My girlfriend's son, who lives with us 100% of the time, I believe is at risk of being taken by his crazy "father" from daycare, and the daycare is saying there is nothing they can do about it, despite him not being on the pickup list, but because he is the co-signing parent on the contract

Here is the series of events that have happened:
- Father showed up at 11pm on my apartment deck, uninvited, with 2 other people, drunk and demanding we come outside, trying to look through windows
-He said he was taking her son the next day to drive him 120km away to visit his equally as crazy mother
-He stood outside for about 5 minutes before they took off when I said I was calling the police

Now we are really concerned for our son's safety, there is no legal documentation for any sort of agreement regarding the child and his custody situation

Some background on the father: Cannot hold a stable job for too long, was unemployed for about 10 months last year, smokes weed constantly, has admitted to doing cocaine and heroin, very violent nature- he once walked down the road with a knife saying he was going to stab someone who p'd him off

We are looking for any ways to get the daycare to NOT release our son to this man until we can go to court

And I have found out from my girlfriend that they never had a paternity test done and they were never married

I have read that a daycare institution cannot release a child to anyone except a legal parent, people on the daycare pick up list, or law/childcare enforcement officials

unless I was reading the wrong documents, having no established paternity of the child is enough for the daycare to refuse pickup if he shows up? Since he cannot prove he is the father, even though he is on the contract?