How can we help?

The PIN is 6 digits and is case-sensitive to numbers only. Check that you're on the correct site, that the user profile exists in your company roster, and that the PIN was issued correctly. If the PIN was recently changed, make sure the user is using the latest one. You can reset it from the Users page.

Presence is derived from the most recent log. If their last event was "in", they must check out first. If this is incorrect — for example after an auto-logout failure — a Manager can manually add a correcting log from the attendance history.

The system enforces strict alternation: a user who is currently checked in can only check out, and vice versa. This prevents duplicate or conflicting logs. Visitors always start with a check-in on their first visit of the day.

Yes. The kiosk interface is responsive and works on any modern browser — phone, tablet, or desktop. For the best experience we recommend a fixed tablet mounted near the entrance.

When you start a kiosk session, the app can use your device's GPS to find the nearest registered site within 1 km. If a match is found, the site is selected automatically. This is optional — you can always pick the site manually from the list. Coordinates are only used locally in your browser and are never sent to our servers.

Make sure the site has valid GPS coordinates saved (latitude/longitude). Also confirm that the browser or app has location permission granted. If you are more than 1 km from the site's coordinates, geolocation will not automatically match — update the coordinates or select the site manually.

Yes. WhoVisited is designed for multi-site operation. Create as many sites as you need — each gets its own kiosk session, timezone, and auto-logout setting. Reports can be filtered per site.

In the Site settings, enable auto-logout and set a daily cut-off time in the site's local timezone. A background job runs every minute and checks out anyone still marked "in" after that time. Auto-logged-out entries are clearly flagged in the audit trail and the manager and affected user receive an email notification.

Go to the Attendance section for any site, apply optional date and direction filters, then click "Export CSV". The file downloads immediately. Alternatively, click "Email report" to receive the CSV by email — useful for scheduling regular reports.

Each row contains: the user's name and type, the site, the timestamp (in UTC and local time), the direction (in/out), whether the log was created automatically by the auto-logout scheduler, and visitor-specific fields (company, purpose, vehicle registration) where applicable.

Presence is derived from the most recent attendance log for each user at each site. Last direction "in" means present; "out" or no log means not on-site. The count is always live — there is no caching or stale data.

All three types use the same 6-digit PIN check-in flow. The difference is that Visitor-type users are prompted for extra detail on check-in: the company they're visiting from, the purpose of their visit, and their vehicle registration. This extra data is included in reports and exports.

A Manager can view and reset any user's PIN from the Users page. Issue the new PIN to the user via a secure channel (not on the kiosk itself). Old PINs are invalidated immediately on reset.

Yes. Users belong to a company roster, not individual sites. Any user in the roster can check in at any of the company's sites using the same PIN.

Go to Profile settings and use the "Change password" form. You must enter your current password to confirm the change. If you've forgotten your password, use the "Forgot password" link on the sign-in page to receive a reset email.

You cannot exit kiosk mode without the Manager account password. This is by design — it prevents standard users from escaping the kiosk and accessing management features. If you are genuinely locked out, contact support from another device.

Yes. All data is transmitted over HTTPS/TLS. Passwords and PINs are stored as one-way hashes — we never see or store them in plain text. Kiosk tokens are ability-scoped and cannot access management or export endpoints.