Start from the challenge, not the feature
Attendance systems are usually chosen on convenience and then relied on for proof, which is the wrong order. Work backwards instead: imagine the specific moment the record gets contested, and ask what you would need to hand over.
There are only really two moments. A customer says nobody attended, or attended for less time than you invoiced. A worker says they worked hours you have not paid. Notice that these pull in opposite directions, which is why a record that only ever supports the employer is a weak record. It will be read as partisan precisely when it matters.
The four failure modes
1. It records an assertion, not an event. A clock-in is a person pressing a button. A scan is a person touching a tag. Both are claims made by the worker, timestamped by you. If the dispute is about whether the claim is true, a faithful record of the claim does not resolve anything.
2. It has no duration. Point-in-time records answer "were they there" and not "for how long". Most invoice disputes are about the second question.
3. It is silent about what it discarded. Many systems drop readings they consider poor quality. A record with invisible exclusions cannot be defended, because the other side's first move is to ask what was removed.
4. It could have been edited. If a manager can change a stored time and nothing about the record reveals it, then the record's authority rests entirely on trusting the person presenting it. Which is the thing being questioned.
A workable standard
Five properties. Any attendance record that has all five will survive a challenge; one that misses several will not.
- Derived, not asserted. The evidence should come from something other than the worker's own tap. Presence measured over time rather than declared at a moment.
- Bounded in time. An arrival, a departure, a duration. Not a single instant.
- Graded, with the workings shown. Readings the system does not trust should be kept and marked rather than deleted, and excluded from totals. Ambiguity should be labelled as ambiguity.
- Tamper-evident. It should be possible to demonstrate the record has not changed since it was written, rather than assert it. A per-day fingerprint does this: alter a reading later and the day stops matching.
- Symmetrical. The worker should see the same record, in the same detail, and be able to take a copy without asking. This is the property people skip, and it is the one that makes the rest credible.
Why symmetry is the load-bearing one
It is tempting to treat worker access as a compliance checkbox. It is actually what makes the evidence persuasive.
A record only the employer can see, produced by software the employer bought, is exactly the kind of evidence a tribunal or a client discounts. The same record, visible to the person it describes, from the day it was created, with an export they control, is a different kind of document. It has been available for contradiction the whole time and was not contradicted.
It also changes adoption. Teams resist monitoring they cannot inspect and tolerate records they can. If collection is limited to working hours, refused outside them on the server rather than by a toggle in the app, and each worker can see exactly what is held about them counted rather than summarised, the conversation stops being about surveillance.
What a good dispute pack contains
When it does get questioned, the goal is one file rather than a folder of screenshots. It should hold the map of the day drawn from saved positions, every reading with what the system made of it including the ones it rejected, every edit with who made it and what the value was before, the photos and signatures with any deletion shown as a deletion, and whether the day still matches its fingerprint so the reader can verify instead of trusting.
The test of such a file is simple: hand it to the other side. If you would rather they only saw a summary, it is not evidence yet.
Practical steps this week
- Take last week and pick the busiest day. Try to reconstruct, from your current system alone, how long one person spent at each place they went.
- Ask whether that reconstruction rests on anything other than what the worker entered.
- Ask what your system does with a reading it distrusts, and whether you can see the ones it dropped.
- Ask whether a worker can get their own copy without going through you.
If any of those answers is uncomfortable, you already know which dispute will be the expensive one.
Questions
Is a GPS timestamp on a clock-in enough evidence?
It establishes where a phone was at the moment somebody pressed a button. It does not establish how long they stayed, which is what most invoice and hours disputes turn on.
Should we tell workers they are being tracked?
Yes, and go further: show them the same record you see. Aside from the legal position, which you should take your own advice on, a record the worker could have contradicted at any time and did not is far more persuasive than one they never saw.
How long should we keep attendance records?
Long enough to cover the disputes you actually get, which is usually longer than a payroll cycle and shorter than forever. Set a retention period deliberately and make sure you can suspend deletion while a specific matter is open.
What makes a record tamper-evident?
That a later change is detectable. A per-day fingerprint over the readings gives you this: if anything is altered afterwards, the day no longer matches, so you can show the record is unmodified rather than simply saying so.
Where this shows up in the product