TemporraTemporra← Back to Temporra

Face ID and geofenced clock-in: what Temporra checks, what it doesn't, and what comes with it

By · · 8 min read

Every timesheet system answers two questions, whether it means to or not. Was it really this person? Were they really on site? Paper answers neither, and most apps answer one. Temporra checks both at the moment of clock-in: the face against the template that worker enrolled, and the phone against a circle drawn around the job. This page is how each check works, where each one stops, and what else you get for the money.

A clock-in passing two checks: the face matched against the enrolled template, and the phone inside a 200-metre circle around the job site.

Temporra is built in the UK for construction and field teams. Its first site was an electrical contractor's: STF Electrics, around ten electricians on client jobs, clock in with face and GPS every morning, and several of the features below exist because of something that went wrong on their sites first. They're our pilot partner and use it free, which is in their case study too.

The face check

The first time a worker sets up Face ID, Temporra asks for their consent, takes an image and turns it into a template: 128 numbers that describe the geometry of a face. That's what gets stored. Not a photo, and not something you could reverse back into one. At each clock-in after that, the phone's camera takes a live image, the device compares it with the template, and the image is thrown away.

What it stops is buddy punching, the oldest timesheet fiddle there is. One person arrives at 7:30, taps in for three mates who turn up at nine, and the payroll pays all four from 7:30. It happens on honest sites too, usually as a favour. A face check ends it, because the mate's face isn't in the queue at 7:30.

What it doesn't do is detect a fake. It's a match against a stored template, not a liveness test, and we won't call it unbeatable. Someone who wanted to defeat it badly enough would try. In practice the person it has to stop is a colleague with a phone, and it does. There's more on the fiddle itself in stopping buddy punching on construction sites.

The feature is off by default. You decide whether to switch it on. A worker can withdraw consent at any time, and their template is then deleted for good.

Biometrics and the ICO

Here's the part most sales pages skip. A face template used to identify someone is special category data under Article 9 of the UK GDPR, the same tier as health records. The ICO's guidance on using biometric data for time and access control is blunt about it: if a reasonable non-biometric option would do the job, you should be able to say why you aren't using it, and you have to document that thinking in a data protection impact assessment, the DPIA that Article 35 requires for high-risk processing.

The ICO also says it's "likely to be very hard to justify" biometric access control without an alternative for people who opt out, and that those people mustn't be disadvantaged. That's why Temporra has a kiosk mode: a shared tablet on site where each worker clocks in with their own PIN. Someone who doesn't want their face used still clocks in, at the same tablet, on the same timesheet.

So the honest set-up is face check on for those who agree, kiosk PIN for those who don't, and a short DPIA that says why. The ICO's broader guidance on biometric recognition goes into the lawful-basis question in more depth. Temporra gives you the consent capture and the deletion. The lawful basis and the DPIA are yours as the employer, and no software vendor can do them for you, whatever their website says.

The geofence

When you add a job, you type the site's postcode. Temporra finds the location and draws a boundary around it. You choose the radius: the company default is 200 metres, and any job can have its own. A tight terrace in Hackney might want 100. A housing site on the edge of Chelmsford with a compound half a mile from the plots needs a lot more.

With GPS checks switched on, a clock-in from outside that circle is refused. Not flagged for someone to look at on Friday. Refused. That's what stops the clock starting from the van at the services, or from the kitchen table.

The location is read once when someone clocks in and once when they clock out, then stored with that single entry. Nothing runs in the background, and nobody's phone reports where they went at lunch. That's a deliberate choice, and it's the one that keeps you on the right side of the rules on tracking employees by GPS. All-day tracking is where employers get into trouble with the ICO. A location check at the gate isn't.

One limit to know about. Clocking in needs a live connection, because that's when the location gets checked. On a basement fit-out with no signal, put the kiosk tablet on the site Wi-Fi or a data SIM and the whole crew clocks in from that.

Two checks, one entry

Each check covers the other's gap. A geofence alone proves a phone was on site, not whose hand it was in. A face check alone proves who, not where. Together, a clock-in at 07:32 on the Riverside job means that worker, at that job, at that minute. If a client ever disputes an invoiced day, that's the line you show them.

What else is in the box

The checks get the hours right. The rest is about doing something with them without retyping anything.

And the things it doesn't do, so nobody finds out after signing up. It isn't payroll software: it hands the numbers to yours. It doesn't calculate statutory pay like SSP or maternity pay. Weekly overtime thresholds aren't in it, only daily. And the face check, again, isn't a liveness test.

What it costs

One flat monthly price by team size, every feature on every plan: £39 for up to five workers, £69 for six to ten, £129 for 11 to 20, £239 for 21 to 50, and a quote above that. Prices include VAT. The admin account you sign up with doesn't count as a worker, and a leaver you mark inactive stops counting straight away. The trial runs 14 days and doesn't ask for a card. There's a worked example on the pricing page.

If your hours currently arrive on paper on a Friday, the cost of paper timesheets is worth ten minutes before you decide.

Common questions

Can a worker clock in with a photo of someone else's face?

The face check compares the live camera image with the template stored when that worker enrolled. It stops the everyday problem, a colleague tapping in for a mate who's still in the van. It isn't a liveness test, so we don't claim it beats a determined fake. Pair it with the geofence and a supervisor who knows the crew.

Does Temporra store photos of my workers' faces?

No. It stores a template, a sequence of 128 numbers describing facial geometry, which can't be turned back into a picture. The live image used at clock-in is processed on the device and not kept. If a worker withdraws consent, their template is deleted.

Is face recognition for clocking in legal in the UK?

It can be, but it's special category data under UK GDPR, so you need a lawful basis, an Article 9 condition and normally a DPIA. The ICO says to offer a non-biometric alternative and not to disadvantage anyone who uses it. In Temporra that alternative is a kiosk PIN.

What happens if someone tries to clock in from outside the site?

With GPS checks switched on, a clock-in from outside the geofence is refused. You set the site by postcode and pick the radius, 200 metres by default, company-wide or per job.

Does Temporra track workers all day?

No. GPS is read at the moment someone clocks in or out and stored with that one entry. There's no background tracking between those two taps.

Does clocking in work without signal?

Clocking in needs a live connection, because that's when the location is checked. On sites with poor coverage, a shared tablet in kiosk mode on Wi-Fi or a mobile SIM handles the whole crew.

Which payroll software does it work with?

It exports a CSV of regular hours, overtime and gross pay that imports into Sage, Xero, QuickBooks and BrightPay. It's a file export, not a live connection, and there's no public API yet.

How much does Temporra cost?

From £39 a month for up to five workers, £69 for six to ten, £129 for 11 to 20 and £239 for 21 to 50, VAT included, with every feature on every plan and a 14-day trial that needs no card.

Where hours fit in

Every guide on this site ends up at the same place. Minimum wage checks, holiday pay, working time limits and lay-off claims all turn on hours, and hours that were captured at the time, by the right person, at the right place, are the ones that hold up when someone asks. That's the whole job of the face check and the geofence.

Related guides

All Temporra guides →

We post each new guide on the Temporra Facebook page. Follow it there if you'd like the next one, and a like helps other UK employers find it.

Start a 14-day free trial →

No card needed for the trial. One flat monthly price by team size, from £39 for up to five workers, VAT included. See pricing.