How does geofenced attendance work?

Each site has a latitude, longitude and a radius between ten metres and five kilometres. On clocking in, the distance from the employee’s position to each of their assigned sites is calculated, and they need to be inside the radius of any one of them — not all.

What stops somebody clocking in for a colleague?

A passkey assertion on a device that employee registered themselves. It is the first factor checked and it is checked before location, so a shared phone or a borrowed login does not get past it.

What happens if the GPS signal is poor?

A reading with an accuracy worse than a hundred metres is refused with a message saying so, because a vague position is not evidence of presence. The attempt is still recorded with its accuracy figure so HR can see the pattern.

Can a QR code be photographed and reused?

The live kiosk code rotates every thirty seconds and is signed rather than stored, so a photograph goes stale almost immediately. A printed poster code is deliberately non-expiring for convenience, and the other two factors are unaffected by that trade — the person still needs their own registered device and a real position inside the radius.

Is a failed clock-in recorded?

Yes — every attempt, pass or fail, gets its own row with the site, coordinates, accuracy, distance, whether a QR was verified, which device credential was used, and a plain-language failure reason. One row per event, not per day.

Sites & geofencing

Three factors, and none of them trusts the other two.

A passkey on the employee's own registered device. A GPS position inside one of their assigned site radii. A rotating code on the office screen. AWRA OpsHub checks all three independently, records the full evidence of every attempt whether it passed or not, and tells the person exactly what went wrong when it did.

Start free See the three factors

Radius from 10 m to 5 km · Passkey device binding · QR rotating every 30 s · Evidence stored per clock event

INDUSTRIAL AREA radius 150 m 62 m · IN 410 m · OUT

Distance is measured on the sphere, not on a flat grid, so a radius means the same thing at the equator as it does at latitude sixty. Coordinates are stored to seven decimal places — about a centimetre of resolution, which is far finer than any phone can actually report.

Independent by design

Each factor answers a different question.

The point of three is not redundancy. It is that "is this the right person", "are they in the right place" and "are they physically at the screen" are separate questions, and a system that answers one of them and infers the others is a system with a workaround.

The device Checked first

Is this the right person? A passkey assertion on a device the employee registered themselves — the phone's own biometric or screen lock, verified cryptographically rather than by a shared code.

The employee registers their own device from their attendance portal — nobody enrols on their behalf
Verification can be enabled per employee, or switched on for many at once
A lost phone's credential can be removed individually, by the employee or by HR, without disturbing their other devices
Checked before location, so a borrowed session never reaches the geofence at all
Which credential was used is recorded on the clock event

This is the factor that solves buddy-punching, which no amount of geofencing can. A colleague standing in the right car park with your password is inside the radius; they are not holding your registered phone.

The position Mandatory where sites are assigned

Are they in the right place? The distance from their reported position to each of their assigned sites, against that site's own radius.

Assigned sites are ranked by distance and whichever one they are genuinely within range of is adopted — an employee covering three branches needs to be near one, not all three
Each site carries its own radius, from ten metres for a single room to five kilometres for a site or estate
A reading with accuracy worse than a hundred metres is refused — a vague position is not evidence of presence
An employee with no assigned site skips the location check entirely, which is correct for genuinely mobile roles
The exact coordinates, accuracy and distance are all stored on the event

The code Per site, optional

Are they physically at the screen? A signed code the employee scans, verifiable only against that site's own secret. Switched on per site, because a warehouse floor and a remote depot do not need the same rigour.

The live kiosk code rotates every thirty seconds, signed rather than stored — no database write per rotation
A tolerance of one rotation either side, so clock skew never blocks an honest scan
A separate printable non-expiring code for a notice board, for sites with no screen
Two independent secrets per site — the QR secret and the kiosk address — each regenerable on its own
Both secrets are never serialised out of the record, so they cannot leak through an interface or an export

Two codes, one honest trade-off

A screen and a printed poster cannot have the same security.

So they are two different tokens with two different properties, and the difference is stated rather than blurred.

The live kiosk code

Displayed on a screen at the site — a tablet, a monitor, a spare laptop — reached by its own address, separate from the QR secret.

Rotation: Every 30 seconds

Storage: None — computed, not saved

Tolerance: ±1 rotation for clock skew

Replay window: Under a minute

A photograph of it is worthless within about a minute. The code is a signature over the current time bucket, so it is stateless — there is no rotation job to run and no row to write sixty times a minute per site, which is why it can rotate this fast at all.

The printed poster code

A print-ready page you pin to a notice board, for a site with no screen to spare. Opens the browser's own print dialogue — no export step, no PDF tool.

Rotation: None — fixed

Lifetime: Until the secret is regenerated

Trades away: Photo-replay resistance

Keeps: Device and position factors intact

Here is the honest part. A printed code can be photographed and it will still work tomorrow. That is the price of not needing a screen — and it is a price worth naming rather than hiding, because the other two factors are untouched by it. Somebody with a photograph of your poster still needs their own registered device and a real position inside your radius. And regenerating the site's secret invalidates every printed copy at once.

When it says no

A refusal that tells you what to do about it.

Somebody standing outside in the rain at seven in the morning does not need "verification failed". Every refusal names the actual problem, with the actual numbers.

Out of range You are 410 m from Industrial Area (your nearest assigned site) — you must be within 150 m of one of your assigned sites to clock in.

Signal too weak GPS signal too weak (±240 m) — move outdoors or near a window and try again.

No registered device Attendance verification is required to clock in — register a device from your attendance portal first.

Code required at this site Scan the office QR code to clock in at Industrial Area.

The interesting one — a scanned code with a bad position You scanned Industrial Area's QR code, but this device reported a location about 380 m away — so its GPS looks unreliable, not your location. Turn on precise location (or use a phone with GPS) and clock in again. This attempt is logged for HR to review.

That last message is worth dwelling on, because it is the one place this design makes a genuinely difficult judgement in public. If somebody scanned a valid code for one of their own sites, they were physically at that site — the code only exists there. But their phone reported a position hundreds of metres away, which happens constantly with cheap handsets indoors and with network-derived positions.

So the system does not accuse the employee of being somewhere else. It says the device's location signal looks unreliable, which is what the evidence actually shows — and it logs the attempt with the QR verification marked as passed, so HR can see a pattern of these and correct them properly through the attendance regularisation flow rather than through a series of arguments.

And the clock-in still stays blocked. That is the deliberate part: the position requirement is not waived just because the failure has a sympathetic explanation, because a rule with a sympathetic exception is a rule with a workaround. Explain honestly, log completely, and still refuse.

The evidence trail

One row per clock event, not one per day.

The attendance record says somebody was present. The verification log says how that was established — and it exists for the failures too, which is where it earns its place.

Verification event · clock_in · 24 Aug 2026 07:58 Passed

Employee

A. Otieno

Site adopted

Industrial Area

Coordinates

-1.3086, 36.8512

Accuracy

±12 m

Distance

62 m

QR verified

Yes

Device credential

cred_7f3a…

Attendance record

Linked

A failed attempt stores the same eight fields plus the reason it failed, in the employee's own language. So a disputed morning is a record you read rather than an argument you have — and a run of weak-signal failures at one site is a pattern you can see before it becomes a grievance.

Because it is one row per event rather than per day, a person who clocked in, out for lunch, back and home again leaves four evidence snapshots. That granularity is what makes fraud review possible at all: an aggregate day tells you nothing about which of four events was the odd one.

One more thing worth knowing about the kiosk. The site screen runs on a public address with nobody signed in, which is exactly right for a device sitting in a warehouse — and it means the guards behind attendance have to work without an authenticated user to lean on. The monthly timesheet lock is one of them: it resolves the workspace explicitly rather than from whoever is logged in, so a locked month is closed to the kiosk too. A guard that only worked for signed-in requests would have left the one unauthenticated write path wide open.

Setting up a site

Four fields and two secrets.

Small on purpose. Everything else about attendance is decided by the roster, the employee's assignments and the shift — a site only needs to know where it is and how far around it counts.

Name unique per workspace

Appears in every failure message an employee reads, so it is worth naming it the way your staff refer to it.

Latitude & longitude 7 decimal places

Validated to real coordinate ranges, and stored far finer than any handset can report.

Radius 10 – 5,000 m

Ten metres for a single room; five kilometres for an estate, a farm or a construction site.

Require QR per site

On where you have a screen or a poster and want the third factor; off where position and device are enough.

The two secrets are generated for you and regenerated independently. Rotating the QR secret invalidates every printed poster and every live code at once — which is what you want after a poster walks off a wall. Rotating the kiosk address invalidates the screen's URL without touching the codes. Keeping them separate means an incident with one does not force you to reprint for the other.

Employees are then assigned to sites — individually, or in bulk for a whole group — and a site shows how many people are attached to it, so a site nobody is assigned to is visible rather than quietly inert.

Straight answers

What verification does today — and what we can add to yours.

Attendance evidence ends up in pay and occasionally in a tribunal, so here it is exactly.

The straight answer

What AWRA OpsHub does today

Three independent factors on a clock event — a passkey on the employee's own registered device, a GPS position inside an assigned site radius, and an optional site QR code
The device factor checked first, before location, so a borrowed session never reaches the geofence
Employees registering their own devices, with individual credentials removable by the employee or by HR without disturbing their other devices
Verification enabled per employee or in bulk, and site assignment done individually or for a whole group
Distance measured on the sphere rather than a flat grid, so a radius means the same thing at any latitude
Coordinates stored to seven decimal places, and validated to real coordinate ranges
A per-site radius from ten metres to five kilometres, for anything between one room and an estate
Assigned sites ranked by distance with the nearest in-range one adopted — an employee covering three branches needs to be near one, not all
Readings worse than a hundred metres of accuracy refused, because a vague position is not evidence of presence
Employees with no assigned site skipping the location check, which is correct for genuinely mobile roles
A live kiosk QR rotating every thirty seconds, signed rather than stored, with a one-rotation tolerance so clock skew never blocks an honest scan
A separate printable non-expiring poster code for sites with no screen, using the browser's own print dialogue
Two independent secrets per site, each regenerable on its own, and both kept out of every serialised form of the record
Every attempt recorded — pass or fail — with site, coordinates, accuracy, distance, QR result, device credential and a plain-language reason
One evidence row per clock event rather than per day, so a four-event day leaves four snapshots
A specific honest message when a valid QR scan meets an implausible position: the device's signal is blamed rather than the employee, the attempt is logged with the QR pass recorded, and the clock-in still stays blocked
The monthly timesheet lock enforced on the unauthenticated kiosk path too, by resolving the workspace explicitly rather than from a signed-in user

More we can add to your workspace

A map picker for placing a site and dragging its radius, instead of entering coordinates by hand
Mock-location and rooted-device detection, refusing a position from a spoofing app
A live site board showing who is currently clocked in at each site, and a headcount against the roster
Geofenced clock-out reminders — a notification when somebody leaves a site radius while still clocked in
Face or photo capture at the moment of clocking, stored alongside the existing evidence
A site-level exception report ranking sites by failed-attempt rate, so a badly placed radius or a weak-signal building surfaces on its own
Offline clock-in on the site kiosk, queued and verified when the connection returns
Beacon or Wi-Fi network presence as a fourth factor, for indoor sites where GPS is genuinely unreliable
A per-site accuracy threshold, so a dense urban building can be given more tolerance than an open yard
Automatic regularisation of the scanned-QR-but-bad-GPS case, raising the correction request itself instead of leaving it to be filed
Shift-aware geofencing, so a site only accepts clock-ins during the hours a shift is rostered there
A scheduled digest of failed verifications, so the pattern reaches somebody without the log being opened

Where we point you to a specialist

Whether you may track an employee's location, and on what notice and consent, is a data-protection question that varies by jurisdiction. We give you the controls; the lawful basis for using them is yours to establish.
We will not build a way to clock somebody in without their own registered device present. That is the factor that makes the rest meaningful, and an override would quietly remove it.
A disciplinary conclusion from attendance evidence is a management decision. We record what happened, completely and in both directions; we do not judge it.
We will not waive the position requirement because a failure has a sympathetic explanation. We will explain the failure honestly and log it fully, and the correction goes through the regularisation flow where somebody accountable approves it.
Continuous background location tracking is not something we will build. Verification happens at a clock event, which is the only moment a location is needed.

A map picker and mock-location detection are the two most-asked items here, and both attach to the site record and the evidence row that already exist. Tell us which matters most for your sites and we will come back with a written spec, a timeline and a price.

One trade-off to decide deliberately at setup: the printed poster code does not expire, so a photograph of it keeps working until you regenerate the site secret. That is the price of not needing a screen, and the device and position factors are unaffected — but if a site has a screen to spare, the rotating kiosk code is the stronger choice.

Around the clock event

What the evidence feeds.

Attendance The register itself, the manual entry path, the bulk import and the correction flow. Shifts & Rosters The shift that decides lateness against its grace period, and whether the day crosses midnight. Timesheets & Overtime The monthly lock this path has to respect, even with nobody signed in. Passkeys & Sign-In The same credential technology behind the device factor, used for platform access. Device Trust How devices are registered, trusted and revoked across the wider platform. Self-Service Portals Where an employee registers their device, clocks in and files a correction.

Questions, answered

Sites & geofencing FAQ.

What actually stops one person clocking in for another?

The passkey on a device that employee registered themselves, checked before anything else. Geofencing cannot solve this on its own — a colleague standing in the right car park with your password is inside the radius. They are not holding your registered phone.

Can somebody photograph the QR code and use it later?

Not the kiosk one — it rotates every thirty seconds and is a signature over the current time window, so a photograph is stale almost immediately. A printed poster code deliberately does not expire, which is the price of not needing a screen; the device and position factors are unaffected, and regenerating the site secret invalidates every printed copy at once.

What if an employee works across several branches?

Assign them to all of them. Their sites are ranked by distance and whichever one they are genuinely within range of is adopted for that clock event — they need to be near one, not all.

What about roles with no fixed site at all?

Leave them unassigned and the location check is skipped entirely, which is the correct behaviour for a driver or a field engineer. The device factor still applies, so it is still verifiably them.

Our building has terrible indoor GPS. What happens?

Readings worse than a hundred metres of accuracy are refused with a message saying so, and every refusal is logged with its accuracy figure — so the pattern at that building becomes visible rather than anecdotal. A per-site accuracy threshold and indoor beacon presence are both on the list above.

Somebody scanned the code but the app said they were far away. Whose fault is that?

The device's, and the message says so rather than accusing the employee. Scanning a valid code proves they were at the site, so an implausible position means an unreliable signal. The attempt is logged with the QR pass recorded, and the clock-in still stays blocked — corrections go through the regularisation flow where somebody accountable approves them.

Do you track people's location continuously?

No, and we will not build that. A position is read at the moment of a clock event because that is the only moment it is needed, and nothing runs in the background between them.

The kiosk has nobody logged in. Is that a hole?

It is deliberate — a screen in a warehouse should not hold a session. It does mean the guards have to work without a signed-in user, which they do: the monthly timesheet lock, for instance, resolves the workspace explicitly rather than from whoever is logged in, so a locked month is closed to the kiosk exactly as it is to the browser.

Ready when you are

Know who clocked in, and know how you know.

Their own device, a real position inside your radius, a code that goes stale in half a minute — and a full evidence snapshot of every attempt, including the ones that failed.

Get started free Talk about your sites