The full instrument panel
Six systems that work as one — from the punch button a worker taps at 6 a.m. to the audit log an accountant reads in March.
The punch is the atom of the product. Everything else is built on it being true.
Draw work zones on a map — no hardware. A punch inside the zone auto-approves; outside is flagged for review. The verdict is computed server-side with PostGIS, so a modified phone can't fake a location the server didn't verify.
Punch with no network, kill the app, reopen days later — the punch syncs exactly once, guaranteed by idempotency keys enforced in the database. Nobody loses a workday to a dead spot.
An optional selfie rides along with the punch and lands on the approver's review card — stored privately, shared only through short-lived signed links.
Recording starts at punch-in and stops at punch-out — never on launch, never on a schedule, enforced by the server. The trail answers "where did the route go today?", is readable by the owner alone, can't be edited by anyone, and is purged after 90 days.
Shift duration per person per day, derived from real punches — with honest bookkeeping: a forgotten punch-out is marked "not tracked", never counted as a 16-hour day.
One punch-in per calendar day keeps records clean. A five-year org holiday calendar blocks accidental holiday punches — and holidays still count as paid days in payroll.
Online, away, or last-seen — honest dots on the team roster. Sentryx says "last seen 10:42", never pretends to know more than it does.
Punches from spoofed GPS are detected and refused at the server. The geofence check on the phone is advisory feedback — the database is the referee.
When GPS accuracy is worse than the geofence radius, the verdict is inconclusive — never "outside". An uncertain punch routes to a human for review; it is never auto-rejected. A weak signal is technology's fault, and we refuse to make it the worker's.
Work that closes with evidence, not with "done ✓" in a chat thread.
Medium, High and Critical — each worth different points in scoring, each visually unmistakable. Overdue and critical tasks announce themselves; nothing important hides in a list.
The manager decides what "done" means per task: a geo-tagged camera photo, presence inside the work zone, a numeric target, or nothing at all. The server enforces it — a required proof can't be skipped from any client.
Coordinates burn into the proof photo and travel as structured data. Closing inside the zone completes the task; closing outside raises a sign-off for the owner to decide — with the evidence attached.
Up to five camera photos per closure, voice notes, documents — compressed on-device, stored privately, viewable in-app by exactly the people entitled to see them.
Can't finish because someone inside the org is holding you up? Mark it blocked and name them — they're notified, and so is leadership. A blocked task stays visible work, never a private excuse note.
Notes, audio and photos along the way, plus every status change stamped with who and when. A disputed closure is reconstructed from the trail, not from memory.
Tick three people, and three independent tasks are created — each with its own dates, its own proof, its own score. No shared-blame group tasks.
Half-written a task and got pulled away? The draft persists on-device for 24 hours, per user, and clears itself on submit. iOS killing the app in the background doesn't eat your typing.
Numbers a manager can act on — and a worker can audit.
Define the KPIs your business actually runs on and weight them out of 100. Every score is a weighted average of real task performance — never a number synthesized from dimensions nobody configured.
Deadlines are to the minute. Finishing on time earns full points; finishing late — or abandoning — costs them, so walking away never beats finishing late. Owners can grant late credit back, case by case.
Team standings per period with per-KPI columns and four-period trend lines. "No data" shows as a dash — never as a zero — because "never measured" and "failed" are different facts.
Every score expands into a per-task ledger: Early +2/2 · Late −2 · 1/2 granted. When a score drops, the reason is a list you can read, not a mystery.
On-time closures over assigned work, per person and for the whole team — a plain count ratio beside the weighted score, each labelled for what it is.
Reports, attendance and payroll export as properly escaped CSV, generated on the server — the same numbers the screens show, ready for your accountant.
From verified punches to a monthly figure — no spreadsheet in between.
day rate = salary ÷ days in month. Verified worked days plus unworked holidays make the payable count. Computed on the server, with a day-by-day drill-down that always agrees with its own total.
Salary lives in its own table with owner-only access enforced by the database on every operation — not by hiding a screen. Verified against live infrastructure, not assumed.
A per-org holiday calendar the owner manages, plus national holidays built in. A holiday counts as paid unless it was already worked — one rule, applied everywhere.
The month's payroll as a server-generated CSV — payable days, day rates and totals per member, produced by the same function the screens read.
Access control enforced where it can't be bypassed: in the database.
Owner, admin, manager, assistant manager, employee. Every privileged action is checked in the database — a role rule is never just a hidden button, and an admin can't promote themselves.
Row-level security separates every organisation's data with no exceptions, verified by cross-org tests. Your attendance, locations and salaries are structurally unreadable to anyone else.
An account binds to the first phone it signs in on; a second device is refused until the owner resets it. Buddy-punching from a friend's phone stops being possible.
The owner decides, per role, who may capture screens. Android blocks captures outright; iOS blanks the app in the switcher and screen recordings — with the platform's real limits stated honestly.
Face ID or fingerprint gates the app on launch. No credentials are ever written to disk for it — it locks the session the platform already protects.
Every consequential change is recorded by database triggers, and the application can neither edit nor delete an entry — enforced by revoked permissions, not by policy documents.
Locking a member blocks sign-in and drops their open session at once. Removing one frees their phone number while every record they created stays readable — history is never the price of an offboarding.
No self-signup, no email invites. An admin creates each member; they sign in with their phone number the same day. Onboarding a new hire takes one form.
The unglamorous engineering that makes everything above dependable.
One product across both platforms, from a field worker's phone to the office iPad — same data, role-appropriate screens.
Punches and task closures queue on-device and sync idempotently. Screens with cached data show the cache with an honest offline banner — never a blank error page.
Every timestamp in the product tells business time — punch times, deadlines and scores are consistent no matter what timezone a device wanders into.
A light theme tuned for direct sunlight — where field work happens — and a dark theme for dawn shifts and warehouses. The user picks; the choice persists.
Real haptic feedback on the gestures that matter — the swipe threshold, the confirmed punch, the destructive action — tuned for one-handed use in daylight glare.
Flagged punches, sign-offs, blockers and nudges land in one bell, updated live, deep-linked to the exact item — and cleared when the item is decided.
A working pilot with your zones, your team and your KPIs — in under a week.