Once you get past the marketing, a biometric attendance machine is a well-understood piece of engineering. This piece walks through what actually happens inside one, from the enrolment session to the punch stored in the software, with enough detail to answer procurement questions honestly.

Step 1: enrolment

Before an employee can use the terminal, they have to be enrolled. The enrolment session captures the biometric and creates the reference template that will be matched against every future scan.

For a fingerprint terminal, enrolment usually goes:

  1. Employee places their finger on the sensor.
  2. The sensor captures a high-resolution image of the ridge pattern.
  3. The terminal repeats this two or three times to average out sensor noise and finger placement variation.
  4. An algorithm extracts the distinctive features (minutiae, ridge endings, bifurcations, orientation).
  5. Those features are stored as a numerical template.
  6. The original image is discarded.
  7. The employee ID is linked to the template in the terminal's database.

For a face terminal, similar but different capture:

  1. Employee stands in front of the camera at a reasonable distance.
  2. The camera captures multiple frames from slightly different angles.
  3. The infrared sensor confirms the face is a living person (not a photograph).
  4. An algorithm extracts geometric measurements, distances between eyes, cheekbone width, jaw shape, etc.
  5. Those measurements are stored as a template.
  6. The original images are discarded.
  7. Employee ID is linked to the template.

Total enrolment time: 30–60 seconds for fingerprint, 5–10 seconds for face. A good installation enrols every employee on site during handover, not remotely.

Step 2: the template

The template is the interesting artefact. It is:

  • A mathematical representation of the biometric.
  • Typically 200–1000 bytes for a fingerprint, 1500–5000 bytes for a face.
  • Not an image. It cannot be reversed into a photograph.
  • Useful only for comparing against future scans of the same biometric.

The privacy question that comes up most: "if my fingerprint template is stolen, can it be used to fake me elsewhere?"

The short answer is no, for two reasons. First, the template format is proprietary to each terminal vendor, a Suprema template will not match on a ZKTeco terminal. Second, even if reverse-engineering somehow produced a matching image, that image cannot be presented to a live sensor with liveness detection.

On Suprema terminals, the template is stored inside a CC EAL6+ certified secure element. This is the same class of hardware protection used in bank chip cards. Extraction is not economically feasible.

Step 3: matching

When an employee arrives, the terminal:

  1. Captures the biometric (fingerprint, face, palm) with the same sensor used at enrolment.
  2. Extracts a template from the captured biometric using the same algorithm.
  3. Compares that template against every enrolled template in the terminal's database.
  4. Returns the best match, above a confidence threshold.
  5. If matched, identifies the employee and records the punch.
  6. If no match, rejects the attempt.

The comparison is the algorithmically interesting step. It calculates a similarity score between the presented template and every enrolled template. If the highest score exceeds a threshold, the match is accepted; otherwise it is rejected.

There are two failure modes to understand:

  • False rejection: a legitimate employee is not matched. Caused by poor sensor placement, worn fingerprint ridges, bad lighting, or a threshold set too high.
  • False acceptance: someone is matched incorrectly. Extremely rare on modern terminals with tight thresholds; more common if the threshold is deliberately loosened to reduce false rejections.

Good terminals balance these with configurable thresholds. Manufacturing specifications quote FAR (False Accept Rate) at around 1 in 100,000 for fingerprint, 1 in 1,000,000 or better for face.

Step 4: the punch record

Once matched, the terminal creates a punch record:

  • Employee ID (the linked ID, not the biometric itself)
  • Timestamp (to the second)
  • Terminal ID (which door)
  • Direction (in/out, determined by policy or manual selection)
  • Sometimes the credential used (which finger, which method on multi-method terminals)

This record is written to the terminal's local storage immediately. Then the terminal attempts to push the record to the central software.

Step 5: syncing to the software

The terminal talks to the software over the network. Common protocols:

  • REST API over HTTPS: modern terminals push punches to a cloud endpoint.
  • Local TCP: the terminal opens a socket to a server on the local network.
  • UDP broadcast: older protocol still used by some ZKTeco models.

If the network is available, the punch reaches the software within seconds and appears in the live dashboard.

If the network is down, the terminal caches the punch locally. Every mainstream terminal supports at least a few thousand cached punches. When the network returns, cached punches are pushed in a batch, in chronological order. A short network outage never loses attendance data.

This resilience is what makes cloud-hosted attendance software workable even at sites with unreliable internet, the terminals are effectively edge devices with local storage and eventual consistency.

Step 6: the software takes over

Once in the software, the punch is grouped with the day's other punches for that employee, matched against the configured shift, and processed for shift rules, overtime and payroll, as covered in How time attendance systems integrate with payroll.

Things worth knowing

Multiple templates per employee. A well-configured enrolment session captures at least two fingers, or fingerprint + face, so an employee with a cut finger or a bandage is never locked out.

Threshold tuning. After the first month of operation, we usually revisit threshold settings for employees who are having recurring false rejections. Adjusted per employee, not globally.

Firmware updates. Terminal manufacturers push firmware updates periodically. Good installations apply them; abandoned installations run on years-old firmware with known bugs.

Enrolment freshness. Fingerprints and faces do age. For a workforce with high staff turnover, this is not an issue; for a stable workforce over 5+ years, re-enrolling occasionally keeps false rejection rates low.

Related reading

Or book a free site survey and we take you through the specific hardware for your site conditions.