No badges, no "bank-grade" anything. Just what the system actually does, in words you can check against what you see on screen.
Signing in to the management dashboard sends a six-digit code to your email address, good for ten minutes. You can mark a device as trusted so your own phone doesn't ask every time — and untrust it from anywhere if you lose it.
If a code can reach you, a twelve-character password is enough. For a break-glass account with no email — where the password is the only lock — the minimum is sixteen. The rule tightens where the second factor is missing rather than applying one blanket number.
Disabling someone, changing their access or resetting a password takes effect on their very next action, not whenever their session happens to expire. Nothing important is cached inside a login token.
Sign-in, code entry, password resets and invitations are all throttled, so neither guessing a code nor flooding somebody's inbox is practical.
The honest version, because staff will ask and you need to be able to answer them.
When somebody clocks in or out, the app asks their phone where it is once, and compares it to the shop's tag. If they're inside the radius you set, it goes through.
A refusal is recorded with the real numbers — how far away, how much was allowed, and how good the phone's fix was — so you can tell a genuine problem from a radius set too tight.
It also separates "the phone couldn't get a position" from "they weren't there". One is fixed in phone settings; the other is a conversation.
There is no background tracking. The app cannot see where anybody is between clocking in and clocking out, or on their day off. It asks at the moment of the tap and at no other time.
No location history is built. No journeys, no dwell times, no map of anyone's movements.
And it's optional per shop — the check only applies where you've given that shop's tag a location. Leave it off and clocking still works.
Their own hours, their own payslips, their own documents. A member of staff cannot see a colleague's pay, a colleague's passport, or anything about another shop.
Can be narrowed to specific screens — build and publish the rota, say, with no access at all to wages, passport scans or right-to-work checks. Both reading and writing are restricted, because either alone leaks.
See the shops they're assigned to. The account owner sees everything in their own account — and nothing in anybody else's, ever.
We run the platform, which is not the same as having your data. The screens we use to keep the service running — server health, backups, the app build — are a separate system with a separate permission from the one that administers your account.
Payslips, invoices and right-to-work scans are the things you cannot simply re-enter, so they are the things we keep three times.
Documents sit in Cloudflare's object storage, served to you over TLS and never from a public URL — every file is fetched through a short-lived signed link.
A second copy is mirrored onto the server itself, so losing access to the storage provider doesn't lose the documents.
A third copy goes to separate off-site storage in the EU, encrypted before it leaves. Only that copy is encrypted, deliberately: two readable copies mean a lost passphrase costs you the backup, never the data.
A full dump every night, kept on a rolling window, plus a standby copy kept in step with the live system at a different provider entirely. Restores are tested — not assumed.
Every backup job reports whether it ran. A job that quietly stops is the one that fails you, so silence is treated as a failure and raises an alert rather than passing for success.
We don't sell your data, share it with advertisers, or feed your staff records into any model. It exists to run your rota, your pay and your screens.
The application and database run on a dedicated server in Germany; documents and the encrypted off-site copy are held in the EU. Nothing is in a shared database with another business's records.
Changes to pay, punches, access and settings are written to an audit trail with the person and the time, kept for 24 months. That's what answers "who changed this" six months later.
Cancel whenever you like and export your pay records before you go. When an account closes we take a final copy, remove the live data, and delete that copy after 30 days — long enough to recover a mistake, short enough not to be a liability.
Your accountant, insurer or a bigger customer may want some of this in writing — who processes what, and on what terms. Ask us and we'll put it in front of you properly rather than pointing at a web page.
No. Your location is checked once, at the moment you clock in or out, and only to confirm you're at the shop. It isn't recorded between those moments, on a break, or on a day off — and the app can't ask for it while it's closed.
No. You see your own hours, your own payslips and your own documents. Colleagues see theirs. Managers see their shops.
Because that's where your wages go. You can see what's on file and ask your manager to change it — which means an account change always passes through a second person.
It's stored to prove your right to work and is visible only to you and your managers. It's held in three places so it can't be lost, and the off-site copy is encrypted.
Tell your manager. Your trusted-device status can be removed immediately, and your next sign-in from anywhere needs the emailed code again.
If there's something your accountant or your staff need to know that isn't on this page, ask. We'd rather write it down than have you guess.
Ask a security question See pricing