Time and attendance software collects employees' clock-in and clock-out records, compares them with the shift plan and turns overtime, lateness, absence and leave into a timesheet ready for payroll. To choose well, look past the screenshots: check how accurately it applies your shift rules, how it feeds payroll and whether it keeps data in line with data protection law.
Where the search usually gets stuck
The process tends to start with a complaint. HR spends two or three days at month end stitching timesheets together, overtime is disputed every month, or the old fingerprint clock can no longer be used. A few suppliers are asked for demos, and every demo looks similar: a colourful calendar, a list of punches and an "export to Excel" button. We cover the old device's reading problems and the logic of switching to cards in fingerprint reader not recognising fingerprints.
The trouble is that demos do not show your shift pattern or your exceptions. The night shift that spans two calendar days, the team on an averaging period, the field technician, or the manager who moves between two sites: these are where most software breaks. If you are still clarifying how attendance tracking works in general, read our time and attendance system guide first; this article focuses on the next step, the buying decision.
The cost of the wrong attendance software
Attendance data is the record of labour, usually one of a company's largest cost lines. The best public figures on its scale come mostly from abroad:
According to a 2015 CDC Foundation press release, productivity losses linked to absenteeism cost US employers $225.8 billion a year, or $1,685 per employee.
It is not only about money. A joint WHO and ILO study estimates that working 55 hours or more a week led to 745,000 deaths from stroke and ischaemic heart disease in 2016. Software that cannot track Türkiye's annual overtime cap and daily maximum hides that risk until month end; the rules are explained in our overtime and timesheet calculation guide.
The legal cost became far more visible in 2026. In its announcement on principle decision 2026/921, the Turkish Personal Data Protection Authority (KVKK, the regulator under Türkiye's GDPR-style law) stated that explicit consent alone is, as a rule, not a sufficient legal basis for processing biometrics for attendance. Complaint volumes are significant too: according to the KVKK 2025 Annual Report, the authority received 12,512 complaints and reports in 2025. Buying fingerprint-based attendance software today may simply mean choosing again soon; see biometric attendance and data protection.
Ten questions to ask when choosing time and attendance software
Put these questions to every supplier in the same order and ask for written answers. Any question left vague is work someone will fix by hand after go-live.
- Can it calculate our shift rules as they are? Shifts past midnight, rest breaks, averaging periods and weekly rest days must be definable to match your contracts. Warning sign: "You can fix that in Excel." We collect the recording problems typical of rotating and night shifts in shift attendance tracking.
- Where do the records come from? Does the software use the access control read at the door, or does it need a separate time clock? A separate clock means staff tap twice and two records that can disagree.
- Which credential does it use? Card, time-limited QR or PIN; biometrics should no longer be the default. We compare the options in fingerprint vs card vs face recognition.
- How does it feed payroll? Ask to see concretely which payroll packages it supports and whether it uses file exports or a direct integration. We cover this separately in time and attendance payroll integration.
- Where are leave, sick notes and assignments recorded? Annual leave, medical reports, off-site duties and training all affect the timesheet; if they live outside the software, someone corrects the timesheet by hand every month.
- What happens when the network drops? The door terminal should keep recording and sync when the connection returns. See access control offline mode.
- Do you have several sites or contractors? Each site should see only its own records, head office should get consolidated reports, and contractor staff should be managed separately.
- Are data protection requirements built into the core? Deletion or anonymisation after the retention period, role-based access and an audit trail of who changed what should be part of the system, not a report added later.
- Is the data yours? Ask in writing in what format you can take the full history when the contract ends.
- How do installation and support work? Installation by number of doors, training, who comes out when a device fails and support hours should all be stated in the proposal.
Cloud, on-premise or bespoke: a comparison
The answers to those questions often depend on how the software is delivered. The three common models compare as follows:
| Model | Strength | Watch out for | Best suited to |
|---|---|---|---|
| Cloud (subscription) | No server, automatic updates, easy across sites | Where data is held; terminal behaviour during outages | Multi-site businesses with small IT teams |
| On-premise (licence) | Data stays on your own server | Server maintenance, backups and updates are your job | Organisations required to keep data in-house |
| Bespoke software | Fits your rules exactly | Longer timeline and higher budget; needs proper requirements analysis | Businesses with non-standard shifts and processes |
The broader build-versus-buy decision is covered in custom vs off-the-shelf software, and the document you need to get comparable quotes from suppliers in writing technical specifications.
One last test for the demo stage: take ten employees from last month's real clock-in data and ask each supplier to calculate their timesheets in its own software. Compare the result with HR's manual calculation. Every difference points to a gap, either in the software or in your current process.
Three common selection mistakes
- Starting with the device. If you pick a terminal first and then look for software to match, your shift rules end up bent around whatever the device supports. The right order is rules, software, then hardware.
- Forgetting the field. Teams working on building sites, in the field or at customer premises never pass a door. Decide early how their time will be recorded; see construction site access and attendance and, for phone-based options, mobile access control.
- Leaving reports for later. If the indicators management wants (overtime trends, absence rate, shift coverage) are not listed during selection, the software never goes beyond the month-end timesheet. Our BI dashboard guide shows how to bring them onto one screen.
How we run attendance projects at Digital Bridge
We set up attendance not as standalone software but as a process running from the door to payroll.
- Discovery and requirements. We review your shift plans, averaging arrangements, leave and sick-note flows, and the layout of doors and turnstiles. If your existing card access control hardware can be kept, we say so in writing.
- Rule set-up and pilot. We define shift and timesheet rules for one team and run them in parallel with your current method for a period, closing the gaps with you.
- Payroll and HR connection. We feed the timesheet output into your HR, payroll and personnel management processes, and where different packages are involved we connect them through system integrations.
- Data protection and roll-out. We finalise privacy notices, retention periods and access rights through our data protection compliance consultancy, then extend to other teams and sites.
SmartPass: the door read as the source of the timesheet
Our own product, SmartPass, combines card access control, time and attendance and canteen meal counting in one system; the building blocks on the door side are explained in what a card access control system is. When an employee taps their card, the door opens, an attendance record is created and, if they are entitled, a meal is deducted; no separate time clock is needed. Timesheets follow the shift plan and reports can be exported to payroll.
SmartPass answers the questions above in concrete terms. Credentials are 13.56 MHz RFID cards and time-limited QR codes, read on the same terminal. Each organisation runs on its own subdomain and database; a holding company gets consolidated reports while sites cannot see each other's records. Card numbers are never stored in plain text, records past their retention period are anonymised, every change is written to an audit trail with old and new values, and the auditor role is read-only.
Pricing is made up of transparent components: hardware is purchased and owned by you, installation depends on the number of doors and mounting work, and the software runs on a monthly or annual subscription per terminal. The breakdown is explained in what drives access control system cost. If canteen counting is on your list too, see canteen meal counting automation.
Next step
To get started, write down your shift plans, headcount, number of doors and the name of your payroll package. Then contact us through our contact page; we will work through the ten questions with your own data and show how SmartPass calculates timesheets for your shift pattern. For more guides on access control and attendance, visit our Access Control & Attendance hub.