Facial Recognition Explained
How TempClock enrols a worker's face, how a kiosk clock is matched to the badge holder, the settings you control, what is stored and where, and what affects accuracy.
Last checked against the product:
Overview
A cloud face-matching service, used with care.
TempClock uses a major cloud provider's face-matching service, hosted in Ireland, to check that the person at the kiosk is the worker whose badge was entered. We do not build our own face model. Face clock-in is optional for every worker: anyone who says no clocks in with their badge and a PIN, or a supervisor clocks them in. The provider is named in the face clock-in notice and in our privacy policy.
Before you start
- Agency console: Admin or super admin for Sites > Face recognition and Sites > Face dashboard. Neither page is in the client dashboard.
- Client dashboard: tenant admin can set PIN clocking and the badge and face check for their own company on Setup > Settings.
Enrolment
With a notice, consent and a liveness check.
The worker gets a link
A coordinator sends a one-time set-up link by email or text, or shows a QR code for the worker to scan in person. Links can be queued for hundreds of workers at once. See Enrolling Workers for Face Clock-in.
They read the notice and choose
Before any camera use, the worker reads Before you set up face clock-in: what is captured, why, who processes it and where, how long it is kept, that it is optional, and how to withdraw. Their answer is recorded with the notice version. If they decline, they set a PIN and their coordinator is told.
A short video check
If they agree, a short video check on their phone proves a real person is present, and their face template is made in that client's own face collection. A reference photo is kept so authorised staff can check who is enrolled.
Matching at the Kiosk
The face must be the badge holder.
Settings
Agency console: Sites > Face recognition.
Agency console: Sites > Face recognition. Not in the client dashboard.
| Section | What it does |
|---|---|
| Per-tenant thresholds | How close a match must be for each client, from 80 to 99. 90 by default. Click View health to see that client's match rates before you change it. |
| Anti-spoof check (multi-frame liveness) | A simple movement check at clock-in that refuses a still photo held up to the camera. Off by default. It is not certified liveness: the certified check runs at enrolment. |
| Clock security per client | PIN clocking (On, Supervisor check, or Off (face only)) and Face match proof for each client. |
| Anti-spoof check per site | Switch the anti-spoof check on or off for one site, or use the global setting. |
| Face match proof | What happens |
|---|---|
| Off | No check. |
| Log (flag only) | The default. A face clock without a valid match token is accepted but flagged for review. |
| Enforce | A face clock without a valid token is refused, and a PIN used within 10 minutes of a face that matched someone else is refused. Face clocks saved while a kiosk was offline still go through: each carries proof of its face match, accepted for 72 hours. Only a saved clock with no proof, for example from a kiosk on an old version, is refused. |
The same two client settings are on the client's edit form under Kiosk and lateness (PIN clocking and Badge and face check), and in the client dashboard on Setup > Settings. See Using PIN Fallback.
Switch face match proof to Enforce only once every kiosk for that client is on the current kiosk version. Check the Version column on Kiosk fleet.
Face Dashboard
Match rates per client.
Agency console: Sites > Face dashboard (the page is titled Face recognition health). Choose Last 24 hours, Last 7 days or Last 30 days. It shows the Match rate, Avg similarity, AWS round-trip, No-match (rejected), AWS unavailable and PIN fallback counts, a Per-tenant breakdown, Borderline matches (lowest similarity) and Recent failures (last 20).
What Is Stored
And for how long.
| Item | Where | Kept |
|---|---|---|
| Face template | The face-matching service, Ireland, in the client's own collection | While the worker is active or dormant; deleted within 4 hours of leaving, at once on withdrawal |
| Enrolment reference photo | Your TempClock instance, hosted in France (EU) | As the face template |
| Photo taken at a face clock | Not stored | Discarded after matching |
| PIN clock photo, and phone clock-in selfie (if phone clock-in is on) | Your TempClock instance, hosted in France (EU) | 90 days |
| Match score and outcome | Your TempClock instance, hosted in France (EU) | 90 days |
The 90-day periods apply once the nightly retention sweep is set to Live (delete) on Setup > Data retention. It starts in dry run, which deletes nothing. Face templates and reference photos are removed on leaving or withdrawal whatever the sweep mode. You set the periods in Data retention.
Getting Good Matches
Most problems are light and position.
Honest Limits
What face matching does not do.
Know who turned up, and pay every hour right.
Face-verified clock-ins, live geofencing and payroll-ready timesheets in one system. Tell us how your shifts run and we will show you how it fits.
Hosted in the EU · Your largest site live first, with us alongside · No app needed to clock in