Location and Security Restriction Setup

In addition to punch locations, your OnTheClock account offers security features to ensure accurate and compliant punching. These settings can be found in each employee profile under the Location & Security tab. 

Methods for Clock-In Restriction

IP Authorization

• Restrict clock-ins to a specific internet network.

• Enforcement rules include:

  • Lock Out Employee – Employee cannot clock in unless on the designated network.

  • Warn Employee – Employee can clock in but will see a warning if not on the designated network.

  • Off – No restrictions.

• Use Enforcement Type to allow multiple IP addresses (e.g., Multi IP Range).

Device Authorizations

• Restrict clock-ins to a specific device.

• The device must first be logged in to appear as an option.

Fingerprint Sign-On

• Enable employees to clock in and out using fingerprints.

• Options:

  • On – Employees may use fingerprints but can also clock in with other methods.

  • On, Fingerprint Only – Employees can only use fingerprint sign-on to clock in.

You can read more about setting up this feature.

Desktop or Laptop GPS

• Record an employee’s GPS coordinates when they clock in or out from a computer.

• This is for recordkeeping only; employees are not restricted to a location.

Mobile Rules and GPS

• Restrict or track clock-ins from mobile devices.

• Mobile Rule options:

  • Do Not Record GPS Coordinates – No location tracking.

  • Record GPS Coordinates – Records a location when clocking in/out.

  • Require GPS to Punch – Employees must share location to clock in/out.

  • Warn if Not at GPS Location – Employee is warned if clocking in outside a set location.

  • Disable Punch if Not at GPS Location – Employee cannot clock in unless at a set location.

GPS Tracking

Track an employee’s GPS location throughout their shift when clocked in.

Setup

Desktop | Mobile

Desktop

IP Authorization

1. Step 1: Log in as an administrator or manager.
2. Step 2: Go to My Team and select the employee you want to restrict. 
3. Step 3: Under “location & security,” toggle IP Authorization on.
4. 
5. Step 4: Specify your enforcement level.
6. Step 5: Specify your enforcement type.
7. Step 6: Enter the public IP into the boxes and click save.

Device Authorization

1. Step 1: Log in as an administrator or manager.
2. Step 2: Go to My Team and select the employee you want to restrict. 
3. Step 3: Under “location & security,” toggle “Enable device & browser authorization” on.
4. Step 4: Find the device in the list and toggle Allow Punching on. 
5. 
6. Step 5: Click save.

Fingerprint Sign On

1. Step 1: Log in as an administrator or manager.
2. Step 2: Go to My Team and select the employee you want to restrict. 
3. Step 3: Under “fingerprint sign on,” choose “On” or “On, fingerprint only.”
4. Step 4: Check if fingerprints are on file. 
5. Step 5: Click Save. 

Desktop or Laptop GPS

1. Step 1: Log in as an administrator or manager.
2. Step 2: Go to My Team and select the employee you want to restrict. 
3. Step 3: Under Desktop GPS Rules, toggle the setting On. 
4. 
5. Step 4: Click Save. 

Primary Work Location

The Primary Work Location is the registered business address where the employee works.

• It is required for payroll tax purposes but does not restrict employees.

• To restrict employees, set up GPS Locations and follow the Mobile Rules & GPS guidance.

• Multiple primary locations can be created and assigned per employee.

• A location address is required to apply a primary work location.

You can have multiple primary locations, and assign them on an individual employee profile. In order to apply a primary location you will need to have a location address.

Mobile Rules & GPS

1. Step 1:  Log in and go to My Team. 
2. Step 2: Select an employee to open their profile.
3. Step 3: From the profile, go to Location & Security. 
4. Step 4: Under Mobile Rules & GPS, toggle Enable Mobile Punch on. 
5. 
6. Step 5: Select your Mobile Rule. 
7. Step 6: Click Save Settings. 

App GPS Tracking

1. Step 1: Log in and go to My Team. 
2. Step 2: Select an employee to open their profile. 
3. Step 3: From the profile, go to Location & Security. 
4. Step 4: Under Mobile Rules & GPS, toggle App GPS Tracking on. 
5.  
6. Step 5: Click Save Settings. 

Mobile

Mobile Rules & GPS

1. Step 1: After logging in, navigate to “Employees.”
2. Step 2: Select an employee to open their profile.
3. Step 3: From the employee profile, navigate to “Location & Security.”
4. Step 4: Under “Mobile Rules & GPS,” toggle “Enable mobile punch” on.
5. Step 5: Select your mobile rule.
6. Step 6: Click “Save settings”.

App GPS Tracking

1. Step 1: After logging in, navigate to “Employees.”
2. Step 2: Select an employee to open their profile.
3. Step 3: From the employee profile, navigate to “Location & Security.”
4. Step 4: Under “Mobile Rules & GPS,” toggle “App GPS Tracking” on.
5. Step 5: Click “Save Settings.”

• Unauthorized Browser Message
  If an employee sees a message that they are on an unauthorized browser, it usually means their cache and cookies were cleared. An administrator must reset the browser as an authorized device.

• Unauthorized IP Address Error
  If an employee receives an error that they are not at an authorized IP address:

  1. Confirm the correct IP address is entered in IP Authorization settings.

  2. If you do not have a static IP, restarting your network may cause your public IP to be reassigned.

  3. The system will display your current IP address under the IP Authorization setup screen so you can update it if needed.