Time clock — arrival, departure, breaks and corrections

Employees clock in and out, and their worked time appears in Staff → Plan vs fact. These hours are used in payroll. Normal clock actions use server time; errors are corrected through a separate edit or request.

Requirements#

• Create employee cards and set their locations. Phone use needs a personal login; a tablet needs the employee’s 4–6 digit PIN.
• The owner sets policies in Staff → Schedule and clock-in settings. Managers edit accessible shifts and decide requests within their permissions; the policy-overrides block is read-only for them.
• Set location coordinates for geofencing; prepare a network-connected device with a browser for a terminal.
• Check the location’s time zone and that the relevant timesheet month is open.

What reaches the timesheet#

A shift stores its schedule, if any, and actual arrival, departure and breaks. Clocking in without a scheduled shift creates an unscheduled shift.

A manual edit receives the manual source; automation should not replace time corrected by a person.

Clock from a phone#

Task: Anna, a sales assistant, starts her working day at the shop.

1. Open Staff → My cabinet and the Today block.
2. Press I’m in. Allow browser location access if requested; in terminal-only mode, confirm the device first.
3. Check that the shift has started. Press I’m out when finishing work.

Result: the shift receives actual start and end times; an overnight clock-out belongs to the open shift even if it started yesterday. If an old shift is still open, resolve it before recording a new arrival. Forgot to clock creates a correction request.

Location and role policies#

Find Clock-in gate in Schedule and clock-in settings.

The check uses the shift location’s coordinates. Without location coordinates, distance cannot be compared. A PIN identifies the employee, not their position: strict mode also requires POS geolocation or terminal confirmation.

To require a terminal at one shop but allow phones at another:

1. The owner opens Per-venue and per-role overrides → ＋ Add override.
2. Choose Venue, the shop and mode; set the radius and automatic closing options if needed.
3. Leave other fields inherited. This block saves separately from the settings panel’s main Save button.

Result: only specified fields change. Priority is the employee’s job role, then its base tier, then the shift location, then the account. A courier rule can therefore override a location’s strict mode. If a setting does not apply, check the higher-priority role rule.

Clock-in by schedule and manager approval#

"Schedule and clock settings" has a "Clock-in by schedule" block. It decides what happens when someone clocks in without a scheduled shift, too early or too late, or comes back right after clocking out.

The clock-in is always recorded — no mode loses the time. When flagged, the shift gets a "🕘 Off schedule" badge in "Plan vs actual". With approval, the employee sees "Clock-in recorded and waiting for manager approval" with the reason, and the shift shows "🕘 Waiting for approval".

The manager decides in "Plan vs actual" with "Approve" or "Reject" in the shift row. Managers do not decide on their own shifts. Rejecting does not erase the hours: it marks that the manager disagrees, and the time is fixed with a regular correction. Until a decision is made, the shift is a period exception and the period cannot be closed without reviewing it.

A clock-in that a manager records for an employee at the POS is not flagged: the manager's action is the approval. The same fields can be set per location or role in "Location and role overrides".

In the Cenaly Team app (Android and Windows) the same line — "Clock-in recorded and waiting for manager approval: later than the schedule" or "Clock-in recorded and flagged: …" — appears in "My shift" under the status while the shift is open. It disappears once the manager decides.

Bind a terminal#

Task: leave a tablet at the entrance to a café, shop or salon.

1. On that device, open Staff → Schedule and clock-in settings with permission to manage terminals.
2. In Clock-in terminals, press Bind this device, name it and optionally select a location.
3. Check that the binding notice appears, then press Open terminal screen.
4. If clocking must happen only there, the owner enables Only from a venue terminal for the account or that location.
5. Leave /clock-terminal open and check a trial clock action. Tablet or monitor mode is saved in the address.

Result: the device confirms clock actions. A terminal assigned to a location accepts arrival for shifts at that location; an unscheduled shift receives that location automatically. A scheduled shift elsewhere causes refusal.

The binding secret stays in the browser. Bind the device again after clearing site data. A revoked terminal is refused on its next clock action. The list shows its last clock action; a warning after more than a day of inactivity is a reason to check power, connectivity and the open screen.

Tablet with a PIN#

The screen offers four actions: I’m in, I’m out, Break and Back from break. Press one and enter your PIN. The employee does not need a personal sign-in on the tablet; the PIN is unique within the account.

After 10 wrong PINs within 15 minutes, input from that terminal is locked for 15 minutes. The screen reports too many incorrect PINs and the wait in minutes. Stop guessing: wait and check the PIN. For PIN verification from a personal login, the counter belongs to the calling employee.

Monitor with a QR code#

The monitor shows a QR code refreshed every 30 seconds. Employees scan it with their phones, sign in to their personal workspace and press the required action. Scanning alone does not clock them in.

Confirmation lasts about two minutes. A server-issued QR is single-use: the first action consumes it, and the next employee needs a new code. If a fresh QR cannot be obtained, the screen may show a short-lived fallback code in the older format, without single-use protection.

If the workspace reports an expired QR, scan a fresh code and repeat the action. Hours belong to the employee signed into the workspace.

Record a break#

Task: Anna works from 09:00 to 18:00 with a half-hour break.

1. After clocking in, press Break on the terminal and confirm your PIN. On a phone, use the break action in My cabinet.
2. On returning, press Back from break on the terminal and confirm the PIN again.
3. Clock out at the end of the shift and check hours in Plan vs fact or My hours.

Result: 30 minutes are deducted from the nine hours between arrival and departure, leaving 8 hours 30 minutes. When actual breaks exist, the scheduled break is not deducted again. If there are no actual breaks, the scheduled break duration is used.

If a break is left open, clock-out closes it at the departure time. While a break is open, it is not yet included in the sum of closed breaks. Starting another break or returning without an open break is refused — check the current state.

Ways to record departure#

This process has no background phone tracking after a shift or biometric time-clock terminal.

Clocking out with open checks#

"Clocking out with open checks or an open cash shift" in "Schedule and clock settings" checks two things on "I'm out": open orders where the employee is the server (last day and a half, at the shift location) and their open cash shift.

On the shared tablet and in the POS hall, a manager records the clock-out despite open checks. If orders could not be checked (no connection to the order registry), the clock-out goes through marked "not checked". A clock action made by the POS without internet is never stopped — the shift only gets the mark.

A manager who still has open checks of their own also sees the list in "Only with a manager" mode and may leave: the decision is theirs.

In the Cenaly Team app (Android and Windows) "End shift" in "My shift" shows the same list: "You still have open checks. Open: table 5, order #123. Your cash shift is still open." In "Warn and show the tables" mode a "Clock out anyway" button sits next to it — the clock-out is recorded with the same mark. In "Only with a manager" mode there is no button, and the text asks a manager to close the tables or clock the employee out.

Automatically close forgotten shifts#

In Auto clock-out for forgotten shifts, enable Close open shifts automatically. It is off by default.

• Wait after the scheduled end, minutes: initially 30. After the wait, departure is set to the scheduled end, not the check time.
• Cap for unscheduled shifts, hours: initially 12. Without a suitable schedule, departure is arrival plus this duration. Zero disables this type of closing.
• These settings can be overridden by location and role.

The check runs every 30 minutes. It leaves closed months and presence-based shifts alone. The shift receives an auto-closed · awaiting confirmation badge, and the employee receives a work-chat notification.

This is inferred time and may differ from actual departure. In My hours, the employee selects Correct or Set clock-out. The latter sends a request; hours change after approval. When closing the period, the manager reviews Auto-closed shift awaiting confirmation; Confirm as is retains the inferred time.

The period cannot close until the exception is resolved. In the payroll draft, the ⏱ badge reminds you that the amount currently uses inferred hours. After confirmation, the badge shows confirmed automatic closing. For the floor and delivery, the shift is already closed when automation runs.

Correct a past clock action#

Task: automatic closing recorded 18:00, but Anna left at 17:30.

1. Anna opens My hours → Set clock-out on the automatically closed shift, enters 17:30 and a comment. For another missed clock action, use Forgot to clock.
2. The owner or a manager with permission for the employee and location reviews the correction request and decides it.
3. After approval, check the new actual time and hours. The request retains the decision-maker and decision time; approval also creates a personnel event.

Result: the timesheet uses the agreed time. Proposed hours do not replace actual time before approval. If the month is closed, ask the owner to reopen it.

The owner or an authorised manager can also edit actual time directly in Plan vs fact. This records a manual source and removes the automatic-closing badge. Do not treat it as a full before-and-after audit: Clock-in history does not provide a separate row for every manual edit. Use a request when you need an agreement with a recorded decision.

Working at several locations#

Employees can receive several locations through their role and card. Separate shifts can belong to different locations; check the scheduled shift’s location and the terminal binding.

There is no automatic transfer between locations within one open shift. Do not treat clocking on another terminal as moving hours. Plan separate shifts with the required locations and check actual boundaries with the manager. An open shift must not remain unresolved before a new arrival.

Clock history and payroll#

In Plan vs fact, click 🕘 Clock-in history beside a shift. It shows related attempts: time, action, initiator, source and result, including recorded refusals. This is view-only, with no correction buttons. An attempt without an identified shift may not appear in that shift’s history.

The timesheet also shows time sources: automatic presence, automatic closing, outside-location flags and manual time. Employees check their own hours; managers check accessible employees. The server recognises retries of the same request after a connection loss to avoid a second clock action; still check the state after an error.

Print your hours at the POS. The employee opens My cabinet → the Hours tab → My hours, chooses the month and clicks 🧾 Print on receipt printer. At a POS with the bridge connected, the timesheet comes out on the location's receipt printer: location name, “Timesheet”, name and period, one line per shift (date, clock-in and clock-out time or the plan, hours) and totals — number of shifts, planned hours and hours worked. If the printer is offline, the job waits in the bridge queue and prints when it is back; without the bridge, the browser print dialog opens. This is a slip for the employee, not the monthly document for signing — that one is printed from Monthly document.

Clocking in and out at the POS without internet#

If the connection drops during a shift, employees can clock in or out on a web POS already prepared for offline work at that location. Their account and personal PIN must be available on the device; signing in as cashier with a PIN does not itself clock them in.

1. Open “Hall panel” → “Day”, find the employee and select “Clock in” or “Clock out”.
2. Without a connection, the employee enters their own PIN, even if a manager started the action. The register saves the mark locally and shows, for example, “Clock-in 09:00 — saved on the register, waiting for connection”.
3. The queue is sent automatically when the connection returns. Until the cloud confirms the mark, a waiting message does not mean the timesheet has changed. “the venue bridge has a copy” also means only that a copy is available for delivery.
4. Once accepted, the timesheet uses the action time recorded by the register, not the delivery time. A conflict shows “Mark … is waiting for the owner’s review: …”; it does not affect the timesheet until resolved. A mark may also be explicitly rejected with a reason.

Limitations#

Saving a mark requires a prepared register, a valid offline permit and a personal PIN. If the register’s clock is in doubt or storage fails, the mark is not recorded. Offline queuing cannot bypass a server refusal based on permissions or clock-in rules. Do not clear browser data while marks are waiting for delivery.

Troubleshooting#

Limitations#

• A closed month accepts no clock actions, edits or requests. This includes the current month if closed early. The timesheet can also be closed for a single location — then clock actions and edits stop only there. Only the owner can reopen it.
• The open-check test on clock-out sees orders with a named server; orders without a server (counter, website) are not found.
• Browser geolocation can be spoofed; distance verification cannot be promised without location coordinates.
• A shared terminal does not replace personal sign-in for the phone QR workflow.
• Device presence is a separate AWS option; do not expect it on cenaly.ru.
• Automatic closing infers departure rather than establishing it; manual edits do not have a universal complete audit trail.

Troubleshooting#

FAQ#

Can employees clock without a personal login? Yes, on a tablet using an issued PIN. Phone and QR clocking require personal sign-in.

The terminal broke — how do we continue? Revoke it and ask the owner to temporarily change the location policy for phone clocking. Check geolocation if strict mode is used.

Automatic closing overstated hours — what should we do? Use Set clock-out, wait for the decision and check the timesheet before calculating payroll.

Related articles#

• Staff — schedules and timesheets.
• Roles and permissions — locations and access.
• Security and data — other logs.
• QR codes and devices — terminal access.
• POS, Cash shift — till workflows.
• Finance — labour costs.