Privacy and security
Working times are personal data. Punchify is built for GDPR-compliant use; the employer remains responsible for the processing.
Data access request (Art. 15 GDPR)
- Each person downloads all data stored about them as a ZIP under Settings → My data.
- Admins create the export for others under People.
The ZIP contains an explanation (purposes, recipients, retention, rights) and the data as JSON and CSV: master data, entries with change history, absences, work plans, shifts and swap requests, account adjustments, devices and sign-ins, log entries.
Retention periods
Under Company → Privacy and security an admin sets periods (all off by default):
| Period | Effect |
|---|---|
| Entries and absences (at least 2 years) | Older entries, absences and account adjustments are deleted – only in closed months. Time and leave accounts stay unchanged because the balance is booked as a carry-over. |
| Log | Older log entries are redacted; action and timestamp remain. |
| People who have left | People whose leaving date is older than the period (and whose account is deactivated) are anonymised and their data deleted. |
Deletion runs daily; a preview shows beforehand what would be affected.
Tamper-evident history
Every change to an entry stays visible as a version. Versions, log and work plans are chained (checksums). Under Log → Check integrity Punchify detects whether data was changed outside the app.
Encryption
- Transport always via HTTPS (Caddy fetches the certificate automatically).
- Backups are encrypted with AES-256-GCM.
- Optionally, sensitive fields are additionally stored encrypted:
PUNCHIFY_FIELD_ENCRYPTION=1(see configuration).
Sign-in
Under Company → Sign-in an admin chooses which methods are allowed:
- Password, optionally with a mandatory second factor (authenticator app with one-time codes and recovery codes),
- Passkeys – sign in with fingerprint, face or device PIN,
- Single sign-on via OpenID Connect, e.g. with Microsoft Entra ID, Google Workspace or Keycloak. People are matched by email address; accounts are not created automatically. Punchify shows the redirect URL for the provider (
https://<your domain>/api/login/oidc/callback).
Admins can always sign in with a password (and second factor if required) so nobody is locked out. If a phone is lost, an admin resets second factor and passkeys under People.
IP allowlist
Per company you can define from which networks sign-in, kiosk and API are allowed. Punchify warns before you lock yourself out. Emergency switch: PUNCHIFY_IP_ALLOWLIST_OFF=1.
Log
Important events – sign-ins, changes to people, entries and settings, exports, approvals, shift plans – appear in the Log (for admins and auditors). It is searchable and can be exported as CSV.
Licence check
Self-hosted installations report to the licence server once a day. Only technical data is transmitted – see Licence. No names, no times.