Security and privacy
What protects your records, what we collect, and where the limits are.
How records are protected
Tamper evidence
Attendance records can't be overwritten through the app or its database login, and each is linked to the one before it. A check runs every night and reports anything that doesn't match.
Separate schools
Each school sees only its own data. Automated tests try to reach one school's records from another, and a student who already has an account elsewhere shares nothing new until they accept.
Staff sign-in
Instructors and administrators need an authenticator app. Passwords are stored as Argon2id hashes, never as text.
Corrections keep history
An edit or a deletion keeps the original record, marked, with a name and a reason.
What we collect about students
Their name, email and optional phone number, from the school or their own profile, and an optional profile photo. At each clock action: the date and time, GPS location and its accuracy, device details and ID, IP address, and their name, email, phone number and class as they stood then. Location is only read after they tap, never in the background. Face ID and fingerprint data stay on the phone and never reach us. We don't sell this data or use it for advertising. Details are in the privacy notice.
What it doesn't protect against
Tamper evident means a change made outside AttendVia shows up, with the proof sent off the server each day. It doesn't mean impossible to change, which no server can honestly promise. Other limits:
- A phone reports its own location. A determined person with technical skill could fake one. The room code and the headcount are there because of this, and we plan to add Apple's App Attest to prove a request comes from the real app.
- An absence between presence checks can go unseen. Checks sample a class; they don't watch it.
- Face ID proves the phone's owner, not that the owner is the person on your roster, if someone else's face was enrolled.
- The website can't use Face ID or a fingerprint. Classes are phone app only unless an instructor allows it, and website clock-ins always need a person's tick at sign-off.
- An instructor can enter false hours. It would be labelled, named and on the audit log, but it isn't prevented.
- Someone in full control of the server could rewrite records and their proof together, back to the last proof that left it. That's why a fingerprint of every record is emailed off the server each day.
- Compliance stays with your program. AttendVia keeps evidence. We don't claim any certification, and whether it satisfies a particular regulator is a question for that regulator.
Questions from your IT or compliance team?
We are happy to go through it with them.