Attendance Needed Evidence, Not Trust
A login proved that someone knew a password; it did not prove an employee was at the branch. The check-in flow was therefore designed around evidence: the employee must be within 100 metres of the assigned location and verify their identity before an attendance record can be written.
Two Weak Signals Beat One Confident One
GPS confirms location but can be spoofed, while biometrics confirm identity but say nothing about where the person is. Requiring both makes proxy attendance impractical: the employee's face or registered device must be physically present at the correct branch. Neither signal is treated as magic, which is generally a healthy relationship to browser APIs.
Face Matching Stayed on the Device
Face detection and descriptor comparison run in the browser with face-api.js and TensorFlow.js; no live face image is sent to the server. This traded some client-side model weight for better privacy and zero server-side inference cost, matching the client's discomfort with centralised facial data while keeping the web deployment simple.
Managers Needed a Scan, Not a Query
The admin view uses a monthly attendance grid, branch filters, drill-down details, map links, and export rather than making managers assemble reports from raw events. Desktop gets a dense table-like overview; mobile gets a bottom sheet so the same information remains usable without horizontal scrolling. The system shipped as a web app across branches, avoiding native-app infrastructure entirely.