Clocking & timesheets

Attendance is payroll’s foundation: the base earnings on a payslip are priced from the regular minutes recorded here. This page covers everything before the money — punching, the timesheet, and how a manager finalizes a day.

The clock

The top of the Time screen is the clock card, and its button follows your state: Clock in → (Start break / End break) → Clock out, with today’s running total beside it. Every punch confirms first, and the confirmation means it: the punch is written into today’s attendance record — this is not a button to mash.

Punched wrong? The hint below the timesheet is the answer: “Something look wrong? A manager can correct a day’s punches.” You cannot edit your own — corrections go through the manager’s Timesheets, deliberately.

The confirm box shows live verification rows only for the checks the org requires: location alone gets a Location row, scan code alone a Scan code row, and with neither required no verification rows appear at all (the punch still records your phone’s position when the phone gives one).

Before you press Clock in, the location row tracks your phone: Checking your location… while it locates, then Location found: checked when you clock in — the comparison with the branch’s range happens the moment you press Clock in — or Position unavailable if the phone cannot give one. Once you press it, if the punch does not go straight through, location shows the result: Inside the branch’s range, Outside the branch’s range, Position unavailable, or This branch has no location check set up — and the scan code row appears then too, showing No code yet — scan the display at the branch until one arrives. Whatever a branch was never itself set up for (no coordinates, no live display) always reads “not set up” — never as a pass.

When scan code is still outstanding, the confirm box offers Scan code and opens the camera: point it at the QR on the branch’s display. If the camera cannot open at all, a box appears for the same six digits typed by hand — but only when the location check has passed, because a code read down a phone line proves nothing on its own.

When a check fails and the org allows punching by exception, the button becomes Clock in as an exception: pick a type (Off-site, Field work, Remote work, Covering an unscheduled shift, Couldn’t complete verification), say what happened, and attach a photo if you have one. The punch still records — just flagged, with the full explanation waiting for the manager in Timesheets.

The timesheet

Below the clock, your timesheet lists each day by month — first in, last out, work hours, break time, overtime, and a status:

Above the timesheet sits a This month summary: Expected days, Days worked, Late days, and total work hours — computed the exact same way as the manager’s review, never recalculated here, so the two screens can never disagree. A month with no expected days at all just says “No attendance was expected this month,” never a row of zeroes.

Manager: Timesheets

Timesheets opens on the days still open — it is your queue, not a ledger; the status and staff filters switch to approved days or everything. Clicking a row opens the day’s detail panel:

• Approve — the panel’s primary action. Once approved, the day is locked against corrections: Adjust and Add interval are refused on it until someone presses Unlock.
• Bulk approve — the week-close, after you’ve scanned the anomalies: check the open days (or select all from the header, capped at 50 per run), and a bar floats up at the bottom of the page (“N selected”); its Approve and one confirmation approve them all, each day locked the same way. Days that refuse (someone still clocked in, say) stay listed with the reason; the rest complete normally.
• Unlock — beside Approve, reopens a locked day. Days that went final by age cannot be unlocked.
• Adjust — corrects a punch interval (the correction path the employee’s hint points at).
• Add interval — lives at page level, because a backfill can target anyone whose days you review — including on a day with no timesheet row yet.
• Export CSV — the review as a file: every row the filters match, named for the dates it covers (an org-wide holder on the Timesheets tab under Company ▸ Oversight gets every branch merged). Durations come out in minutes so a spreadsheet can sum them without ambiguity.

That Company tab covers the whole organization, so its days arrive a page at a time — Load more fetches the next — and it has no column sorting and no totals row, which could only describe the pages loaded so far. The export is always the whole range, so that is where the organization’s totals are.

A flagged day carries its own Exception badge in the status column, with the reason, type, verification result and any photos shown directly below the row — no second screen to open, and the same type words the employee saw. When the roster itself says this person had no shift today but punched in anyway, the row also carries an Off-roster badge — that is the roster’s own fact, independent of whatever type the employee picked, and both can appear together. Approve and bulk approve treat these rows no differently.

Clock rules

Company ▸ Settings ▸ Timekeeping (under Policy in the settings list) holds the clock rules, rounding and timesheet cadence. The snapshot notice on that screen is the most important sentence in the module: every timesheet freezes the policy as it was when the sheet was created, so changing the policy never rewrites a day already recorded. Policy edits change the future, not history — money already computed does not move because a rule changed today.

The same page also carries four clock-verification switches: Require location confirmation on punch, Require scanning a display code on punch, Allow punching by exception, and Late grace period (minutes). These switches only state what the ORG requires, never which branch is actually equipped for it — a branch with no geofence is never asked to confirm location, and a branch with no live display is never asked to scan a code. That is exactly why “Branch verification settings” below makes every branch this leaves quiet visible — see the next section.

Branch verification settings

Each branch’s own clock-in radius, enrolment key and display devices are managed lower on the same Timekeeping page:

• Pick a branch to set its Clock-in radius (metres) — the allowed range, centred on that branch’s own coordinates. The field disables itself, with a reason, when the branch has no coordinates set yet. Coordinates are set on Company ▸ Settings ▸ Locations (under Organisation in the settings list): click the branch’s row and fill in Latitude and Longitude in Edit Location (see Organization).
• The Enrolment key is a single-use pairing code for a physical display, with a copy action. Issuing a new one immediately invalidates the previous key; each key works once.
• The Display devices table lists every device’s label, last-seen time and checking-in IP, each with its own Revoke (confirmed first, and permanent).
• Regenerate device secrets issues a fresh secret to every enrolled device at that branch. Each display picks it up on its own next check-in; the previous secret keeps working until then — this is not a switch that interrupts clocking in.

When either of the two require-switches above is on, the screen lists — by name — every branch it is not actually checking yet, so nobody has to open each branch to find out:

The second row is the one most likely to be forgotten: revoking the last device, or leaving a tablet in a drawer until its 7-day lease lapses, reaches it with nobody having touched a setting. A device the system has flagged as a possible duplicate always shows “Duplicate device detected” in the device table — never a healthy status.

The branch’s clock display

Some branches require scanning a rotating code shown on-screen when punching in, to prove the person is actually at the branch — the code is shown by a spare phone or tablet propped by the door, changing every 20 seconds. The screen shows the code as a QR to scan and as six digits to read, plus a countdown and this device’s own name. Nothing else.

The QR and the digits are always the same code: staff normally scan, and the digits are there for a phone whose camera will not open — including read aloud over the phone to someone standing at the branch, which is why typing them also needs a passing location check.

Setting up a new display: open the link head office sends (or type the address yourself) on that device’s own browser. It asks for the Enrolment key (a pasted link fills this in automatically) and a Device name (e.g. “Front desk tablet”) — press Activate and it starts showing a code. The enrolment key can only be used once.

Once online, the device checks in automatically every 15 minutes, which is what lets it keep working offline for up to a week; missing a single check-in is not itself a problem. What to do if the screen shows one of these instead of a code: