This sounds like an engaging project. Hope it goes well for you.
I don’t want to be a downer, but there may be some legal regulations you need to meet. Probably not too hard, but you don’t want a surprise to bit you at the last minute.
Possible examples:
- if you consider pivoting towards biometrics, that information may need special privacy provisions
- interface terminal may have privacy implications (eg may not be OK to have a screen showing last N people who ‘punched’ in)
- may have audit log requirements as it’s related to payment of staff
- may need documentation in company business statements, employee handbooks or whatever
- ‘punch in punch out’ may not line up with employee contracts
- if the system will also be used for health and safety (eg checking everyone got out of the burning building) there may be extra requirements
- consider how to handle disputes which may arise