Security & privacy
Employee location and payroll data deserve a clear answer.
Punchless holds two sensitive things: where your crew is during work, and the hours that drive their pay. Here is exactly how we handle both - what we collect, when, how long we keep it, and the controls that protect it. No hand-waving.
How location tracking works
Tracked only while Work Mode is on
GPS is active only while a technician has Work Mode on - closing the app does not stop it, turning Work Mode off does. With it off, nothing is recorded. If it is left on after hours, the phone asks "Still working?", and a company that sets work hours has location outside them discarded unless the worker says they are still on the clock.
One-tap pause, always
A technician can pause tracking at any moment during the workday - for a personal errand or a lunch break - and resume when they choose. The control is theirs, on their own device.
Geofenced, not a live trail
Punchless samples location at a low frequency and reacts to geofence crossings at your shop and job sites. It builds a timecard from arrivals and departures - not a second-by-second map of someone's whole day.
Employees see their own data
Technicians can review their own timecard entries and the GPS events that generated them in the mobile app. There are no hidden records.
Security controls
Encryption in transit
All traffic is served over HTTPS/TLS. Sensitive integration tokens are encrypted at rest.
Tenant isolation
Every record is scoped to its company. A tenant-isolation guard on the API prevents one company's data from being read or written by another.
Multi-factor authentication
Managers and admins can enable TOTP-based MFA on their accounts for a second factor at sign-in.
Least-exposure by default
API docs are disabled in production, security headers are enforced, and login lockout throttles brute-force attempts.
Access controls
Role-based access (technician / manager / admin, and a read-only auditor for your accountant or lawyer) limits what each person can see and do. Owners approve who joins the workspace.
Every change accounted for
Timecard edits, approvals, and key actions are logged with who and when, and each entry is sealed with the one before it - so a change to the record is always accountable, and an edit to the log itself shows.
Data retention
12 months
Raw GPS history
by default, then automatically purged (configurable, minimum 30 days)
4 years
Raw GPS history on Compliance
at least, whatever the setting says - a wage claim can reach back two years under federal law (three if wilful) and four in California, and evidence recorded on the plan keeps its four years after a plan change
7 years
Timecards & payroll records
retained to meet common wage-and-hour recordkeeping expectations
Compliance, stated plainly
Punchless is an independent, SMB-focused product. We are not yet SOC 2 certified, and we won't claim a badge we haven't earned. What we do today: encrypt data in transit, isolate every tenant, offer MFA, enforce least-exposure defaults, and keep every change to a timecard alongside what it replaced. Formal third-party attestation (SOC 2) is on our roadmap as we grow. If your procurement needs specific documentation, tell us what - we'd rather have the real conversation than overstate our posture.
One limit worth stating before you buy rather than after: Punchless tracks a device, not a person. If a technician hands their phone to a colleague, the record follows the phone. We use no biometrics - no face scan, no fingerprint, no photo check-in - because we do not think a tool that runs in someone's pocket all day should be reading their body. What the record gives you is a continuous movement pattern that is hard to fake convincingly, which is a narrower claim than proving identity and the only one the technology supports.
The same applies to wage-and-hour rules. Rather than assert that we handle overtime, we publish every rule we enforce, the statute it comes from, and the test that checks it - including the gaps we have not closed. It is generated from the test suite, so it cannot drift from what the code actually does.
The log of every change is a hash chain: each entry carries a fingerprint of the one before it, so editing or removing an entry breaks every fingerprint after it. You do not have to take our word for that. Download the log from the Audit log page and check it on any computer with our checker - one Python file with nothing to install, short enough to read before you run it. What an intact chain proves is narrower than it sounds: the entries are consistent with each other. Someone with access to the database could still rewrite every entry after an edit so the chain checks out. Closing that means publishing the chain's latest seal somewhere we cannot reach, and that part is not built yet.
Accessibility
Punchless targets WCAG 2.2 Level AA. We have not been audited by a third party, so rather than claim conformance, here is what is actually measured and what is not.
On every push, CI runs axe against every page the dashboard renders, in both the light and dark themes, at WCAG 2.2 AA. It has to come back with zero findings or the build fails. Two further checks run beside it: every page must have exactly one main landmark and one heading, and a separate sweep measures the real composited colour of every word on the screen against its background.
What that sweep still finds: 28 pieces of text below the AA contrast floor - 25 in dark mode, 3 in light, the worst of them at 2.84:1 against a required 4.5. They are two grey tokens used for secondary text, they are listed in the test with the exact ratio each one has today, and the test fails if any of them moves. Choosing the replacement greys is a palette decision we have not made yet.
Also not done: no screen-reader pass on the mobile app, ten routes that need a signed-out or customer session are not yet in the sweeps, and keyboard operation is covered by specific tests rather than a general one - a control can have a correct role and an accessible name and still be unreachable, which is a gap automated checks do not close. If any of this blocks you, say so and we will tell you where it actually stands.
A note on employee GPS. In most U.S. states, GPS tracking of employees during work is legal with proper written disclosure. Punchless requires administrators to obtain any consent their local employment law requires, and we recommend a written GPS policy in your employee handbook. We are not a law firm and this is not legal advice. See our Privacy Policy for the full data-handling detail.
Questions about security or a data-processing agreement?
Reach us directly and we'll answer specifics - no runaround.