Features
Every layer of a security operation, verified
Each capability is built around one principle: the record must be trustworthy enough to bill against — at the punch, at the signature, and at billing time.
Server-verified timekeeping
Time In / Time Out is recorded when the server accepts the event — never before. High-resolution punch timestamps are preserved alongside the normalized accounting minutes, so what was worked is what's billed.
Geofence evidence, not tracking
Location is captured only during a punch and evaluated on the server. Inside, outside, uncertain, denied, and stale paths each produce a real, recorded event that a reviewer can approve, return, or reject for billing review.
Signed, immutable shift records
On Time Out the guard signs the exact timesheet they completed. A typed or drawn signature binds to a content hash of the fields being signed. Material changes supersede signatures and require re-approval — no old stamp on a new record.
Scheduling without double-booking
Build one-time and recurring shifts, catch same-person conflicts, publish changes, and notify the affected guards. Open-shift requests go to supervisors for assignment — never silently filled.
Reviewed invoice preparation
Eligibility requires a closed, signed, approved shift with no blocking exception. Authorized admins prepare invoices from eligible shifts across facilities; the app builds the package for review only — it never auto-sends.
Tenant-isolated messaging
Private guard-to-HR conversations, supervisor channels, and company announcements stay scoped to their membership. Admin access doesn't automatically expose every private HR conversation to every supervisor.
Roles and capabilities
Owners, admins, HR, supervisors, and guards each get the least access they need — enforced at the database, server, storage, export, and realtime layers. Invoicing stays admin-only by default, always.
Multi-tenant by design
Every record and file carries a tenant ID. One identity can work for several companies through isolated memberships with a clear company switcher — and CWA support never becomes a customer workforce seat.
Time In / Time Out
The canonical timestamp is server receipt time. Client timestamps and location acquisition time are retained as evidence — not authority. No client-clock backdating.
Geofence evidence
Each worksite has a center, radius, and units with an effective date. Inside, outside, uncertain, denied, and stale each produce a real, recorded event for review. No background tracking.
Signed shifts
A signature binds to a content hash of the fields being signed. Material changes supersede it and require re-approval. We never stamp an old signature onto a new record.