread across Baltimore County and Anne Arundel. That is a real shape for this trade: it sits in the 5‑to‑9 band that 28 Maryland companies occupy, just under the 10‑to‑19 band that 31 more occupy.

That works out to $2.91 per monitored account per year, and we want to say clearly that this is good value. It is cheaper than one service call. Nothing in the rest of this article is an argument that SecurityTrax is overpriced, because it plainly is not, and a dealer running on it should keep running on it. The argument is about a different thing entirely: what that meter counts, and what it cannot count.

A meter that charges you for growing and for standing still

Look again at the two core meters. A customer costs $3 once when you create the record, and $0.15 every month for as long as the record stays active. Both of those are reasonable. Together they produce an incentive structure that points in an odd direction for this particular trade, and the arithmetic is short enough to do here.

The whole economic proposition of an alarm company is that an account acquired once pays every month for a very long time. Recurring monthly revenue held for seven or ten years is the asset; it is what the business is valued on when it sells. On this meter, the seven‑year account — the good one, the one you want more of — costs 4.2 times more in storage than it did to create. The meter is priced against the length of the relationship, and the business is priced on exactly the same thing.

The second consequence is stranger. Because creates and storage share one budget, the $250 minimum does not correspond to a customer count at all. It corresponds to a curve.

A dealer signing nobody can hold 1,666 accounts inside the minimum. A dealer signing fifty a month can hold 666. Growth costs a thousand records of headroom, and it costs them before the new accounts have billed anything.

None of this is a criticism of the pricing design, which is genuinely thoughtful and unusually honest. It is an observation about what happens when any vendor picks a unit of account: the unit becomes the thing your business optimizes toward, whether or not it is the thing your business is about. The alarm trade’s unit is the account‑month held under contract. Every product we looked at meters something adjacent to that — users, records, creates, tokens, work orders — and the gap between the two is where the surprises live.

Which brings us to the surprises that no vendor in the list above has any reason to model, because they exist in exactly one state and, in the sharper cases, in exactly one city.

The sentence that splits your company in half

Maryland licenses this trade under the Maryland Security Systems Technicians Act, codified at Business Occupations and Professions Title 18. It is administered not by a professional board but by the Secretary of State Police, which is the first sign that you are in unusual territory. Two credentials sit under it: a security systems agency license for the company, and a security systems technician registration for the individual. Neither substitutes for the other.

Buried in the scope section of that title, at §18‑102(b), are two consecutive paragraphs that between them decide the shape of every record your company keeps. Here they are, verbatim:

“(3) Except as provided in paragraph (4) of this subsection, this title supersedes any local law or ordinance in the State that requires registration, training, bonding, or insurance for security systems technicians or other individuals who have access to circumventional information.

(4) This title does not preempt local governments from licensing or regulating security system agencies or security system users.” — Md. Bus. Occ. & Prof. §18‑102(b)(3)–(4)

Read those together and the boundary is unmistakable. Your people are a state matter, and no county may touch them. One rulebook, one registration, one renewal, valid identically in Cumberland and in Canton. Your company and your customers are a local matter, and every county may write its own rules. Twenty‑three counties and Baltimore City, each free to license the firm and to regulate the people who own the systems it installs.

Now go and look at what Baltimore City actually registers. Article 19, Subtitle 8 of the Baltimore City Code registers three categories of person: the contractor, the monitor, and the user. It does not register technicians. It could not; §18‑102(b)(3) took that power away. The city ordinance fits the state carve‑out exactly, and it fits it because that is the only shape a local alarm ordinance in Maryland is allowed to have.

The employee table is national. The customer table is municipal. That is the whole article in two sentences, and no product built for fifty states has any reason to have discovered it.

Two more parts of §18‑102 are worth knowing before we leave it. Paragraph (b)(1) says the title does not supersede any local law establishing standards for electricians or for electrical work involved in installing security systems, and (b)(2) says it does not authorize anyone to do electrical work that otherwise requires an electrician’s license. So the one credential the state deliberately left in local hands is the electrical one — and, as we will see, Baltimore County has quietly built its entire fee structure on top of that fact.

And §18‑102(c) contains a carve‑out that is a trap in disguise. A master electrician, currently licensed and acting only within the scope of that occupation, does not need the agency license. But §18‑102(c)(2) then says that same master electrician may not personally provide security systems services unless registered as a technician, and may not obtain access to circumventional information unless registered as an individual with such access. In other words: the electrician exemption covers the pulling of wire and stops at the keypad. If your subcontracted electrician programs a single user code, the exemption you were relying on no longer describes what happened.

Two clocks, and neither one is the date on the license

Both credentials run for three years. Both are staggered by regulation rather than aligned to a common date — §18‑307(a) and §18‑3A‑07(a) each direct the Secretary to stagger the terms. And each has a renewal deadline that is not the expiration date printed on the credential. They are different deadlines, they carry different penalties, and the penalties run at different rates.

Start with the company. §18‑307(c) requires the Secretary to transmit a renewal notice at least one month before the license expires, and that notice must state, among other things:

“(2) that the Secretary must receive the renewal application and proof of insurance or bonding … at least 15 days before the license expiration date for the renewal to be issued and mailed before the license expires; … (4) that, if the complete renewal application and proof of insurance or bonding … are not received at least 15 days before the license expiration date, a fee of $25 per day shall be charged against the agency until the day the license expires, at which time the agency shall be considered closed.” — Md. Bus. Occ. & Prof. §18‑307(c)(2), (c)(4)

Three things in that sentence. The deadline is T minus 15 days, not the expiration date. The meter is $25 a day. And the end state is not “lapsed” or “in grace,” it is closed — the statute’s own word for a company that no longer exists as a licensee. Fifteen days at twenty‑five dollars is $375, which is 3.75 times the $100 renewal fee, and it is the maximum possible late fee because on day sixteen there is no longer anything to be late for.

Now the individual, under §18‑3A‑07. Subsection (c) is mandatory language: “At least 90 days before a registration expires, the applicant shall submit to the Secretary” the renewal application, the fee, and any late fee. Subsection (f)(1) then prices lateness on a completely different date: if a complete renewal application is not received “at least 30 calendar days before the certification expires, the Secretary shall assess a late fee of $5 per day until the application is received,” and (f)(2) caps the total at $150.

Put those two subsections side by side and you get something genuinely odd. The statute imposes a duty at ninety days and a price at thirty. Between them lies a sixty‑day window in which a technician is in breach of a statutory “shall” and owes nothing at all. And the $150 cap divided by the $5 daily rate is exactly thirty days, which means the meter reaches its ceiling at precisely the moment the registration expires. After that the fee stops growing — but §18‑3A‑07(f)(3) says the Secretary may not register any applicant who has outstanding late fee obligations, so the money stops accruing and the block does not.

The cheaper credential has the earlier deadline. The $15 registration must be filed six times further out than the $100 license, and its maximum penalty is ten times its own fee where the company’s is under four. If you were designing a compliance calendar from first principles you would not arrive at this, and neither would any renewal‑reminder feature written for a national market, because a national product stores one field — the expiration date — and reminds you about it.

Here is what one slipped quarter costs our nine‑person company with six registered technicians, if the agency renewal and all six technician renewals fall in the same window and all of them slip by the same number of days.

Three technicians at the statutory cap cost $450, which is more than the company’s own worst‑case penalty of $375. Past three field employees, the people are the bigger exposure — and the people are the credential your software is least likely to be tracking.

There is one piece of relief in each clock and it is worth knowing about, because it is the kind of thing that gets missed. Both §18‑307(g)–(i) and §18‑3A‑07(h)–(i) create a temporary status: if you filed everything on time and the FBI criminal history check simply has not come back before the expiration date, you keep operating until the check completes or the renewal is decided. But §18‑307(h) is explicit that temporary status is available “only if the renewal application and all required documents and fees were submitted by the expiration date.” The relief is for the government’s delay, not for yours.

Maryland has a legal term for the passcode field in your database

The definitions section of Title 18 opens with something we have not seen in any other trade we have written about. Before it defines an agency, a technician, or a security system, it defines this:

“(1) ‘Circumventional information’ means information, including pass codes, that allows an individual to alter the operation of a security system. (2) ‘Circumventional information’ does not include generic user or installation manuals.” — Md. Bus. Occ. & Prof. §18‑101(b)

Maryland has given a statutory name to the codes stored in your customer records, and then built a permission system around who is allowed to see them. §18‑3A‑01 states it four ways in four consecutive paragraphs: an individual may not personally provide security systems services unless registered; a licensee may not employ or contract with an individual with access to circumventional information unless that individual is registered; neither a licensee nor a registrant may provide access to circumventional information to an unregistered individual; and an employee of a licensee may not obtain access unless registered as an individual with access.

Note who that catches. Not just the technician in the truck. The dispatcher who reads a code to a customer over the phone. The bookkeeper who can open the account record. The part‑time office manager who covers the desk on Fridays. Maryland does not care what their job title is; it cares whether they can see the field. Every one of those people needs their own state registration, their own fingerprints, their own three‑year clock and their own ninety‑day filing date.

This is an access‑control policy written into a statute in 1990s language, and it maps onto a modern role‑based permission model almost perfectly. The problem is that the mapping runs the wrong way: the statute says who may hold the role, and your software says who does. Nothing checks that the two lists agree.

A bond that is a list of everyone with the codes

Then §18‑401 turns that list into a financial instrument. To be licensed, an applicant must either execute a fidelity bond or maintain general liability insurance, and if it chooses the bond, §18‑401(c)(1) requires that the bond cover all individuals who are licensed, registered as technicians, or have access to circumventional information — and all applicants for either credential. The bond schedule and the access list are the same list.

The bond’s purpose is narrow and specific. Under §18‑401(c)(2) it is for the benefit of any person injured on the premises of a consumer by a fraudulent or dishonest act of a licensee, a technician, or an individual with access to circumventional information, where that act is willful or malicious. The minimum is $50,000 — and §18‑401(c)(4)(ii) adds that the surety’s total liability to all insured persons may not exceed the sum of the bond. Fifty thousand dollars, shared across every claimant, for the whole company, for the whole state.

The same fifty thousand dollars, and the opposite duty

The alternative under §18‑401(d) is general liability insurance, also at a minimum of $50,000. Identical number, entirely different coverage: general liability does not respond to employee dishonesty at all, which is the exact risk the bond was written for. A company that satisfies the statute with a general liability policy has complied fully and has bought none of the protection the bond describes.

And the two instruments carry opposite notification duties, which is the detail most likely to be missed:

§18‑401(c)(5)(ii) is the quiet masterpiece there: if your surety fails to notify the Secretary that your bond has been canceled, the bond stays in force. A bond that cannot lapse silently. The insurance route has no such backstop, and the duty to speak sits on you. Whichever you pick, §18‑401(e) makes the consequence of letting coverage drop non‑discretionary: the Secretary shall suspend the license and may not reinstate it until proof is filed.

An office in the State, and the records that have to be in it

The same section contains a requirement that is, as far as we can tell, unique among the trades we have written about in this series. To obtain a license, §18‑401(a)(2) requires an applicant to:

“maintain in an office in the State, documents or other records that are made in the State or relate to a service performed in the State and make those records available for inspection by the Secretary for compliance with this title.” — Md. Bus. Occ. & Prof. §18‑401(a)(2)

That is a data residency clause, written decades before anybody used the phrase, and it applies to a trade whose entire software stack is now hosted somewhere in northern Virginia. And it is not a background rule you can quietly fall short of: §18‑401(b) provides that the Secretary may not issue or renew a license or registration unless the applicant submits proof of compliance with subsection (a) — which is subsection (a) in full, including paragraph (2). The records requirement is a renewal gate. The Maryland State Police licensing page lists it among the pre‑application requirements in exactly those terms.

We are not going to overstate this. “An office in the State” holding “documents or other records” is language from a paper era, and no regulator we are aware of is arguing that a Maryland alarm dealer’s cloud database violates it. But a company whose only copy of its work orders, its site records and its technician assignments is inside a vendor’s tenancy, retrievable only through that vendor’s export function, is a company that would have a slightly awkward afternoon if an inspector walked in. And it is a company that would have a very bad quarter if the vendor were acquired — which, as the pricing sweep above demonstrates, is the single most likely thing to happen to a product in this category.

Three of the twenty‑two products we checked have been absorbed into other companies. One of them now answers its pricing URL with a redirect to a page about cash flow. “Records available for inspection” is a good reason to hold your own copy, and the acquisition rate in this market is a better one.

Every job in the city is a filing, and every missed one is its own offense

Now the local half of §18‑102(b)(4), which is where this trade gets genuinely unusual. Baltimore City Code Article 19, Subtitle 8 is titled “Burglar Alarms — Registration and Regulation.” It was enacted by Ordinance 00‑069 in 2000, substantially rewritten by Ordinance 12‑061, and amended again by Ordinances 22‑125 and 22‑161 in 2022.

The first thing to know is who runs it, because it is not who you would guess. Under §8‑1(c), “Commissioner” means the Housing Commissioner of Baltimore City. The registrations, the fees, the appeals and the reports all go to the Department of Housing and Community Development. The police are the ones who do or do not turn up. Two agencies, one file, and your customer only ever meets the second one.

The second thing is the filing cadence, and this is the sentence that ought to be printed above every dispatch board in the region:

“An alarm system contractor must keep its registration with the Commissioner current by, within 10 days of the undertaking, reporting to the commissioner, on a form approved by the Commissioner, whenever it undertakes to install, maintain, alter, inspect, administer, sell, or service any alarm system in Baltimore City.” — Baltimore City Code Art. 19, §8‑3(b)

Read the verb list again: install, maintain, alter, inspect, administer, sell, or service. That is not “new installations.” It is every service call, every battery change, every annual inspection, every sale of a system you will never see again, and every remote programming session — each one a report on an approved form, each one within ten days. And §8‑3(c) closes the loop: “For purposes of the penalties imposed by this subtitle, each event that violates this section constitutes a separate offense.”

Here is what that means in volume for a company like ours, with three trucks and just under half its work inside the city line.

Sixteen hundred and eighty‑eight filings a year, or roughly one hundred and forty a month, generated by a nine‑person company. Each of them individually trivial. Each of them individually an offense if it does not happen. Ten missed filings at the published $500 citation is $5,000, and the doubling provision for repeats inside twelve months makes a bad year considerably worse than that.

Your dispatch board is a regulatory filing queue. Every product in the pricing sweep above treats a completed work order as the end of a workflow. In Baltimore City it is the beginning of a ten‑day clock.

The monitors have a parallel obligation under §8‑4(b), on the same ten‑day cadence, whenever they undertake to monitor any system in the city — and §8‑4(c) counts each contract by an unregistered monitor as a separate offense rather than each event. Both registrations cost $50 a year, which is the least significant number in this entire section.

The monthly list of everyone you protect

Then §8‑6(c)(1): “Each monitor doing business in the City must provide the Commissioner with a monthly report of all users in the City to whom the monitor is then providing services.” And §8‑6(c)(2) adds that the Commissioner may demand additional updated reports on request, in whatever format the Commissioner requires. The city’s own program materials say where it goes: by email, to the False Alarm Reduction Program.

So your customer list — the asset the whole business is valued on — is a monthly government filing. Twelve times a year, plus on demand. And the program materials add a duty the code text does not spell out: monitors must notify the department of users who cancel alarm service within 10 days. Churn is a reportable event.

There is one more report, and it applies to the half of the trade that installs without monitoring. Under §8‑6(b), if the person selling or leasing an alarm system is not under contract to monitor it, that person must report the transaction within ten days, and the report must contain the user’s name, address and telephone number and the make and model of the system. The unmonitored sale requires a device inventory record that the monitored one does not. If your system stores equipment against an account only when a monitoring contract exists, you are missing exactly the records the city wants.

The number the dispatcher has to read out

This is the field that decides the argument. Baltimore City’s published guidance for alarm contractors and monitors sets out what a monitoring operator must do at the moment it asks for a police response. It must place the call to the dedicated alarm line, 410‑396‑2677, not to 911. Automatic dialers are flatly prohibited by §8‑10. And:

Monitors must “provide the customer’s registration number at the time of the request for a police response. If not available, indicate.” — City of Baltimore, Information for Alarm Contractors and Monitors

Your monitoring platform must therefore carry, per site, a Baltimore City alarm registration number — a value issued by the Housing Commissioner to your customer, not to you, which you did not create and cannot generate — and surface it to the operator in the two seconds between an alarm signal and a dispatch request. No national alarm platform has that field. It has a “permit number” free‑text box, if you are lucky, and nothing that knows the box is mandatory in one of the jurisdictions it serves and meaningless in the next one.

It gets sharper. §8‑7(a)(2) makes it unlawful for the alarm system of any unregistered user to cause contact with or summon City police, with each such event a separate offense. And §8‑7(b) puts a duty on the monitor who detects an activation from an unregistered user: report the activation to the Police Department in the normal way, and report the unregistered user to the Commissioner. The industry’s own national ordinance directory records the consequence bluntly for Baltimore City: dispatch requires a user registration, and if there is none, they fine both.

Which means that at the instant a signal arrives, your software has to answer a question it has almost certainly never been asked: is this address registered with Baltimore City? If yes, dispatch with the number. If no, dispatch anyway — and simultaneously open a second, entirely different notification to a housing department, about your own customer, which will probably result in a citation to that customer and possibly one to you.

Two calls, two numbers, and one identity check

§8‑11 requires verification before dispatch for everything except hold‑up and panic alarms, and Ordinance 22‑161 tightened it into something quite specific:

“For the purpose of this section, verification shall require, at a minimum, that a second attempt be made to a different number if the first attempt fails to reach an alarm user or an individual at the alarm system site who can properly identify themselves to determine whether an alarm signal is valid before requesting a police response.” — Baltimore City Code Art. 19, §8‑11(b)(2)

That is a schema requirement dressed as a procedure. To lawfully request a dispatch in Baltimore City you need at least two distinct contact numbers per site, and the first one has to fail with an identity check before the second is tried. A customer record with one mobile number on it cannot satisfy §8‑11(b)(2), and the moment you discover that is the moment the alarm is already sounding. Failure to follow the two‑call requirement is one of the enumerated $500 alarm‑company citations.

This is the single cheapest thing to fix and the single most commonly broken, because contact numbers rot. People change phones, key holders leave, the office manager who was the second number retired in 2023. There is no product in the sweep above that treats “this site has fewer than two reachable contacts” as a compliance defect rather than a data‑quality nag, because in forty‑nine states it is a nag.

A counter that resets on a calendar in one place and slides in the other

Baltimore City’s false alarm schedule sits at §8‑8, and Ordinance 22‑161 rewrote it in 2022. The first false alarm in any twelve‑month period is free. After that:

The non‑residential column is exactly double the residential one at every rung, which is at least tidy. What is not tidy is what happens ten miles north.

Baltimore County runs its program under Code Article 13, Title 11, Subtitle 2. Its fee schedule — increased with effect from 1 January 2019, the first change since 1998 — forgives the first two false alarms rather than one, starts at $70, and keeps climbing all the way to the fourteenth and beyond.

Now compare them properly, because the comparison is not the direction anyone expects. Five false alarms at a commercial site cost $1,100 in Baltimore City and $245 in Baltimore County — the city is 4.5 times more expensive. But the city’s fifth alarm also ends police response, and the county’s does not. The county’s ladder keeps climbing, and its cumulative total does not pass the city’s entire five‑rung ladder until the tenth false alarm, at $1,400.

The city charges four and a half times more for the first five and then stops sending anyone. The county charges less for the first five and never stops billing. A chronically faulty site is cheap in the county for a year and catastrophic in the city in a quarter, and the answer to “which is worse” depends entirely on a number your software is not counting.

And the counting windows are different types, which is the part that no configuration screen accommodates. Baltimore City counts “in any 12‑month period” — a sliding window, evaluated continuously. Baltimore County counts “within a calendar year” — a fixed window that empties at midnight on 31 December. A site with four false alarms in November and December is, on 2 January, back to zero in the county and still four deep in the city, one signal away from losing police response.

Two other definitional details in §8‑8 and §8‑1 change what your event log has to record.

Thirty days after installation, nothing counts

§8‑1(e)(2) excludes three things from the definition of a false alarm: a signal canceled by the monitor before a responding officer arrives; a signal that occurs within 30 days of the original installation of the system; and a signal from a medical alert device.

The middle one is a thirty‑day grace window keyed to a date that only the installer holds. If the installing company and the monitoring company are different businesses — which, in a trade full of dealer programs and account sales, they very often are — then the field that determines whether a signal is worth $150 or $0 lives in a system nobody has connected to the one making the decision.

The first one is stranger and better. Whether a signal is a false alarm depends on a race: your operator’s cancel call against a patrol car’s arrival. Which means your monitoring log needs a cancel timestamp and an officer‑arrival timestamp on the same event, and the arrival timestamp is not yours. Every second your operator saves in the verification sequence is a real option on a real fee — while §8‑11(b)(2) simultaneously requires that operator to attempt two calls to two different numbers first. The ordinance asks you to go faster and to do more, in the same paragraph.

The certificate that saves the fee and not the account

§8‑8(d)(1) is generous on its face. The Commissioner must waive one false alarm fee if the user has the system inspected by a registered contractor or monitor and obtains a certification that it has been inspected and is functioning properly. A real, mandatory, document‑triggered waiver — and the document can only be issued by someone holding a city registration, which is a quiet piece of demand generation for the registered half of the trade.

Then §8‑8(d)(2) takes back the important half: “If a false alarm fee is waived under this subsection and the user is subject to a subsequent false alarm fee, that subsequent fee will be assessed as if the previous fee had not been waived.”

So the waiver forgives money and does not rewind the counter. The counter is what triggers no‑response status. The certificate saves the fee and does not save the police response, which is the thing your customer is actually paying you for.

It also creates a small optimization problem that is exactly the sort of thing software should be doing and no software is:

Three hundred and fifty dollars separates the best placement from the worst, on one certificate, for one site. And it is a genuine judgment call rather than an obvious one: hold the waiver for the expensive fifth alarm and you may never need it, because most sites never get there. Spend it on the second and you have bought certainty cheaply. That is a decision that wants a number attached to it — this site’s signal history, its fault pattern, whether the panel has been replaced — and the number exists in your monitoring log.

Two administrative details to close the section. The city’s late fee is $25 if a false alarm fee goes unpaid for thirty days after notice, and if the late fee then goes unpaid for ten business days, §8‑8(e)(2) lets the Commissioner put the system on no‑response status for non‑payment alone — no false alarms required. And under §8‑8(f), the warning notice that goes out after the second false alarm goes by certified mail to the user with a copy by regular mail to the monitor. You are formally on notice about your own customer’s counter, three alarms before it matters.

The primary key changes at the county line

We have been circling this and it deserves its own section, because it is the finding that makes the case for a layer of your own better than any cost comparison could.

Baltimore City defines a user in §8‑1(i) as the owner or lessee of the alarm system, or of the premises equipped with one, or any other person who uses one — and then excludes, in §8‑1(i)(2)(i), the owner or manager of a multi‑tenant building with respect to any alarm system used solely by a tenant. The city’s record follows the person who uses the system.

Baltimore County does not have a concept of “user” as its unit at all. It defines an alarm location in §13‑11‑201(c) as “a single premises served by an alarm system” or “each tenancy, if served by a separate alarm system in a multi‑tenant property.” The county’s record follows the tenancy.

Two governments, ten miles apart, solving the same problem — who owns the false alarm in a rowhouse split into four apartments — and arriving at two different primary keys. The city keys on a person. The county keys on a space. Your customer table has one of those.

That is not a philosophical distinction. It decides who gets the citation when the tenant in unit 3 moves out, who has to re‑register when the lease changes hands, and whose twelve‑month history follows the account. In the city, a tenant who moves takes their registration and their false alarm count with them, and the new tenant starts clean. In the county, the alarm location stays where it is and so, arguably, does its calendar‑year count.

And that is only the first row of the table. Here is the rest of it.

Three rows in that table deserve a second look.

The county waives its permit fee for an electrical license. §13‑11‑203(c)(3) is the local half of the state’s §18‑102(b)(1) carve‑out, monetized: Maryland refused to preempt local electrician rules, and Baltimore County has responded by making the electrical license worth $125 every three years to any alarm contractor who holds one. That is a real, checkable, recurring saving sitting in a document your office may already have in a filing cabinet.

A county court can order your monitoring company to disconnect a system. §13‑11‑209(b)(2) lets the Administrative Officer petition for an injunction requiring “the commercial or residential alarm system user or the alarm system monitor” to disconnect the alarm. That is a court order pointed at you, arising from your customer’s conduct, terminating the service you are billing for. It is worth knowing which of your accounts is closest to that threshold, and the only place that is knowable is your own signal history.

In the county, a monitored customer need not register; in the city, everyone must. §13‑11‑207(a) puts the registration duty only on users who do not retain a monitor — the monitor’s own permit and reporting carry the rest. So the identical customer is a mandatory registration record with a number your dispatcher must read out on one side of the line, and not a registration record at all on the other. The same field is required and meaningless depending on the address.

One more thing about directories

While researching this article we checked Baltimore City’s entry in the False Alarm Reduction Association’s national local‑ordinance directory, which is the reference many dealer platforms and monitoring centers use to configure a jurisdiction. On 1 September 2026 it describes the city’s fee schedule as $50 for the 2nd and 3rd false alarm, $100 for the 4th, $150 for the 5th, rising to $500 for the 12th and above for residential users and $1,000 to $2,000 for commercial users at the 12th through 15th.

That is the schedule Baltimore City had before Ordinance 22‑161. The current §8‑8 starts at $75 residential and $150 commercial, and has no rungs above the fifth, because the fifth is where police stop coming. The directory is wrong in both directions at once: too low at the bottom, and describing eleven rungs of a ladder that no longer exists.

We say this without any criticism of FARA, which is a small nonprofit doing genuinely useful work across thousands of jurisdictions, and whose entry is otherwise accurate and detailed — it is where we confirmed the dedicated dispatch number and the enumerated $500 citations. The point is structural, and it applies to every secondary source including this article: ordinances move and directories drift. If your platform’s Baltimore rules were configured from a directory, there is a reasonable chance they encode a fee ladder that stopped existing in 2022.

Two definitions twenty years apart, and a tie-breaker that takes the bigger one

The last piece of the Maryland layer is a tax question, and it is a live one for every dealer in the state who has added a cloud video or hosted access product in the last three years.

Maryland Tax‑General §11‑101(m)(10) has for many years made “a security service” a taxable service, and it names the sub‑categories expressly: “(i) a detective, guard, or armored car service; and (ii) a security systems service.” Alarm monitoring is squarely inside that, and it is taxed at the general 6% rate.

Since 1 July 2025, Maryland has also taxed a new category. §11‑101(m)(14) makes taxable “a data or information technology service described under NAICS Sector 518, 519, or 5415,” and §11‑104(l)(1) sets the rate for that category at 3%. NAICS 518 is computing infrastructure providers, data processing and hosting — which is, functionally, a precise description of storing a customer’s video clips on your behalf.

So the recurring line on a modern alarm invoice can be described accurately in two different subsections carrying two different rates. Most states resolve that with a “true object” test, or a primary‑purpose test, or a bundling rule. Maryland resolves it with arithmetic:

“If a different rate from the rate specified under paragraph (1) of this subsection could be applied to a sale or use of tangible personal property, a digital code, a digital product, or a taxable service, the higher rate shall apply to the sale.” — Md. Tax‑General §11‑104(l)(2)

The statute does not ask which description fits better. It asks which number is bigger. Every genuinely ambiguous line on an alarm company’s invoice therefore resolves to 6%, and it resolves that way by operation of a sentence rather than by anyone’s judgment.

The tax rate on a line item is not a field. It is a max() over the set of categories that could describe it. No billing engine we have ever seen stores it that way, and the ones that store a single rate per product are storing the answer to a question the statute does not ask.

The amounts are not trivial for a dealer with a video attach rate. On a $14.99 monthly cloud video line the difference between 3% and 6% is $0.45 a month, or $5.40 a year per account. Across our 1,400‑account company, if half the base takes video, that is $3,777 a year riding on which subsection you decided the line belongs to — and under §11‑104(l)(2) the decision has already been made for you in the direction that costs your customer more.

There is a second tax structure worth naming, because it catches dealers who move from monitoring into installation. §11‑101(n)(2)(i) provides that “use” includes acquiring tangible personal property “for use or resale in the form of real estate by a builder, contractor, or landowner.” That is Maryland’s construction‑contractor rule, and where equipment is permanently installed into real property the general effect is that the contractor is the taxable consumer of the materials rather than a reseller of them — so the company owes tax on its own cost, and there is no resale certificate to hand the supplier.

On a $2,850 commercial job with $1,120 of equipment, that is $67.20 owed by you on your cost, rather than $171.00 collected from the customer on the whole job. One invoice, two entirely different roles: on the hardware line you are the taxpayer, and on the monitoring line you are the collector. Whether a given installation is “in the form of real estate” is fact‑specific — a hardwired panel and a plug‑in camera are not the same question — and this is a paragraph to take to your accountant rather than to act on from a blog post. But the software point stands regardless of how the facts come out: your invoice needs to be able to hold both roles at once, and a product that applies one tax treatment per document cannot.

The store this trade should have and mostly does not

Almost every alarm company in Maryland sells the same way it sold in 2005: a phone call, a site visit, a paper or PDF agreement, and a card taken over the phone for the first month. The recurring revenue then runs on a bank draft that nobody looks at until it fails. There is usually no customer‑facing anything — and where there is, it is the manufacturer’s app, which belongs to the manufacturer.

We think that is a mistake, and not for the reason you would expect. The reason is not conversion rate. It is that the ordinance has handed you a list of things only your customer can supply, and you are currently collecting all of them by telephone.

Go back through Article 19, Subtitle 8 and count what has to come from the person who owns the premises rather than from you. Their Baltimore City registration number, which they obtain and you must recite at dispatch. Two distinct contact numbers, with someone at each who can identify themselves, or you cannot lawfully request a police car. A registration updated within 10 days of any change under §8‑5(a)(2). A decision about whether to spend their one §8‑8(d) inspection waiver now or later. And, when they cancel, a notification you owe the department within ten days.

Every one of those is a form. Not one of them is a form today.

A customer portal in this trade is not a nice‑to‑have marketing asset. It is the cheapest available mechanism for keeping the two‑call verification requirement satisfied, because the only person who reliably knows that the second number is dead is the person whose number it is.

So here is what an online storefront and portal is actually worth to an alarm company in Baltimore, in the order the money shows up.

It sells the plan on your domain and takes the money into your merchant account. Monitoring, video, cellular backup, extended warranty and inspection visits are all products with a price and a recurring cycle. Selling them through your own store rather than over the phone means the tax treatment is applied at the line — monitoring at 6% under §11‑101(m)(10)(ii), the hosted video line handled explicitly under the §11‑104(l)(2) rule rather than by whatever a national tax engine guesses, and installed equipment handled as its own thing entirely. The store is where the invoice structure from the last section becomes real instead of theoretical.

It makes the compliance fields required at the point where the customer cares. A Baltimore City address in the checkout triggers the registration field, the two‑contact minimum and the printed registration notice that §8‑6(a)(2) requires you to hand over before the user takes possession of the system. A Baltimore County address triggers a different set, or none. The customer fills them in while they are buying something, which is the one moment in the entire relationship when they are paying attention.

It gives them a reason to come back and keep them current. Signal history, false alarm count against both the city’s rolling window and the county’s calendar one, how close they are to no‑response status, the waiver they have not spent, and a button to book the inspection that produces the certificate. That is a portal a commercial customer will actually log into, because it is about money and about whether the police will come.

It sells the upgrade at the moment the data says so. A site with three false alarms in ten months is a site with a failing sensor, a bad pet setting or a door that has dropped in its frame. That is not a support ticket, it is a quote — and it is a quote you can put in front of the customer with the arithmetic attached: the next two signals cost $300 and $500, and the fifth one ends dispatch. Nothing sells a panel replacement like a table.

The last row is the one to sit with. In a trade where the account base is the enterprise value, letting the customer relationship live inside an app with somebody else’s name on it is a slow, comfortable and completely reversible mistake — reversible right up until the day it is not.

What we would actually build for a Baltimore alarm company

Everything above is one argument made several ways: the rules that govern a Baltimore alarm company are credential‑driven, per‑job, per‑jurisdiction and counted in windows of different types, and the systems sold into the category are national, per‑record, per‑user and static. That gap is not a defect in SecurityTrax or D‑Tools or Bold Group. Those products serve every state, and no sane product manager encodes a rolling‑window counter for one city and a calendar‑year counter for the county next door.

So the honest recommendation for most companies is a good dealer platform plus a thin layer that knows where it is and who is registered. Here is what that layer contains.

A credential register with two clocks per person and one for the company

Every technician, dispatcher, bookkeeper and office manager who can see a passcode, each carrying their state registration number, their expiration date, their T−90 filing date and their T−30 penalty date — and the company’s agency license carrying its own T−15. The register renders as a calendar rather than a list, because the useful question is never “when does this expire” but “what is due in the next sixty days and who owes it.” It also answers the question §18‑3A‑01 actually asks: does every person with access to circumventional information in our system hold a current registration? That is a join between your permissions table and your HR records, and nobody has written it because in most states there is nothing to join.

A job record that closes into a filing

Completing a work order at a Baltimore City address creates a §8‑3(b) report obligation with a ten‑day due date, on the approved form, from data the technician has already entered. One hundred and forty a month becomes one batch a week that someone approves rather than one hundred and forty things nobody remembered. Where the address is in Baltimore County, the same completion creates nothing, because the county asks for changes to the permit rather than a report per job — and the system should know the difference rather than making a person know it.

A site record that holds a jurisdiction, not just a zip code

City registration number, county permit status, which counting window applies, how many countable false alarms this site has in that window, the installation date that opens the thirty‑day exclusion under §8‑1(e)(2)(ii), and the two verified contacts §8‑11(b)(2) requires. From those fields, “is this site one signal away from no‑response” is a query rather than a phone call to the housing department.

A signal log that records the race

Cancel timestamp, dispatch request timestamp, officer arrival where you can get it, and the verification attempts with which number was called and whether the person identified themselves. That log is what makes the §8‑1(e)(2)(i) exclusion arguable, what makes a §8‑16 appeal to the Board of Municipal and Zoning Appeals worth filing, and what proves the two‑call requirement was met if anyone ever asks.

An invoice that can hold two tax roles at once

Monitoring at 6%, hosted video priced under the §11‑104(l)(2) rule rather than a guess, installed materials treated under §11‑101(n)(2)(i) as your own consumption rather than the customer’s purchase, and the whole thing reconciled to a sales and use tax return with the 6% and 3% amounts on the lines the Comptroller expects them on.

A storefront that is your front door

Your domain, your merchant account, your customer records, plan sales, upgrade quotes, the compliance fields collected at checkout, and a portal that shows the customer their own false alarm position. Described in the section above, and it is the piece that costs least to own outright.

Every price is fixed before we start, every project ships with the full source code, and you own it — which, given §18‑401(a)(2) and the acquisition rate in this software market, is worth slightly more here than in most trades. There is no hourly meter, no per‑seat charge and no per‑record charge, which for a company whose whole strategy is to add accounts and keep them for a decade matters more than it sounds.

Build, buy, or keep both

We will say the unfashionable thing first: most Baltimore alarm companies should keep renting their dealer platform. Scheduling, work orders, inventory, equipment orders, recurring billing, central station integration and the accounting sync are genuinely hard products to build and cheap ones to rent. SecurityTrax at $4,078.80 a year for a 1,400‑account dealer is $2.91 per account per year, which is less than one truck roll. We are not going to rebuild that for you and then charge you to maintain it.

What we will say is that the rented product ends exactly where this article began. Here is the honest split, and it is the only list in this article:

• Rent it if it is the same in Baltimore as it is in Boise: scheduling, dispatch, work orders, inventory, equipment ordering, recurring billing, accounting sync, central station integration, and the technician app.
• Build it if it depends on a Maryland credential, a Baltimore jurisdiction or a counting window: the two renewal clocks, the circumventional‑information access check, the ten‑day filing queue, the monthly roster, the registration number at dispatch, the two‑contact minimum, the false alarm counter and the per‑line tax treatment.
• Own it outright if losing it would cost you the business: your storefront, your customer records, your signal history, and the copy of your records that §18‑401(a)(2) expects to find in an office in this State.

The crossover arithmetic in the table above is worth sitting with. A custom store and portal at $6,000 costs less than one and a half years of the published subscription, and after that it costs what hosting costs. That comparison is not entirely fair — the subscription buys support, integrations and continuous development, and we do not pretend otherwise — but it is fair enough to be worth doing before you sign a third annual renewal.

And there is one number that is not on any comparison table. Six technicians thirty days past a renewal date is $900 in statutory late fees, and an agency license fifteen days past its own is $375 and a company the statute describes as closed. A calendar that knows about T−90, T−30 and T−15 pays for a Prototype Sprint the first time it prevents that from happening once.

Who we are

founderandai is a small studio in Baltimore. We are ex‑startup founders who build custom software at fixed prices — web apps, online stores and operations systems — and you work directly with the people writing the code. We publish our prices for the same reason we spent a morning reading Title 18 rather than a market report: a nine‑person company carrying two state credentials, two municipal registrations and a hundred and forty filings a month deserves a number it can act on without a discovery call.

If you run an alarm or integration company in this region, the fastest useful thing you can do with this article is check two facts. Count how many people in your organization can see a passcode, and count how many of them hold a current Maryland security systems technician registration. If those two numbers are not the same, §18‑3A‑01 has an opinion about it, and it will not be the last thing in this article that surprises you.

Questions Baltimore alarm companies actually ask

How much does alarm company software cost in 2026?

Of the twenty‑two products we checked on 1 September 2026, exactly one publishes a complete rate card. SecurityTrax prices usage rather than seats: a $250 monthly minimum, a $250 one‑time setup for new signups, $3 once per customer created, $0.15 per active customer record per month, and an Operations Plus bundle at $5 per active user per month, with all three counting against the minimum. Artificial intelligence, address intelligence, advanced API and automation usage are metered separately in SecurityTrax Tokens, with 5,000 tokens included each month that do not roll over. A Baltimore dealer with 1,400 active accounts, 30 net adds a month and six Operations Plus users lands on $330.00 a month, which is $3,960.00 a year, or $4,078.80 once Maryland’s 3% technology tax is added. D‑Tools, Solutions360, Bold Group and SedonaOffice all return a 404 on /pricing while their home pages return a healthy 200. Perennial Software and Wintac do not respond at all, and Davisware’s pricing URL now redirects to a general marketing page at ECI Solutions.

Do I need a license to install alarm systems in Maryland?

Yes. Under the Maryland Security Systems Technicians Act, codified at Business Occupations and Professions Title 18, a person may not engage or solicit to engage in the business of providing security systems services in the State without a security systems agency license issued by the Secretary of State Police. The application fee is $100 and the renewal fee is $100, the term is three years, and the applicant must execute a fidelity bond or maintain general liability insurance of at least $50,000 under §18‑401. The same section requires the licensee to maintain records relating to services performed in the State in an office in the State and to make them available for inspection. A master electrician acting only within the scope of that occupation does not need the agency license, but under §18‑102(c)(2) may not personally provide security systems services or obtain access to passcodes without being registered.

What is a security systems technician registration in Maryland?

It is a separate credential from the company license, issued to the individual by the Secretary of State Police under §18‑3A‑01. Anyone who personally provides security systems services must hold it, and so must anyone with access to what the statute calls circumventional information — meaning passcodes and anything else that allows a person to alter the operation of a security system. The fee is the higher of $15 or the Secretary’s actual processing cost, the term is three years, and §18‑3A‑07(c) requires the renewal application to be submitted at least 90 days before expiration. A late fee of $5 per day begins only at 30 days before expiration and is capped at $150, so there is a sixty‑day window in which a technician is late under the statute and owes nothing. The Secretary may not register anyone with outstanding late fees.

Does an alarm company have to register with Baltimore City?

Yes, and so does the monitoring company, and so does every customer. Baltimore City Code Article 19, Subtitle 8 requires an alarm system contractor to register with the Housing Commissioner before undertaking any work on any alarm system in the city, and requires a monitor to register before monitoring any system in the city. Both registrations cost $50 a year. §8‑3(b) then requires the contractor to report each undertaking on an approved form within 10 days, and §8‑3(c) makes each event that violates the section a separate offense. §8‑6(c)(1) requires each monitor to file a monthly report of all its city users. Users must register within 10 days of activating a system under §8‑5(a), and pay nothing for it under §8‑5(c).

How much are false alarm fees in Baltimore City?

Under §8‑8, as amended by Ordinance 22‑161, the first false alarm in any rolling 12‑month period is free. For a residential user the second and third cost $75 each, the fourth $150 and the fifth $250. For a non‑residential user the second and third cost $150 each, the fourth $300 and the fifth $500, so a commercial site that reaches five false alarms in a rolling year has paid $1,100. Two or more false alarms on the same calendar day arising from a single event count as one. A signal within 30 days of the original installation is not a false alarm, and neither is a signal the monitor cancels before the responding officer arrives. A $25 late fee applies if the fee is unpaid 30 days after notice, and non‑payment alone can put the system on no‑response status.

What happens after five false alarms in Baltimore?

In Baltimore City the system goes on no‑response status under §8‑9, which means that except for a hold‑up alarm or a panic alarm, police will not be dispatched to investigate a signal from that address at all. Reinstatement requires a written application and a finding by the Commissioner that the system has been repaired, upgraded or replaced and the cause corrected. Baltimore County handles the same number very differently: under §13‑11‑209(b), five false alarms in any 365‑day period allow the Administrative Officer to petition a court for injunctive relief, which may require the user to repair the system or require the user or the alarm system monitor to disconnect it. The county fee ladder also keeps climbing past five, reaching $1,000 per event for a commercial user at the fourteenth and above.

Is alarm monitoring subject to Maryland sales tax?

Yes. Md. Tax‑General §11‑101(m)(10) makes a security service a taxable service and names a security systems service expressly, so monitoring is taxed at the general 6% rate. The harder question is the cloud video or hosted access line on the same invoice, because §11‑101(m)(14) has taxed a data or information technology service described under NAICS Sector 518, 519 or 5415 at 3% since 1 July 2025. §11‑104(l)(2) resolves the overlap without asking which description fits better: if a different rate could be applied, the higher rate shall apply. Separately, equipment permanently installed into real property is generally consumed by the contractor under §11‑101(n)(2)(i) rather than resold, which means the company owes tax on its own cost of materials rather than collecting it from the customer on the installation. This is fact‑specific and worth taking to an accountant.

Is custom software cheaper than an alarm dealer platform?

Usually not for the core platform, and we would not pretend otherwise. SecurityTrax at $4,078.80 a year for a 1,400‑account dealer is good value for scheduling, work orders, inventory and recurring billing, and rebuilding that would be an expensive mistake. The arithmetic changes for the layer above it. Our Online Store package at $6,000 costs less than 1.47 years of that subscription and is then yours outright, and a Custom App at $12,000 costs 2.94 years. The case for building is not price. It is that the Maryland and Baltimore fields do not exist in any national product: the two credential clocks, the circumventional‑information access check, the ten‑day city filing per job, the monthly roster, the city registration number that has to be read out at the moment of dispatch, and a false alarm counter whose window type changes at the county line.

Sources and method

Everything above was read from primary sources on 1 September 2026. Statutes: the Maryland General Assembly’s compiled Business Occupations and Professions article, Title 18 in full (§§18‑101, 18‑102, 18‑201 to 18‑205, 18‑301 to 18‑311, 18‑3A‑01 to 18‑3A‑11, 18‑401, 18‑402, 18‑501 to 18‑504, 18‑601 and 18‑701), and Tax‑General §§11‑101 and 11‑104. Ordinances: Baltimore City Code Article 19, Subtitle 8 read in full from the City of Baltimore Law Library (§§8‑1 to 8‑11 and 8‑16 to 8‑18, as amended by Ordinances 22‑125 and 22‑161), and Baltimore County Code Article 13, Title 11, Subtitle 2 (§§13‑11‑201, 13‑11‑203, 13‑11‑207, 13‑11‑209 and 13‑11‑210). Fees, processing times and pre‑application requirements for both state credentials are from the Maryland State Police Licensing Division’s own security systems agency license and security systems technician license pages. Baltimore City registration fees, the enumerated $500 alarm‑company citations, the dedicated dispatch line and the monitor’s reporting duties are from the City’s published Information for Alarm Contractors and Monitors and from the False Alarm Reduction Association’s local ordinance directory entry for the city, both read on 1 September 2026. The Baltimore County fee schedule effective 1 January 2019 and the permit fee increase of 26 November 2018 are from the National Electronic Security Alliance’s bulletin recording them; Baltimore County’s own web pages refuse non‑browser requests and we could not re‑verify current amounts there. Market data: Census Bureau County Business Patterns 2023 county and state files, downloaded and filtered by us for Maryland and NAICS 561621, 561622 and 561612. Vendor prices and HTTP status codes were read from each vendor’s own pricing page on 1 September 2026, following redirects, and SecurityTrax’s three published worked examples were recomputed from its stated rates and reproduced exactly. Every arithmetic derivation in this article is our own and is shown in the tables so that you can check it. Nothing here is legal or tax advice; statutes move, ordinances move faster, and your attorney and your accountant should see any figure you intend to rely on.