Buddy punching — one employee clocking in for another — is one of the oldest problems in workforce management. Face verification solves the identity half of it, but only if it's fast, resists a held-up photo, and gives an administrator a way to confirm what actually happened.
The architecture
Face detection, landmark extraction, and face matching run on-device, using a TensorFlow.js-based model that loads lazily — only the moment someone opens face check-in, never as part of the app's main bundle. The face is compared as a 128-number mathematical embedding, computed locally and matched against the enrolled template.
- Enrollment: a guided setup asks you to turn your head slowly to each side. The device computes your embedding and captures a reference photo, and both are stored — scoped to your organization — so your admin can later confirm who's enrolled.
- Check-in: a fresh embedding is computed and compared against the stored one using Euclidean distance; below a threshold counts as a match, which the server independently re-verifies rather than trusting a client-asserted 'it matched.' A photo of that check-in is captured and stored for review.
- Liveness: the guided head-turn is the liveness signal. The client records a timestamped head-pose series, and the server independently replays it to confirm a real left-and-right movement happened — something a flat photo can't fake — before accepting the check-in.
Why this design, specifically
Matching stays local so it's fast and works with a weak connection. The stored photo is the honest tradeoff for a trustworthy attendance record: rather than claim a camera trick is unbeatable, we give administrators a real photo per check-in plus an approved-device requirement, so identity is confirmed by more than the model alone.
Only an administrator can remove someone's enrollment, so a member can't clear their own face to sidestep verification — they'd have to re-enroll under the same guided, reviewable flow.