Your workforce data deserves care
AttendFlow holds attendance, and sometimes location and verification data, about real people. This page explains what is collected, who can reach it, how long it is kept — and what we do not claim.
What AttendFlow holds, and why
Four categories. Each exists to do a job, and the job is named beside it.
Employee information
So an attendance record belongs to a named person in a known part of the business.
- Name and contact details
- Employment details — job title, branch, department, team
- The employment history of that record
- Leave requests and entitlement
Attendance information
The record itself, and everything worked out from it.
- Check-in and check-out times
- Attendance status, lateness and early departures
- Working hours, breaks and overtime
- Corrections, and who approved them
- Exceptions — a missing check-out, an unusually long shift
Location information
So a check-in can be judged against the workplace it claims to be at, and — only where an organization enables it — so time away from that workplace during the working day can be accounted for.
- Your organization's work locations and their boundaries
- The position recorded at the moment of a check-in or check-out
- Why a check-in was refused — outside the boundary, too imprecise, no location sent
- Movement samples and distance from the workplace, where movement tracking is enabled
Position is read when somebody checks in or out. Continuous collection happens only where an organization has switched movement tracking on, and only between check-in and check-out — see the location section below.
Verification information
So an organization that requires proof a check-in was made by the right person can have it.
- Whether a check-in carried a successful verification, and when
- Consent records — what was agreed, which version of the wording, and when
- Refused attempts, with the reason each was refused
- The devices attendance has been recorded from
Camera frames are never stored. What face verification retains is the outcome of each check — not a photograph.
Separation between organizations
Your organization's data is scoped to your organization
AttendFlow is used by many employers at once, and the thing that matters most is that one of them can never read another's workforce.
- Workforce data is scoped to the organization it belongs to
- One organization cannot see or reach another organization's data
- Inside your organization, who sees what is decided by the roles and permissions you configure — scoped to a branch, a department and everything under it, or a single team
Proving a check-in
Verification is something you switch on, not something we impose
How much proof a check-in has to carry is your organization's decision, location by location. Most organizations use a QR code and a geofence and nothing else.
- QR codes can expire or be withdrawn, so a copied code stops working when you retire it
- A check-in can be required to be inside the location's boundary, and to carry a position accurate enough to rule on
- Face verification can be required as part of a check-in, where an organization has it and requires it
- One person can be allowed to record attendance for a colleague — and the record always says who did it
- Attempts that did not become attendance are kept, each with the reason it was refused
A refused attempt is an event, not a finding about a person. Most have ordinary explanations — a phone indoors, a boundary drawn tightly, a code retired last week. AttendFlow records what happened and leaves the conclusion to the people who know the circumstances.
Face verification
The most sensitive thing we do, and the most controlled
Where an organization uses face verification, AttendFlow confirms that the person checking in is the employee the record belongs to.
- Camera frames are never stored — what is retained is the outcome of each check, not a photograph
- The employee agrees first, and that agreement is recorded
- Without current consent, face verification does not run
- Withdrawing consent starts the erasure of that employee's face data
- It is off until it is deliberately turned on for an organization
This is AttendFlow's own check, made during a check-in. It is not your phone's fingerprint or face unlock, and AttendFlow cannot read or reach that system.
Location and movement
What is collected, when it starts, and when it stops
Two different things get called “location tracking”, and they are not the same. AttendFlow reads a position when somebody checks in or out. Continuous collection is a separate feature that is off unless your organization turns it on.
- At check-in and check-out, a position is read so the check-in can be judged against the work location it claims to be at
- Movement tracking is a separate, separately-permissioned option, off by default
- Where it is enabled, collection runs only between check-in and check-out — it starts at check-in, stops at check-out, and does not run on an employee's own time
- During that window the app can report position while it is not on screen, which the app store permission text states in those words before anybody agrees to it
- What the record then shows is distance from the work location and whether the employee was inside or outside it
- Movement data expires on a schedule your organization sets per location — 90 days unless you change it — and attendance is unaffected when it does
We are not going to describe this as anything other than what it is: where an organization enables movement tracking, an employee's device reports location during their working day, including when the app is closed. That is why it is off by default, why it sits behind its own permission, and why the employee sees it described plainly on their own phone before it starts.
Accountability
Significant actions leave a record
When somebody asks “who changed this, and when?”, the useful answer is a record made at the time rather than a reconstruction afterwards.
- Security-relevant actions are written to an audit trail recording who did what to which record
- Attendance corrections are raised, approved or refused, and recorded as corrections rather than applied silently
- When attendance is recorded for another employee, the action is attributed to the person who performed it
- Changes to employment records are kept with the actor and the time
The life of a record
Collected, used, controlled, retained, deleted — and what each of those actually means here.
- 1
Collected
When an employee checks in or out, when an administrator records something, and — where enabled — during a working session for movement.
- 2
Used
To produce the attendance record, the hours, the exceptions and the reports your organization runs. Employees can see their own record too.
- 3
Controlled
Scoped to your organization, and inside it to the roles you configure. Your employer decides who may see what.
- 4
Retained
Employee and attendance records are kept for as long as your organization keeps them — retention is the employer's decision. Movement data expires on the schedule set per location.
- 5
Deleted
Deletion within a workspace is the employer's to perform. Data removed from the live system may still sit in encrypted backups until those age out on their ordinary cycle; we do not restore a backup to reinstate something somebody asked us to erase.
What we do not claim
A trust page that lists only strengths is the one you should not trust.
- We hold no security certification — not ISO 27001, not SOC 2, not PCI, not HIPAA — and we do not describe ourselves as certified.
- We do not claim to be “GDPR compliant”. Compliance depends on how your organization uses the product as much as on how we build it; our Privacy Policy sets out the roles each of us plays.
- We do not claim the system cannot be breached. No product can honestly claim that.
- We have not published a data-residency guarantee or a sub-processor register.
For the formal details
This page explains how the product behaves. The documents below are the ones that govern — where they and this page differ, they win.
Questions we have not answered here?
Ask them before you adopt the product rather than after. We would rather have a difficult conversation early than a disappointed customer later.