Biometric devices

Connect an eSSL or ZKTeco face or fingerprint device at an outlet so staff punches reach Maska HR attendance on their own.

A biometric device at the outlet door takes each punch by face, finger or card and sends it straight to Maska over the internet. Maska matches the device user to a person, decides whether the punch is an IN or an OUT, and counts it on their attendance day, the same way it counts a punch from the staff app. Late marks, missing punches, regularisation, overtime and payroll all work as usual.

There is no PC at the outlet, no software to install and no fixed IP address. You register the device’s serial number in Maska and type one server address into the device.

Time: about 15 minutes per device, plus about 30 seconds per person to enrol.

Which devices work

A device works with Maska if its menu has any of these:

• COMM. → Cloud Server Setting (newer eSSL and ZKTeco firmware)
• COMM. Settings → ADMS (eSSL colour-screen keypad devices such as the X990)
• COMM → Cloud Server Setting with Server mode set to PUSH (older ZKTeco uFace models)

Another sign: System Info → Firmware Info lists Push Service.

A device sends to one server only. If it sends to eSSL eTimeTrackLite or another attendance app today, pointing it at Maska stops that. Punches already on the device are not sent again; export old ones by USB if you need them (see Devices that cannot connect).

Before you start

• Internet at the device. A network cable to the router is best; Wi-Fi models work too.
• Admin access to the device. If someone set a Super Admin on it, that person must verify (face, finger or password) to open the menu.
• Access in Maska. Adding or changing a device needs permission to manage HR settings. Outlet managers and HR can see the devices and the unmatched punches.
• An attendance number for each person. Numbers only, up to 9 digits (for example 1001, 1002). This becomes their User ID on the device. Devices take 1 to 9 digit User IDs, and a User ID cannot be changed on the device later: you would have to delete the person and enrol them again. Decide the numbers before you enrol anyone.

Steps in Maska

1. Give everyone an attendance number.
   • One person: open their profile, choose Change job, pick the day it takes effect and fill Attendance number.
   • Everyone at once: Setup › Data import › Job details. Fill the attendance number column in the template and upload it.
   • A number is unique across the company. Maska refuses a number someone else already holds.
2. Allow device punches. In Setup › Policies › Capture, under How time is captured, turn on Biometric device in the capture policy for the people who will use it. Keep Mobile punch with GPS on too if you want them to have the staff app as a fallback. A device punch from someone whose policy does not allow it is still kept, but marked for review.
3. Add the device. Do this from a phone or laptop connected to the outlet’s internet: the same Wi-Fi or router the device uses (not head office, and not mobile data). Maska uses this to confirm the device is yours. Open Time › Devices and choose Add device:
   • Serial number: on the device under Menu → System Info → Device Info, and on the sticker at the back. When you already have a device at that outlet, a new one calling in from the same network shows under Devices calling in: tap it to fill the serial.
   • Name: something staff and managers recognise, for example “Indiranagar door”.
   • Outlet: where the device is.
   • Punches: leave it on In and out for one device at the door (see How IN and OUT work). In only and Out only are for sites with a separate entrance and exit device.
   • Trust the device’s IN/OUT keys: leave it off unless staff are trained to press the IN and OUT keys on the device. A wrong key makes a wrong day.
   • Choose Add device. Maska shows Now set up the device with the values to type on the device, and Waiting for the device to call in from this network… until it connects.
   • Until the device calls Maska from the same internet connection you added it from, it shows as Confirming and Maska does not take its punches yet. Once it calls in from there, it is confirmed on its own and shows Online.
   • A claim lasts 24 hours. The device’s drawer shows when it expires, for example “Expires at 4 pm tomorrow”. If it expires, or you added the device from another network, open the device’s drawer on a phone or laptop on the outlet’s internet and choose Confirm from this network. That starts a fresh 24 hours from the network you are on.

You can close that screen and finish later. The same values are in the device’s drawer: open the device from the list on Time › Devices.

Steps on the device

Menu names below come from the manufacturers’ manuals. Firmware differs between batches, so where a label differs the alternatives are given.

The values are the same on every model. Type the Server Address exactly as Maska shows it in Now set up the device or the device’s drawer; for your live account that is punch.maska.co.in.

eSSL face devices with a touchscreen

AiFace Mars, Jupiter, Arion and Magnum.

1. Open the menu. Tap the menu icon on the standby screen. If a Super Admin exists, verify as them.
2. Protect the menu (once). User Mgt. → New User, create yourself and set User Role to Super Admin. After this, staff cannot open the menu.
3. Network.
   • Cable: COMM. → Ethernet, turn DHCP on. If you must use a fixed IP, fill IP Address, Subnet Mask and Gateway, and set DNS to 8.8.8.8. With the default DNS of 0.0.0.0 the device cannot find punch.maska.co.in.
   • Wi-Fi: COMM. → Wireless Network (or Wi-Fi Settings), turn Wi-Fi on, pick the network, enter the password and choose Connect to Wi-Fi.
4. Point it at Maska. COMM. → Cloud Server Setting:
   • Server Mode: ADMS (if shown)
   • Enable Domain Name: on
   • Server Address: the one Maska shows, punch.maska.co.in
   • Server Port: 443
   • Enable Proxy Server: off
   • HTTPS: on. It is on by default on these models.
   • If it will not connect on 443, use port 80 with HTTPS off. Changing HTTPS shows a security prompt and restarts the device.
5. Date and time. System → Date Time: Select Time Zone GMT+5 (India), Date and Time Auto Sync on if your model has it (otherwise set the date and time by hand), Daylight Saving Time off, 24-Hour Time on.
6. Punch state. Personalize → Punch States Options → Punch State Mode: Off. Maska decides IN and OUT; staff press nothing.
7. Check. Within a minute a cloud icon appears at the top right of the standby screen, and Maska shows the device as Online.

eSSL and ZKTeco keypad devices

X990, K30 Pro, MB160 and MB20.

1. Open the menu. Press M/OK (or the Menu key).
2. Protect the menu. User Mgt. (or Users) → New User, set User Role to Super Admin.
3. Network. COMM. (or COMM. Settings) → Ethernet: DHCP on, or a fixed IP with DNS 8.8.8.8. Wi-Fi models: COMM. → Wireless Network.
4. Point it at Maska.
   • X990-style firmware: COMM. Settings → ADMS. Enable Domain Name on, Server Address as Maska shows it (punch.maska.co.in), Server port 80, Enable Proxy Server off. This firmware has no HTTPS.
   • MB20 and MB160-style firmware: COMM. → Cloud Server Setting, the same values. If there is an HTTPS setting, use port 443 with HTTPS on, or 80 with HTTPS off.
5. Date and time. System → Date/Time: set the date and time by hand, 24-Hour Time on, Daylight Saving Time off. These models have no time zone setting: make sure the clock shows Indian time.
6. Double scans. System → Attendance → Duplicate Punch Period (m): 1.
7. Punch state. Personalize → Punch State Options → Punch State Mode: Off.
8. Check. A cloud icon shows in the status bar, and Maska shows the device as Online.

ZKTeco touch devices

SpeedFace V5L, ProFace X and uFace 800.

1. Open the menu. Tap the menu icon. Create a Super Admin as for the eSSL face devices.
2. Network. COMM. → Ethernet (DHCP on, or a fixed IP with DNS 8.8.8.8). Wi-Fi is under COMM. → Wireless Network.
3. Point it at Maska. COMM. → Cloud Server Setting:
   • Server Mode: ADMS (older uFace 800: Server mode PUSH)
   • Enable Domain Name: on (older uFace 800: URL Mode on)
   • Server Address as Maska shows it (punch.maska.co.in), Server Port 443 with HTTPS on (or 80 with HTTPS off), Enable Proxy Server off.
4. Date and time. System → Date Time: India time zone (GMT+5), daylight saving off. If your model has no time zone setting, make sure the clock shows Indian time.
5. Punch state. Personalize → Punch State Options → Punch State Mode: Off.
6. Check. An icon shows at the top right of the standby screen, and Maska shows the device as Online.

Matrix COSEC ARGO and VEGA (coming soon)

Matrix COSEC devices are set up from the device’s own web page rather than its menu. Support is being built; until then, use the punch file import.

Enrolling staff on the device

1. User Mgt. (or Users) → New User.
2. User ID: the person’s attendance number in Maska, exactly the same digits (for example 1042).
3. Name: their name. Keep it short; devices allow about 17 to 23 characters.
4. User Role: Normal User.
5. Face on face devices, Fingerprint (press the same finger three times) or Card.
6. Save. If the number is taken, the device says the user ID already exists.

Several devices at one outlet, or at different outlets, are fine: enrol each person with the same User ID on every device they use.

Wrong User ID? It cannot be edited on the device. Either delete the person on the device and enrol them again with the right ID, or leave it and fix it in Maska from Unmatched punches (below).

Sending the staff list from Maska to the device, so you only pick a name and scan the face or finger, is coming soon.

How IN and OUT work with one device

One device at the door is enough for coming in and going out. Staff scan once when they arrive, once when they leave, and once each way for a break. They do not press any key.

• Maska looks at the person’s last punch. If they are clocked in, the next punch is an OUT; otherwise it is an IN.
• A second scan within a minute of the first counts once.
• If someone forgets to punch out, the next day’s first punch still starts as an IN, and the day they missed shows a missing OUT for their manager to fix.
• Punches that arrive late (for example after the device was offline) are put back in time order, and the day is worked out again.
• The capture policy’s pairing rule (such as first in, last out) still applies on top.

Punches reach attendance within about 5 minutes. They show on Time › Attendance › Day log with the device as the source.

Unmatched punches

Time › Devices › Unmatched punches lists punches from a device User ID that no one in Maska holds as their attendance number, for example “Device user 1042 punched 14 times but no one in Maska has attendance number 1042”. These punches are kept but not counted. The Unmatched column on the device list, and the warning in a device’s drawer, show how many each device has.

• Assign to… picks the person. Maska gives them that attendance number through a job change and counts all the waiting punches on their days. Their later punches match on their own.
• Ignore is for a number that is not a member of staff, such as a test user or someone who has left. The punches are kept as rejected and never counted. If the number punches again, it shows here again.

A number held by two people at once also lands here, until one of them is given a different number.

Held punches

Time › Devices › Held punches lists device punches Maska kept for you instead of counting, grouped by why:

• In a locked month: the punch falls in a month that is already locked. Reopen the month in Time › Month close first, then release it.
• Dated in the future: the device clock was ahead. Fix the device clock, then release the punches whose times are right.
• Older than 30 days: Maska does not count punches that old on its own.
• Could not be recorded: release it to try again.

Tick the punches (or a whole group) and choose Release. They go back to be counted on the person’s days. Maska says how many it released, and how many are still held because their month is locked. Adding or releasing needs permission to manage HR settings.

Test and go live

1. Have one person punch. Within about 5 minutes the punch shows in Time › Attendance › Day log, and under recent punches in the device’s drawer.
2. Check Unmatched punches. Anything there is a User ID on the device with no attendance number in Maska: assign it.
3. Have the same person punch again later: it should show as an OUT.
4. Tell staff: scan once when you arrive, once when you leave, and once each way for a break.

Devices that cannot connect: punch file import

If a device cannot send to Maska, bring its punches in from a file:

1. On the device: USB Manager → Download → Download Attendance Data to a USB stick, or export the attendance logs from the device’s PC software.
2. In Maska: Setup › Data import › Attendance punches. The import takes the employee code, date, time and In/Out for each punch. See Data import.

An import that reads a device export directly, by attendance number, is coming soon.

Troubleshooting

Privacy

Maska never receives or stores face or fingerprint data. Enrolment stays on the device, and Maska drops any face, fingerprint or photo data a device tries to send. Maska stores only the punch times, the device user number and which device the punch came from.

Tell staff that attendance is taken on a biometric device, and keep a non-biometric way to punch (the staff app) for anyone who needs one.