Frequently asked questions

A standard tablet at each clocking point: an Android tablet (Android 8.0 or later, ideally 10 to 11 inch with a front camera) running the TempClock kiosk app, or any tablet with a front camera running the kiosk in the browser, an iPad included. Add a lockable stand, permanent power and a reliable connection: Wi-Fi or, at a site with no usable Wi-Fi, a tablet with 4G mobile data (Android switches to mobile data only when the tablet has no Wi-Fi connection, not when the Wi-Fi is up but its internet is down). Printed QR badges are optional. NFC and RFID cards are coming soon. There are no proprietary terminals, and workers need no app to clock in. For a larger rollout we can rent you terminals and supply stands, quoted for your sites. USB card readers are coming soon.

A single small site can be configured in a day. For a multi-site agency we plan a phased go-live with you: configuration and rate checks and a Sage test import, then your largest site goes live first, with us alongside through the first weeks, and the other sites follow one at a time. It is a live go-live, not a pilot or a free trial. For four sites that is about 12 weeks from contract to all four sites live. We agree the timetable with you at the start. The Go-live KPIs page measures the first site against your paper records: no-shows, missed clock-outs, corrections, approvals and kiosk speed.

Setting up your sites, pay and charge rates, pay week and Sage codes; importing workers from a spreadsheet (with a preview that checks every row first); enrolling workers for face clock-in or setting PINs; installing kiosks; training coordinators, payroll and client supervisors; and close support at your largest site when it goes live first, with the first pay week's totals checked with your payroll lead before the other sites follow. You can keep paper running alongside at any site for as long as you want.

Yes. We walk you through the full system with sample data shaped like yours: your sites, your rates and your pay week. Talk to us and we will arrange it.

Not yet. NFC and RFID cards are coming soon: card clocking (NFC or RFID cards, tapped on an NFC tablet or read by a USB card reader) will be switched on once it has been tested on our terminals. Until then workers type their badge number on the kiosk or tap Scan badge and hold a printed QR badge up to the tablet camera, then the face match or PIN follows. You print the QR badges yourself from the Badges page, so there is nothing extra to buy. Where you switch on phone clock-in, workers can also clock in on their own phone.

Yes. A night shift is one record from clock-in to clock-out, priced with night rate bands that can run across midnight. The October and March clock changes are paid on the hours actually worked. Mark a site as 24/7 and a kiosk that stops checking in raises an alert at any hour. Live activity, the fire register and the dashboards show who is on site through the night. If a worker forgot to clock out after a late shift and badges in for their next booked shift at the same site, the kiosk closes the old shift at its booked end as a missed clock-out for the office to check, and clocks them in. One limit to know: clock times are kept in UK local time, so a clock made between 01:00 and 01:59 on the night the clocks go back is read as the second 01:00, and a shift that really ended in the first one is corrected in the usual way.

Live activity refreshes every 30 seconds. A booked worker who has not clocked in after the grace period appears on the Not clocked in list, day or night, with an alert on screen. Press Find cover to see up to 10 free, eligible workers ranked best first, and offer the shift to the ones you pick by email, or by text with the SMS add-on. The first to accept is booked.

On one Exceptions screen, with a tab each for late starts, no-shows, early finishes, missing clock-outs, excessive hours, missed breaks, disputes, shifts the client has not approved, flagged clocks, clocks on cancelled bookings, clocks into a locked week and offline conflicts. You can filter by site, export each tab, and dismiss an item only with a reason.

Close week takes you down one page for each client: check the exceptions, approve the remaining shifts (a Coordinator approves on Timesheets, or an Admin on Close week; the Payroll role cannot approve), lock the week with a reason, then export the Sage 50 Payroll file and the charge schedule for invoicing. Once a week is locked its figures are frozen and never change, on screen, in the files or through the API. A clock that arrives after the lock, for example from a kiosk that was offline, appears on the next week's page as an adjustment. Only a super admin can unlock a week, with a reason.

Yes. Close week produces the import file in Sage 50 Payroll's own Employee Payment Hours and Rates layout (Employee Reference, Payment Reference, Hours, Rate), from approved shifts only, with one line per worker per Sage payment. Hours times Rate equals the pay TempClock worked out, to the penny. Every shift left out is listed with the reason, each export is recorded, and exporting the same week again needs a reason. We test-import the file with you during set-up. For client invoices the charge schedule produces Sage 50 Accounts and Xero files, and can send a closed week's invoices straight to Sage Accounting (cloud) through Sage's API and read back whether they are paid. For Sage Payroll (cloud) there is a list to enter by hand, because Sage documents no import of pay values for its UK cloud payroll.

Yes. The public REST API (version 1.3) covers workers, availability, requirements and bookings, clocks, approved timesheets and payroll by pay week, with an OpenAPI description. Each key has its own access levels, an optional expiry date and its own rate limit, and pay figures need their own access. Signed webhooks tell your other systems when a shift is approved, rejected, queried or amended, a pay week is locked, a payroll export is made, or a booking is made, changed or cancelled. See the developer docs.

Each agency user has a role. Coordinators handle workers, shifts, no-shows, exceptions, corrections and shift approvals, without pay figures. Payroll closes the week, locks it and runs the exports and the charge schedule. There are also Read-only and Admin users. Client users in the portal are Approvers, Supervisors or Viewers, limited to the sites ticked for them, and never see pay rates. Every refusal is recorded in the audit log, and two-factor sign-in is available on every console.

The worker presents their badge (typed, or scanned from a printed QR badge; NFC and RFID cards are coming soon), then looks at the camera. The photo is matched by a major cloud provider's face-matching service, hosted in Ireland, against that client's enrolled workers, and the clock is accepted only if the best match is the badge holder. The photo is then discarded. In our production measurements the face match itself took a median of 0.36 seconds (95% within 0.58 seconds). From one worker to the next at the same kiosk, the fastest gap was 8 seconds and a good queue ran at about 11 seconds, so we plan on about 4 workers a minute per kiosk at a shift change. The Kiosk fleet page times every real clock, so you can check that figure at your own sites.

The worker gets a one-time link (by email, text or a QR code shown by a supervisor), reads the face clock-in notice in English, Polish, Romanian or Lithuanian and chooses whether to agree. If they agree, a short video selfie on their phone passes a liveness check that proves a real person is present, and their face template is created. If they decline, they set a PIN instead.

Workers can clock in with their badge and PIN; each PIN clock takes a photo and is flagged for review. If the face-matching service is unreachable the kiosk switches to PIN-only and alerts you. If a face-verified clock cannot be sent, the kiosk keeps it and sends it, with the original time, when the connection returns. If the kiosk cannot reach the server at all, it says so and points people to the paper sign-in sheet, which you key in afterwards on the Backfill page.

It makes it much harder, but no system makes it impossible. A face clock only succeeds when the face matches the badge holder, and a mismatch is refused and logged. You can switch on an optional anti-photo movement check at the kiosk, and set clients to require a valid match before a clock is accepted. PIN clocks remain available as a fallback, so every PIN clock is photographed and listed on the Exceptions page for review.

Each client has its own match threshold. The default is 90%, which keeps the risk of a false match low at the cost of an occasional retry in poor lighting. You can change it in the face recognition settings; changes take effect immediately. In our production measurements about 18% of match attempts were refused and retried, mostly in poor lighting or with the face at an angle.

Matching and the enrolment liveness check use a major cloud provider's face-matching service, hosted in Ireland (eu-west-1). We do not build our own face model. Our privacy policy and data processing agreement name the provider as a sub-processor.

Face templates cope well with glasses, facial hair and hairstyle changes. If a worker starts failing to match, a coordinator sends them a re-enrolment link and they take a fresh video selfie on their phone.

The face template is held by the face-matching service in Ireland, in a separate collection for each client. TempClock keeps the enrolment reference photo and the photo taken at each PIN clock or phone clock-in, in your instance hosted in France, visible only to users with access to that worker or site. The photo taken at a face clock-in is not kept. Face templates and reference photos are deleted within 4 hours of a worker being made inactive, and at once if they withdraw consent. PIN clock photos are kept for 90 days by default; you set the periods in Data retention.

Yes. Each site is a location with its own address, geofence, kiosk settings, rate rules and site rules, and can be marked as running 24/7. Every clock is recorded against the site where it happened. Workers can move between sites and their hours are split by site for payroll and invoicing. Everything flows into one agency console.

Yes. In the client portal your clients approve, reject, query or propose an amendment to their workers' hours, one at a time, a selection, or a whole week at a large site in one go, limited to the sites each user is allowed to see. When a client rejects a shift, you can correct it and send it back for approval, or accept the hours with a recorded reason. Portal users are Approvers, Supervisors or Viewers: only Approvers approve and see charges, and nobody in the portal sees pay rates. You can require client approval before hours go to payroll.

Yes, if you switch on worker self-service for a client. Workers sign in with a one-time link and can see their shifts, confirm or decline them, accept cover offers, set their availability, request time off and check their hours, in English, Polish, Romanian or Lithuanian. Clocking in from a phone is a separate option, off by default; when on, it needs a face match, GPS within the site geofence, a registered phone and a booked shift.

The kiosk has separate flows for visitors and contractors. Visitors enter their name, company and who they are visiting. Contractors also record their trade, permit number and induction status. Both appear on that site's fire register until they sign out.

Timesheets, payroll with pay elements, margin, spend, charge schedules, attendance and fulfilment, overtime, exceptions, working time, AWR tracking, reliability, cancellations, occupancy, workforce insights and the Go-live KPIs for a new site. Most can be exported as CSV, the main ones as Excel or PDF, and several can be emailed on a schedule.

Yes. Rate rules set pay and charge rates per client, site, job role or cost code, with dates, and with overtime (daily and weekly), weekend, Sunday, bank holiday and night premiums as a multiplier or a fixed rate. Charge rates are kept separate from pay rates at every level. You can import a rate card from CSV with a preview step.

You set daily and weekly thresholds in rate rules. Daily overtime is the time beyond a set number of hours in one shift; weekly overtime applies once a worker passes the weekly threshold in your pay week, counting paid time in clock-in order. A shift that is not paid, such as one the client rejected, does not count towards the threshold. The payroll screen, the Sage file and the overtime report all use the same calculation.

Yes. Pay rates and charge rates are kept separately. The margin report shows pay cost, charge and margin by client, site and worker, and warns you about shifts that have no charge rate. Clients on the portal only ever see charges.

Each site can have a map pin and a radius. When a kiosk clocks someone, TempClock records the device location and the distance from the site. In warning mode an off-site clock is recorded and flagged; in strict mode it is refused, and a strict site must have a map pin. Phone clock-in, where switched on, always requires the phone to be inside the site geofence.

Yes. Clock messages show a notice at the kiosk. You can target them at workers, sites or clients, show them at clock-in, clock-out or both, and set start and end dates.

Short questions shown at clock-in or clock-out, such as a fit-to-work declaration or a safety briefing check. A question can be set as blocking, so a particular answer refuses the clock-in and asks the worker to see a supervisor. Responses are kept per worker and can be exported.

The kiosk screens are available in English, Polish, Romanian and Lithuanian. You set a default language for each site, and the kiosk switches to a worker's own language once their badge is entered. The face clock-in notice is in the same four languages. Messages and survey questions you write are shown as you wrote them. Worker names with accented letters are stored correctly.

Yes. From Workers, Privacy (GDPR), an authorised user can produce a subject access export for a worker: a ZIP with their record, clock events, documents, photos and audit entries. The same page records or withdraws consent, deletes face data and anonymises leavers. The action is logged.

Yes, on the agency console, client dashboard and client portal. It uses an authenticator app, with 10 single-use backup codes and optional trusted devices that are cancelled when you sign out everywhere. Each console can be made compulsory from a set date, and a new instance makes it compulsory on the agency console 14 days after set-up.

You define document types (right to work, DBS, CSCS, driving licence and so on) and upload documents per worker with expiry dates. TempClock alerts you before and when a document expires.

Only if you switch it on. The kiosk camera feed is off by default and is switched on per site. When on, agency staff and that client's own users can watch it, and frames are deleted after 24 hours by default.

TempClock costs £150 per active site per month, with every feature included. On top, each month there is a per-worker charge only for workers who clock a shift on 2 or more different days in that month: 45p each for the first 50 such workers, 35p each for workers 51 to 250 and 25p each above 250. Workers who clock on only one day that month are not charged. At 10 or more sites the site charge drops by 25% to £112.50. All prices exclude VAT.

With 4 sites the site charge is £600 a month. With 600 workers clocking on 2 or more days in a month the per-worker charge is £180, so £780 in total; with 1,200 workers it is £930; with 1,500 workers it is £1,005 (all ex VAT). Use the calculator on the pricing page for your own numbers.

Email notifications are included. Text messages to workers (shift reminders, offers, confirmations) are an optional add-on at £25 a month, pro rata for the days it is on, plus 8p per SMS segment sent. It is off unless you ask for it.

Your own tablets work with TempClock. For a larger rollout we can also rent you kiosk terminals, supply floor stands and wall mounts, add 4G mobile data to a rented terminal for a site with no usable Wi-Fi, and set up and train your team at your sites. These are quoted for each customer, so talk to us with your sites and headcount. USB card readers are coming soon.

Yes. Each additional site is £150 a month (less 25% at 10 or more sites). If you deactivate a site, billing for it stops at the end of that billing month.

An active location in your account, where workers can clock in. Deactivated locations are not charged.

Raise a ticket from Help & support in any console, or with the kiosk's Report an issue button. You can also reach us by phone on 0330 520 4321 and by email in business hours (Monday to Friday, 08:00 to 18:00 UK time), and by email out of hours. P1 issues (clocking stopped at a site, the system down, or a suspected data breach) get a first response within 30 minutes from 07:00 to 22:00 UK time and within 2 hours overnight, every day of the year, with a fix or workaround within 4 hours of the response. Other issues are handled in business hours with published response times. See our terms.

Yes. Every page has a Need help? link next to its title that opens the step-by-step guide for that page. The support centre has 123 guides, with a starting guide for each role: coordinators, payroll, client supervisors and workers.

If a kiosk stops checking in for 5 minutes, an email alert goes to your admins and to our support team; at a site marked 24/7 this happens at any hour. The Kiosk fleet page shows each kiosk's last contact, app version and clock times.

TempClock is built to support your UK GDPR obligations as controller: a versioned face clock-in notice in four languages with recorded consent, a PIN alternative, retention periods you set, subject access exports, anonymisation and an audit log. We act as your processor under a data processing agreement, and a DPIA template is available on request. The app and database are hosted in the EU, in a data centre in France; face matching runs in Ireland. The UK's adequacy regulations cover both, so no extra transfer safeguard is needed. An encrypted copy of the nightly backup is kept on a separate server in the UK. Our sub-processors are listed in our privacy policy.

Every correction to a clock needs a reason code and a note, and keeps the original time, who changed it and why. Approvals, rejections and queries are logged per shift, and changes to worker rates, rate rules and pay settings are logged with the values before and after. A client with history cannot be deleted, only deactivated, so its records stay.