Product 003 — Remote Offline Time & Attendance
R.O.T.A.
Clocking in that works three floors below the signal.
Time and attendance for workforces that start their shift in a basement, a plant room or a cleaners’ cupboard with no Wi-Fi and no mobile signal. R.O.T.A. records every clock-in offline, carries it out securely, and turns it into approved, payroll-ready hours.
01 — The problem
No signal. One visit a week. Payroll still needs the truth.
Contract cleaning, facilities and security teams often clock in where connectivity simply does not exist. Paper sheets get lost, phone apps need a signal, and a manager only reaches each site every few days. The result is hours nobody can fully trust: for payroll, for the customer, or for the staff themselves.
0 bars
Underground clock-in points
The terminal sits where the work starts: basements, cupboards, plant rooms. It must work with zero connectivity, indefinitely. R.O.T.A. is designed for exactly that, not as a fallback mode.
1 visit
A manager passes by weekly
That visit is the network. The manager’s phone collects sealed records over Bluetooth and uploads them when it is back online. No cabling, no site Wi-Fi project.
6 years
Of records you have to keep
UK minimum wage rules mean attendance records must stand up for years. Every event is signed, chained and never edited, so the record you keep is the record that happened.
02 — How it works
Tap in. Seal it. Carry it out. Pay it.
01
Tap in
Staff show a rotating QR code from their phone, or tap a secure NFC card and enter a PIN. The terminal shows a staff number, never a name, and plays a sound.
02
Sealed on the terminal
Each event is signed, hash-chained and encrypted to the cloud the moment it is recorded, and written to two stores. Nothing on the tablet can be read or altered.
03
Carried by the manager app
On the weekly visit the manager’s phone collects the sealed batch over Bluetooth. It is a blind courier: it cannot open what it carries.
04
Confirmed, then paid
The cloud verifies every signature, acknowledges receipt (only then does the terminal delete), pairs ins and outs, and prepares approved hours for payroll.
03 — Three ways to clock in
Right for every member of staff, with no biometrics.
Phone, card or temporary pass. Every event records which method was used, so reports show exactly how much assurance sits behind each hour.
Phone · high assurance
Signed, rotating QR code
The staff app shows a single-use code that changes every 30 seconds and only after the phone is unlocked. Keys live in the phone’s secure hardware. Staff can also see their own hours.
Card + PIN · medium-high
Secure NFC card
For staff without a smartphone: a cryptographic NFC card (NTAG 424 DNA or DESFire EV3) plus a PIN. Cards are issued, replaced and revoked from the manager app or the web app.
Temporary · flagged
Time-limited pass
New starters, forgotten phones and cover staff get a basic card that expires. Hours clocked with it are clearly flagged for review, never silently mixed in.
04 — Built for trust
Designed so the record cannot lie, and nobody has to take our word for it.
01 / Privacy
No names on any device
Terminals and manager phones hold opaque IDs, public keys and PIN verifiers only. Names stay in the cloud and payroll, where they belong.
02 / Integrity
Signed, chained, append-only
Every event is signed on the terminal and hash-chained to the one before. Nothing is edited in the cloud; corrections are separate, reasoned, audited adjustments.
03 / Confidentiality
Encrypted to the cloud
Records are sealed on the terminal with the cloud’s public key. The courier phone, a lost tablet or a curious contractor cannot read them.
04 / Resilience
Delete only on confirmation
A terminal keeps its records in two encrypted stores and purges them only after a cloud-signed acknowledgement. A dropped connection never costs a shift.
05 / Compliance
No biometrics, UK hosting
Phone unlock happens on the device; R.O.T.A. never sees a face or a fingerprint. Data is hosted in the UK with six-year retention defaults aligned to minimum wage record-keeping.
06 / Accountability
Audit log for everything
Every approval, adjustment, credential change and verification check is logged with who, when and why.
05 — For the office
Hours that arrive ready to approve.
The web app does the work that used to live in spreadsheets: it pairs ins and outs, applies your rounding, break and overtime rules, handles overnight shifts and clock changes correctly, and surfaces the exceptions that need a human.
- Exceptions queue: missing clock-outs, unknown cards, suspicious patterns, clock drift, late data
- Adjustments with a reason and an audit entry; originals never change
- Approve and lock each pay period, then export to payroll and ERP
- Reports by site, person and period, with CSV export for your customers
- Site-scoped roles, single sign-on and MFA
06 — Straight talk
What R.O.T.A. is not.
Not a lone-worker alarm. Terminals are offline by design, so there are no real-time alerts. If you need those, you need a different product alongside this one.
Not biometric. No face matching, no fingerprints. The ICO has already stopped an employer using facial recognition for attendance; we built the alternative they were told to offer.
Not a disciplinary engine. Exceptions and flags are prompts for a person to review, with a reason recorded. R.O.T.A. never decides on its own.
07 — Getting started
From one basement to the whole estate.
01
Site walk-through
We look at where your people clock in, how often managers visit, and what payroll and reporting need from the data.
02
Pilot one site
A terminal, a handful of cards, the staff app and the manager app, running alongside your current process for a full pay period.
03
Roll out
Terminals per site, cards issued, staff synced from payroll, approved hours flowing to payroll and ERP. Then add more sites at your pace.
08 — Questions
Straight answers.
What hardware does it need?
An Android tablet in a wall enclosure at each clock-in point, running in locked-down kiosk mode, with mains power and battery backup. Staff use their own phones or an NFC card. Managers use the app on their existing iPhone or Android phone.
What if a manager misses the weekly visit?
Nothing is lost. The terminal keeps every event in two encrypted stores until the cloud confirms receipt. The web app shows which sites are overdue a visit so nobody forgets.
Can staff clock in for each other?
Phone QR codes are single-use, rotate every 30 seconds and need the phone unlocked. Cards are cryptographic and need a PIN. Temporary passes are flagged. Authorised staff can also run spot checks and retrospective verification, each one logged.
How does it connect to payroll?
Staff lists come in from your payroll system, and approved hours go back out, through an adapter we build for your provider. ERP export for costing and billing and per-site customer reports follow in the next phase.
Where is the data held and for how long?
In UK data centres. Defaults keep clock events, timesheets and the audit log for six years after the pay period, in line with UK minimum wage record-keeping, and keep terminal telemetry for twelve months. All of it is configurable.
Is it available today?
R.O.T.A. is in development with a design built alongside a UK cleaning contractor. We are looking for a small number of pilot partners with genuinely offline sites. Talk to us if that is you.
Got a site with no signal?
Tell us about it. We are onboarding a small number of pilot partners for R.O.T.A. and would rather show you a terminal in a basement than a slide deck.