Help and documentation

Everything needed to set Klock up and run it. If something here is wrong or missing, say so — this page is the same text the assistant reads, so fixing it fixes both.

Getting started

Three things happen in order: you enrol your staff, you leave a tablet at the door, and at the end of the period you export the hours. A workspace is created with a 14-day trial and no card.

1. Create the workspace. Sign up with an email and password, or with your identity provider. You choose a company name, a workspace address and a plan; you can change the plan later.
2. Add your employees. Admin → Employees. Each person needs a clock code (whatever is convenient on the floor) and a name.
3. Record consent, then enrol each face. Consent is per person and must be recorded before a face can be stored or matched.
4. Open the kiosk on the door tablet at /kiosk and leave it running.
5. Export at the end of the period — a Sage import file, a branded PDF per employee, or Excel and CSV.

The kiosk

The kiosk is its own page at /kiosk, separate from the admin app. It has no navigation, so a tablet can be locked to it, and the office can use the admin app at the same time without disturbing it.

Setting up a tablet

Open /kiosk and paste the workspace's kiosk device token when asked. The token is on your Billing page. It is stored on that device only and you will not be asked again. The token is deliberately not accepted from the address bar, because a URL ends up in history and logs and that one would let anybody punch.

The camera needs a secure context. That means https://, or localhost. A plain http:// address on your LAN will not be allowed to open the camera by the browser — this is a browser rule, not a Klock setting.

Clocking in and out

Staff step up and look at the camera. Klock decides in or out by flipping from that person's last punch, so nobody has to choose. If somebody needs to force a direction — after a missed punch, say — press Clock IN or Clock OUT first. That choice holds until a punch actually succeeds, then reverts to automatic.

When a face is not recognised

The kiosk takes a short burst of frames and keeps the best match, so one blurred frame does not refuse anybody. It also waits a moment after the screen is touched, because a photo taken while somebody is still reaching back from a button is the most common cause of a false refusal.

A refusal shows how close it came: closest 0.54 · needs ≤ 0.50. Use that number rather than guessing:

• Close to the bar, for everybody — the threshold is tighter than your enrolments justify. Raise it slightly in Admin → Face recognition accuracy.
• Close to the bar, for one person — re-enrol that person. The dashboard names anyone scoring below the quality gate.
• Nowhere near the bar — that person is probably not enrolled, or consent was withdrawn.
• “Could not tell you apart from another employee” — two people's templates sit too close together. Re-enrol both with more varied poses. Klock refuses rather than guessing, because a wrong match puts one person's shift on another person's timesheet.

Anybody the camera cannot match can use their employee code and PIN instead. A PIN punch is recorded as a PIN punch, so a timesheet shows which hours rest on a typed number rather than a face.

Enrolment and face quality

Enrolment produces a list of 128 numbers describing a face. No photograph is stored or transmitted — the image is discarded in the browser. The numbers cannot be turned back into a picture.

The enrol screen guides the person through several angles and captures each automatically. It scores the result out of 100 and refuses to save anything below the bar, which defaults to 90. A weak template is worse than none: it fails at the door, and the fix is a manual punch nobody trusts. The screen keeps capturing and improving until it clears.

Three things drive the score, and they fail differently:

• Too few samples — one bad angle and nothing matches. Capture at least three.
• Low detector confidence — blurry, dark, or partly obscured. Improve the lighting.
• Spread between samples — too wide means the samples disagree, usually changed lighting or another face captured by mistake. Too narrow means every sample is the same frozen pose, which looks tidy and generalises badly.

Scores can also drop when somebody else is enrolled, because part of the score is how close a person sits to their nearest neighbour. The Employees panel always shows the current score, and the dashboard flags anyone under the gate.

Consent and erasure

Biometric data is special personal information under POPIA. Consent is recorded per person, with the policy version and who recorded it, and can be withdrawn at any time. Erasing a person's biometrics deletes every stored template and revokes consent — their punch history survives, because that is a payroll record rather than biometric data.

Timesheets and the payroll arithmetic

Shifts

A shift is a clock-in paired with the next clock-out. It is classified day or night by the local time it started, and it stays on the date it began — so a shift running 18:00 to 05:00 is one shift on one day, not two halves on two dates.

A second clock-in with no clock-out between does not close anything. It starts a new open shift, and the earlier one is reported as open rather than being quietly given a plausible end time. Open shifts show on the dashboard and block nothing until you export.

Breaks

Unpaid breaks are fixed clock windows — lunch is 12:00 to 12:40, not "40 minutes somewhere". They are deducted by overlap, so somebody who clocks out at 12:20 loses the twenty minutes they actually took, not the whole forty. Each window can apply to day shifts, night shifts or both.

Overtime

Daily overtime is taken first, then the weekly threshold applies only to hours not already counted as daily overtime — applying both independently would count the same hour twice. Defaults follow the BCEA: nine hours a day, forty-five a week, Monday start. Set either to 0 to switch that threshold off.

Rounding

Off by default, because any rounding rule moves money and should be a decision. When on, it is applied as the report is built and never to the stored punch, so the exact time stays available to check against. In and out round in opposite directions under a one-sided policy, so "up" consistently means in the employee's favour.

Leave

Leave is recorded, never inferred: annual, sick, family responsibility, unpaid and public holidays. Only configured working days are counted, so a Monday-to-Sunday booking is five days and not seven. Part-day leave is recorded in hours and paid in hours. A day of leave is valued at the standard working day set in Admin → Shift schedule, which is deliberately a separate setting from the overtime threshold.

Gaps, not absences

Klock has no roster, so it cannot know who was due in. It reports gaps — working days with neither a punch nor leave — and leaves the interpretation to you. A gap is not evidence of absence and should never be treated as a disciplinary finding on its own. Days that have not happened yet are never gaps.

Exporting to payroll

Payroll packages do not import "hours worked". They import transactions: a quantity against an earning code, for an employee identified by payroll's own number. Klock produces that file.

• Layouts — Sage VIP and Payroll Professional, Sage Business Cloud, Sage 300 People, or a plain all-columns file for anything else.
• Earning codes are yours to set, because every installation renames them. If you are not sure which they are, paste a sample export into Admin → AI assistance and Klock will propose them for you to confirm.
• Payroll references — the number on the floor and the number in payroll are rarely the same. Klock keeps both, refuses to reuse one, and lists anyone unmapped instead of leaving them off the run.
• It will not send the same hours twice. A push carries an idempotency key and a checksum; re-running a period that has already gone through is refused unless you force it.

Before exporting, check the preview. It lists open shifts, employees with no payroll number, and anything else that would distort the run.

The dashboard

Live: who is on shift, who has a missed clock-out, who has not clocked in today, who is on leave. For the period: paid hours, overtime and its share, late starts, gaps, open shifts, the share of punches that were a face match rather than a PIN or a manual correction, and anyone whose enrolment needs redoing.

A missed clock-out is an open shift running longer than the configured maximum, which defaults to fourteen hours. Correct it in Admin → Timesheets with a manual punch.

Manual punches

A manual punch is somebody editing payroll data by hand, so it always requires a date, a time and a reason of at least three characters. Without a reason the audit log records that hours changed and nothing about why, which is exactly the question asked months later when a payslip is disputed. Future times are refused, and so are dates more than a year old.

AI assistance

Optional, off until an owner switches it on. Three things it does:

• A review brief before you export — a prioritised read of the period's exceptions, ranked by what would cost money if it went out unnoticed.
• Questions about your hours — your question becomes a query, and Klock runs it. Every figure comes from the same place the timesheet does.
• Sage earning codes — paste a sample from your payroll system and Klock proposes the mapping, quoting the line it read each code from. Nothing is applied until you enter it.

The model never produces a number. It reads figures Klock has already calculated, or it writes a query Klock runs. Face templates are never sent. Employee codes are sent instead of names by default, and Klock puts the names back before you read them.

Every plan includes an amount of AI usage each month and every call is metered against it. When the allowance is used up Klock stops and tells you, rather than spending on. You set the ceiling in Admin → AI assistance.

Accounts, sign-in and billing

A workspace has one or more owners, who sign in at the Klock website to manage billing. Staff never sign in — they use the kiosk.

• Password or single sign-on. You can create a workspace with Microsoft Entra, Google Workspace, Okta or any OIDC provider. An account created that way has no password; use the SSO button.
• Linking — an identity provider can only take over an existing account if it explicitly confirms the email address belongs to that person. Providers that do not say so can create new workspaces but cannot adopt existing ones.
• Seats are active employees. Somebody who has left is deactivated rather than deleted, keeps their history, and stops consuming a seat.
• If billing lapses the workspace becomes read-only and stays readable. Payroll records are a statutory obligation, not leverage. Nothing is deleted.

There is currently no password reset email, because Klock does not send email yet. If you are locked out, contact support and we will restore access.

Privacy and POPIA

Your organisation is the responsible party for your staff's biometric data; Klock is the operator. In practice that means you must tell your staff what is collected and why, obtain their consent, and offer the PIN alternative to anybody who declines — declining must not cost somebody the ability to be paid.

Each customer's data is in a separate database. Face templates are 128-number descriptors, never images. Full detail is on the security page.

Troubleshooting

• The camera will not start. The page must be on https or localhost, and the browser must have camera permission for that site. Check the address bar's site settings.
• Everybody is refused. Check the distance shown on the refusal. If nobody is close, the workspace may have no enrolled templates — or the kiosk is pointed at the wrong workspace, which shows as "unknown workspace".
• One person is always refused. Re-enrol them. Check their score in Admin → Employees first.
• Hours look wrong. Check in this order: is there an open shift; are the break windows what you expect; is rounding on; is the overtime threshold what payroll uses. The report's own policy footer states all four.
• Leave is paying too much or too little. Check the standard working day in Admin → Shift schedule, and whether part-day hours were recorded.
• An employee is missing from the payroll file. They have no payroll reference. The export preview lists them.
• “Read only” on every change. The trial ended or a payment failed. Billing has the detail; your data is intact.

Getting help

Ask the assistant below — it answers from this page. For anything it cannot answer, or anything account-specific, email our support team.