---
title: "Clocking & timesheets"
description: "Punching in and out, the monthly timesheet, the manager's review console, and the policy and verification settings."
---

> Documentation Index
> Fetch the complete documentation index at: https://peoplematter.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Clocking & timesheets

Attendance is payroll's foundation: the base earnings on a
[payslip](/en/docs/payroll/payslip/) are priced from the regular minutes recorded here.
This page covers everything before the money — punching, the timesheet, and how a
manager finalizes a day.

## The clock

The top of the **Time** screen is the clock card, and its button follows your state:
**Clock in** → (**Start break** / **End break**) → **Clock out**, with today's running
total beside it. Every punch confirms first, and the confirmation means it: the punch
is written into today's attendance record — this is not a button to mash.

Punched wrong? The hint below the timesheet is the answer: "Something look wrong?
A manager can correct a day's punches." You cannot edit your own — corrections go
through the manager's [Timesheets](#manager-timesheets), deliberately.

The confirm box shows live verification rows only for the checks the org requires:
location alone gets a **Location** row, scan code alone a **Scan code** row, and with
neither required no verification rows appear at all (the punch still records your
phone's position when the phone gives one).

Before you press **Clock in**, the location row tracks your phone: **Checking your
location…** while it locates, then **Location found: checked when you clock in** — the
comparison with the branch's range happens the moment you press **Clock in** — or
**Position unavailable** if the phone cannot give one. Once you press it, if the punch
does not go straight through, location shows the result: **Inside the branch's range**,
**Outside the branch's range**, **Position unavailable**, or **This branch has no location
check set up** — and the scan code row appears then too, showing **No code yet — scan the
display at the branch** until one arrives. Whatever a branch was never itself set up for
(no coordinates, no live display) always reads "not set up" — never as a pass.

When scan code is still outstanding, the confirm box offers **Scan code** and opens the
camera: point it at the QR on the branch's display. If the camera cannot open at all,
a box appears for the same six digits typed by hand — but only when the location check
has passed, because a code read down a phone line proves nothing on its own.

When a check fails and the org allows punching by exception, the button becomes
**Clock in as an exception**: pick a type (Off-site, Field work, Remote work,
Covering an unscheduled shift, Couldn't complete verification), say what happened,
and attach a photo if you have one. The punch still records — just flagged, with the
full explanation waiting for the manager in **Timesheets**.

## The timesheet

Below the clock, your **timesheet** lists each day by month — first in, last out, work
hours, break time, overtime, and a status:

| Status | Meaning |
| --- | --- |
| **In progress** | An interval is still open. |
| **Open** | The day ended; waiting to be finalized. |
| **Final** | Approved by a manager — or aged out past the deadline. Payroll prices from it. |

> **"Final" does not always mean someone pressed Approve**
>
> Days still Open past the deadline go Final **automatically**, judged in the
> location's own timezone — a timesheet cannot stay open forever waiting for a click.
> So "Final" does not necessarily mean "a human reviewed this".

Above the timesheet sits a **This month** summary: **Expected days**, **Days worked**,
**Late days**, and total work hours — computed the exact same way as the manager's
review, never recalculated here, so the two screens can never disagree. A month with
no expected days at all just says "No attendance was expected this month," never a
row of zeroes.

## Manager: Timesheets

**Timesheets** opens on the days still **open** — it is your queue, not a ledger;
the status and staff filters switch to approved days or everything. Clicking a row
opens the day's detail panel:

- **Approve** — the panel's primary action. Once approved, the day is locked against
  corrections: **Adjust** and **Add interval** are refused on it until someone presses **Unlock**.
- **Bulk approve** — the week-close, after you've scanned the anomalies: check the open
  days (or select all from the header, capped at 50 per run), and a bar floats up at the bottom
  of the page ("N selected"); its **Approve** and one confirmation approve them all, each day
  locked the same way. Days that refuse (someone still clocked in, say) stay listed with the
  reason; the rest complete normally.
- **Unlock** — beside Approve, reopens a locked day. Days that went final by age cannot
  be unlocked.
- **Adjust** — corrects a punch interval (the correction path the employee's hint
  points at).
- **Add interval** — lives at page level, because a backfill can target anyone whose days
  you review — including on a day with no timesheet row yet.
- **Export CSV** — the review as a file: every row the filters match, named for the dates
  it covers (an org-wide holder on the Timesheets tab under Company ▸ Oversight gets every
  branch merged). Durations come out in minutes so a spreadsheet can sum them without
  ambiguity.

That Company tab covers the whole organization, so its days arrive a page at a time —
**Load more** fetches the next — and it has no column sorting and no totals row, which
could only describe the pages loaded so far. The export is always the whole range, so that
is where the organization's totals are.

A flagged day carries its own **Exception** badge in the status column, with the
reason, type, verification result and any photos shown directly below the row — no
second screen to open, and the same type words the employee saw. When the roster
itself says this person had no shift today but punched in anyway, the row also
carries an **Off-roster** badge — that is the roster's own fact, independent of
whatever type the employee picked, and both can appear together. Approve and bulk
approve treat these rows no differently.

## Clock rules

Company ▸ Settings ▸ **Timekeeping** (under Policy in the settings list) holds the clock rules, rounding and timesheet cadence. The
snapshot notice on that screen is the most important sentence in the module: **every
timesheet freezes the policy as it was when the sheet was created, so changing the
policy never rewrites a day already recorded.** Policy edits change the future, not
history — money already computed does not move because a rule changed today.

The same page also carries four clock-verification switches: **Require location
confirmation on punch**, **Require scanning a display code on punch**, **Allow
punching by exception**, and **Late grace period (minutes)**. These switches only
state what the ORG requires, never which branch is actually equipped for it — a
branch with no geofence is never asked to confirm location, and a branch with no
live display is never asked to scan a code. That is exactly why "Branch verification
settings" below makes every branch this leaves quiet visible — see the next section.

## Branch verification settings

Each branch's own clock-in radius, enrolment key and display devices are managed
lower on the same **Timekeeping** page:

- Pick a branch to set its **Clock-in radius (metres)** — the allowed range, centred
  on that branch's own coordinates. The field disables itself, with a reason, when
  the branch has no coordinates set yet. Coordinates are set on Company ▸ Settings ▸
  Locations (under Organisation in the settings list): click the branch's row and fill in
  **Latitude** and **Longitude** in **Edit Location** (see
  [Organization](/en/docs/organization/)).
- The **Enrolment key** is a single-use pairing code for a physical display, with a
  copy action. Issuing a new one immediately invalidates the previous key; each key
  works once.
- The **Display devices** table lists every device's label, last-seen time and
  checking-in IP, each with its own **Revoke** (confirmed first, and permanent).
- **Regenerate device secrets** issues a fresh secret to every enrolled device at
  that branch. Each display picks it up on its own next check-in; the previous
  secret keeps working until then — this is not a switch that interrupts clocking in.

When either of the two require-switches above is on, the screen lists — by name —
every branch it is not actually checking yet, so nobody has to open each branch to
find out:

| Situation | Warning |
| --- | --- |
| Location required, but the branch has no geofence configured (or no coordinates) | Enabled, but this branch has no geofence configured |
| QR required, but the branch has no display device available | Enabled, but this branch has no display device available |

The second row is the one most likely to be forgotten: revoking the last device, or
leaving a tablet in a drawer until its 7-day lease lapses, reaches it with nobody
having touched a setting. A device the system has flagged as a possible duplicate
always shows **"Duplicate device detected"** in the device table — never a healthy
status.

## The branch's clock display

Some branches require scanning a rotating code shown on-screen when punching in, to
prove the person is actually at the branch — the code is shown by a spare phone or
tablet propped by the door, changing every 20 seconds. The screen shows the code as a
**QR** to scan **and** as **six digits** to read, plus a countdown and this device's
own name. Nothing else.

The QR and the digits are always the same code: staff normally scan, and the digits are
there for a phone whose camera will not open — including read aloud over the phone to
someone standing at the branch, which is why typing them also needs a passing location
check.

**Setting up a new display:** open the link head office sends (or type the address
yourself) on that device's own browser. It asks for the **Enrolment key** (a pasted
link fills this in automatically) and a **Device name** (e.g. "Front desk tablet") —
press **Activate** and it starts showing a code. The enrolment key can only be used
once.

Once online, the device checks in automatically every 15 minutes, which is what lets
it keep working offline for up to a week; missing a single check-in is not itself a
problem. What to do if the screen shows one of these instead of a code:

| On screen | What it means |
| --- | --- |
| **Please reconnect** | This display hasn't reached the server in a while, usually a network drop — check its connection; the screen recovers on its own once it's back online, no re-enrolling needed. |
| **Duplicate device detected** | The system has detected what looks like a second copy of this same device running, and has permanently stopped showing a code. This isn't something to fix at the tablet — ask an administrator to revoke it and enrol it again. |

Source: https://peoplematter.app/en/docs/time/index.mdx