A facial recognition attendance system that proves who turned up
Workers enter their badge at a tablet kiosk and look at the camera. The face must match the badge holder, and the clock is logged with its match score. The face match itself takes well under a second, and the photo is discarded once it has been checked.
0.36s
Median face-match time in production (95% within 0.58s, measured over 2,756 matches). We plan on about 4 workers a minute per kiosk at a shift change.
Badge first, then the face
TempClock uses a major cloud provider's face-matching service, hosted in Ireland. We do not build our own face model. The badge says who the worker claims to be; the face match checks it, within that client's enrolled workers.
-
Enrol once
The worker opens a one-time link, reads the notice and chooses. If they agree, a short video selfie passes a liveness check that proves a real person is present, and a face template is created. A reference photo is kept, visible only to authorised users.
-
Match at the kiosk
The worker enters their badge (typed or QR; NFC and RFID cards are coming soon) and looks at the camera. The photo is searched against that client's enrolled workers and discarded. The clock is accepted only if the best match is the badge holder, at or above your threshold (90% by default).
-
Extra checks
You can switch on an anti-photo movement check at each site, and set a client to refuse any clock that does not carry a valid match from the kiosk. A mismatch is refused without showing anyone's identity.
-
Log the proof
The match score, site, kiosk and time are recorded with the clock. PIN clocks are photographed and flagged for review, so every hour carries its own evidence.
●
sha256
85cfee0fb3c001ba1f7835aae12d…
Special category data · UK GDPR Art. 9
Making buddy clocking hard
No system makes buddy clocking impossible, so TempClock layers the checks and records what happened. Here is what each one does, and where its limits are.
Someone else's face
A face clock succeeds only when the face matches the badge that was entered. A colleague using someone else's badge is refused, and the attempt is logged.
Held-up photos
Enrolment uses a liveness check, so a template cannot be made from a photo. At the kiosk you can switch on an anti-photo movement check per site; it is off by default.
The PIN route
PIN clocking stays available for people who opt out and for outages. Every PIN clock takes a photo and appears on the Exceptions page, so a supervisor can check it.
When a match is not confident enough, nobody is locked out
If a face cannot be matched with enough confidence (poor light, a bad camera angle), the worker tries again or clocks in by PIN, and the PIN clock is flagged for a manager to review. In our production data about 18% of match attempts needed a retry.
Biometric clocking is legal in the UK, done correctly
Facial data is special category data under UK GDPR, so it needs a lawful basis, a clear privacy notice and proportionate safeguards. TempClock is built so you can deploy it that way, not work around it after the fact.
Notice and consent
Workers see a versioned notice before any camera use, and their answer is recorded. Withdrawing consent deletes their face data at once.
A workable alternative
Every worker can clock in with badge and PIN, or through a supervisor, so face clock-in is never the only route.
Honest about storage
Enrolment reference photos and PIN clock photos are stored in your instance in the EU, access-controlled and deleted on your retention schedule. Face clock photos are not kept.
DPIA and SAR
A DPIA template is available on request, and a subject access export gathers a worker's records in one ZIP.
This is general guidance on how the system is built, not legal advice. Your data protection responsibilities as an employer remain your own.
Hours you can prove, the same day
Face-verified clock-ins close the gap between the hours worked, the hours billed and the hours you can evidence.
Buddy clocking, made hard
A face clock only succeeds for the badge holder, and PIN clocks are photographed for review. The match score travels with the hour.
Disputes you can settle
When a client queries an hour, you answer with a verified time, a site and a match score, not one person's word against another's.
Standard tablets
The kiosk runs on an Android tablet with the TempClock app, or an iPad in the browser. No proprietary clocking terminal to source.
Recorded as it happens
The match score, site and kiosk are written with the clock as the day happens. Corrections keep the original time and a reason.
A verified face is the start of the record
The clock-in carries on through geofencing, the kiosk and a payroll-ready timesheet. See how the rest of the system fits together.
Know who turned up, and pay every hour right.
Face-verified clock-ins, live geofencing and payroll-ready timesheets in one system. Tell us how your shifts run and we will show you how it fits.
Hosted in the EU · Your largest site live first, with us alongside · No app needed to clock in