📖 All guides
Photo at each punch (buddy-punching protection)
The entrance tablet takes a still photo at every punch so managers can confirm who really clocked in — and flag the ones that weren't them.
Buddy punching — one employee keying a coworker's PIN — is the oldest time-clock problem there is, and every modern time clock answers it the same way: a photo at the moment of the punch. SafeShift does exactly that on the entrance tablet. It is a still picture, not face recognition: nothing is measured or matched, and the photo is only ever shown to managers at that location.
- 1
Turn it on for a location
Go to Locations → Integrations → Entrance tablet (the kiosk must be on) and set Photo at each punch to keep 7, 30, 60 or 90 days. Owners and location admins can change it. Paired tablets pick the setting up within a few minutes — no re-pairing.
- 2
What employees see on the tablet
The PIN screen shows a small 📷 Photo at each punch · Foto en cada marcación chip; tapping it opens the full notice in English and Spanish — *A photo is taken each time you punch and kept for N days so your manager can confirm who punched. It is not used for anything else.* After entering a PIN, a live camera box sits at the top of the punch screen (mirrored, like a selfie) so the person sees exactly what will be captured. The photo is taken the instant they tap a punch button — the box flashes and says *Photo taken* — and the confirmation shows the still. The first time, the tablet's browser asks once for camera permission — allow it.
- 3
The punch never waits for the photo
A punch is recorded exactly as before and never blocked by the camera. If the tablet has no camera, permission was denied, or the upload fails, the punch still lands and Clock Station shows no photo with the reason. With offline punching on, photos are saved on the tablet alongside the queued punches and sent when the connection is back.
- 4
Review on Clock Station
On Clock Station the card's avatar becomes the latest punch photo (the colored ring still shows break status). Click it to open the day's punch timeline — clock in, breaks, clock out — each with its photo and time, plus which tablet took it. The same view is on the mobile app's Clock Station.
- 5
Flag a punch that wasn't them
In the timeline, click 🚩 Not this person, pick a reason (someone else punched, wrong employee, other) and add an optional note. Flagging never changes the punch — fix the times on the time card as usual (every correction is audit-logged). Flagged photos appear in a red strip at the top of Clock Station until a manager closes the flag as Corrected or Dismiss — it was them. Flags and their outcomes are permanent: the punch, the photo and the flag together are the record.
- 6
Retention and privacy
Photos are stored encrypted, served through short-lived links, visible only to managers who can see that location (Shift Leads see only their own department), and never appear in exports or reports. Every time a manager opens a timeline it is written to the document-access log. Photos are deleted automatically after the window you chose; a photo with an open flag is kept until the flag is closed. Turning the feature off stops capturing immediately and lets stored photos age out within 30 days.
Good to know
- Pair the tablet where the camera sees the person's face at punch height — a wall mount at eye level works; a flat counter mostly photographs ceilings.
- Tell the crew before you turn it on. Most employers mention it in the handbook or a short memo; the tablet notice covers the ongoing disclosure.
- Attestation Station tablets (question-only, next to a POS) never take photos — only punch tablets do.
If something goes wrong
Is this face recognition? Do we need consent forms?
No. It is a plain photograph stored with the punch — nothing is measured, matched or extracted, so biometric-privacy laws (which cover faceprints) don't apply the way they would to face sign-in. The tablet shows a standing notice, which is the industry-standard disclosure for photo time clocks. If you're in a state with specific workplace-surveillance notice rules, your usual handbook notice covers it.
The avatar shows 🚫 — why is there no photo?
Open the timeline: each missing photo says why — camera permission denied on the tablet, no camera on that tablet, or the upload failed. The punch itself is fine. The punch screen also tells the employee when the camera is blocked so a manager hears about it.
Every punch says "camera permission denied" and the tablet never asked.
The browser has the camera blocked for safeshiftops.com. Chrome / Android: tap the lock icon in the address bar → Permissions → Camera → Allow (for an installed home-screen app, open it in Chrome once, allow, then relaunch). iPad Safari: Settings → Safari → Camera → Allow, or for the Home-Screen app: Settings → Apps → the SafeShift Kiosk entry → Camera. Fully Kiosk Browser: Settings → Web Content Settings → Enable Camera Access (and grant the Android camera permission when it asks). Then enter a PIN — the camera box should appear at the top of the punch screen.
On an iPad, an employee tapped the red camera indicator at the top and now every punch says the camera is blocked.
That red pill is iPadOS's own camera-in-use indicator (in Safari it's the camera button in the address bar). Tapping it and choosing Stop makes the system refuse the camera for the page until it reloads. The kiosk notices this and reloads itself the next time it sits on the PIN pad, so the camera comes back on its own. To stop it happening at all: when you lock the tablet with Guided Access, draw a circle across the whole top status-bar strip before tapping Start — Guided Access disables touch inside the circle, so the indicator can't be tapped. The camera is only live from the fourth PIN digit until the confirmation screen clears.
Can an employee refuse the photo?
The photo is part of punching on the tablet, like the PIN. An employee who objects can punch on the SafeShift app on their phone (if mobile clocking is on at the location) or a manager can enter their time — the policy is yours to set.
Can I change the retention window later?
Yes. A shorter window deletes older photos on the next nightly run; a longer one applies to new photos going forward.