Someone Always Leaves Through the Back Door.
A forgotten clock-out leaves an open row that can never become payroll. Most tools answer that by closing the row themselves and moving on — which quietly turns a guess into an approved wage. Shiftavo asks a human three times first, and if it does ever close a row on its own, it says so on the row and refuses to let anyone approve it until a person checks the time. That's the whole design: every step up the ladder is worse evidence than the one below it, so the cheap steps run first and the automatic one is last, optional, and never final.
Three Steps, in That Order.
Each step asks a person. A person's answer is always better evidence than a system-written time.
A reminder while they can still fix it.
Once the shift's scheduled end plus your grace window has passed and the row is still open, the person gets one push: 'Still clocked in — forgot to clock out?' Tapping it either clocks them out at that moment or opens the correction form. One push per punch, ever — no nagging, and nothing for shifts that ended more than a week ago.
The next punch asks the question.
After a few hours an open punch stops blocking the next clock-in. Instead the kiosk or the app ask 'when did you finish?' for the stale shift, and start the new one normally either way. On the kiosk the answer is behind their PIN, so it counts as their own attestation — not a manager's reconstruction.
The backstop — only if you turn it on.
Off by default. When enabled, an hourly sweep closes rows whose shift ended more than your delay ago and that nobody has approved. It writes the scheduled end plus whatever allowance you set — never 'now', which would invent hours nobody claims to have worked.
A Flagged Guess, Never a Record.
What separates an automatic clock-out you can defend from one you can't.
The row wears an orange badge.
'Auto clock-out — verify' sits on the timesheet row for as long as the flag is set. It isn't a subtle color change you learn to ignore — it's a state the row is in, visible to every manager who opens the week.
It can't be approved until a person checks it.
Clicking approve is refused: 'Can't approve — the clock-out was recorded automatically. Verify or correct the time first.' That holds even for companies running fully automatic approval. A machine guess never reaches payroll on its own.
Nothing accrues in the meantime.
The row stays scheduled, not confirmed. No time compensation accrues, no auto-approval fires. The sweep deliberately does the minimum needed to close the row and stops there.
Three ways out, all of them a person.
A real clock-out arriving late overwrites the guess. A manager corrects the time. Or someone confirms the hours as they stand — confirming is attesting, and that's when the hours accrue. Any of the three clears the flag.
A Monday That Went Wrong.
Monday 08:00. Lena punches in at the counter kiosk for an 08:00 – 16:00 shift. 16:00, she leaves through the back without punching out. 16:15, grace elapses and she gets one push. Her phone is in her bag.
Tuesday 09:00. She taps her tile at the kiosk for the next shift. It asks: 'You're still clocked in from Mon 08:00 — when did you finish?' If she answers, the story ends there — a PIN-verified attestation closes Monday as a normal clock-out. Say she dismisses it and starts her shift.
Tuesday 17:00. The sweep runs. Monday ended 25 hours ago, past the 24-hour delay, and the row is unapproved — so it closes at 16:30 (scheduled end plus a 30-minute allowance), flagged. Nothing accrues. No notification is sent. 17:05, Marek opens the timesheet and sees 08:00 – 16:30 with an orange verify badge; approving is refused. 17:10, he asks Lena, she left at 16:05, he corrects it. The flag clears, the hours accrue, and the row approves like any other.
Four settings, all yours. The switch itself (off), how long to wait before closing (24 hours), how much to add to the scheduled end for businesses where running over is normal (0 minutes), and when an open punch stops blocking the next one (4 hours). The two numbers only appear once the switch is on.
