Platform Security Controls

1. Server-Authoritative Timestamps

Frontline employees cannot alter their clock-in time by modifying local smartphone clock settings, changing device time zones, or manipulating offline device caches.

Attendance records receive their timestamp directly from the database server clock (server time) during execution of the backend RPC function, formatted and displayed in the company's designated operational timezone (Asia/Phnom_Penh, UTC+7).

2. Multi-Tenant Row-Level Security (RLS)

Data segregation is enforced at the database engine level via PostgreSQL Row-Level Security. Every table—including attendance logs, rosters, profiles, and payroll—is protected by database access policies.

Users authenticate using Supabase Auth JWT tokens. Database policies verify that the requesting user holds an active membership in the target organization before returning or modifying records. Role scopes (Owner, HR, Branch Manager, Supervisor, Payroll Admin, Employee) restrict visibility strictly to authorized data.

3. Immutable Attendance Records & Correction Auditing

Original attendance punches are protected from ordinary employee and manager edits. Once recorded, raw punch events cannot be overwritten or silently modified by employees or managers.

If an employee requests an attendance correction (e.g., due to an unexpected delay or device issue), the correction is logged as an independent adjustment record accompanied by mandatory employee reason notes. Supervisor approvals or rejections are tracked in audit logs alongside reviewer user IDs and timestamps.

4. Restricted Attendance RPC Function

Attendance entries are written exclusively via a dedicated database function (check_in_out) that validates branch geofence distance, server-observed public IP evidence, registered device parameters, and active shift rules in an atomic transaction.

Direct write access to attendance tables is revoked from client-side users, preventing arbitrary insertion or spoofing of attendance rows.

5. Point-in-Time Verification (Zero Continuous Tracking)

SlidesClock does not conduct continuous background location monitoring. GPS coordinates are requested strictly when an employee initiates the slide action to clock in or out under a branch GPS policy, or when an authorized manager explicitly captures coordinates to establish a workplace geofence radius.

On iOS, attendance checks do not transmit SSID or BSSID Wi-Fi network names due to platform privacy safeguards; network verification relies on the public IP observed by our servers. Android devices may transmit SSID/BSSID where available.

6. Operational Disclosures and Boundaries

We believe in factual, transparent communication regarding technical capabilities:

• Device Registration: Device registration (recording IDFV on iOS, platform, model, and OS description) is operational to link accounts to primary phones. However, hardware-level cryptographic attestation (such as Apple App Attest) is not operational, and SlidesClock does not claim to be tamper-proof or spoof-proof.
• Storage Buckets: Employee avatars and payment receipts are stored in private, authenticated storage buckets. Company logos are public branding files accessed by exact URL.
• Notification Pruning: Terminal-state push notification outbox records older than 30 days are automatically deleted during daily maintenance by an automated database pruning cron function (app_prune_notification_outbox).
• Certifications: We do not make unverified claims of SOC 2 or ISO certifications. Our security posture relies on hosted infrastructure (Supabase and Vercel) and strict database-level access controls.