Feature
A time clock that survives a real counter.
One tablet, a shared counter, eight stores, and nobody with time to police it. Staff punch with a 4-digit PIN, breaks pair themselves, and the punches that came off the tablet can never be edited — not by a manager, not by the owner. Fixes happen in a separate, audited lane, so a timesheet always tells you which times are the machine's and which are somebody's memory.
01 — How it works
PIN in, punch, done
The clock lives in the same counter kiosk that runs quotes and returns. A PIN starts every transaction, including a punch, so identity is never assumed from whoever happens to be standing there.
- A 4-digit PIN nobody else knowsEmployees set their own PIN from their phone portal. Weak codes and duplicates are refused, so two people at the same company can't share a number by accident. PINs are stored hashed with a server-side pepper — an owner can regenerate one, but nobody can look one up.
- Breaks pair, they don't accumulateHours are computed by pairing in with out and subtracting break start / break end pairs. A day with four punches and a day with two are read by the same rule, so a missed break-end shows up as an exception instead of quietly inflating the week.
- Exceptions flagged, not buriedAn unpaired punch gets a flag on the timesheet. An open shift today is just “in now” — only a prior day left open reads as a missing out punch, because flagging the person currently working is noise a manager learns to ignore.
- Kiosk punches are immutableThe delete endpoint refuses any punch whose source isn't a manager. What the tablet recorded stays recorded. Manager-entered times carry the name of whoever entered them and can be removed — the audit trail is the point.
- Real Eastern time, not drifted UTCTimes are entered and displayed in the store's clock and converted both ways at the boundary. We shipped this wrong once — a manager's 5pm fix landed four hours off — and the conversion is now a tested helper in both directions.
02 — Fixing a day
The fix-punch drawer
Somebody forgot to clock out. That is going to happen every week of your working life, so the repair path matters more than the capture path. Opening a day gives you four cards in shift order — in, break start, break end, out — each showing the punches that already exist, tagged kiosk or fixed, with a remove button only on the ones a manager added. A kind with nothing recorded shows a red “— —” so the hole is visible before you start typing. Fill any subset of the four, save once, and all of them post together. A day stepper moves back and forth through the week without closing the drawer, and clicking a cell on the actual-hours row opens straight to that date.
The timesheet shows two sub-rows per person per week: scheduled and actual. That pairing is why the drawer gets used — a manager isn't hunting for anomalies, the scheduled row is sitting right above the actual one and the gap reads itself. Scheduled hours come from the published rota in staff scheduling, and both rows are keyed to the employee and the store, so a person working two locations never has one store's hours show up on the other's timesheet.
03 — Multi-store reality
Scope, roles, and people who are two things at once
Every timesheet query, punch edit and export is scoped on the server to the stores the owner assigned that manager. Hiding a tab is not access control, so the API checks the same rule the sidebar does — and an unassigned manager sees nothing at all rather than everything, because a permissions bug should lock you out, not open the company up. Hours exports and clock rules are owner-only. Pay rates never leave owner endpoints.
Then there is the case that breaks most time clocks: somebody salaried at one location and hourly at another. Salary here is a property of a placement, not a person. A payroll profile row at a specific store makes that store's work salaried; the same employee's punches at a different store are hours and get paid as hours. The timesheet marks the salaried row, shows zero actual hours on it to match what the payroll sheet expects, and leaves the hourly store's real punches alone. Those same rules carry straight into the weekly payroll workbook so the timesheet and the spreadsheet can't disagree.
This replaced a paid scheduling-and-clock subscription at an 8-location shipping-store franchise with 32 people on the roster. The weekly hours export matches the template their bookkeeper was already using, down to the company and area codes per store, which is the only reason a switch like that is survivable mid-year. More on the whole surface: workforce & store ops.
04 — Questions
Straight answers.
Can a manager change someone's punches?
A manager can add missing punches and delete punches a manager added. Punches made at the kiosk are immutable — the delete endpoint refuses anything whose source is not “manager”. Every manager punch is tagged with who entered it, so a timesheet always shows which times came off the tablet and which came from the office.
What stops employees from sharing PINs?
Employees set their own 4-digit PIN from their phone portal, and weak or duplicate PINs are rejected — no two people at a tenant can hold the same code. PINs are stored hashed with a server-side pepper, never in plain text. An owner can regenerate a PIN as a fallback when someone is locked out.
Does a manager see every store's hours?
Only the stores the owner assigned them. Store scope is enforced on the server for timesheets, punch edits and exports — not just hidden in the sidebar. A manager with no stores assigned sees nothing until the owner assigns them, which is deliberate: it fails closed.
How do you handle someone who is salaried at one store and hourly at another?
Salary is a per-store fact, not a per-person one. A payroll profile row at a specific store marks that placement salaried; the same person's punches at another store are treated as hourly and paid as hours. The timesheet marks the salaried row and zeroes its actual hours, while the hourly store's real punches survive untouched.
05 — Next step
Bring a week of real punches.
Book a 20-minute demo. We'll walk a live week — kiosk punches, a flagged exception, a manager fix, and the hours export your bookkeeper gets on Monday.
Workforce & ops pricing is quoted per site and headcount — see pricing · no contracts