A device lock time clock is a time clock that accepts punches only from a phone or tablet you have approved, and ideally only when that device is at the right place. It is a fraud control, not a screen setting. If you landed here looking for a way to make your phone's lock screen show the time, or to lock a phone after a timer, that is a different tool (more on that below). If you manage field employees and want to stop one person punching in for another, read on.
TL;DR
- A "device lock" in time tracking means a punch is tied to a specific, verified device, not just to a name and a PIN.
- Your phone's screen lock and screen timeout settings protect the phone. They do not record hours or prove who clocked in.
- Device checks work best combined with identity verification and a job-site boundary (geofence). Any one of them alone has gaps.
- The law does not require a particular time clock, but it does expect accurate, retrievable records. Tell employees what you collect and why.
- Clock-Me combines GPS-verified punches, identity checks, geofencing and device-based fraud detection, with a free plan for small teams.
Table of Contents
- Two meanings of "device lock", and which one this page covers
- Why a PIN or a name is not enough in the field
- What a device lock actually does
- What the law expects from a time clock
- Privacy: verify punches, do not follow people
- Our perspective: verify the punch, not the person's whole day
- How to set up a device-verified time clock for a field team
- What a device lock cannot do
- How the options compare
- Pricing for a device-verified time clock
- FAQ
- Sources
Two meanings of "device lock", and which one this page covers
Search results for this phrase are mostly about phone settings: lock screen clocks, screen timeouts, timer apps that lock a phone for a set period, and Intune policies for maximum inactivity time. Those are legitimate tools. They answer a different question: how long before this device locks itself?
The operating systems build these in for security and personal control. Android's Digital Wellbeing app timers and Apple's Screen Time, for example, limit how long someone uses an app each day. They were designed for personal productivity and parental control. They have nothing to say about who started a shift, where, or when.
The second meaning is what managers of crews, drivers, cleaners, installers and inspectors usually need: a time clock that is locked to a device, so a punch can only come from a phone you know belongs to that employee. That is the subject of this article.
Why a PIN or a name is not enough in the field
A paper sheet or a shared tablet at a trailer door relies on trust. A basic app that lets anyone log in with a password relies on the same trust, just on a screen. Three things go wrong in practice:
- Buddy punching. A coworker clocks in for someone who is running late. Passwords and PINs are easy to share, and nothing in the record shows it happened.
- Punching from the wrong place. An employee taps "start" from the driveway at home, or from the previous job site, because the app does not check.
- Shared or swapped phones. Two people use one login on one phone, or one person uses several devices, and the timecard shows a single clean line.
Each of these costs money in overpaid hours, and each creates a records problem if a wage claim comes in. Locking punches to a verified device closes the third gap directly and makes the first two much harder.
What a device lock actually does
Think of it as one layer of three. Each answers a different question about a punch.
| Layer | Question it answers | What it stops |
|---|---|---|
| Identity verification | Is this the right person? | Buddy punching, shared credentials |
| Device check | Is this a device we recognize, used the way we expect? | Swapped phones, one login on many devices, spoofed setups |
| Location check (GPS and geofence) | Is the device where the work is? | Punching from home, from the road, from the wrong site |
A device lock on its own tells you the phone is familiar. It does not tell you the right person is holding it. A face or ID check on its own does not tell you the punch came from the job site. The three together are what make a record hard to fake.
A note on hardware IDs
It is tempting to read "device lock" as "collect the phone's hardware serial number." Modern phone operating systems restrict access to those identifiers for privacy reasons, and they add a data-collection burden you probably do not want. Our own take on this is covered in Device ID Time Tracking for Managers: Skip Hardware IDs, Verify Time. The short version: you do not need a permanent hardware fingerprint to catch most device-based fraud. You need the system to notice when something about the punch does not add up.
What the law expects from a time clock
There is a common assumption that a locked-down, high-tech time clock equals compliance. It does not, and it is also not required.
Under federal rules, employers are not required to use time clocks, but if they do, the records must reflect hours actually worked. The same rules allow disregarding insubstantial, infrequent periods of time that cannot practically be recorded, such as a few seconds or minutes. They do not allow systematically leaving work unpaid.
California is similar on the hardware question. California law does not require electronic timekeeping or time clocks, and paper is allowed, but records should be indelible and retrievable. A 2026 overview of electronic time records adds that the Labor Code does not prescribe a format or technology, and that solid, accessible records are strong evidence if a dispute arises. It also notes that records must capture more than a start and a stop: they should show when each work period begins and ends.
What this means for you: the lock on the device is a means, not the goal. The goal is a record you can produce, that matches the work done, and that an employee can see and attest to. For a closer look at California specifics, see Audit Ready Timekeeping for California Employers & HR.
Privacy: verify punches, do not follow people
Device and location checks collect data about employees, and regulators are paying attention. The NLRB General Counsel has said that electronic surveillance must not interfere with protected rights, and the memo cautions against continuous, covert monitoring. For anything biometric, a KPMG regulatory alert describes retention-policy and disclosure expectations, including under California's consumer privacy law.
A practical way to stay on the right side of this:
- Collect at the moment of the punch, not all day. A location check when someone clocks in or out is a different thing from a live map of their route.
- Tell people in writing what is collected, why, and who can see it, before you switch it on.
- Match the data to the need. If you only need to know a crew was on site, you do not need a breadcrumb trail.
- Set a retention rule and stick to it.
If you want a broader view of what employee device monitoring can involve from a security and investigations angle, this overview of employee device monitoring is a useful read. Our own guidance on keeping location data narrow is in Employee GPS Privacy: Use Events, Not Streams to Cut Legal Risk.
Our perspective: verify the punch, not the person's whole day
We built Clock-Me around one idea: a time record should be believable the moment it is created. That is why the platform pairs GPS-verified clock-ins with identity verification, geofencing and device-based fraud detection, rather than leaning on any single control.
We also made a deliberate choice to avoid paper timesheets and continuous background tracking. Managers get live dashboards that show who is clocked in and where the punch happened. Employees get a simple one-tap clock-in. Nobody has to carry a log, and nobody is followed between jobs.
We think that balance is also the safer legal position. Event-based checks give you proof of attendance without the privacy exposure of a constant location feed. And because the point is a record you can stand behind, features such as timecard attestation and timesheet approval sit next to the punch itself, so the employee confirms the hours and the manager signs off before payroll export.
If a vendor tells you a locked device makes you compliant, ask what the record looks like when an employee disputes it. That is the real test.
— Clock-me
How to set up a device-verified time clock for a field team
This works whether you are moving off paper or off a basic app.
- List your sites and roles. Note each job site or service area, and which employees work where. Crews that move between locations need a setup for multiple job site tracking.
- Decide how strict to be. Fixed sites suit a tight geofence. Roaming work, like mobile service calls, may need a wider boundary or a location check at the punch only.
- Set up identity verification. Choose the check that fits your workforce, so a shared password is no longer enough to clock someone in.
- Turn on device-based fraud detection. The goal is to flag odd patterns, such as one login on several phones, for a manager to review.
- Write a short disclosure. One page: what is collected, when, why, who sees it, how long you keep it. Have employees acknowledge it.
- Run a one-week pilot. Use a single crew. Compare the new records to your old sheets and fix geofence sizes where punches fail at the edge of a site.
- Roll out and review exceptions weekly. Flagged punches are conversations, not automatic penalties. Approve timesheets, then export to payroll.
For a deployment-focused walkthrough, see Field Teams: Mobile Time Clock You Can Deploy in Days.
Shared kiosk or personal phones?
A kiosk is a single device everyone punches on. It is easy to control but only works where people physically pass it, and it does nothing for crews spread over several sites. Personal or company phones let each employee punch where they work, and the device check becomes meaningful because each person has a known phone. We compare the trade-offs in Kiosk vs Mobile Time Clock for Small Teams.
What a device lock cannot do
Be honest with yourself about the limits, because your employees will be.
- It cannot prove effort. A verified punch shows presence at start and end. It does not show productivity, and it should not be sold internally as if it did.
- GPS has error. Signal drifts, especially indoors, in basements and in urban canyons. Build in tolerance and a way for an employee to flag a failed punch with a note. We cover this in GPS Time Tracking Benefits for Field Managers, Despite GPS Limits.
- It cannot replace rules. Rounding, meal and rest breaks, and overtime are policy and law questions. The clock records facts; you still apply the rules, and rounding is only acceptable if it does not, over time, shortchange actual hours worked.
- It can create distrust if introduced as surveillance. Explain the purpose: accurate pay and fewer disputes.
How the options compare
Without naming any vendors, here are the main types of time clock you will weigh.
| Type | Strength | Weakness for field teams |
|---|---|---|
| Paper timesheets | No technology needed | Easy to alter, slow, hard to retrieve |
| Basic app, login only | Cheap and quick | Credentials can be shared, no location proof |
| Shared kiosk | Simple to control | Only works at fixed entrances |
| Phone-based clock with GPS only | Shows location | Does not prove the person or the device |
| Phone-based clock with identity, device and geofence checks | Verifies who, with what, and where | Needs a short disclosure and setup time |
Pricing for a device-verified time clock
Clock-Me plans are based on the number of active employees. These are the published monthly prices:
| Plan | Price |
|---|---|
| Free | $0 per month |
| Starter | $31.99 per month |
| Growth | $54.99 per month |
| Business | $99.99 per month |
| Pro | $224.99 per month |
| Corporate | $439.99 per month |
| Enterprise | No published price |
Small teams can start on the free plan and test verified clock-ins on a real crew before paying anything. You can compare the tiers on our plans page, or see how the GPS punch clock and geofencing work on the home page.
FAQ
Does a device lock make my time clock legally compliant?
No. Neither federal rules nor California law require a specific time clock, and a locked device does not by itself equal compliance. What matters is that your records accurately show hours worked and can be retrieved when needed.
Is a phone's screen lock or app timer the same as a time clock?
No. Screen timeouts and app timers are personal security and wellbeing tools. They do not record who worked, where, or for how long, so they cannot serve as payroll records.
Can I use GPS and device checks without tracking employees all day?
Yes. Event-based checks verify location at the moment of the punch rather than streaming it continuously. That gives you proof of attendance with a smaller privacy footprint, and it is easier to explain to your team.
What should I tell employees before turning this on?
Tell them what is collected (for example, location at clock-in and identity checks), why you collect it, who can see it and how long you keep it. Regulators recommend transparency, and a short written acknowledgment is a good habit. Your own employment counsel can confirm requirements for your state.
Sources
- eCFR: 29 CFR Part 785, Subpart D, Recording Working Time
- California Employment Law Report: Pen-and-paper or electronic timekeeping (2018)
- California Employment Law Report: Electronic time records and pay stubs (2026)
- NLRB: General Counsel memo on unlawful electronic surveillance
- KPMG: AI and Privacy, a look at biometric tech and data regulation
- Google Android Help: Digital Wellbeing app timers
- Hub Security & Investigative Group: Employee device monitoring