Separate company access from privileged service access
Company administrators authenticate through Supabase Auth. Database row-level policies and capabilities control supported dashboard data access. Worker devices use opaque tokens stored hashed and communicate through server functions, rather than receiving a worker database session.
Administrators can enrol two-factor sign-in with an authenticator app, and a company can require it for every administrator. The requirement is enforced in the database itself: without a two-factor session, an administrator's queries return no company data.
Privileged worker and ERP functions use service access and enforce their own tenant checks. It would be inaccurate to say row-level security applies to every query regardless of execution context. Within a company, site and organizational scope limitations also matter; review roles and permissions before relying on strict site separation.
What attendance evidence is stored
Accepted attendance includes the capture timestamp, receipt time, site, coordinates, reported accuracy, liveness result and a selfie in private object storage. Event location is captured for attendance; the product does not continuously log a worker’s route between punches.
Optional face matching uses a mathematical reference generated on the device. The enrollment photograph is not uploaded, but the reference is stored server-side and a personal device can keep a secure copy for pre-checking. Accepted attendance selfies are still stored. A template-based system is not a system with no photographs or no sensitive biometric data.
Optional matching and kiosk identification
Personal-device verification compares a claimed worker identity with an enrolled reference. Shared-kiosk identification searches eligible enrolled workers at the kiosk’s site. They have separate rollout gates. Both are on the Growth plan and enabled per workspace. Kiosk identification requires internet.
Enrollment records an affirmative notice interaction and version. The appropriate lawful basis, workforce information, fallback and any impact assessment depend on the proposed use and applicable law. Controlled pilot enablement is not a declaration that those decisions are complete for wider rollout.
The client trust boundary
Face inference runs in the app; the server compares the submitted candidate with its reference and applies its decision thresholds. A modified client could submit a fabricated vector. Server-side comparison does not provide device attestation or prove the candidate came from a fresh trusted camera capture.
GPS distance checking likewise evaluates submitted coordinates; it does not authenticate the physical device position. From app version 1.0.19, each punch also carries device evidence (mock location, emulator, hooking tools, root or jailbreak, developer mode), and the server adds its own checks for repeated fixes, impossible travel and reused selfies. Each company chooses whether each signal blocks, flags or is allowed; see fake GPS and buddy punching detection. These signals are reported by the app, and Play Integrity or App Attest are not used yet.
Liveness (a blink on Starter, one randomized action on Growth) is a capture control, not certified presentation-attack resistance. No fraud-proof or accuracy guarantee is made.
Deletion, retention and operating region
An administrator can reset an active face profile, deleting its template and requiring fresh enrollment. Rejected matching attempts retain outcome metadata rather than the rejected selfie on the server. A punch the server refuses stays in the worker's rejected-records list on the phone for 30 days, with its selfie, so a supervisor can correct genuine work; it is then pruned automatically.
Attendance records, accepted selfies, templates, logs and backups need distinct retention decisions. A universal customer-configurable retention schedule or selectable data residency is not currently promised. The project’s configured Supabase region is ap-south-1 (Mumbai); confirm hosting and transfer arrangements during procurement.
Review the evidence before rollout
Supported correction and activity records help explain administrative decisions. They are not cryptographic tamper-proof storage or a guarantee of independent approval. SSO/SAML/SCIM, a contractual uptime SLA, named customer-success staffing and a completed certification are not established public offers.
For UK-specific biometric monitoring considerations, see the ICO guidance, which is under review following statutory changes. The privacy policy and data processing document describe the current documented position; deployment-specific contractual and privacy details still need confirmation.