Secure a biometric device

A biometric device identifies itself only by its serial number. The Security panel lets you make sure punches really come from your office, and lets you review punches that arrive suspiciously late.

Before you start

• You need manage access to attendance.
• The device should have connected at least once, so Attendex knows its current IP.

Lock a device to your office IP

1. Go to Time & Attendance → Biometric Devices ( open Biometric Devices).
2. On the Devices tab, click Security next to the device.
3. Click Lock to current IP (…). The button shows the IP the device last connected from.

The button now reads Security (IP locked). Requests for this device from any other IP are ignored and logged as security events.

Allow several IPs or a range

Use this if your office has two internet lines or a fixed range.

1. Open Security for the device.
2. In Allowed IPs / ranges, enter public IPs or CIDR ranges separated by commas, for example 203.0.113.7, 198.51.100.0/24.
3. Click Save security settings.

If the device's last IP is not in your list, Attendex warns you that the device will be refused until it connects from an allowed IP.

Remove the lock

Open Security and click Remove IP lock, then confirm. The device is accepted from any IP again.

When your internet IP changes

If your provider changes your office IP, a locked device is refused. Nothing is lost:

• The device keeps its punches and keeps retrying.
• Your admins get an in-app notification that the device was refused.
• Open Security, click Lock to current IP (or update Allowed IPs / ranges) and the device uploads its backlog on its next try.

New-IP alerts (devices without a lock)

When a device that is not IP-locked connects from an IP it has never used before, your admins get an in-app notification. If you don't recognise the IP, lock the device to your real office IP.

Hold late-arriving punches

1. Open Security for the device.
2. Enter a number of days in Hold punches older than (days), for example 7.
3. Click Save security settings.

Punches that reach Attendex more than that many days after they happened are kept aside instead of counting. Leave the field empty to turn this off (the default). It never applies while the device is IP-locked, because a locked device's backlog is trusted.

Review held punches

1. Open the Punch Logs tab.
2. Under Punches held for review, check the employee, Punch time, Received time and Device / IP.
3. Click Accept to count the punch (the day is recalculated), or Discard to ignore it.

Security events

Device security events on the Punch Logs tab lists recent events such as Refused (IP not allowed), New IP, Old punches, Punches held and Future-dated punches. Open it when something looks wrong.