Data privacy, security and the audit log
Updated 2026-11-07
What it is
This page explains what data PunchMe keeps about your company and employees, how the sensitive parts are protected, who can see them, and what's recorded in the audit log. Your company owns its data. For employee data, your company decides why it's collected, and Hostspica processes it on your behalf to run PunchMe.
The full legal terms are in the privacy policy and the data processing addendum.
Who uses it
| Task | Permission |
|---|---|
| See employee profiles (with bank, PAN, UAN and ESI numbers masked) | employees.view |
| Reveal full bank, PAN, UAN and ESI numbers | payroll.manage |
| Download reports as CSV | reports.export |
| See field staff locations | field.view |
| Change privacy-related settings (face match, self-service, review visibility) | settings.edit |
| Reset an employee's device or face | employees.edit |
| Turn field tracking on or off for an employee | employees.edit |
Every one of these is also limited by the person's access scope. An office-scoped HR sees only their office's employees. See Roles and permissions.
Where to find it
- Settings → Punch verification: Require face match.
- Settings → Employee self-service: what employees can edit themselves, and Show performance reviews to employees.
- Employees → (employee) → Device & face: Reset device and Reset face.
- Employees → (employee): the Reveal button next to masked numbers (needs
payroll.manage). - Reports: CSV downloads.
What PunchMe stores
| Data | Example | How it's protected |
|---|---|---|
| Company profile | Name, address, GSTIN | Normal database storage |
| Team member accounts | Name, email, password | Passwords are hashed (PBKDF2-SHA256), never stored as text |
| Employee profile | Name, email, phone, address, date of birth, emergency contact | Normal database storage, limited by role and scope |
| Bank account, PAN, UAN, ESI IP number | ••••4321 | Encrypted (AES-256-GCM) before storage. Shown masked. |
| Aadhaar | Last 4 digits only | PunchMe never asks for or stores the full Aadhaar number. |
| Face template | 192 numbers per sample | Encrypted (AES-256-GCM). No face photo is uploaded or stored. |
| Punches | Time, GPS coordinates and accuracy, mock-location flag, device, result of each check | Normal database storage |
| Field tracking pings | GPS points while checked in | Deleted automatically after 90 days |
| Field visit photos | Photo taken at a client visit | Private file storage |
| Documents | PDF, JPEG, PNG or WebP, up to 5 MB | Private file storage. Deleting a document deletes the file. |
| Payroll | Salary structures, payslips, statutory figures | Limited to whole-company roles with payroll permissions |
| Billing | Top-ups, Razorpay order and payment IDs, invoices | Card and UPI details stay with Razorpay. PunchMe never sees them. |
Pending profile changes that touch bank, PAN, UAN or ESI are encrypted the same way until HR approves or rejects them.
PunchMe runs on Cloudflare (app, API, database and file storage). Payments go through Razorpay. Emails and push notifications go through their providers. The full sub-processor list is in the data processing addendum.
How sign-in is protected
| Who | How they sign in | Protection |
|---|---|---|
| Owner and team members | Email and password | Email must be confirmed. Sign-in attempts are rate-limited. A password reset signs out every session. |
| Employees | Email and a 6-digit code | The code expires in 10 minutes, allows 5 tries, and can be resent at most 5 times in 10 minutes. |
| Employee phone | Registered on first sign-in | The account works only on that phone until HR resets it. See Device binding. |
Dashboard and app sessions renew in the background for up to 30 days after sign-in, then ask you to sign in again. Removing a team member cuts their access to the company on their next click.
Turning it on or off
| Setting | Where | Default | What it controls |
|---|---|---|---|
| Require face match | Settings → Punch verification | Off (on for Remote only) | Whether a face template is collected and checked at every punch |
| Employees can edit / Needs HR approval | Settings → Employee self-service | Per section | Whether employees can change personal, statutory, bank and document details in the app |
| Show performance reviews to employees | Settings → Employee self-service | On | Whether employees see their reviews in the app |
| Field tracking | Per employee | Off | Whether location is collected during the day. The employee must also agree in the app. |
Encryption, masking and the audit log are always on. They can't be turned off.
What happens when it's on / when it's off
| Face match on | Face match off | |
|---|---|---|
| What the app collects | A face template at enrolment and at each punch | No face data |
| Employee consent | Asked in the app before enrolment | Not needed |
| Stored templates | Kept, encrypted | Templates already enrolled stay stored until you reset them |
| Field tracking on (and employee agreed) | Off | |
|---|---|---|
| Location collected | Only while the employee is checked in | Only at punch time |
| History | Kept 90 days, then deleted | Nothing extra stored |
The audit log
PunchMe records who did what in your company: the person's name, the action, what it was done to, and when. The log can't be edited or deleted from the dashboard.
What's recorded:
| Area | Examples of logged actions |
|---|---|
| Company and settings | Company details changed, settings changed (with the names of the fields), setup completed, letterhead and help-bot changes |
| Team | Role created, edited or deleted; member edited or removed; invite sent or revoked |
| Employees | Created, edited, imported, archived; device reset; face reset; profile and document approvals |
| Sensitive data | Every reveal of full bank, PAN, UAN or ESI numbers, from the profile, payroll or a change request |
| Attendance | Attendance created or edited by staff, flagged punch approved or rejected, correction forwarded or rejected |
| Leave and expenses | Approve, reject, forward |
| Payroll | Run, finalize, mark paid, payslip adjustments and corrections, salary changes, bank and statutory file exports |
| Other modules | Loans, overtime, letters, onboarding tasks, helpdesk replies, reviews, goals, surveys, kiosks, field tracking on/off |
What's not recorded:
- Old and new values. A settings change shows which fields changed, not what they were before.
- Page views, and normal viewing of masked data.
- Report CSV downloads.
- Employees' own actions in the app (their punches, requests and profile edits are kept as records, not as audit entries).
- IP addresses.
Open Audit log in the menu (under Company, needs settings.view) to see the log, newest first: time, who, action, target and detail, 100 entries per page with Previous / Next. The log is kept for the life of your account. Office- and department-scoped people see the whole company's log, so give settings.view only to people who should.
Changing it midway
- Turning face match off. New punches stop using face. Enrolled templates stay stored. Click Reset face on each employee to delete theirs.
- Reset face. Deletes the employee's stored template straight away. The app asks them to enrol again if face match is on.
- Reset device. Unregisters the phone and signs the employee out. They register again on the next sign-in.
- Archiving an employee. They lose app access, their phone is unregistered, and they stop counting toward the bill. Their records (attendance, payslips, documents) are kept so you can still produce reports and statutory files.
- Removing a team member. Their access ends. Their past actions stay in the records and the audit log under their name.
- Changing self-service settings. Requests already waiting for approval stay in Requests and can still be decided.
Exporting and deleting data
Export. Download reports as CSV from Reports (needs reports.export). Payroll has its own exports: bank file, PF ECR, ESI, Form 24Q, Tally and journal voucher. See Payroll and Statutory compliance.
Delete one employee's personal data. The employee emails support@punchme.online from their work email with the subject "Delete my data". We confirm with your company and finish within 30 days.
Delete the whole company. The owner emails support@punchme.online from the owner's email with the subject "Delete company account". We delete the company, its users and all employee data within 30 days.
What we must keep. GST invoices, payments and billing records are kept for up to 8 years after the financial year they relate to, as Indian GST and income-tax law requires.
Automatic deletion.
| Data | Deleted after |
|---|---|
| Field tracking pings | 90 days |
| One-time punch challenges | When they expire |
| Notification delivery logs | 7 days |
Everything else is kept while your account is open, including while it's paused for billing.
Limits and edge cases
- Masked numbers show only the last 4 digits. Revealing the full number needs
payroll.manageand whole-company or matching scope, and is always logged. - Office- and department-scoped roles can't open payroll at all.
- A change to an employee's bank details always sends an email to the employee, so they notice if someone else made it.
- An archived employee's email can be reused for a new employee, but the old record isn't merged into the new one.
- The audit log records the actor's name at the time. If they later change their name, old entries keep the old name.
Related
- Roles and permissions
- Face check
- Device binding
- Field tracking
- Employee profile
- Documents
- Payroll
- Onboarding and exit
Common questions
Does PunchMe store photos of employees' faces?
No. The phone turns the face into a template of numbers and sends only that. The server stores the template encrypted and compares new scans against it.
Who can see an employee's full PAN or bank account number?
Only people with payroll.manage who can see that employee, plus the owner. Everyone else sees •••• and the last 4 digits. Every reveal is written to the audit log.
Can I see the audit log in the dashboard?
Yes. Open Audit log in the menu. Anyone with settings.view can see it.
Do you store the full Aadhaar number?
No. PunchMe stores only the last 4 digits, which is enough to identify the card without the risk of holding the full number.
How long is location history kept?
Field tracking pings are deleted after 90 days. GPS coordinates recorded with each punch are kept with the attendance record for as long as your account is open.
What happens to our data if we stop paying?
The account pauses but the data is kept. To have it deleted, the owner emails support@punchme.online with the subject "Delete company account".