INFORMATION AND RESOURCES
Security Features
Fareclock uses strong administrative, technical, and physical security measures to help protect personal information from loss, misuse, unauthorized access, or disclosure.
Role-Based Access Controls (RBAC)
- Employers can assign permission levels according to function
- Administrator access is restricted based on approved permissions
Authentication & Administrative Security
- Administrator accounts support multi-factor authentication (MFA) and two-step verification
- Required password policy and login requirements
- Configurable authentication providers and verification settings
Biometric Verification Protections (Optional)
- Face recognition helps prevent buddy punching
- Liveliness detection and anti-spoofing protections
- Detect replays, videos, and screen-based tricks
- Biometric data can be deleted by authorized admins
Geolocation Controls (Optional)
- GPS data collected only at clock-in/clock-out
- Optional continuous live tracking only if enabled
- Configure controls to block missing location data
- Detect fake GPS data or spoofed device location
Audit Logs & Monitoring
- Log administrative actions and access activity
- Track suspicious behavior and failed login attempts
- Audit reporting for compliance and investigations
Device & Application Security
- Optional device binding to link user to a specific device
- Detect tampering and duplicate app installs
- Block rooted devices or airplane mode
- Set up lock controls until admin review or unlock
Fraud & Abuse Prevention
- Detect unusual login activity and suspicious punches
- Flag fake GPS and timestamp manipulation attempts
- Enable alerts for face verification mismatches
- Security notifications for critical account changes
Data Encryption
- Data transmitted securely using SSL/TLS encryption
- Sensitive information protected during transmission
Secure Cloud Infrastructure
- Hosted on Google Cloud secure-by-design infrastructure that is built on widely recognized compliance frameworks (SOC, ISO, PCI, etc.)
Data Retention & Deletion Controls
- Configure retention periods and permanently delete user data
- Organization or user data is deleted 30 days after it becomes inactive
Penetration Testing & Security Audits
- Regular security testing by external specialists
- Vulnerability assessments and remediation processes
Automatic Updates & Patch Management
- Security patches pushed to apps and backend systems to help ensure protections stay current without customer action
Worker Privacy Controls
- Consent prompts for location or biometric collection for transparency into what data is collected and why
Secure Payment Processing
- Payments processed via Stripe
- No raw credit card data used for timekeeping operations
