Attendance records say where people were and when. Here is exactly how we keep them private to your company.
Every request is checked on the server against the company the session belongs to. Records carry their company in the database and cross-company references are rejected by database constraints — changing a URL or an ID never reveals another company’s data.
Passwords are hashed with bcrypt and checked against a list of commonly used passwords. Repeated failed sign-ins are slowed down and temporarily blocked. Sign-in errors don’t reveal whether an account exists.
Anyone can add an authenticator app (TOTP) to their account. Authenticator secrets are encrypted at rest.
Companies can let their team sign in with Google, Microsoft or LinkedIn using their own app credentials, which are encrypted at rest.
Every signed-in device is listed on your account page. Sign out one device, all other devices, or everywhere. Changing your password signs out your other devices automatically.
Admins decide what managers and employees can see and change. Permissions are enforced by the server, not just hidden in the interface.
Changes to people, roles, settings, attendance rules and exports are recorded with who, when, the IP address and device. Admins can search and filter the log.
Every page and API call is served over HTTPS with HSTS. Each company workspace gets its own certificate.
We store what attendance needs: names, work emails, roles, clock-in times, and — for punches made from the app with permission — the location of that punch. We don't sell data or show ads. Exports are limited to people with permission and are recorded in the audit log. Private workspaces are never shown to search engines.
Create your workspace in a couple of minutes. Your first 14 days are on us.