One attendance process,
from capture to handoff.

Workers onboard with a company code and worker identity, then use their remembered device and PIN. The personal-device flow records liveness selfie and event GPS. Optional face matching has separate rollout requirements. A selfie or liveness result alone is not proof of enrolled identity.

The server checks authorization and applicable requirements before accepting a capture. It calculates geofence distance from submitted coordinates when required. This is a server decision about supplied evidence, not a guarantee that a modified device cannot provide misleading inputs.

Personal devices can queue captures while offline. The dashboard sees accepted events after synchronization, not records still on disconnected phones. A terminal rejection removes the queued capture and needs worker/supervisor follow-up when genuine attendance is missing.

The daily engine pairs events, attributes overnight shifts, applies configured breaks and overtime, and layers applied corrections over the original evidence. Missing punches remain exceptions. Configured paid-time arithmetic is an attendance input, not a universal payroll-law decision.

A permitted administrator supplies a correction and reason. The company can require a permissioned approval decision before application. This does not impose an independent second person, multi-level payroll approval or a finalized-period lock.

The reviewed-hours export shares the Timesheets engine and excludes blocking days. Named ERP layouts need payroll IDs and receiving-system mapping. Keep exclusions and receiver results alongside the file. The REST API is a separate raw-event data product.

The site kiosk identifies eligible enrolled workers through an online 1:N flow. It is a controlled rollout with notice, calibration and fallback requirements, not a standard offline option for every company.