Frequently Asked Questions

TKS Nexa is a cloud-based attendance and workforce management platform. It replaces manual attendance registers, spreadsheets, and fragile legacy software with an automated system that tracks when employees arrive and leave using biometric devices (fingerprint or face scanners), generates reports, manages shifts and leave requests, and works even when internet connectivity drops.

No. TKS Nexa is designed for regular business administrators, HR managers, and office coordinators—not IT professionals. The management portal uses a straightforward dashboard with clear labels, guided wizards, and tooltips. Our onboarding team handles the initial scanner pairing and network configuration for you during your trial period at no extra charge.

Most organizations are up and running within 1–3 business days. After you submit a trial request, our team provisions your dedicated workspace (your private instance of TKS Nexa), helps you connect your scanners, and imports your employee roster. You can start recording attendance immediately once the scanner is paired.

An Edge Node is simply the physical device installed at your entrance or gate—typically a biometric fingerprint scanner or a face recognition terminal. We call it an "edge" node because it sits at the edge of your network (at the building entrance), rather than in a central server room. In everyday terms, it's the machine your employees touch or look at when clocking in or out. You might also see it referred to as a "device", "terminal", or "scanner" throughout the platform—they all mean the same thing.

The Edge Agent is a small background program that runs on a computer at your premises (often a regular desktop or mini-PC near the scanner). Its job is to act as a messenger between your biometric scanner and TKS Nexa's cloud. When an employee punches in, the scanner sends the punch to the Edge Agent, which then forwards it securely to the cloud. If the internet is temporarily down, the Edge Agent stores punches locally and uploads them automatically once the connection is restored. Think of it as a reliable postman between your gate and the cloud.

Your Workspace (also called a Tenant) is your organization's private, isolated space within TKS Nexa. It contains all of your employees, attendance records, shifts, leave data, and settings. No other organization can see or access your workspace data—it's completely separate, like having your own private office within a shared building. Each organization that signs up gets its own workspace with its own web address.

This is a safety feature. In real-world conditions, internet connections can drop due to power cuts, ISP issues, or router failures. When that happens, your scanners and the Edge Agent continue recording attendance punches locally on the device. Once the internet comes back, all stored punches are automatically synchronized (uploaded) to the cloud—no records are lost, no duplicate entries are created, and no manual intervention is needed. We call this "offline edge buffering" because the edge device buffers (temporarily holds) data until it can send it.

It means every organization using TKS Nexa has its own private, walled-off section of the system. Your employee data, attendance logs, shift configurations, and reports are completely invisible to other organizations on the same platform. Even TKS Nexa's own support staff cannot see your biometric templates. Think of it like individual bank vaults inside the same bank building—each vault belongs to one customer and only they hold the key.

RBAC is a way of controlling who can see and do what in the system. Instead of giving everyone the same level of access, TKS Nexa lets you assign roles like "HR Admin", "Department Head", "Supervisor", or "Employee." Each role has specific permissions—for example, an HR Admin can edit shifts and approve leave, while a regular employee can only view their own attendance and submit leave requests. This keeps sensitive data protected and prevents accidental changes.

Mobile GPS can be spoofed using mock-location apps, VPNs, or device emulators. To ensure forensic integrity, TKS Nexa evaluates mobile check-ins with a dynamic Multi-Factor Trust Score (0–100%). Check-ins receive baseline credit from verified GPS geofence proximity, but high-confidence verification requires corroboration from physical gate terminals, biometric face enrollment, and tamper-resistant device tokens. Any check-in scoring below organizational policy thresholds is automatically flagged for line-manager review.

TKS Nexa edge nodes and biometric terminals run autonomous edge processing. Recognition checks and turnstile relays trigger locally in sub-seconds without contacting cloud servers. Attendance punches are buffered in secure on-device encrypted storage with cryptographic timestamps. Once internet connectivity is restored, all buffered logs auto-synchronize to your cloud database with zero duplicate records and zero data loss.

Yes. TKS Nexa is hardware-agnostic and supports standard HTTP/TCP push protocols, standalone IP relays, and Wiegand controllers from popular manufacturers including ZKTeco, Hikvision, Dahua, and biometric turnstiles. Our technical team assists with terminal network pairing, subnet routing, and firmware validation during your trial.

Terminals utilize dual-lens visible light + infrared (IR) cameras with 3D structured light liveness detection. The system inspects skin micro-textures, thermal signatures, and depth to instantly reject printed photos, tablet screens, and silicone masks. Biometric facial features are converted into irreversible 512-dimensional mathematical vectors—raw employee photos are never exposed or transmitted unencrypted.

Adaptive Corroboration bridges mobile convenience with physical camera security. When an employee clocks in via mobile, the server dynamically evaluates their risk profile. If the punch carries elevated risk (such as an unverified handset or boundary uncertainty), the system initiates a step-up challenge requiring on-site camera recognition. The moment any registered campus camera, entrance turnstile, or corridor terminal sees the employee, the challenge is automatically verified in real time.

No. TKS Nexa prioritizes "Invisible Corroboration First." If an on-campus camera or entrance gate already recognized the employee when they walked onto campus earlier that morning or within the recent window, their mobile check-in is silently and automatically corroborated in the background with zero friction. Furthermore, employees with a history of verified punches enjoy reduced sampling rates, while random background audits maintain institutional integrity.

Every on-premise TKS Edge Agent includes an autonomous system watchdog service. If an unexpected power cut, OS reboot, or network crash occurs, the watchdog automatically recovers the background sync worker within seconds of system boot. All punch events recorded by physical turnstiles or gate cameras during the offline period remain safely preserved in local SQLite/cache storage and immediately replay to the cloud upon restoration, while an incident alert is sent to the central platform operations deck.

Each TKS Edge Node features an embedded high-performance local SQLite datastore capable of buffering over 500,000 offline punch events and facial biometric logs without performance degradation. Even during weeks of total internet or fiber outages, staff can continue passing through gates and facial recognition terminals in under 300 milliseconds. When connectivity is restored, an asynchronous rate-limited replication queue streams buffered logs to the cloud in chronological order, automatically adjusting for grace periods and shift boundaries.

TKS Nexa works with a wide range of fingerprint scanners, face recognition terminals, and palm-vein readers from popular manufacturers like ZKTeco, Hikvision, and Dahua. We support devices that communicate using standard network protocols (HTTP/TCP push), Wiegand controller wiring, and standalone IP relays. If you already have scanners installed, our team will check compatibility during your trial—most modern commercial biometric terminals work seamlessly.

Yes. TKS Nexa includes a mobile web portal where remote or field employees can log attendance using their smartphone. The system captures a GPS location (to verify they are at an authorized work site) and a selfie photo (to confirm identity). Administrators can set up geographic boundaries (geofencing) to define exactly where mobile check-ins are allowed—for example, within 200 meters of a client office.

Modern face recognition terminals used with TKS Nexa have built-in anti-spoofing technology. They use a combination of a regular camera and an infrared (IR) sensor to detect whether a real, living person is standing in front of the device. The system checks for 3D depth, skin texture, and thermal heat signatures—so printed photos, pictures on a phone screen, or masks are instantly rejected. Your employees' facial data is converted into encrypted mathematical codes and never stored as actual photographs.

TKS Nexa monitors the health of your scanners in real-time from the cloud dashboard. If a device goes offline (due to power loss, network disconnection, or hardware failure), the system alerts your administrator immediately. Once the device comes back online, any attendance punches stored in its local memory are automatically synchronized to the cloud. No attendance data is lost during the outage.

TKS Nexa utilizes high-dimensional FaceBiometric EdgeNet-512 neural embeddings paired with dual-lens 3D infrared hardware sensors. Instead of comparing raw image pixels, the scanner computes an encrypted 512-dimensional vector map of facial bone geometry and skin texture in under 200 milliseconds. Infrared liveness detection actively verifies micro-movements and blood flow, permanently blocking printed photographs, silicone masks, and smartphone screen replays.

Absolutely. TKS Nexa lets you create unlimited shift templates—Morning (9am–5pm), Evening (2pm–10pm), Night (10pm–6am), or any custom hours. Each department, team, or even individual employee can be assigned to a different shift. You can also set up rotating rosters where employees automatically switch between shifts on a weekly or monthly cycle.

TKS Nexa has a smart 24-hour shift engine. If a shift starts at 8:00 PM and ends at 4:00 AM the next day, the system correctly assigns the entire shift to the date it started (not split across two dates). Grace periods for late arrival, early departure rules, overtime calculation, and break deductions all work correctly even for overnight shifts.

Yes. For each shift, you can configure a grace window (for example, 15 minutes after shift start) during which employees are still marked as "on time." You can also define late penalty tiers (e.g., 1–15 min late = Warning, 16–30 min = Half-day deduction), early departure thresholds, and half-day cutoffs. These rules are fully customizable per department or shift.

Yes. With the built-in Automated Workflow Builder, administrators can define trigger rules for late check-ins, early exits, or unexplained absences. When an employee breaches their shift's configured grace period (e.g., 15 or 30 minutes late), the system automatically triggers alerts to their line manager via email or in-app notifications, and can notify the employee with reminders of the organizational attendance policy.

TKS Nexa provides a dynamic 24-hour shift engine. Shifts that span across midnight (e.g. 8:00 PM to 4:00 AM) are properly assigned to the commencing work-date. You can define configurable grace arrival windows (e.g., 15 minutes), half-day thresholds, late penalty tiers, meal break deductions, and custom weekend/gazetted holiday overtime multipliers per department.

Each employee gets their own login to a simplified portal (separate from the admin dashboard). From here, they can: view their daily/monthly attendance records, see their shift schedule, check remaining leave balances, submit leave applications, view their approval status, download their pay-period attendance summary, update their personal contact information, and receive company announcements. This reduces the workload on HR by letting employees handle routine tasks independently.

Yes. Employees who work outside the main office—such as sales representatives, field engineers, delivery staff, or remote workers—can log attendance using their smartphone through the Mobile Web Portal. The system captures a GPS location (to verify they are at an authorized work site) and a selfie photo (to confirm their identity). Administrators define "geofence" zones—circular boundaries around approved work locations—so check-ins are only accepted from valid areas.

Yes. Staff can view and download an official Attendance & Service Record Certificate directly from the Employee Self-Service portal. The certificate summarizes monthly scheduled days, verified attendances, approved leave categories, and compliance percentages. Each certificate features an immutable SHA-256 cryptographic verification seal and unique Certificate Reference Number, ensuring authenticity for embassies, financial institutions, and government audits.

Tenant administrators can control attendance regularization, attendance-certificate downloads, mobile punching, and the PWA install prompt at the tenant policy level. Missed-punch submission, certificate download, and mobile punch can also be allowed or blocked for an individual employee. Plan entitlements and role permissions are still enforced before these switches take effect.

Off-site staff use the secure TKS Nexa Self-Service Mobile Web Portal with GPS geofencing and mobile selfie verification. Administrators can designate authorized geographical radiuses around client premises or allow mobile check-ins with tamper-proof coordinate logging. Staff can also submit Official Duty (OD) regularization requests with mandatory attachment proof.

TKS Nexa utilizes a hybrid attendance architecture. On-site physical terminals and gate cameras (powered by the TKS Edge Agent) record high-throughput arrivals at building entrances and turnstiles, while the TKS Nexa Mobile App allows employees and faculty to clock in directly from their desks or field stations. The central cloud platform seamlessly cross-correlates both data streams into a unified timesheet without creating duplicate records.

Standard mobile-only attendance systems rely on basic phone GPS and unverified camera selfies, which are notoriously susceptible to mock-location GPS spoofing apps, emulator replay attacks, and proxy "buddy-punching" (sending a photo of a colleague). TKS Nexa solves this vulnerability without requiring expensive Bluetooth beacons or NFC tags by combining on-device 3D liveness detection, hardware Keystore signing, OS integrity attestation, and Adaptive Physical Camera Corroboration with on-premises gate cameras.

When a step-up challenge is issued, the mobile app displays an intuitive countdown screen (e.g., 5 minutes). The employee simply walks past any installed campus terminal, entrance gate, or corridor camera. There is no need to touch the physical device—the edge camera’s face recognition algorithm recognizes the employee in under 200 milliseconds, instantly pushes the match to the central cloud, and turns the mobile countdown screen green with a "Verified" confirmation.

Yes. TKS Nexa is designed for organizations with multiple physical locations. You can define your Headquarters, Regional Offices, Branch Campuses, and even specific Building Wings or Gate Zones within each campus. Each location can have its own scanners, shifts, and reporting. Administrators get a unified dashboard to monitor attendance across all locations in real time. Employees can be restricted to one campus or allowed to roam across multiple locations.

Yes. TKS Nexa is architected for multi-campus institutions. You can configure Headquarters, Regional Offices, and Branch Campuses with specific building wings and gate zones. Employees can be restricted to their assigned home campus or granted multi-campus roaming access with automatic gate recognition across all institutional facilities.

TKS Nexa provides temporary visitor passes and contractor provisioning. Administrators can issue time-bounded access passes using dynamic QR codes sent to visitor phones, visitor RFID badges, or temporary biometric enrollment with strict auto-expiry dates. Once the validity window expires, gate access is automatically denied without manual intervention.

Traditional geofences draw a crude circular radius around a point, which frequently spills over into public streets, adjacent residential neighborhoods, or excludes irregularly shaped campus wings. TKS Nexa implements multi-vertex Polygon Geofencing using the ray-casting algorithm. Administrators draw the exact physical boundary of the institution. A mobile punch is only accepted if the employee’s coordinates fall strictly within the actual property boundary.

Due to satellite signal obstruction from tall concrete buildings or heavy canopy, smartphone GPS accuracy may occasionally fluctuate (e.g., ±40 meters). If an employee is standing near a campus edge and their GPS accuracy circle overlaps the perimeter boundary, TKS Nexa safely returns a "Boundary Uncertain" advisory. The app gently prompts the employee to wait 5 seconds or step slightly away from exterior walls to acquire a precise satellite lock, avoiding erroneous out-of-bounds rejections.

TKS Nexa supports any leave type your organization needs—Annual/Earned Leave, Casual Leave, Sick/Medical Leave, Maternity/Paternity Leave, Compensatory Leave, Unpaid Leave, and any custom categories you define. Each leave type has its own yearly quota, monthly accrual rate, and maximum carryover rules. Employees apply through their self-service portal, and the request flows through your approval hierarchy automatically.

When an employee submits a leave application, it is sent first to their direct reporting manager for approval. The manager can approve, reject, or forward it to the next level (e.g., Department Head or HR Admin). You can configure 1, 2, or 3 approval tiers depending on your organization's policy. At each stage, the approver receives a notification and can add comments. Leave balances update automatically once final approval is granted.

HR Admins can define custom leave categories (Annual Paid, Sick/Medical, Casual, Maternity/Paternity, and Unpaid) with yearly quotas, monthly accrual schedules, and max carryover limits. Applications follow a multi-tier approval hierarchy (Reporting Manager → Department Head → HR Admin). Leave balances update automatically upon approval, and medical documentation can be required.

Your data is stored in secure cloud infrastructure with enterprise-grade protection. All data is encrypted both in storage (AES-256 encryption) and during transmission (SSL/TLS). Biometric templates (fingerprint/face data) are converted into irreversible mathematical hashes—the original biometric image cannot be reconstructed. Access to your workspace is protected by role-based permissions, and all login activity is logged for audit purposes.

Yes. TKS Nexa uses a "Soft Delete" system (like a Recycle Bin). When you delete an employee, campus, shift, or department, the record is moved to a Trash section rather than being permanently erased. A Super Admin can restore deleted items at any time with a single click, along with all their associated attendance history and permission settings. Records are only permanently removed when explicitly purged from the Trash.

TKS Nexa maintains a 99.9% cloud uptime service level agreement (SLA). This means the system is designed to be available around the clock with minimal downtime. Databases are backed up continuously with point-in-time recovery capability, plus automated daily snapshots stored in a separate location. In the unlikely event of a server issue, your data can be restored to any point within the retention window.

No. TKS Nexa is built on a privacy-first "Edge AI" architecture. Facial detection, 3D anti-spoofing liveness, and 512-dimensional biometric vector extraction are executed directly on the employee's smartphone using Google ML Kit and TensorFlow Lite. The app compares mathematical embedding vectors locally and never streams raw video to the cloud server, drastically reducing bandwidth and protecting employee privacy.

Google Play Integrity (Android) and Apple App Attest (iOS) provide cryptographic hardware-level proof that the app is authentic, running on genuine mobile hardware, and has not been tampered with, reverse-engineered, or executed inside a rooted emulator. This prevents malicious third-party utilities from injecting fabricated GPS coordinates or fake camera feeds into the attendance system.

TKS Nexa is engineered with zero-trust multi-tenancy. Each organization operates within dedicated tenant database partitions with separate cryptographic keys, session scopes, and cache namespaces. Tenancy middleware automatically scopes all Eloquent queries and database transactions to the active tenant domain. Furthermore, every Livewire administrative component employs method-level authorization guards and Spatie role-based access control, ensuring cross-tenant data leakage or unauthorized method invocation is mathematically impossible.

Every organization operates within dedicated tenant isolation with separate database schemas, isolated storage buckets, and strict tenancy scoping guards. We enforce AES-256 encryption at rest, SSL/TLS in transit, and granular Role-Based Access Control (RBAC). Raw facial templates are encrypted using one-way mathematical hashes compliant with ISO 27001 data protection standards.

Traditional HR suites charge PKR 35,000–45,000 per month because they bundle dozens of modules you may never use—forcing you into expensive, all-in-one contracts. TKS Nexa is modular: you start with a base plan (from PKR 5,499/month) covering the features you actually need, and only add extras (like Helpdesk, Fleet Monitoring, or Automations) if and when your organization requires them. You pay for actual active employees, not empty seats.

You can scale instantly without waiting for contract changes or renegotiations. Through the self-service Marketplace in your management console, you can purchase additional employee seat packs (e.g., 50 more seats) or scanner licenses at prorated rates. The capacity increase takes effect immediately—no downtime, no delays, no extra paperwork.

We offer a full-featured 14-day trial with zero upfront cost. During the trial, you get access to the complete admin portal, employee self-service, shift management, and report generation. You can connect a test scanner or use our simulated device to explore the full workflow. Our team handles the initial setup for you at no charge. No credit card is required to start.

We support local Pakistani payment methods (Direct Bank Transfer via IBAN, JazzCash, Easypaisa) as well as international credit and debit cards (Visa, Mastercard, UnionPay). Official sales tax invoices with NTN compliance details are automatically generated for every payment. You can download receipts and invoices at any time from your billing dashboard.

Traditional HR suites force clients into rigid, all-in-one bundles packed with dozens of unused modules and expensive annual lock-ins. TKS Nexa provides modular freedom starting at PKR 5,499/month. You only pay for the exact active employee seats and biometric terminals you operate, with the freedom to activate add-ons (Fleet monitoring, Helpdesk, Automations) on demand.

We offer a full-featured 14-day cloud evaluation with zero upfront commitment. You can explore the complete admin portal, configure shifts, test employee self-service, and connect a test biometric terminal or simulated edge node. Our technical onboarding specialists assist with network topology planning and terminal setup free of charge.

You can scale instantly without waiting for contract renegotiations. Through the self-service Marketplace in your management console, you can purchase 50-employee seat packs or additional terminal licenses at prorated rates. Capacity increases immediately without system downtime or operational disruption.

We support both local Pakistani payment rails and international cards: Direct Bank Transfer (IBAN) with online payment proof upload, JazzCash, Easypaisa, and major credit/debit cards (Visa, Mastercard, UnionPay). Official sales tax invoices, NTN compliance details, and downloadable payment receipts are automatically generated for every transaction.

TKS Nexa provides a comprehensive suite of reports: Daily Attendance Summary, Monthly Attendance Register, Late Arrival Report, Early Departure Report, Overtime Report, Leave Utilization Report, Department-wise Analytics, Individual Employee History, and Absenteeism Trends. All reports can be filtered by date range, department, shift, and employee. Reports can be exported as Excel spreadsheets, CSV files, or print-ready PDF documents.

Yes. TKS Nexa provides one-click export in Excel and CSV formats that are structured for direct import into popular payroll packages. The exported data includes employee codes, work hours, overtime, late deductions, and leave days—ready for payroll processing. For enterprise customers with ERP systems (like SAP or Oracle), we also offer a secure REST API and real-time webhook notifications for automatic data synchronization.

Yes. TKS Nexa provides one-click export tools in Excel, CSV, and PDF formats structured for direct ingestion into popular payroll packages. Furthermore, our secure REST APIs and real-time punch webhooks allow direct programmatic synchronization with enterprise ERPs including SAP, Oracle, and custom institutional accounting systems.

Yes. TKS Nexa incorporates an enterprise-grade Soft-Delete Trash bin across all entities (Employees, Campuses, Offices, Shifts, and Devices). Deleted records remain safely in Trash until explicitly purged by a Super Admin and can be restored with a single click without losing historic attendance records or permission relationships.

TKS Nexa maintains a 99.9% cloud uptime SLA backed by redundant high-availability cloud infrastructure. Databases are backed up continuously with point-in-time recovery capabilities, automated daily off-site snapshots, and SSL/TLS end-to-end transport encryption.

All plans include comprehensive documentation, administrator guides, and access to our integrated Helpdesk ticketing portal. We provide onboarding consultation for terminal network topology, static IP configuration, turnstile relay wiring, and admin training. Priority SLA add-ons are available for 24/7 mission-critical institutional operations.

All subscription plans include access to our integrated Helpdesk ticketing system (submit issues directly from your admin dashboard), comprehensive documentation and administrator guides, email support during business hours, and free initial onboarding assistance (scanner pairing, network setup, employee import). For organizations requiring faster response times, we offer Priority SLA add-ons with dedicated support channels and guaranteed resolution timeframes.

Yes. During your trial and initial deployment, our technical onboarding team assists with scanner network pairing (connecting the device to your local network and TKS Nexa cloud), static IP configuration, firewall port requirements, and for turnstile installations, relay wiring guidance. This service is included at no additional cost. We also provide step-by-step guides for IT staff who prefer to handle setup independently.

Every tenant administrator has access to the direct Helpdesk console within their dashboard. You can open a ticket, assign priority (Low, Normal, High, Urgent), and attach device diagnostic logs or screenshots. Nexa HQ technical specialists respond directly within the conversation thread. Once resolved, administrators can reopen tickets with a single click within a 7-day grace window if further help is needed.

The device continues recording attendance normally! Biometric scanners store employee profiles and verify faces or fingerprints locally in sub-seconds. Punches are buffered in secure on-device flash memory (holding up to 50,000+ punches). As soon as the network or Wi-Fi reconnects, the Edge Agent automatically uploads all buffered punches to the cloud with exact timestamps. No records are lost, and no manual resynchronization is needed.

TKS Nexa includes built-in hardware failover. If a scanner terminal malfunctions or is damaged, your administrator receives an immediate offline alert. You can hot-swap a replacement unit in under 5 minutes: simply connect the replacement device and pair it to your workspace—all employee biometric profiles and shift schedules will automatically download from the cloud. In the interim, employees can clock in using the mobile web portal with GPS geofencing.

Employees can submit an "Attendance Regularization Request" directly from their Self-Service Portal on their smartphone or browser. They select the date, specify their estimated arrival/departure time, and add a brief reason. Their reporting manager receives an instant notification to approve or decline with one click. Once approved, the attendance record updates automatically and recalculates work hours.

Buddy punching and photo spoofing are strictly prevented. Modern terminals paired with TKS Nexa use dual-lens cameras (visible light + infrared) with 3D structured-light liveness detection. The system checks skin micro-texture, thermal depth, and pupil reflection. High-resolution photos, smartphone video replays, and silicone masks are instantly rejected. In addition, unauthorized spoof attempts trigger a security log entry in the admin audit trail.

TKS Nexa natively supports cross-midnight and 24-hour continuous operations. Shifts configured with cut-off windows past 24:00 (for example, 20:00 to 04:00) automatically link the evening clock-in and next morning clock-out to the single originating work day. Work hours, overnight shift allowances, and late deductions calculate accurately without splitting attendance across two calendar days.

Terminals configured with TKS Nexa provide seamless multi-modal fallbacks. If severe cuts, peeling skin, or extreme environmental backlighting prevent instant biometric match, employees can immediately tap their assigned RFID smart card or enter their 6-digit PIN on the terminal keypad. In addition, reporting managers can log a verified check-in from their mobile app, or the employee can submit an attendance regularization request with one tap.

Edge nodes and biometric terminals are built for total offline autonomy. Local flash memory buffers 50,000 to 100,000+ attendance transactions indefinitely without requiring network access. Sub-second face and fingerprint matching continues unhindered. When internet or mobile hotspot connectivity is restored—even weeks later—the Edge Agent batches and streams all historical logs to the cloud chronologically, with zero data loss.

Access revocation takes under 60 seconds across all branches. When an administrator deactivates or suspends an employee in the Cloud Admin Portal, TKS Nexa pushes an instantaneous purge command to all connected edge nodes and turnstiles. The user's face vector, fingerprint hash, and RFID card are deleted from device flash memory immediately, preventing any further gate entry.

TKS Nexa includes automated fallback policies for locations lacking physical camera coverage. If an attendance location has no active edge nodes, the system evaluates the available mobile signals (3D liveness, polygon geofence, handset binding, and Play Integrity). Under the standard tenant policy, the attendance record is accepted and automatically tagged as "Camera Unavailable," allowing line managers to review the entry without disrupting the employee's workday.

Yes. Through the Automated Workflow Builder, administrators can configure trigger-based rules without writing code. You can listen for events such as "Consecutive Late Arrivals", "Unapproved Absence Exceeding 2 Days", or "Missing Check-Out". Using multi-condition logic gates (AND/OR), the workflow can automatically dispatch targeted email notifications to reporting managers, flag attendance trust records, or trigger official duty clarification requests.

Yes! Face recognition terminals with TKS Nexa perform sub-second recognition in just 0.2 to 0.4 seconds per person. During shift start and rush hours, an entrance scanner can process 30 to 40 employees per minute continuously as they walk past the terminal. For large campuses with hundreds of staff arriving at the same time, multiple terminals can be installed across turnstile lanes or entrance gates, all synchronizing concurrently to the same central database without duplicate entries or delays.

TKS Nexa features automatic duplicate-punch suppression (anti-passback cooldown). If an employee scans their face or finger twice within a short window (e.g., within 2 to 5 minutes), the system logs the first valid timestamp and suppresses duplicate subsequent scans. The employee sees a confirmation message without corrupting their daily work hours or generating erroneous multiple check-ins.

The shift engine natively handles split shifts and double shifts. If an employee completes a morning shift, leaves the facility, and returns for an evening shift, the system records distinct punch pairs. Overtime hours exceeding normal shift thresholds are categorized into "Approved Overtime" or "Pending Review" based on your organization's overtime approval policy before flowing into payroll exports.

Biometric terminals installed with TKS Nexa connect to an uninterruptible power supply (UPS battery backup) that keeps the scanner running for 4 to 8 hours during power outages. If power fails completely, terminals feature non-volatile memory—no attendance records or biometric templates are wiped. Upon power restoration, the terminal boots within 20 seconds, reconnects to the network, and synchronizes any pending punches immediately.

TKS Nexa supports multiple biometric modalities so every worker can clock in reliably: 1) Multi-finger enrollment allows registering up to 10 fingers, so if one finger has a cut, another can be used. 2) Contactless face recognition eliminates physical touch entirely. 3) For employees with heavily damaged fingerprints (e.g., industrial or chemical workers), administrators can issue contactless RFID proximity cards or secure personal PINs.

The facial recognition algorithm maps permanent 3D cranial bone structure and 512-dimensional facial geometry rather than surface appearances. Prescription eyeglasses, sunglasses (on IR-enabled terminals), facial hair (growing or shaving a beard), new hairstyles, and daily makeup variations do not affect recognition accuracy. Only full face-covering masks require either mask-enabled recognition mode or secondary RFID/PIN verification.

For sales reps, delivery drivers, remote workers, or field service engineers who do not visit a central office, TKS Nexa includes the Mobile Web Portal. Staff open the mobile link on their smartphone, take a live verification selfie, and check in. The system automatically captures GPS coordinates and cross-references authorized client site locations (geofences) configured by the administrator.

You never need to re-scan or re-register an employee's face or fingerprint when they move. Biometric hash templates are stored centrally in your cloud workspace. In the Admin Portal, simply update the employee's assigned campus or department. TKS Nexa automatically pushes the employee's biometric credentials to the new location's edge scanners over the cloud within 60 seconds.

Migration is fast and seamless. TKS Nexa includes automated CSV employee roster importers and supports standard network push protocols from popular manufacturers (ZKTeco, Hikvision, Dahua). In most cases, existing biometric scanners can be paired with TKS Nexa simply by updating the server IP address in the scanner's communication menu. Our technical onboarding team assists with network pairing and data verification during your 14-day trial at no charge.

Yes! Every employee has access to their secure Employee Self-Service (ESS) Portal on their smartphone or browser. They can view real-time punch-in/out timestamps, track accumulated working hours, monitor shift schedules, and check remaining leave balances. The system also sends optional gentle notifications if an employee is approaching late-arrival thresholds.

Employees can inspect their attendance reputation anytime via the Employee Self-Service portal (accessible from mobile or web). The "Attendance Trust & Security" card on their profile displays their 30-day Trust Average, real-time trust level, enrolled facial biometric status, and the model name of their registered primary smartphone. Helpful guidance tips are also provided to help employees keep their trust rating at 100%.

TKS Nexa provides an enterprise bulk import wizard allowing administrators to upload full employee directories via standard CSV or Excel sheets. The system performs dry-run schema validation, verifying employee codes, unique CNIC numbers, email addresses, and campus office mappings before committing records. If errors are detected, line-by-line correction reports are provided. Additionally, biometric photo archives can be bulk-uploaded in ZIP format to provision facial recognition templates in one pass.

Every mobile attendance check-in is evaluated by our multi-factor trust engine on a 0–100 scale based on four cryptographic signals: (1) Biometrics & 3D Liveness (40 pts) ensuring live human presence; (2) Registered Handset Binding (30 pts) verifying the punch originates from the employee’s enrolled smartphone; (3) Campus Polygon Geofencing (20 pts) validating high-accuracy coordinates inside the authorized perimeter; and (4) Travel Velocity Continuity (10 pts) checking plausible distance and travel time between consecutive punches.

Trust levels provide clear, constructive feedback rather than punitive accusations. "High Trust (80–100%)" means all biometric, handset, and campus polygon signals matched cleanly. "Under Review (60–79%)" occurs when a minor anomaly was detected—such as clocking in from a newly changed replacement phone or near a perimeter boundary—which is accepted for payroll but queued for administrative awareness. "Flagged Anomaly (<60%)" indicates a significant discrepancy (such as severe location mismatch or liveness failure) requiring line-manager review.

Each employee profile is securely bound to their primary registered smartphone during their first verified check-in. The handset’s hardware identifier and cryptographic key are enrolled in the system. While employees can occasionally punch from an unverified handset if their phone battery dies, doing so lowers their device trust score and automatically triggers an on-site camera corroboration challenge to guarantee the employee is genuinely on premises.

TKS Nexa utilizes strict multi-tenant architecture with separate tenant databases or cryptographically scoped schema isolation per workspace. Employee records, biometric vectors, timesheets, and private encryption keys are completely segregated. A tenant administrator or staff member can never query or access another workspace's records. Furthermore, all biometric vectors are stored as non-reversible mathematical 512-dimensional embeddings rather than raw facial imagery, ensuring full compliance with international privacy frameworks including GDPR and local data protection regulations.

Yes. Both Platform Owners and Organization Administrators have access to an Active Sessions Management console in their security settings. The interface displays real-time telemetry for every authenticated session—including client IP address, device type, operating system, web browser user-agent, and timestamp of last activity. Administrators can remotely invalidate any suspicious or forgotten session individually, or execute "Log Out Other Sessions" to revoke all active tokens across mobile and desktop devices with a single click.

TKS Nexa implements enterprise-grade session protection including cryptographically random session IDs, automatic session regeneration upon authentication or privilege elevation, strict cookie security flags (HttpOnly, Secure, SameSite), and device fingerprint matching. Database-backed session drivers track active state in real time, so when a user logs out or changes their credentials, previous session tokens are immediately destroyed and rejected by all edge nodes and cloud APIs.

When provisioning new users or resetting credentials, TKS Nexa utilizes a cryptographically secure pseudo-random generator that creates high-entropy passwords incorporating uppercase letters, lowercase letters, numbers, and special symbols. Generated passwords comply with enterprise complexity standards. Upon first login with a temporary credential, the system triggers a mandatory Force Password Change workflow, requiring the user to define their own private credential before gaining access to workspaces or employee portals.

Platform Owner password updates are guarded by strict security verification workflows. The owner must supply their current password to authenticate the modification. Upon submission, password complexity is strictly evaluated, all other concurrent administrative sessions are revoked, and an urgent security notice is dispatched to the verified owner notification channels. If two-factor authentication (2FA) is enabled, a one-time cryptographic token verification is required before changes take effect.

The checkout and subscription activation process is fully encrypted with TLS 1.3 and complies with PCI-DSS Level 1 payment processing standards. Prospective organizations do not need a pre-existing workspace account to order—simply select your desired plan and hardware addons on the storefront pricing page, provide your organization billing details, and complete payment. The automated provisioning engine automatically initializes your isolated tenant workspace, generates your administrator onboarding credentials, and sends immediate confirmation invoices.

Yes. TKS Nexa provides installable PWA access and policy-controlled mobile punching. The browser supplies device geolocation coordinates and accuracy, and the server validates that evidence against the configured office radius or polygon. When geofencing is enforced, out-of-boundary attempts are rejected. The plan entitlement, mobile-punch permission, tenant policy, and employee-level mobile-punch switch must all allow submission.

A polygon map boundary is an exact virtual fence drawn on a map around your company offices, grounds, or gates. Unlike a simple circle that might include roads or neighboring buildings outside your property, a polygon outlines your exact property lines. When staff check in on their phone, GPS checks if they are truly inside the boundary line. If they are outside, the check-in is stopped.

When using mobile data, your phone checks your satellite GPS signal and displays the precision, such as GPS (5m). When connected to your office Wi-Fi network, it shows your office location. This makes sure that check-in records are exact, transparent, and verified.

Employees can submit an Attendance Regularization request directly from the mobile app or employee portal. You simply specify the missed punch type (Shift In, Shift Out, or Both), the exact time, and a reason. To uphold organizational attendance integrity, requests must be submitted within your company's allowable window (typically within 3 past days) and comply with your monthly quota. Once your manager approves it in the Dedicated Approvals Workspace, your attendance log is automatically synthesized.

Managers and HR administrators access a centralized Approvals Workspace located in the main navigation. It features dedicated tabs with real-time pending counters for Leave Requests, Attendance Regularizations, and Official Duty logs. Approvers can review team member leave balance impacts, view attached documentation, inspect missed punch reasons, and approve or reject with mandatory remarks in a few clicks.

Yes, provided your organization administrator has enabled "Allow Offline Mobile Attendance" under Settings → Attendance (disabled by default for security). When offline, the mobile app captures live facial biometrics, verifies liveness (blink/smile), records device GPS coordinates, and encrypts all forensic evidence into a secure AES-256 outbox. Biometric matching is designated as "Pending Online Verification" while offline. The moment the handset reconnects to Wi-Fi or cellular network, pending records auto-sync to the central cloud for authoritative server-side facial matching.

TKS Nexa enforces a multi-tier Guardrails Suite to preserve attendance integrity: Guardrail 1 (Past Allowed Days) restricts submissions to a strict past window (default 3 days); Guardrail 2 (Missed Check-Out Duty Policy) governs unclosed shifts; Guardrail 3 (Monthly Quotas) caps allowable missed punch requests (default 3 per employee/month) to deter habitual negligence; and Guardrail 4 (Shift Window & Duplicate Protection) validates that requested punch times fit within the employee's scheduled shift and rejects overlapping punches. If an employee exceeds their monthly threshold, line managers receive an automatic frequency alert.

Employees can submit an Attendance Regularization request directly from their Self-Service portal under My Attendance. The employee specifies the target date, whether check-in or check-out was missed, the corrected time, and a mandatory justification. Administrators govern the policy through configurable settings, including maximum allowed past days (default: 7 days) and monthly submission limits (default: 3 requests). Once approved by an authorized manager, verified attendance records are automatically synthesized.

Yes. The system records and saves every scan you make across all devices, including phone apps and gate turnstiles. For daily records, your first scan of the day is your Check-In, and your very last scan of the day is counted as your Check-Out. If you have only scanned once, Check-Out displays as --:-- until you scan when leaving.

Productive time represents your actual working hours between your Check-In and Check-Out. If an employee has not checked out yet or a standard schedule applies, the portal uses the standard shift timing to calculate productive hours clearly and fairly.

Every successful punch—whether completed on mobile or through an edge biometric reader—generates an immutable 8-character cryptographic verification code (such as A7K9X2B4). This code serves as an instant digital forensic receipt for the employee. If an attendance dispute ever arises, administrators can search directly by this 8-character code in the analytics portal to view the exact second, device, GPS coordinates, and camera verification result.

No. TKS Nexa intelligently distinguishes between boundary gate turnstiles and internal checkpoint readers. Scanning at internal touchpoints (like cafeterias, meeting halls, or labs) is recorded as an "Activity Scan", confirming your presence without interrupting your active working shift. Your official shift duration is only bounded by your initial Shift In and final Shift Out gates.

Yes. While a leave request is still pending review, you can edit your dates, update your reason, or cancel the request directly from your employee dashboard. If a manager rejects a request, they are required to provide a constructive explanation so you know exactly why and how to re-apply. Once a leave request is fully approved, any subsequent cancellation can be handled by an administrator.

When an employee clocks in but misses their final check-out, TKS Nexa's Guardrail 2 (Missed Check-Out Default Duty Policy) automatically evaluates the unclosed shift before any regularization is filed. Organizations configure one of four enterprise duty policies under Settings → Attendance: (1) Half-Day Credit (default HR practice: automatically credits 4 working hours); (2) Zero Hours (strict audit compliance: counts 0 working hours until an approved regularization request is submitted); (3) Shift-End Cap (automatically closes the punch at the scheduled shift conclusion); or (4) Smart 30-Day Rolling Average (dynamically credits the employee's clean average check-out time over the past 30 days, filtering out irregular outliers). Additionally, an intelligent suggestion banner prompts the employee with their suggested departure time when filing a missed punch request.

TKS Nexa provides an enterprise Biometric Template Sync Matrix in the Edge Fleet console. Administrators can monitor the synchronization state of every enrolled facial profile across all physical terminals and turnstiles in real time. If a device has pending updates or reconnects after an offline period, administrators can dispatch Over-The-Air (OTA) commands like SYNC_TEMPLATES, RELOAD_CONFIG, or REBOOT to immediately sync all facial vectors without visiting the turnstile physically.

The Monthly Payroll Input Sheet reconciles actual biometric attendance, scheduled workdays, approved paid leaves, outdoor official duties, unexcused absences (LWP), overtime hours, and late penalty deductions. Full-day attendances count as 1.0 day and half-days count as 0.5 days. The calculation formula—Present + (Half-Days × 0.5) + Paid Leaves + Official Duties - Late Deductions—produces Net Payable Days that can be exported in one click as a CSV ready for import into third-party payroll and ERP systems.

The Visual Shift Rostering calendar provides an interactive weekly and monthly matrix where HR managers can assign, adjust, and override shifts for individual employees or entire departments. Support for bulk rotational shifts allows recurring shift propagation across morning, evening, and night rotations with automated conflict detection, rest day enforcement, and live shift schedule visibility in employee portals.

The owner-configured dunning engine evaluates dated unpaid invoices and classifies each workspace as current, in grace, restricted, or suspended according to configured ageing thresholds. It marks overdue invoices, can automatically suspend a workspace at the suspension threshold, and records automated suspension in the platform audit trail. Owners can review affected tenants and run an evaluation from the billing control center.

The Platform Owner Control Center measures each tenant's database footprint and tenant-scoped file storage, compares the combined total with the configured plan quota, and highlights warning or over-quota states. Measurements are cached briefly to protect infrastructure performance and are available from the tenant detail view.

Platform governance exports include an export identifier, generation timestamp, record count, genesis seal, and an HMAC-SHA256 chain. Every row incorporates the previous row's seal, and the manifest records the final seal. This creates tamper-evident evidence for compliance review and SOC-2 readiness; it does not by itself represent third-party SOC-2 certification.

TKS Nexa implements hardware-anchored anti-tampering protection using native monotonic system clocks (SystemClock.elapsedRealtime()). Unlike the standard wall-clock, hardware monotonic timers count uninterrupted CPU ticks from device boot and cannot be changed by manual time adjustments, timezone spoofing, or disabling automatic network time. When synced, the central server calculates true capture time: Server Sync Time minus Monotonic Elapsed Time. If claimed punch time drifts by more than 180 seconds, the central system detects the fraud, flags is_time_manipulated = true, slashes the trust score, and enforces the true hardware timestamp for payroll.

Yes. The interactive organization hierarchy maps managers and direct reports, supports department filtering, and prevents circular reporting relationships during manager reassignment. Access is guarded by the organization-chart permission so administrators can delegate visibility without exposing unrelated administrative tools.

No. TKS Nexa does not store actual photo files on gate devices or phones. When a photo is uploaded, the system creates a private mathematical code made of 512 numbers (called a facial template) using FaceNet neural architecture. When you look at the camera to check in, it only matches these numbers. Because no photos are kept on devices, employee personal photos and privacy remain completely safe.

When you take a selfie with your phone camera, many devices naturally mirror or flip the picture. TKS Nexa automatically detects and corrects selfie orientation so your face matches your profile picture accurately. Administrators set the required matching score (default 70%, minimum 60%) to prevent unauthorized check-ins while ensuring genuine staff are verified smoothly.

TKS Nexa utilizes a high-precision 512-dimensional FaceNet neural architecture combined with a calibrated rejection curve. The system analyzes hundreds of unique facial geometry nodal points. Close lookalikes and distant relatives typically score between 25% and 68%, falling strictly below the calibrated 70% passing threshold. Only the genuine employee achieves a passing match, ensuring complete protection against unauthorized clock-ins while remaining fully backward-compatible with legacy devices.

Because facial recognition matching is authoritative online via API against the employee's securely enrolled master template, the mobile app performs live on-device anti-spoofing and neural vector generation during offline mode without showing premature 0% similarity or unverified match rates. The punch is clearly marked as "Secured Offline (Pending Server Matching)". Once network connectivity is restored, the background auto-sync securely transmits the encrypted neural vector to the central server, where cosine similarity is calculated and the definitive match score is recorded.

Buddy punching happens when someone clocks in for an absent friend. To stop this, TKS Nexa pairs each employee account with their own single phone on their very first check-in. If someone tries to log into that account from a different phone, the system rejects it. If an employee loses or replaces their phone, an administrator can simply click "Unlink Mobile Device" on their profile, allowing them to link their new phone on their next clock-in.

If a selfie cannot be matched (for example, due to dim lighting or blurriness), the Verify button pauses for a brief cooldown period of a few seconds. This lets your phone camera refocus and allows you to hold your phone steady in good lighting before taking another picture.

Yes. If a remote office or branch does not have physical biometric gate hardware, employees can use mobile check-in with their phone camera. The app checks their selfie, confirms they are on their registered phone, and makes sure their GPS location is inside the approved office boundary.

Administrators can jump straight to any settings area or bookmark it in their browser using direct web addresses (for example, /admin/settings?category=general&section=branding or ?category=attendance&section=biometrics). This makes it quick and easy to share exact settings sections with other managers.

The organizational chart lets staff and managers view all departments, offices, and who reports to whom. Administrators can update reporting managers or move staff between departments directly on the chart, with automatic safeguards that prevent circular reporting lines.

Administrators can govern offline punch permissions at any time by navigating to Settings → Attendance → Allow Offline Mobile Attendance. By default, offline mobile attendance is disabled to mandate live network verification. When enabled, remote teams working in basements, underground parking, or field areas with zero cellular reception can safely record attendance without operational disruption.