Punching in and out: how a punch is checked

What it is

A punch is an employee's check-in or check-out from the PunchMe app. Each punch goes through a fixed set of checks: a one-time challenge, a device signature, a phone integrity check, an optional face check, and a location check. The server then applies your punch rules and saves the punch, flags it for review, or refuses it.

All checks run every time. The goal is simple: the punch must come from the employee's own phone, with the employee in front of it, at the right place, right now.

Who uses it

• Employees punch from the employee app on Android or iPhone.
• Staff without their own phone punch at an office kiosk. Kiosk punches use a different flow, covered on that page.
• Dashboard users with attendance.view see the results in Attendance. Users with attendance.manage review flagged punches.

Where to find it

• Employee app: the Home tab. The big round button shows Check in, Check out, Set up face, Day off or Done.
• Dashboard: Attendance → Daily shows each punch. Attendance → Flagged punches shows the ones waiting for review.
• Manager app: the Attendance tab. Tap a record to see its checks: distance from the office, GPS accuracy, face score, liveness, mock GPS and flags.

What the employee sees

1. They tap Check in.
2. The first time, the app asks for location access. It explains why before the system prompt. If face check is on, it also asks for the camera.
3. "Getting ready…": the app asks the server for a challenge and starts finding the location at the same time.
4. "Face check…" (only if face check is on): the camera opens. The employee follows two steps, such as Blink and Turn your head left, then looks straight at the camera.
5. "Getting your location…": the app waits for the GPS fix.
6. "Verifying…": the punch goes to the server.
7. A result appears under the button: "Checked in. Have a great day!" or the reason it failed.

Check-out works the same way. Once both are done the button shows Done and the card shows "Day complete".

What is checked, in order

The server runs the checks in this order. Some failures stop the punch at once. Others are recorded as a problem and handed to your punch rules.

If the punch passes, it is saved. If any problem was set to Allow, flag for review, the record also goes to Flagged punches and reviewers get a "Punch needs review" notification.

When more than one problem is blocked, the employee sees the message for the first one.

The challenge

The challenge is a one-time code the server creates for each punch. It names the employee, expires after 60 seconds, and carries the two liveness steps the face check must use. The server picks two different steps at random from blink, turn left, turn right and smile.

Once a punch uses a challenge, it can't be used again. This stops someone from capturing a good punch and sending it again later.

The device signature

When an employee first signs in, the app creates a key inside the phone's secure hardware (Android Keystore or iPhone Secure Enclave). The private part never leaves the phone. The server keeps the public part. Each punch signs the challenge with this key. A punch from any other phone, or a copied request, fails the signature check.

Each employee has one registered phone. To move to a new phone, someone with employees.edit clicks Reset device. See Device binding.

Phone integrity

On Android, the app asks Google Play Integrity for a verdict tied to the challenge. The server checks that the phone meets Google's device integrity bar and, in production, that the app was installed from Google Play. On iPhone, Apple App Attest does the same job.

If Google's service can't be reached, PunchMe does not block the punch. An outage on Google's side should not stop your staff from working.

Timing

• The punch time is the server's time when the punch arrives, not the phone's clock.
• The date of the record is the local date at the employee's home office.
• The app waits up to 15 seconds for a location. It takes the first fix within 50 m. If none comes, it uses the best fix it got.
• The whole flow, from tapping the button to sending, must finish inside 60 seconds. If the face check takes longer, the punch expires and the employee taps again.

Check-out

Check-out finds the open check-in from the last 20 hours. This means a night shift that started at 10 pm can check out at 6 am the next day.

At check-out, PunchMe works out the minutes worked. If the day was present or late and the hours are below Half day below (hours), the day becomes a half day. See Absent and half day.

Check-out does not check the geofence. The employee can check out from anywhere. Fake GPS and GPS accuracy are still checked.

Forgotten check-outs

Every 15 minutes, PunchMe looks for check-ins open for more than 20 hours. It closes them at the shift end time, or 23:59:59 local time if the employee has no shift. The status stays as it was. The record is marked as an automatic check-out.

Turning it on or off

Punching itself is always on. What you control:

• Require face match in Settings → Punch verification. Default off (the setup guide turns it on if you choose remote only).
• Each rule in Punch verification. See Punch rules.
• Block punches on off days in Settings → Work policy. Default on.
• The geofence for each office in Setup → Offices.

Changing it midway

• Settings apply to the next punch. Punches already saved keep their status and flags.
• If you turn on Require face match while staff are checked in, they need a face check to check out. Anyone not enrolled sees Set up face first.
• If a punch is in progress when you change a rule, the new rule applies, because the rules are read when the punch reaches the server.

Limits and edge cases

• One check-in and one check-out per day. There is no break punch.
• Undoing a check-out is not available in the dashboard or the apps.
• If the day was auto-marked absent, a late check-in still works and replaces the absent mark.
• If the day was marked on leave or edited by HR, check-in is refused with "You're marked on leave today" (or the set status).
• No network? The app saves the punch on the phone and syncs it later. See Offline punch.
• The app needs location permission for every punch, and camera permission when face check is on.

Related

• Face check
• Geofence and GPS
• Punch rules
• Flagged punches
• Device binding
• Offline punch
• Kiosk
• Employee app

Common questions

Why did my staff get "Punch expired — try again"?

The challenge lasts 60 seconds. If the face check or GPS took longer, or the app was left open mid-punch, the challenge ran out. Tapping again gets a fresh one.

Can an employee punch for a colleague on their phone?

Not if face check is on. The face must match the phone owner's enrolled face. Without face check, PunchMe still knows the punch came from that employee's registered phone, but not who held it.

Does changing the phone's time or date help cheat?

No. Online punches use the server's clock. The phone's time is stored for reference only.

Why does check-out work outside the office?

The geofence is checked on check-in only. People often leave the building before they remember to check out, and field staff end the day elsewhere.

An employee can't check in on Sunday. Why?

If Block punches on off days is on, the app shows Day off with the check-in button greyed out. Check-out of an open check-in still works. If their app is out of date, the server still refuses the check-in. See Working days and holidays.

Does PunchMe upload a photo of the employee?

No. The phone turns the face into a list of numbers and sends only that. See Face check.