The time clock records when people start and stop work and rolls those entries into an attendance record managers can review. It lives at /people/clock and is designed privacy-first: it captures work time, not screens or keystrokes, and honors consent settings.
Clocking in
- 1Employees open People > Clock (or scan the workspace QR code at a shared station).
- 2Choose Clock in. The server records the timestamp and the network address.
- 3Take breaks with the break control if enabled; clock out at the end of the shift.
- 4The entry appears on their daily timesheet and in their Self-service history.
Onsite versus remote
Each clock-in is classified from the requester's IP address against the office ranges you configure. An address inside a configured range is ONSITE; anything else is REMOTE; a missing address is UNKNOWN. Ranges accept a single IP or an IPv4 CIDR block.
10.0.0.0/24 # whole office subnet
203.0.113.45 # single static IP
Classification: ONSITE | REMOTE | UNKNOWNIPv6 and malformed rules only match exactly, so a bad rule can never widen your onsite range by accident.
QR clock-in stations
- Print or display the workspace QR code at a reception desk or site gate.
- Employees scan it with their phone, sign in, and the clock-in is recorded to their own account.
- Use QR for shared sites where no one has a workstation.
Review and approval
- 1Managers open Attendance and review the period, filtering by team or by ONSITE/REMOTE.
- 2Correct missed clock-outs or wrong times; corrections are audited.
- 3Approve the period. Approved time can feed payroll and productivity views.
Only HR administrators can edit office IP ranges and correct other people's time. Employees can only clock themselves.