How a punch is checked
Buddy punching, photos held up to the camera, fake-GPS apps and borrowed phones are the everyday ways attendance gets faked. This is what PunchMe does about each one, step by step.
- 1
The phone is registered to one employee
On first sign-in, the app creates a P-256 signing key inside Android Keystore. The private key never leaves the phone; the server keeps the public half. If the employee signs in on a new phone or reinstalls the app, sign-in is refused until HR resets the device from the dashboard.
- 2
The server issues a one-time challenge
Each punch starts with a fresh challenge from the server. It is signed by the server, tied to that employee, valid for 60 seconds and accepted only once, so an old punch can't be replayed.
- 3
Google Play Integrity checks the app and device
The app asks Google Play for an integrity verdict bound to that challenge. A punch that fails it is handled by your rule for failed device checks.
- 4
A liveness check with random steps
When face check is on, the server picks two steps for this punch from blink, turn left, turn right and smile. The employee has to follow them on camera, which a photo or a recorded video can't do on cue.
- 5
The face is matched on the server
The phone turns the face into a numeric template and sends only that. No photo is uploaded or stored. The server compares it with the employee's encrypted templates and decides the match.
- 6
The phone signs the punch
The challenge is signed with the phone's Keystore key and sent with the location, GPS accuracy, the phone's mock-location flag and the phone's clock. The server checks the signature against the registered key.
- 7
Location is checked against your rules
The server checks the check-in against the office geofence, which you set as a radius or a drawn boundary. It also checks GPS accuracy against your limit and looks for a mock location reported by Android.
- 8
Your policy decides the outcome
Each failed check is blocked, flagged for HR review, or allowed, depending on how you set that rule. Flagged punches wait in the Flagged punches list until someone approves or rejects them.
When there's no network
The app still runs the liveness check (two random steps) and the face template, signs the whole punch with the phone's key and stores it encrypted on the phone. It syncs when the network is back. The server rejects offline punches older than 72 hours or dated in the future, and by default sends the rest to HR for review.
You set the rules
Each check can block the punch, flag it for review, or allow it. These are the defaults for a new company.
| Rule | When it applies | Default |
|---|---|---|
| Fake GPS | Android reports a mock location | Block |
| Outside the geofence | Check-in from outside the office boundary | Block |
| Weak GPS | Accuracy worse than your limit | Flag for review |
| Face matched only just | Above your match threshold, but by a small margin | Flag for review |
| Device check failed | Play Integrity verdict failed | Block |
| Offline punch | Punch made without network and synced later | Flag for review |
| Kiosk punch | Punch made on a shared office tablet | Allow |
A clear face mismatch is always refused. The geofence applies to check-ins on office days; GPS checks apply to every punch.
How we look after your data
No photos of faces
Face check stores encrypted numeric templates (AES-256-GCM), not pictures. HR can reset an employee's face at any time, and enrolment needs the employee's consent in the app.
Sensitive numbers encrypted
Bank account, PAN, UAN and ESI numbers are encrypted before they are stored.
Tokens kept safely on the phone
The app keeps its sign-in token encrypted with a Keystore key, and signing out deletes the punch key and any punches waiting to sync.
Field location only on duty
Field tracking runs only for employees it's turned on for, only after they agree in the app, and only while they're checked in. Location history is deleted after 90 days.
Access by role
Team members get roles with specific permissions, limited to an office or department if you like. Payroll is visible only to company-wide roles you allow.
Hosted on Cloudflare
The app, API, database and file storage run on Cloudflare. Payments go through Razorpay; we never see card details.
Your company owns its data. For employee data, your company decides why it's collected and PunchMe processes it on your behalf. Details are in the privacy policy and the data processing addendum.
The iOS app isn't released yet. When it is, it uses a Secure Enclave key and Apple App Attest in place of Android Keystore and Play Integrity. Fake-location detection on iPhone is more limited than on Android.
Found a security issue?
Email security@punchme.online with the steps to reproduce it. Please give us reasonable time to fix it before telling anyone else, and don't access other people's data, disrupt the service or run automated scans against it. We'll reply to confirm we've got your report and keep you updated while we fix it.
Try it with one office first.
Set up a geofence, add a shift and a few employees, and watch the first week of punches come in. No card needed for the trial.