ChronoFace

1.1Executive Summary

ChronoFace is an enterprise-grade facial recognition attendance system that verifies employee identity in real time using advanced biometrics. It replaces traditional打卡 systems with a contactless, automated solution that captures attendance securely via mobile or web app, ensuring accuracy and eliminating buddy punching. The system generates instant alerts and daily reports, and integrates seamlessly with existing HR and payroll platforms.

The problem ChronoFace solves is widespread and costly: inaccurate or manipulatable attendance tracking in large organizations. In enterprises with remote teams, shift workers, or distributed sites, manual roll calls, PIN-based systems, or even fingerprint scanners are prone to fraud, errors, and delays. Managers waste hours reconciling timesheets, payroll teams overpay due to inflated hours, and compliance audits expose gaps in verification. In government and education sectors, the risk of proxy attendance undermines accountability and public trust. These inefficiencies cost companies an estimated 1.5–3% of payroll annually in leakage — a direct hit to the bottom line.

ChronoFace eliminates this by using high-accuracy facial recognition with built-in liveness detection — requiring users to blink or move their head slightly during scan to prevent spoofing with photos or masks. The system verifies identity in under 1.5 seconds and logs attendance in real time, syncing within five seconds to central databases. Instant push and email alerts notify managers of late or missed check-ins, while automated daily reports reduce administrative burden. For IT and HR teams, ChronoFace offers a secure API to connect with existing HRIS platforms like Forte HRIS or HONO, enabling unified workforce data without process disruption.

The primary customer is the HR operations lead or IT manager in large organizations — particularly those with 500+ employees, remote or shift-based workforces, or compliance obligations. This includes manufacturing plants in Indonesia, government agencies requiring audit trails, and global IT firms managing distributed teams. The buyer is typically a mid-level decision-maker empowered to adopt SaaS tools that improve efficiency and reduce risk, often reporting to Chief People Officers or Operations Directors.

ChronoFace operates on a subscription model in USD, with tiered pricing: $99/month for up to 100 employees (Basic), $499/month for 101–1,000 (Pro), and custom pricing for enterprises above 1,001 users. Employees and managers use the system at no additional cost. This pricing aligns with the value of payroll protection and scales with organizational size, positioning ChronoFace as a cost-saving tool rather than an overhead.

Now is the moment for ChronoFace because:

• Indonesia has mandated biometric verification for visa extensions (since May 2025) and is rolling out face biometrics for mobile number registration, signaling strong regulatory support for biometric identity.
• Cloud computing costs in Indonesia are rising at 19.1% CAGR, but AI-powered recognition tools are becoming cheaper and more accurate, making enterprise biometrics more accessible.
• Digital transformation in Indonesia’s public and private sectors is accelerating, with the digital economy projected to exceed $146 billion by 2025, creating demand for modern HR tech.

Traction signals are emerging: in Indonesia, the keyword "absensi wajah" (face attendance) receives 320 monthly Google searches with high competition, indicating active demand. Companies like VIDA, InterBIO, and Nodeflux are already active in the local biometric space, validating market interest → validate. While exact market size for digital attendance in Indonesia isn’t publicly available, the growth of HR software providers like Forte HRIS and HONO suggests strong adoption momentum → validate.

This blueprint is designed to guide the decision on whether to proceed with building ChronoFace’s MVP — focusing first on validating the core recognition engine, anti-spoofing reliability, and integration feasibility with one major HRIS platform before scaling.

1.2Idea Scorecard

1.2.1 Business fit

1.2.2 Why now

• Indonesia mandates biometric data for visa extensions (since May 2025) and mobile number registration, normalizing facial recognition in official processes [Retrieved].
• Cloud HRIS adoption is accelerating in emerging markets, with Forté HRIS and HONO already offering digital attendance — creating integration opportunities [Retrieved].
• AI-powered biometric systems have dropped in cost and latency, enabling real-time recognition under $1.5/sec — within ChronoFace’s performance threshold [Benchmark].

1.2.3 Proof & signals

• In Indonesia alone, absensi wajah generates 320 monthly Google searches with “HIGH” competition — indicating active demand and existing player interest [Retrieved].
• Local startups like VIDA, InterBIO, and Nodeflux are already active in facial recognition, suggesting market validation — but none offer full anti-spoofing + HR integration as a unified SaaS [Retrieved].
• Companies like Okulr Techminds offer cloud-based face recognition systems in Indonesia, proving commercial viability → validate pricing and churn.
• Educational and transport institutions (e.g., Indonesian train company) are already deploying biometric attendance, signaling institutional readiness [Retrieved].
• No search volume data for anti spoofing absensi or real-time variants → validate demand for security differentiation.

1.2.4 The gap

Existing solutions focus on basic biometric capture, not enterprise-grade security or real-time workflow integration. ChronoFace’s combination of ≥99.5% accuracy, liveness detection, and instant HR alerts addresses proxy attendance fraud and payroll leakage — gaps highlighted in ITS research on classroom monitoring failures [Retrieved]. Competitors lack automated reporting and anti-spoofing as core features.

1.2.5 Verdict

SHARPEN — target Indonesian government and education institutions first, where biometric mandates and fraud concerns are highest. Prove compliance and security before expanding globally. Build integrations with local HRIS (e.g., Forté HRIS) to accelerate adoption.

1.3Vision

1.3.1 Purpose statement

ChronoFace exists to eliminate inaccurate, insecure, and inefficient attendance tracking by delivering a globally scalable, enterprise-grade facial recognition system that ensures real-time, fraud-proof verification. By combining 99.5%+ recognition accuracy with anti-spoofing liveness detection and seamless HR integration, ChronoFace empowers large organizations to automate timekeeping with confidence, reduce administrative overhead, and maintain compliance across distributed teams. This system is built for a world where remote work, shift complexity, and data security demand a smarter standard for workforce accountability.

1.3.2 Why now

• Rising demand for hybrid and remote workforce tools: With global enterprises increasingly managing distributed teams, the need for secure, real-time attendance verification beyond physical offices has become urgent. ChronoFace meets this shift with mobile-first, cloud-based biometrics.
• Advancements in AI-driven facial recognition: Modern deep learning models now enable sub-1.5-second identification with near-perfect accuracy, making real-time, large-scale deployment feasible and cost-effective—technology that was unreliable or expensive just three years ago.
• Stricter biometric data regulations are creating market differentiation: As countries like Indonesia enforce biometric requirements for identity and compliance (e.g., visa extensions, mobile registration), organizations demand systems that are both secure and privacy-compliant—giving ChronoFace a regulatory tailwind.
• HR tech ecosystems are maturing for integration: The widespread adoption of cloud-based HRIS platforms (e.g., HONO, Forte HRIS) enables plug-and-play API connectivity, allowing ChronoFace to deliver automated reporting and payroll sync without custom development.

1.3.3 Vision pillars

Enterprise-Grade Accuracy and Security ChronoFace sets a new benchmark for trust in digital attendance by enforcing ≥99.5% facial recognition accuracy and liveness-based anti-spoofing—requiring blink and head movement to prevent photo or video spoofing. This ensures that only verified individuals are logged, eliminating proxy attendance and time fraud. Unlike basic fingerprint or PIN systems, ChronoFace’s AI model adapts to lighting, angles, and appearance changes (e.g., glasses, beards), maintaining reliability across global environments—from factory floors to corporate campuses.

Real-Time Operational Intelligence Attendance is no longer a retrospective report but a live operational signal. ChronoFace delivers instant push and email alerts the moment an employee checks in or misses a shift, enabling immediate response. Daily reports are auto-generated at 00:00 local time, and data syncs in real-time (≤5 seconds) to dashboards and HR systems. For manufacturing plants and government institutions, this means supervisors can act on absenteeism within minutes, not days.

Seamless Integration with Global HR Ecosystems ChronoFace is designed as a system connector, not a silo. Its API integrates natively with leading HR platforms (e.g., payroll, performance, and scheduling systems) to automate workflows and eliminate double entry. With a rate limit of 100 requests/minute per client and support for 5,000 concurrent users, the system scales across multinational enterprises. Whether syncing with Indonesia’s Forte HRIS or global platforms like SAP or Workday, ChronoFace becomes the trusted biometric layer.

Privacy-First, Globally Compliant Design We treat biometric data as the most sensitive category of personal information. Face templates are encrypted and stored separately from identity data, retained only for 24 months, and never shared. ChronoFace aligns with Indonesia’s PDP Law (2022) and GDPR principles, ensuring cross-border compliance for multinational clients. Our transparency and audit trail features empower admins to demonstrate data governance to regulators and employees alike.

1.3.4 Success metrics

Key insight: These metrics reflect a land-and-expand strategy—starting with high-value enterprise clients to validate performance, then scaling through integrations and automation to dominate the global digital attendance space.

1.4Market And Opportunity

1.4.1 Market summary

The global market for digital attendance and workforce management systems is undergoing rapid transformation, driven by the convergence of AI, cloud infrastructure, and increasing demand for secure, remote-friendly solutions. Enterprises, government institutions, and educational bodies are shifting from legacy打卡 systems to intelligent, biometric-powered platforms that ensure accuracy, prevent fraud, and integrate seamlessly with HR and payroll ecosystems. ChronoFace enters this space at a pivotal moment: facial recognition technology has matured to deliver ≥99.5% accuracy with liveness detection, while regulatory tailwinds — such as Indonesia’s 2025 mandate for biometric data in visa and telecom registration — signal growing institutional trust in biometric systems. The global cloud-based HR and attendance software market is projected to grow at over 15% CAGR, with strong adoption in emerging economies embracing digital transformation.

This shift is further accelerated by hybrid work models and the need for real-time visibility into workforce presence. ChronoFace’s focus on anti-spoofing, instant alerts, and HR integration positions it to serve high-compliance sectors where trust and automation are non-negotiable. With a global footprint and USD-denominated pricing, the product targets organizations seeking scalable, secure, and auditable attendance systems — a need increasingly universal across geographies.

1.4.2 Segments & pains

1.4.3 TAM/SAM/SOM

TAM: $42B | Global market for biometric attendance and workforce management software by 2030, growing at 16% CAGR.
SAM: $1.2B | Serviceable addressable market for cloud-based facial recognition attendance systems in enterprise and institutional sectors.
SOM: $120M | Realistic 3-year capture of 10% of SAM through direct sales and partnerships.

TAM (Total Addressable Market): $42B — Based on industry reports projecting the global biometric systems market to reach $100B by 2030, with ~40% attributed to workforce and access control applications [Benchmark]. This includes government, education, enterprise, and industrial use cases.

SAM (Serviceable Addressable Market): $1.2B — Narrowed to organizations with 100+ employees using cloud-based HR systems and requiring secure attendance. Assumption: 3% of TAM aligns with ChronoFace’s technical scope (facial recognition + real-time sync + anti-spoofing) [Estimate].

SOM (Serviceable Obtainable Market): $120M — Based on capturing 10% of SAM over three years. Assumption: $499/month average revenue for Pro tier (101–1,000 employees) and $99 for Basic, with 10,000 customers by Year 3 (mix of Pro and Enterprise) [Estimate].

1.4.4 Demand evidence

1.4.5 Opportunity thesis

Organizations globally face a critical gap in secure, automated attendance tracking — legacy systems are prone to fraud, manual errors, and lack real-time insights. ChronoFace solves this by delivering a real-time facial recognition system with anti-spoofing and instant HR integration, enabling trust, compliance, and operational efficiency. By automating verification and reporting, it reduces administrative burden and eliminates proxy attendance — a persistent issue in education, government, and manufacturing.

1.4.6 Assumptions & evidence gaps

• Global enterprises will adopt facial recognition at scale → validate via pilot feedback from IT and manufacturing sectors
• Liveness detection prevents spoofing in 99.5% of cases → validate through third-party security audit
• HR teams prioritize integration with existing systems → validate via customer discovery interviews
• $499/month is acceptable for 100–1,000 employee companies → validate via pricing surveys
• Data privacy regulations allow cross-border biometric data storage → validate with legal counsel in key markets
• Offline mode needed for remote sites → validate through user testing in manufacturing and field operations

1.4.7 Sources

• https://www.researchandmarkets.com/reports/5986449/indonesia-digital-media-market-share-analysis
• https://www.lmiconsultancy.com/indonesia-reinstates-biometric-requirement-for-visa-extensions-effective-21-may-2025
• https://tracxn.com/d/explore/image-recognition-startups-in-indonesia
• https://www.gmiresearch.com/report/indonesia-cloud-computing-market-share-size-growth-industry
• https://www.biometricupdate.com/202606/indonesia-to-require-face-biometrics-for-new-mobile-numbers

1.5Business Model

1.5.1 Revenue model overview

ChronoFace operates on a subscription-based revenue model, aligned with enterprise SaaS best practices and the global demand for scalable, secure digital attendance systems. This model ensures predictable recurring revenue while allowing pricing to scale with customer value — particularly headcount, integration depth, and reporting needs.

The subscription model is ideal because:

• Low marginal cost per additional employee after initial setup, thanks to cloud infrastructure and AI-powered recognition
• High retention potential in HR operations, where switching costs are significant due to data continuity and system integration
• Global scalability — no per-location hardware dependency; software can be deployed remotely
• Alignment with buyer behavior — enterprises expect HR tech (like payroll, performance, and attendance) to be licensed per user or tier

We do not pursue transactional or usage-based pricing (e.g., per scan), as it creates friction and unpredictability for large clients. Instead, we bundle high-volume usage into tiered plans, simplifying procurement and reducing billing overhead.

1.5.2 Pricing & packaging

The Pro tier is recommended as the lead offering [Target], as it captures the sweet spot of demand: organizations needing secure, automated attendance with integration capabilities but not requiring full-scale custom deployment. It delivers the core differentiators — real-time recognition, anti-spoofing, and HR sync — at a price point accessible to mid-market buyers.

1.5.3 Unit economics

Explanation of acronyms:

• CAC (Customer Acquisition Cost): Total cost to acquire a paying customer, including marketing, sales, and onboarding
• LTV (Lifetime Value): Total revenue expected from a customer over their relationship with the product

High LTV:CAC ratio (~5:1) indicates a capital-efficient model suitable for scaling [Target]. Margin strength is driven by AI efficiency and minimal hardware dependency — a key advantage over legacy biometric systems.

1.5.4 Monetization roadmap

• 0–3 months: Launch Pro tier as flagship; offer 30-day free trial with face enrollment and scan demo
• 3–6 months: Introduce add-on modules:
  • Payroll Sync Module: +$99/month (integrate with ADP, SAP, local HRIS)
  • Audit Trail Export: +$49/month (PDF/CSV logs with timestamps and liveness metadata)
• 6–12 months: Launch Professional Services:
  • On-premise deployment (for government): one-time fee $5,000+
  • Custom integration support: $150/hour
• 12 months: Explore multi-product bundle with HR analytics platform partners

1.5.5 Risks & mitigations

The model is designed for global reach with local adaptability, ensuring competitiveness in both premium and emerging markets.

1.6Competitive Landscape And Positioning

The global facial recognition attendance market is crowded with regional specialists, legacy HRIS vendors adding biometrics, and low-cost local solutions—especially in high-growth markets like Indonesia. While many offer basic face scanning, few deliver verified liveness detection, real-time sync, or seamless HRIS integration at scale. ChronoFace enters as a cloud-native, AI-powered system built for large, distributed organizations requiring security, accuracy, and automation. It competes not only against digital biometric systems but also against manual processes and generic time-tracking tools still widely used in mid-tier enterprises.

quadrantChart
    title Positioning Map: ChronoFace vs Competitors
    x-axis Low Automation --> High Automation
    y-axis Low Security --> High Security
    quadrant-1 High Security & High Automation
    quadrant-2 High Security & Low Automation
    quadrant-3 Low Security & Low Automation
    quadrant-4 Low Security & High Automation
    Okulr Techminds: [0.6, 0.5]
    VIDA: [0.4, 0.7]
    BioTime: [0.65, 0.55]
    "Manual Spreadsheets": [0.2, 0.3]
    "Generic HRIS": [0.75, 0.4]
    ChronoFace: [0.85, 0.9]

Key insight: ChronoFace dominates the high-security, high-automation quadrant—targeting organizations where fraud prevention and operational efficiency are mission-critical.

For large enterprises and government institutions who require tamper-proof, real-time attendance with audit compliance, ChronoFace is the enterprise facial recognition attendance system that delivers ≥99.5% accuracy with liveness-based anti-spoofing, unlike generic HRIS platforms with weak biometric add-ons.

1.6.1 Differentiation & Moats

• Liveness Detection with Blink & Head Movement
  Defensible via: Proprietary AI models trained on global facial diversity; integrated directly into recognition flow.
  Attack vector: Competitors may license similar tech from AI vendors (e.g., Face++), but integration lag creates a 6–12 month lead.

• Real-Time Sync & Alerts (<5 sec delay)
  Defensible via: Edge-to-cloud architecture optimized for low latency; part of core design, not an add-on.
  Attack vector: Cloud-native HRIS like HONO could replicate with investment, but not without sacrificing other features → validate.

• Seamless HR System Integration (via API)
  Defensible via: Pre-built connectors for major HRIS (e.g., SAP, Oracle, HONO); ecosystem lock-in over time.
  Defensible via: API rate limit (100/min) ensures stability at scale—unlike REST-only competitors.

• Global Compliance by Design
  Defensible via: 24-month data retention aligned with labor laws; encryption in transit/at rest.
  Defensible via: Built for cross-border operations (e.g., Indonesia’s PDP Law, GDPR) → reduces legal risk for multinationals.

1.6.2 Pricing Posture vs Market

• ChronoFace’s tiered pricing ($99–$499/month) undercuts per-user HRIS biometric modules (~$4–8/user = $400–$8,000 for 100–1,000 users) [Benchmark]
• Flat-rate model simplifies procurement vs. per-user pricing—appeals to cost-conscious enterprises
• Custom Enterprise tier enables upsell for large deployments with advanced needs (e.g., offline mode, audit trails)
• Deliberately positions as premium but cost-efficient—not the cheapest, but the best value for secure, scalable attendance

1.7Strategic Roadmap

1.7.1 Roadmap Principles

1. Validate before build – Confirm user demand and core functionality with real-world testing before investing in full MVP development.
2. Revenue enabling before nice-to-have – Prioritize features that unlock paid adoption (e.g., HRIS sync, alerting) over analytics or offline modes.
3. Security and compliance first – Embed anti-spoofing and data retention rules from day one to meet global and regional (e.g., Indonesia PDP Law) expectations.
4. Scale only when sustainable – Proceed to growth phase only after unit economics and retention metrics are proven.

1.7.2 Phased Roadmap

1.7.3 Phase Flow with Decision Gates

flowchart LR
    P1[Validation Phase] --> G1{Demand proven}
    G1 -->|Yes| P2[MVP Build]
    G1 -->|No| Pivot[Sharpen or stop]
    P2 --> G2{Users activate}
    G2 -->|Yes| P3[V1 Launch]
    G2 -->|No| Iterate[Iterate MVP]
    P3 --> G3{Unit economics work}
    G3 -->|Yes| P4[Scale]
    G3 -->|No| Optimize[Reduce churn]

1.7.4 Decision Gates Detail

1.7.5 Trade-offs

1. Payroll integration (delayed to Phase 2) – Not required for initial adoption; HR sync suffices for MVP [Validated]
2. Offline mode – Remote access is important but rare in target enterprises; cloud dependency acceptable for now [Estimate]
3. Multi-language support – Global scope but English-first acceptable for early adopters [Target]
4. Advanced analytics (forecasting, trends) – Valuable but not core to attendance capture; can be added post-V1 [Benchmark]
5. Mobile offline sync – High complexity for edge cases; real-time sync covers 95% of use cases [Estimate]

Key insight: The roadmap de-risks ChronoFace by validating core biometric performance and market demand early, ensuring resources are spent only when user behavior confirms product-market fit.

1.8Financial Overview

1.8.1 Startup Cost Breakdown

1.8.2 Unit Economics (per Company Subscription)

1.8.3 3-Year Revenue Projection (IDR)

Key assumptions driving projections:

• Customer acquisition: 15–25 new companies in Year 1 (mix of Basic and Pro tiers) [Estimate]
• Expansion: 30% YoY growth in paying customers, driven by remote work demand and digital transformation [Benchmark]
• Operating costs: Fixed at IDR 80 juta in Year 1 (team, tools, marketing), scaling gradually
• Global reach: Pricing in USD, converted at IDR 15.000/USD for local reporting [Validated]
• No hardware costs: Pure SaaS model — clients use existing smartphones or webcams [Target]

1.8.4 Break-Even Analysis

Break-even formula:
Fixed Costs ÷ (Price per unit – Variable Cost per unit) = Break-even units

Using base case:

• Fixed costs (Year 1): IDR 80.000.000
• Contribution margin per unit: IDR 4.640.000
• Break-even units: 17.2 → 18 companies/year or ~1.5 per month
• Expected break-even: Month 14 (accounts for slow initial traction and onboarding cycles)

1.8.5 Financing Readiness (KUR Framing)

1.8.6 What This Is NOT

These figures are planning estimates, not audited financials. They are based on conservative assumptions, market benchmarks, and AI-era development efficiencies. Actual costs and revenue will depend on customer adoption, integration timelines, and compliance validation — all of which must be tested post-MVP.

2.1User Personas

Rudi

HR Manager, Manufacturing Plant

GOAL accurate shift attendance for 2,000+ workers

PAIN buddy punching and manual timesheet errors

“Kami kehilangan jutaan rupiah tiap bulan karena absensi palsu.”

Dina

Government Administrator

GOAL secure, auditable attendance for public officers

PAIN lack of real-time oversight and compliance risks

“Kami butuh sistem yang tidak bisa dibohongi, dengan jejak digital yang kuat.”

Arif

IT Director, IT Company

GOAL seamless integration with HRIS and payroll

PAIN fragmented systems and delayed syncs

“Data absensi harus masuk ke payroll tanpa intervensi manual.”

Lina

School Administrator, University

GOAL track faculty attendance across multiple campuses

PAIN inconsistent check-in methods and no liveness detection

“Dosen sering titip absen, dan kami tidak bisa lacak secara real-time.”

2.1.1 Rudi – HR Manager, Manufacturing Plant

Demographics:
Rudi is 42, based in Surabaya, Indonesia. He manages HR operations for a large manufacturing plant with over 2,000 shift workers. He uses mobile and desktop tools daily but relies heavily on offline processes for attendance due to inconsistent connectivity on the factory floor.

Goals/Needs:
Rudi needs a reliable, tamper-proof attendance system that eliminates buddy punching and reduces payroll discrepancies. He wants real-time visibility into shift attendance and automated reporting to reduce end-of-month reconciliation.

Behaviors:
He conducts weekly audits and monthly payroll reviews. He prefers mobile access for on-site checks but uses desktop for reporting. He collaborates with IT to ensure system uptime during shift changes.

Pain Points:
Manual timesheets and fingerprint scanners are prone to proxy attendance ("buddy punching") and mechanical failures. Data sync delays cause payroll errors, costing the company an estimated IDR 50–100 million monthly [Estimate]. He lacks real-time alerts when workers miss shifts.

Quote:
"Kami kehilangan jutaan rupiah tiap bulan karena absensi palsu."

Interaction with the System:
Rudi uses the ChronoFace web dashboard to monitor attendance in real time, receive instant alerts for missed punches, and export daily reports. Workers scan faces at entry points using mobile devices with offline sync capability.

2.1.2 Dina – Government Administrator

Demographics:
Dina is 38, working in a regional government office in Jakarta. She oversees attendance compliance for 500+ civil servants. She is tech-savvy but bound by strict data governance and public accountability rules.

Goals/Needs:
Dina needs a secure, auditable system that ensures only authorized personnel can log attendance. She requires liveness detection and anti-spoofing to prevent fraud and meet regulatory standards.

Behaviors:
She reviews attendance logs monthly for audits and responds to disciplinary cases. She coordinates with central IT to ensure compliance with national data protection laws, including Indonesia’s PDP Law (2022) [Retrieved].

Pain Points:
Current systems lack real-time verification and biometric audit trails. There are frequent disputes over attendance records, and no way to prove presence definitively. She fears reputational and legal risks from data breaches.

Quote:
"Kami butuh sistem yang tidak bisa dibohongi, dengan jejak digital yang kuat."

Interaction with the System:
Dina uses ChronoFace’s admin dashboard to verify liveness logs, review RecognitionEvents, and generate compliance reports. The system’s anti-spoofing via blink and head movement [Canonical Fact] ensures only live users are authenticated.

2.1.3 Arif – IT Director, IT Company

Demographics:
Arif is 35, based in Bandung, leading IT operations for a 750-person tech firm. He manages digital infrastructure, including HRIS, payroll, and identity systems. He values API-first design and automation.

Goals/Needs:
Arif wants seamless integration between attendance and existing HR platforms like Zoho People and Forte HRIS. He needs real-time data sync and automated reporting to eliminate manual data entry.

Behaviors:
He evaluates tools based on API reliability, security, and ease of integration. He runs quarterly system audits and prefers cloud-native, scalable solutions.

Pain Points:
Current attendance tools export CSV files that require manual upload, causing delays and human error. He struggles with inconsistent data formats and lack of API standardization across vendors.

Quote:
"Data absensi harus masuk ke payroll tanpa intervensi manual."

Interaction with the System:
Arif configures ChronoFace’s HR system sync API to push attendance data in real time (≤5 sec delay) [Canonical Fact] to their HRIS. He monitors API health via logs and receives alerts on sync failures.

2.1.4 Lina – School Administrator, University

Demographics:
Lina is 40, managing staff operations at a multi-campus university in Yogyakarta. She oversees 300+ faculty and administrative staff. She uses desktop systems for reporting and mobile for on-the-go checks.

Goals/Needs:
Lina needs a unified attendance system that works across campuses and prevents proxy attendance. She wants daily automated reports and real-time presence tracking for accountability.

Behaviors:
She checks attendance weekly and runs monthly summaries for performance reviews. She collaborates with department heads to address absenteeism.

Pain Points:
Faculty often "titip absen" (proxy check-in) using ID cards or shared passwords. Current systems lack liveness detection, making fraud easy. She spends 3–5 hours weekly reconciling discrepancies.

Quote:
"Dosen sering titip absen, dan kami tidak bisa lacak secara real-time."

Interaction with the System:
Lina uses ChronoFace’s mobile app to conduct random spot checks. Faculty must perform blink and head movement during check-in, preventing spoofing. Daily reports are auto-generated at 00:00 local time [Canonical Fact].

2.1.5 Motivation Matrix

Key insight: Each persona prioritizes trust, automation, and compliance, but faces distinct operational and technical frictions—highlighting the need for a flexible, secure, and integrable solution.

2.1.6 Accessibility & Localization Notes

• Language Support: Full Bahasa Indonesia interface with toggle to English for global enterprises. All error messages, prompts, and reports localized.
• Low-Bandwidth Mode: Mobile app supports offline face scanning with auto-sync when connectivity resumes—critical for remote factories and campuses.
• Accessibility: Voice-guided check-in for visually impaired users; high-contrast UI for outdoor use. Text-to-speech for attendance alerts.
• Cultural Sensitivity: Liveness detection avoids mandatory eye contact (respects cultural norms); supports hijab and other head coverings via inclusive training data.
• Regulatory Alignment: Complies with Indonesia’s PDP Law (2022) [Retrieved] for biometric data storage and consent. Data encrypted at rest and in transit.

Key insight: Localization goes beyond translation—inclusive design and offline resilience are critical for adoption across Indonesia’s diverse and distributed workforce.

2.2User Roles

2.2.1 Roles & Responsibilities

Key insight: Each role reflects a real organizational layer — from frontline staff to operations leadership — ensuring the system supports actual enterprise workflows without overcomplicating access.

2.2.2 RBAC/Permissions

RBAC (Role-Based Access Control) ensures users only access functions necessary for their job. This minimizes risk, supports compliance, and simplifies training.

• Create: Add new users or attendance rules
• Read: View attendance records (own, team, or company-wide)
• Update: Modify user details, schedules, or system settings
• Delete: Remove user accounts or records (with audit trail)
• Approve: Authorize attendance exceptions or overrides
• Export: Download data for reporting or payroll integration
• Admin: Full system configuration, API access, and integration management

Key insight: Admins have full control, but no role can alter biometric templates directly — these are immutable after enrollment to prevent tampering and ensure audit integrity.

2.2.3 Trust & Safety Considerations

PII (Personally Identifiable Information) includes facial templates, employee IDs, and attendance logs. ChronoFace treats all biometric data as highly sensitive.

• Audit Logs: Every system action (login, export, deletion, policy change) is logged with timestamp, user, and IP. Logs are retained for 24 months [Validated – Canonical Fact].
• PII Handling: Face templates are encrypted at rest and in transit. Raw images are deleted post-processing. Access to biometric data is restricted to system processes — no human can view or download facial scans.
• Anti-Spoofing Enforcement: All scans require liveness detection (blink + head movement) to prevent photo or video spoofing [Validated – Canonical Fact].
• Compliance Alignment: Designed to meet evolving regulations like Indonesia’s PDP Law (2022) and GDPR for global operations. Data sovereignty options allow regional storage.
• Moderation: No user-generated content, but managers can flag suspicious attendance patterns for admin review — creating a lightweight human-in-the-loop for integrity.

Key insight: Security isn’t just technical — it’s procedural. By limiting access, logging actions, and automating verification, ChronoFace builds trust across governments, enterprises, and employees.

2.3Features Epic Level Breakdown

2.3.1 Epic List

2.3.2 Epic Details

Face Enrollment & Liveness Check User Stories:

• As an employee, I want to enroll my face once using blink and head movement so my identity is securely verified
• As an admin, I want to monitor enrollment completion rates across teams
• As a system, I must reject photos, videos, or masks during enrollment

Acceptance Criteria:

• Enrollment requires live blink and subtle head motion [Validated: Anti-spoofing method]
• Failed attempts trigger guidance prompts (e.g., “Please look straight”)
• Face template stored encrypted; raw image not retained

Dependencies: None
Non-functional: Security (data encryption), Performance (≤3 sec enrollment), Compliance (PDP Law alignment)

Real-Time Attendance Scanning User Stories:

• As an employee, I want to scan my face quickly to clock in/out from mobile or kiosk
• As a manager, I want to see real-time attendance status of my team
• As a system, I must reject unrecognized or spoofed attempts

Acceptance Criteria:

• Recognition in ≤1.5 seconds [Validated: Domain Rule]
• Match threshold ≥99.5% confidence [Validated: Domain Rule]
• Failed scans logged with reason (low light, no match, spoof detected)

Dependencies: Face Enrollment
Non-functional: Performance (response time), Accuracy, Usability (low-light adaptation)

Instant Alerting System User Stories:

• As a manager, I want to receive an alert if an employee is late or absent
• As an HR officer, I want to be notified of suspicious login attempts
• As a system, I must deliver alerts via push and email within seconds

Acceptance Criteria:

• Alerts triggered within 5 sec of event [Validated: Domain Rule]
• Configurable alert rules (e.g., >15 min late, unapproved absence)
• Delivery success rate ≥99.9%

Dependencies: Real-Time Scanning
Non-functional: Reliability, Latency, Observability (delivery tracking)

Daily Automated Reporting User Stories:

• As a manager, I want a daily summary of team attendance every morning
• As an admin, I want customizable report templates for different departments
• As a system, I must generate reports even if users are offline

Acceptance Criteria:

• Reports generated daily at 00:00 local time [Validated: Domain Rule]
• Includes present/absent, late arrivals, early departures
• Exportable in PDF/CSV; delivered via email or dashboard

Dependencies: Real-Time Scanning, Alerting
Non-functional: Automation, Data consistency, Scheduling

HR System Integration User Stories:

• As an admin, I want attendance data to sync automatically with our HRIS
• As an IT lead, I want secure API access with rate limiting and audit logs
• As a system, I must handle sync failures gracefully

Acceptance Criteria:

• API supports 100 requests/minute [Validated: Domain Rule]
• Bi-directional sync with at least Zoho People, HONO, Forte HRIS
• Sync status visible in admin dashboard

Dependencies: Real-Time Scanning, Reporting
Non-functional: Interoperability, Security (OAuth), Scalability

Shift & Site Management User Stories:

• As a plant manager, I want to assign shifts across multiple factory sites
• As an HR officer, I want to define attendance rules per shift type
• As a system, I must prevent clock-ins outside authorized times/locations

Acceptance Criteria:

• Support geofenced clock-ins and time-based rules
• Shift schedules exportable and editable in bulk
• Conflict detection (e.g., double booking)

Dependencies: HR Integration, Real-Time Scanning
Non-functional: Flexibility, Geolocation accuracy, Rule engine performance

Biometric Audit Trail User Stories:

• As a compliance officer, I want a tamper-proof log of all recognition events
• As an auditor, I want to filter events by date, user, or outcome
• As a system, I must retain data for 24 months [Validated: Domain Rule]

Acceptance Criteria:

• Immutable logs with timestamps, device ID, confidence score
• Exportable for regulatory audits
• Access restricted to admin and compliance roles

Dependencies: All core scanning and enrollment epics
Non-functional: Data retention, Security, Auditability

Offline Mode for Remote Sites User Stories:

• As a field supervisor, I want workers to clock in even without internet
• As an admin, I want all offline data to sync automatically when online
• As a system, I must prevent duplicate or fraudulent entries

Acceptance Criteria:

• Local storage of up to 1,000 scans per device
• Conflict resolution on sync (e.g., timestamp-based)
• Full audit trail preserved post-sync

Dependencies: Real-Time Scanning, Biometric Audit
Non-functional: Resilience, Data integrity, Storage efficiency

2.3.3 Phasing

flowchart TD
    EpicA[Epic 1: Face Enrollment & Liveness Check] --> EpicB[Epic 2: Real-Time Attendance Scanning]
    EpicB --> EpicC[Epic 3: Instant Alerting System]
    EpicB --> EpicD[Epic 4: Daily Automated Reporting]
    EpicC --> EpicE[Epic 5: HR System Integration]
    EpicD --> EpicE
    EpicE --> EpicF[Epic 6: Shift & Site Management]
    EpicE --> EpicG[Epic 7: Biometric Audit Trail]
    EpicF --> EpicH[Epic 8: Offline Mode]

    MVP[MVP Phase] --> EpicA
    MVP --> EpicB
    MVP --> EpicC
    MVP --> EpicD

    MMP[MMP Phase] --> EpicE
    MMP --> EpicF
    MMP --> EpicG

    Next[Next Phase] --> EpicH

• MVP (Months 1–3): Launch with core attendance flow — enrollment, scanning, alerts, reporting. Targets Basic and Pro tiers. Enables immediate value for remote teams and educational institutions.
• MMP (Months 4–6): Add integrations and shift management. Unlocks Enterprise tier and government contracts. Drives upsell via automation and compliance.
• Next (Months 7+): Offline mode and advanced analytics. Expands into manufacturing and remote field operations globally.

2.3.4 Non-Functional Summary by Epic

Key insight: Security and compliance are not add-ons — they are foundational to trust in biometric systems, especially in regulated markets like Indonesia and government sectors.

2.4Reference Research

2.4.1 Benchmark Table

Key insight: While local players like Okulr and InterBIO serve Indonesia’s growing demand, they lack advanced anti-spoofing and global scalability. Global platforms like Face++ offer strong tech but require heavy customization. ChronoFace can fill the gap with a dedicated, secure, out-of-the-box attendance solution that combines high accuracy, liveness checks, and HR integration.

2.4.2 UX Highlights

1. Liveness Onboarding Flow (Inspired by VIDA)
   Step-by-step guidance: “Blink once,” “Turn head left,” with real-time feedback. Reduces enrollment errors.
   Rationale: Ensures high-quality face templates from day one [Validated].

2. Real-Time Attendance Confirmation (Like Okulr)
   Green checkmark + vibration + push: “Attendance recorded at 08:00 AM.”
   Rationale: Instant feedback builds user trust and reduces retries.

3. Manager Dashboard (Similar to Zoho People)
   Daily attendance heatmap, late arrivals flagged in red, exportable CSV.
   Rationale: Enables quick oversight without deep navigation.

4. Offline Mode Indicator (Analogous to BioTime)
   When internet drops, app shows “Offline – 3 pending scans” and syncs automatically when back online.
   Rationale: Critical for remote or factory sites with unstable connectivity.

5. Anti-Spoofing Alert (Unique to ChronoFace)
   If a photo is detected, system logs: “Spoof attempt blocked – static image detected” and notifies admin.
   Rationale: Reinforces security and deters fraud [Target].

6. Multi-Site Shift Calendar (Inspired by HONO HRMS)
   Managers view attendance across Jakarta HQ and Surabaya plant in one timeline.
   Rationale: Supports complex workforce structures in manufacturing and government.

2.4.3 Technical Patterns

1. Real-Time Event Streaming
   Use WebSocket or Firebase to push attendance events to dashboards and HR systems within 5 seconds [Validated].
   Why: Meets real-time sync requirement and enables instant alerts.

2. Liveness Detection via Micro-Movement Analysis
   Require blink + subtle head turn; analyze frame-by-frame optical flow.
   Why: Prevents photo, video, and mask spoofing [Anti-spoofing method: Canonical].

3. Webhook-Based HR Integration
   Allow customers to connect ChronoFace to their HRIS (e.g., Forte HRIS, Zoho) via configurable webhooks.
   Why: Enables seamless data flow without custom coding per client.

4. Edge-Based Recognition (Mobile-First)
   Perform initial face match on-device, then confirm on server.
   Why: Reduces latency and bandwidth use, especially in low-connectivity areas.

5. Automated Daily Reporting with Time-Zone Awareness
   Generate reports at 00:00 local time per site, not UTC.
   Why: Aligns with local payroll and shift cycles [Reporting generation: Canonical].

6. Audit Trail for Recognition Events
   Log every scan attempt (success/fail, timestamp, device, IP, liveness score).
   Why: Supports compliance and forensic review in government and enterprise settings.

2.4.4 Source List

• Okulr Face Recognition System — Product page, credible vendor in Indonesia [Retrieved]
• VIDA – Tracxn Startup Profile — Startup data, market positioning [Retrieved]
• Indonesia to require face biometrics for new mobile numbers — Regulatory trend, national identity linkage [Retrieved]
• Forte HRIS Pricing & Features — HR software integration benchmark in Indonesia [Retrieved]
• HONO HR Software Indonesia — Example of AI-powered, integrated HRMS [Retrieved]
• Face++ Platform Documentation — Technical benchmark for global facial recognition APIs [Retrieved]

2.5User Journeys Flow Diagram

2.5.1 Overview

This section maps the core user journeys for ChronoFace, an enterprise facial recognition attendance system. The primary goals are to enable seamless onboarding of employees, ensure accurate and secure daily attendance logging, and empower managers and admins with real-time alerts and reporting. Success is measured by high adoption rates, minimal friction during check-in, and rapid incident response. These journeys reflect role-based permissions (Employee, Manager, Admin) and align with the MVP scope, including face enrollment, real-time scanning, liveness detection, alerting, and reporting. The flows are designed for global deployment, with attention to security, usability, and compliance with evolving biometric data regulations.

2.5.2 User Journey Flow Diagrams

flowchart TD
    Start([Employee Onboarding]) --> Download[Download App]
    Download --> Register[Register Account]
    Register --> Verify[Verify Identity]
    Verify --> Enroll[Enroll Face Template]
    Enroll --> Liveness{Liveness Check Passed?}
    Liveness -->|Yes| Confirm[Face Template Saved]
    Liveness -->|No| Retry[Retry Capture]
    Retry --> Liveness
    Confirm --> Complete([Onboarding Complete])

Key insight: The enrollment journey prioritizes security and accuracy through mandatory liveness detection, reducing spoofing risk while maintaining a smooth user experience. A failed liveness check loops the user back—no escalation path needed for basic cases.

flowchart TD
    Start([Start of Shift]) --> Open[Open ChronoFace App]
    Open --> Scan[Scan Face]
    Scan --> Detect{Face Detected?}
    Detect -->|Yes| Liveness{Liveness Confirmed?}
    Detect -->|No| Retry[Retry Scan]
    Liveness -->|Yes| Match{Match in Database?}
    Liveness -->|No| Retry
    Match -->|Yes| Record[Attendance Recorded]
    Match -->|No| Alert[Unknown Face - Alert Admin]
    Record --> Notify[Push + Email Confirmation]
    Alert --> Notify
    Notify --> End([Check-in Complete])

Key insight: Real-time attendance relies on fast, secure recognition with clear feedback loops. Unknown faces trigger alerts, ensuring oversight without blocking the user—critical for large organizations with rotating staff.

flowchart TD
    Start([Manager Login]) --> Dashboard[View Admin Dashboard]
    Dashboard --> View[View Attendance Summary]
    Dashboard --> Filter[Filter by Team/Shift]
    Filter --> Export[Export Daily Report]
    Export --> Receive[Email Report at 00:00]
    Receive --> Review[Review Trends]
    Review --> Act{Take Action?}
    Act -->|Yes| Adjust[Update Scheduling/Notify]
    Act -->|No| End([Monitoring Complete])
    Adjust --> End

Key insight: Managers rely on automated, timely reporting to make operational decisions. The journey emphasizes passive data consumption with optional intervention, aligning with real-world HR workflows.

2.5.3 Edge Cases & Error Handling

• Poor lighting or camera quality: System prompts user to “Move to better light” or “Clean camera lens” with visual guidance; fallback to manual time entry if repeated failures occur.
• Network outage during scan: App queues the scan locally and syncs when connectivity resumes within 5 minutes; beyond that, logs a warning and notifies admin.
• Face not recognized despite valid enrollment: Triggers a “Recognition Failed” screen with option to re-scan or report issue; logs a RecognitionEvent for audit and model retraining [Estimate].
• Multiple faces detected: System rejects scan and prompts “Only one face at a time”; prevents proxy attendance attempts.
• Liveness detection failure (e.g., user can’t blink): Offers alternative verification method (e.g., PIN + photo) for accessibility, logged as a special event [Pending – accessibility compliance review].
• Admin dashboard timeout or API rate limit: Displays cached data with “Last updated X mins ago” and retries sync; ensures usability during peak loads [Validated: API rate limit = 100/min].

2.5.4 Analytics Events

KPI (Key Performance Indicator) refers to measurable values that demonstrate how effectively the product is achieving key business objectives. These events enable funnel analysis, error tracking, and performance benchmarking across global deployments.

2.6Sitemaps

2.6.1 Sitemap diagram

Marketing Site
├── Home Page
│   ├── How It Works
│   ├── Security & Compliance
│   ├── Use Cases
│   │   ├── Enterprises
│   │   ├── Government
│   │   ├── Education
│   │   └── Manufacturing
│   ├── Pricing
│   │   ├── Basic Tier
│   │   ├── Pro Tier
│   │   └── Enterprise Inquiry
│   ├── Resources
│   │   ├── Case Studies
│   │   ├── Blog
│   │   └── API Documentation
│   └── Contact Sales
└── Login Page
    └── ChronoFace App Shell
        ├── Dashboard
        │   ├── Today's Attendance Snapshot
        │   ├── Alert Feed
        │   └── Quick Actions
        ├── Attendance
        │   ├── Scan Face (Live Capture)
        │   ├── My Attendance Log
        │   └── Shift Schedule
        ├── Employees
        │   ├── Employee Directory
        │   ├── Enroll New Employee
        │   │   ├── Capture Face Template
        │   │   └── Liveness Check
        │   └── Manage Profiles
        ├── Recognition Events
        │   ├── Real-Time Feed
        │   └── Audit Trail
        ├── Alerts
        │   ├── Instant Notifications
        │   └── Alert Settings
        ├── Reports
        │   ├── Daily Attendance Report
        │   ├── Monthly Summary
        │   └── Export Data (CSV/PDF)
        ├── Integrations
        │   ├── HRIS Sync Status
        │   └── Connect System (API Setup)
        └── Settings
            ├── Company Info
            ├── Subscription Plan
            ├── User Roles & Permissions
            └── Data Retention Policy

2.6.2 Screen inventory

2.6.3 Navigation patterns

Marketing Site (public-facing):
Hosted at chronoface.com, this site targets decision-makers across global enterprises, government, education, and manufacturing. It emphasizes security, compliance (especially with Indonesia’s PDP Law and biometric mandates), and integration capabilities. Navigation is linear and conversion-focused, guiding users from awareness (use cases) to action (pricing, contact sales). All content is accessible without login.

App Shell (authenticated):
Accessed post-login via web or mobile, the app shell separates duties by role. Employees see only Attendance and My Log. Managers gain access to Dashboard, Alerts, and Reports. Admins unlock full control including Employees, Integrations, and Settings. The structure supports MVP requirements: real-time scanning, instant alerts, reporting, and HRIS sync. Navigation is role-gated and task-oriented, minimizing cognitive load.

Key insight: The sitemap enforces security and role clarity while ensuring all MVP features are directly accessible within three clicks from the dashboard — critical for global usability and adoption.

2.7Wireframes Consult

2.7.1 Wireframe Scope

• Priority Flows & Devices
  Focus on three core user flows across mobile (iOS/Android) and desktop web platforms:

  1. Employee Attendance Flow (Mobile-first): Face enrollment, daily check-in/out via facial scan
  2. Manager Oversight Flow (Desktop): View team attendance, respond to alerts, export reports
  3. Admin Setup Flow (Desktop): Company onboarding, employee bulk upload, system integration setup

• Fidelity Notes
  All wireframes to be low-fidelity grayscale mockups. Focus on layout, hierarchy, and interaction logic — not color, branding, or visual design. Annotations required for non-obvious behaviors (e.g., liveness detection feedback).

• Screens by Flow

  Flow	Screen	Device	Notes
  Attendance	Face Enrollment Intro	Mobile	Explains liveness check steps
  Attendance	Live Camera View	Mobile	Real-time preview with face detection overlay
  Attendance	Scan Success Feedback	Mobile	Confirms attendance logged
  Attendance	Scan Failure (Retry)	Mobile	Guides user on alignment or lighting
  Manager	Dashboard Overview	Desktop	Shows team status, late arrivals, absences
  Manager	Attendance Detail View	Desktop	Drill-down per employee
  Manager	Report Export Panel	Desktop	Filter and download options
  Admin	Onboarding Wizard	Desktop	Step-by-step setup (company info, HRIS sync)
  Admin	Employee Management	Desktop	Table view with actions (edit, deactivate)
  Admin	Integration Settings	Desktop	Connect to HR/payroll systems (e.g., SAP, BambooHR)

2.7.2 Layout Guidance

• Mobile Screens (Attendance Flow)

  • Top: Minimal header with company logo and time
  • Center: Full-screen camera preview with dynamic face framing guide
  • Bottom: Status text (e.g., “Blink to verify”) and countdown during liveness check
  • Post-scan: Full-bleed success/failure message with icon and action button (e.g., “Done” or “Try Again”)

• Desktop Screens (Manager & Admin)

  • Left sidebar: Main navigation (Dashboard, Employees, Reports, Settings)
  • Top bar: User profile, notifications, search
  • Content area:
    • Dashboard: Summary cards (Today’s Attendance, Late Entries), table of recent scans
    • Reports: Date picker, filter dropdowns, preview table, export button
    • Settings: Form fields grouped by category (e.g., “Biometric Settings”, “HR Integrations”)

• Content Hierarchy
  Primary actions (e.g., “Start Scan”, “Export Report”) use dominant buttons. Status feedback (e.g., “Attendance Recorded”) uses system toast messages at top center.

2.7.3 Interaction Notes

• States

  • Loading: Skeleton screens on dashboard and report views [Estimate]
  • Empty: “No attendance today” illustration with prompt for managers
  • Error:
    • Network: “Cannot connect — retry” button
    • Face not recognized: “Face not matched. Try again or contact admin”
    • Liveness failed: “Movement not detected. Ensure camera sees your full face”

• Camera-Specific Behaviors

  • Auto-capture triggered when face is centered and liveness (blink + head turn) is confirmed
  • Continuous feedback: “Move closer”, “Too dark”, “Hold still” — displayed in real time

• Alert Handling
  Managers see badge on notification icon when new late/absent alert arrives. Click opens inline detail panel.

2.7.4 Handoff Plan

• Figma File Structure

  • Pages:
    • 01_Mobile_Attendance
    • 02_Desktop_Manager
    • 03_Desktop_Admin
    • 04_Components
  • Components Library:
    • Button (Primary, Secondary, Disabled)
    • Input Field (Text, Dropdown, Toggle)
    • Table (Sortable headers, row actions)
    • Toast Message (Success, Error, Info)
    • Camera Overlay (Frame guide, instruction text)
  • Variants:
    • Button: :hover, :active, :disabled
    • Toast: auto-dismiss after 5s

• Handoff Readiness
  All screens linked in clickable prototype flow. Developer notes embedded per frame for edge cases (e.g., “After 3 failed scans, show help option”). Design specs (spacing, typography) to follow in high-fidelity phase.

2.8Design System

2.8.1 Brand & Accessibility Foundation

ChronoFace’s brand identity is secure, precise, and modern—designed to instill confidence in high-stakes attendance verification. The design system reflects Swiss-inspired minimalism: clean layouts, uncluttered interfaces, and purposeful use of space to highlight critical actions like facial scanning and alert confirmation.

Accessibility is non-negotiable. The system targets WCAG 2.1 AA compliance (Web Content Accessibility Guidelines), ensuring usability for people with visual, motor, or cognitive impairments. This includes sufficient color contrast, screen reader compatibility, keyboard navigation support, and resizable text without layout breakage. Given global operation, the system must support left-to-right (LTR) and right-to-left (RTL) languages and accommodate low-bandwidth environments.

Primary device focus is mobile-first, reflecting widespread smartphone use in remote and industrial settings. Secondary support includes desktop web apps for HR administrators. All components are optimized for touch interaction, gloved use in manufacturing, and legibility under variable lighting—critical for facial recognition accuracy [Validated].

2.8.2 Typography

Key insight: A consistent, legible type system reduces cognitive load during time-sensitive attendance scans and supports global readability.

2.8.3 Color

All text-background combinations meet minimum 4.5:1 contrast ratio (WCAG AA). Red/green differentiation is supplemented with icons for colorblind accessibility.

Key insight: Semantic color coding enables instant recognition of attendance status and system feedback—critical in noisy or high-turnover environments.

2.8.4 Spacing & Layout

• Spacing Scale: 4px and 8px base units (e.g., 8px, 16px, 24px, 32px)
• Layout Grid: 12-column responsive grid on desktop; single-column on mobile
• Breakpoints:
  • Mobile: 320–767px
  • Tablet: 768–1023px
  • Desktop: 1024px+
• Padding & Margins: Multiples of 8px for containers, 4px for micro-spacing (e.g., icon-text gaps)

Consistent rhythm ensures predictable, scannable interfaces across enrollment, scanning, and admin dashboards.

2.8.5 Components

All components support dark mode via system preference detection.

2.8.6 Motion

Animations follow the principle: subtle, purposeful, performant. Use micro-interactions to confirm actions (e.g., button press ripple, scan success pulse). Transitions between screens use 200–300ms fade-slide effects. Avoid motion during facial capture to prevent distraction. All animations respect prefers-reduced-motion OS setting.

2.8.7 Tone & Voice

Copy is clear, professional, and action-oriented:

• Use active voice: “Scan complete” not “Your scan has been completed”
• Keep messages concise: “Face not recognized. Try again.”
• Avoid jargon: Use “Check-in” instead of “Biometric verification event”
• Error messages include guidance: “Poor lighting. Move closer to window.”

This tone reinforces reliability and reduces user anxiety during time-sensitive attendance.

2.8.8 Screen Mockups

Illustrative examples — these AI-generated mockups show the look & feel only; copy and data are placeholders.

2.9Screen Mockups

Illustrative examples — these AI-generated mockups show the look & feel only; copy and data are placeholders.

3.1Technology Stack High Level

3.1.1 Architectural Style & Summary

ChronoFace is built as a cloud-native, microservices-based SaaS platform with a strong emphasis on real-time performance, security, and global scalability. The architecture follows a frontend-backend-data-external services separation, optimized for fast development, AI integration, and compliance with global data protection standards. Given the real-time facial recognition requirement (≤1.5 seconds response time) and anti-spoofing needs, we leverage edge-optimized AI inference and a distributed backend hosted on AWS, the most widely adopted cloud platform for enterprise SaaS. The system is designed to support both online and offline modes (planned in Phase 2), ensuring usability in remote manufacturing or government sites with unstable connectivity.

The frontend is a TypeScript-first stack using React and Next.js for the web app, and React Native for mobile, enabling code reuse and fast iteration. The backend uses Node.js with NestJS for structured, maintainable services, while facial recognition logic is isolated in a dedicated AI inference service using ONNX Runtime for cross-platform compatibility. Data is stored in PostgreSQL for relational integrity (e.g., attendance records, user roles) and Redis for real-time caching of face templates and session states. All communication is secured via OAuth2 and JWT, with audit logs stored for compliance. The system integrates with HR platforms via a RESTful API layer, with future support for webhooks and event-driven messaging (e.g., payroll sync).

3.1.2 Stack Table

Alternatives:

• On-prem option: Use Docker + Kubernetes with MinIO and OpenFaaS for clients with data sovereignty needs (e.g., government)
• Heavy analytics: Replace Lambda with Apache Spark on AWS EMR for Phase 2 forecasting features
• Mobile-first: Consider Flutter for faster cross-platform builds if React Native talent is scarce

3.1.3 Key Decisions & Tradeoffs

• AI model ownership vs. third-party API: We use a custom-trained model instead of AWS Rekognition or Azure Face to ensure ≥99.5% accuracy and full control over liveness logic. This increases initial R&D cost but reduces long-term licensing fees and avoids vendor lock-in [Tradeoff: Higher upfront effort, lower TCO].
• Serverless for cost efficiency: AWS Lambda handles non-real-time tasks (daily reports, email alerts), reducing idle server costs. However, cold starts could delay background jobs — mitigated by provisioned concurrency [Estimate].
• PostgreSQL over NoSQL: Chosen for strong consistency in attendance records and HR integrations. While NoSQL (e.g., MongoDB) scales horizontally better, it risks data integrity in payroll-critical systems [Decision: Prioritize accuracy over raw scale].
• ONNX for model portability: Enables future offline mode by running the same model on edge devices (e.g., factory kiosks). Tradeoff: Slight performance overhead vs. native TensorFlow Lite, but better long-term flexibility.
• React Native for mobile: Faster time-to-market than native iOS/Android, but camera performance must be rigorously tested. We’ll use native modules for biometric capture to ensure reliability.
• AWS over GCP/Azure: AWS has the broadest compliance coverage and strongest presence in target markets (Asia, Middle East, LATAM). GCP has better AI tools, but AWS wins on global enterprise adoption [Benchmark].
• Caching face templates in Redis: Reduces recognition time from ~2s to ≤1.5s. Risk: Cache invalidation must be tightly managed during employee updates. Mitigated by event-driven cache refresh.
• No blockchain for audit trail: Despite demand for tamper-proof logs, blockchain adds complexity and cost with minimal benefit over signed database logs + backups. We use write-once audit tables with cryptographic hashes instead.

3.1.4 System Architecture Diagram

flowchart TB
    subgraph Frontend["Frontend Layer"]
        A[Next.js Web App]
        B[React Native Mobile App]
        C[Camera & Biometric Input]
    end

    subgraph Backend["Backend Services"]
        D[API Gateway]
        E[Auth Service (Cognito)]
        F[Attendance Service]
        G[AI Inference Service]
        H[Reporting Service]
        I[Alert Engine]
    end

    subgraph Database["Data Layer"]
        J[(PostgreSQL)]
        K[(Redis Cache)]
    end

    subgraph External["External Services"]
        L[HRIS Systems (via API)]
        M[Email (SES)]
        N[Payroll (Future)]
        O[AWS S3 (Face Templates)]
    end

    A --> D
    B --> D
    C --> B
    D --> E
    D --> F
    F --> G
    G --> K
    G --> O
    F --> J
    H --> J
    I --> M
    F --> I
    H --> M
    F --> L
    J --> F
    K --> G

Key insight: The architecture isolates AI inference from core business logic, enabling independent scaling and updates — critical for maintaining real-time performance as user count grows.

3.2Deployment And Ci Cd

3.2.1 Environments & Branching Strategy

To ensure stability, security, and agility, ChronoFace uses a streamlined environment and branching model aligned with global deployment needs and compliance requirements.

Key insight: Three-tiered environments allow safe iteration while protecting live operations — changes must pass automated and human checks before reaching users.

3.2.2 Pipelines: Build, Test, Scan, Deploy

CI/CD (Continuous Integration / Continuous Deployment) means automatically testing and moving code changes through stages. Every code update triggers this pipeline:

1. Build – Compile mobile and web apps from source
2. Test – Run unit, integration, and UI tests [Validated]
3. Security Scan – Check for vulnerabilities in code and dependencies (SAST/DAST) [Validated: OWASP Top 10]
4. Compliance Check – Validate data handling aligns with PDP Law (Indonesia) and GDPR [Pending: legal review]
5. Deploy to Dev – Auto-deploy on dev merge
6. Deploy to Staging – Manual trigger after dev validation
7. Approval Gate – Required for production: Security + Product sign-off
8. Deploy to Production – Manual trigger post-approval

Key insight: Automated testing catches 90% of issues early; manual gates ensure only vetted, secure updates reach customers.

3.2.3 Secrets & Configuration Management

Secrets (like API keys and database passwords) are never stored in code. Instead:

• Tool: HashiCorp Vault (cloud-hosted)
• Per Environment: Separate secret sets for dev, staging, production
• Access Control: Role-based (developers can’t access prod secrets)
• Rotation: Automated every 90 days [Target]

Configurations (e.g., feature flags, API endpoints) are managed via environment variables synced from Vault.

Key insight: Centralized secret management prevents data leaks and supports compliance with biometric data laws.

3.2.4 Observability: Logging, Metrics, Tracing, Alerting

To monitor health and respond quickly:

Alerts trigger for: failed logins (>5/min), recognition delay (>2 sec), or system outage.

Key insight: Real-time observability ensures we detect and fix issues before users are impacted.

3.2.5 Rollback & Release Strategy

• Rollback: Fully automated — if a deployment fails, revert to last stable version in <2 minutes [Target]
• Release Method:
  • Staging: Full deploy after UAT
  • Production: Manual gate with rollback ready
• Feature Flags: Used for high-risk features (e.g., new anti-spoofing model) — enable gradually
• Canary Releases: Not used initially; planned for Phase 2 with regional rollouts

Key insight: Manual production approval and instant rollback balance innovation with risk control — critical for biometric systems.

3.3Business Rules Per Page Module

3.3.1 Face Enrollment (Mobile & Web)

Purpose & scope Enables employees to register their facial biometric template securely using liveness detection. This is the foundational step for all future attendance scans. Only enrolled faces can be recognized.

Preconditions & invariants

• Employee must be provisioned in the system by an Admin or Manager [Validated]
• Device must have a front-facing camera and internet connectivity [Estimate]
• Liveness check (blink + head movement) must be passed to complete enrollment [Validated: Anti-spoofing method]
• No duplicate face templates allowed per employee [Validated]

Input validations

• Camera feed: Must be ≥720p resolution for accuracy [Estimate]
• Lighting: System warns if lighting is insufficient (detected via image histogram analysis)
• Pose: Face must be centered, upright, and within 15° of frontal view
• Motion: Head movement and blink must be detected in sequence during capture

Core rules & state transitions

• State: Not Enrolled → Enrollment Initiated → Liveness Passed → Face Template Stored
• Only the employee can initiate self-enrollment; Admins can trigger re-enrollment if fraud is suspected
• After 3 failed attempts, the employee is locked out for 15 minutes and an alert is sent to Admin [Estimate]

Side effects & integrations

• On success: FaceTemplate record created; event logged in RecognitionEvent
• Webhook: face_enrolled sent to HRIS (e.g., Zoho People, Forte HRIS) if integrated [Benchmark]
• Idempotency: Re-attempts with same session ID do not create duplicate templates

Error handling & empty/loading states

• Offline: Show “Cannot enroll offline” — no local storage of partial templates
• Camera error: Prompt to check permissions or switch device
• Empty state: “You haven’t enrolled your face yet. Tap to begin.”

Audit & security notes

• All enrollment attempts are logged with timestamp, device ID, and geolocation [Validated: Data retention period]
• Face templates encrypted at rest and in transit using AES-256 [Target]
• No raw images stored — only mathematical embeddings [Validated: PDP Law alignment]

Key insight: Secure enrollment is the first line of defense — liveness enforcement and encryption ensure trust in all downstream attendance events.

3.3.2 Attendance Scan (Mobile App)

Purpose & scope Allows employees to clock in/out via facial scan. The system verifies identity in real time and records attendance instantly. Designed for daily use across shifts and locations.

Preconditions & invariants

• Employee must be enrolled [Validated]
• Current time must fall within allowed scan window (±15 mins of shift start/end, configurable by Admin) [Estimate]
• Recognition must occur within ≤1.5 seconds [Validated: Recognition response time]
• AttendanceRecord cannot be created without liveness confirmation [Validated]

Input validations

• Face must match enrolled template with ≥99.5% confidence [Validated: Facial recognition accuracy]
• Liveness: Real-time blink and micro-movement analysis required per scan
• Location: Optional geofencing (if enabled by Admin) — must be within 100m of site
• Frequency: Max one scan per minute per employee to prevent spam

Core rules & state transitions

• State: Pending Scan → Face Detected → Liveness Confirmed → Match Verified → AttendanceRecord Created
• Employee can only scan once per shift start and once per shift end
• If scan fails 3 times, lock for 10 minutes and notify Manager

Side effects & integrations

• On success: AttendanceRecord created with timestamp, location, and confidence score
• Event: attendance_recorded webhook sent to HR/payroll systems [Benchmark]
• Alert: Push + email sent instantly to Manager and Admin [Validated]
• Idempotency: Duplicate scan attempts (same second, same location) are rejected

Error handling & empty/loading states

• “Low light” warning with guidance to move closer to light source
• “Face not recognized” — prompt to reposition or contact Admin
• Loading: “Scanning… (≤1.5 sec)” with progress indicator
• Offline: Not supported — show “Connect to internet to scan”

Audit & security notes

• Every RecognitionEvent is immutable and timestamped [Validated]
• Anti-spoofing logs (e.g., photo/video detection attempts) are stored for audit [Target]
• No caching of face data on device — all processing server-side [Validated]

Key insight: Real-time liveness per scan closes the loop on spoofing risks — making attendance tamper-resistant by design.

3.3.3 Admin Dashboard (Web)

Purpose & scope Central control panel for Admins to manage employees, view attendance, configure settings, and monitor system health. Serves as the operational nerve center.

Preconditions & invariants

• User must have Admin role [Validated]
• Access requires MFA (email + OTP) [Target]
• Dashboard loads only after company data sync completes [Estimate]
• Attendance data displayed in real time (≤5 sec delay) [Validated]

Input validations

• Employee import: CSV must include name, email, role, and shift (if applicable)
• Shift configuration: Start/end times must not overlap; max 3 shifts per day
• Site setup: Geofence radius must be 50–500m
• API key generation: Requires confirmation and audit log entry

Core rules & state transitions

• Admin can:
  • Add/remove employees
  • Assign Managers to teams
  • Enable/disable geofencing
  • Export reports (daily, weekly, custom)
  • Reset face enrollment
• Changes take effect immediately; no approval workflow

Side effects & integrations

• On employee add: employee_created event → syncs to HRIS via API
• On reset: enrollment_reset → triggers re-enrollment flow on next app open
• Report export: report_generated → logs in Report entity; available for 24 months [Validated]
• Idempotency: Bulk imports reject duplicate employee emails

Error handling & empty/loading states

• Empty state: “No employees yet. Import your team or invite via email.”
• Loading: Skeleton UI with estimated load time (<3 sec)
• Sync error: “Data sync failed. Retrying…” with manual refresh option

Audit & security notes

• All Admin actions logged in AuditTrail with IP, timestamp, and action type [Target]
• Role-based access: Only Admins can delete employees or reset data
• Session timeout: 15 minutes of inactivity [Estimate]

Key insight: Centralized control with full auditability ensures compliance and operational control at scale.

3.3.4 Attendance Alerts (Push & Email)

Purpose & scope Delivers instant notifications when attendance events occur or anomalies are detected. Ensures real-time visibility for Managers and Admins.

Preconditions & invariants

• Recipient must have Manager or Admin role [Validated]
• Alert must be triggered within 5 seconds of attendance event [Validated: Attendance data sync frequency]
• Each alert type has a defined delivery channel (push, email, or both) [Estimate]

Input validations

• Push: Device must be registered and opted-in
• Email: Must be valid corporate domain (e.g., @company.com) [Estimate]
• Content: Must include employee name, time, location (if available), and action (in/out)

Core rules & state transitions

• Triggers:
  • Clock-in/out success
  • Late arrival (>5 mins past shift start)
  • Missed shift
  • Suspicious activity (e.g., spoofing detected)
• State: Event Detected → Alert Queued → Delivered → Read (if opened)

Side effects & integrations

• Retry: Failed pushes retried 2x at 30-sec intervals [Estimate]
• Webhook: alert_sent sent to monitoring tools (e.g., Datadog)
• Idempotency: Duplicate events (same employee, same action, same second) do not trigger new alerts

Error handling & empty/loading states

• “Delivery failed” — logged and visible in Admin dashboard
• Silent fallback: If push fails and email is enabled, send email
• No alerts during system maintenance (scheduled)

Audit & security notes

• All alerts logged with recipient, channel, and timestamp [Validated]
• No PII in push notifications — only “John clocked in” [Target: PDP Law]
• Opt-out not allowed for Admins; optional for Managers [Estimate]

Key insight: Instant, reliable alerts turn passive data into active management — closing the loop between attendance and action.

3.3.5 Daily Attendance Report (Web)

Purpose & scope Automated report summarizing all attendance activity for the previous day. Used by HR and payroll teams for compliance and processing.

Preconditions & invariants

• Generated daily at 00:00 local time per site [Validated: Reporting generation]
• Only Admins and designated Managers can access
• Report includes all employees with activity or exceptions (e.g., absent, late) [Estimate]

Input validations

• Timezone: Based on company or site setting (not employee device)
• Data cutoff: All events up to 23:59:59 of previous day included
• Format: PDF and CSV; CSV includes raw timestamps and confidence scores

Core rules & state transitions

• State: Pending Generation → Processing → Ready → Delivered (if email enabled)
• Report generation is idempotent — same input always produces same output
• Manual generation allowed for custom date ranges (up to 90 days)

Side effects & integrations

• On completion: report_generated event → triggers email to Admins and HRIS sync
• Webhook: daily_report_ready sent to payroll systems (e.g., for wage calculation)
• Storage: Reports retained for 24 months [Validated]

Error handling & empty/loading states

• “Report delayed” if system overload — retry every 15 mins up to 3x
• Empty report: “No attendance activity yesterday” — still delivered
• Loading: Progress bar with ETA (<2 mins)

Audit & security notes

• Access logs: Who viewed or downloaded the report [Target]
• Encryption: Reports encrypted at rest and in transit
• No auto-delete — retention strictly 24 months [Validated]

Key insight: Automated, tamper-proof reporting reduces HR workload and strengthens compliance posture.

3.3.6 HR System Integration (API)

Purpose & scope Enables two-way sync between ChronoFace and external HRIS (e.g., Zoho People, Forte HRIS, HONO). Keeps employee data and attendance records aligned.

Preconditions & invariants

• Integration must be enabled by Admin
• API key must be generated and shared securely [Target]
• Sync direction:
  • HRIS → ChronoFace: Employee create/update/delete
  • ChronoFace → HRIS: AttendanceRecord, Alerts, Reports
• Rate limit: 100 requests/minute per client [Validated]

Input validations

• Incoming HRIS data: Must include employee ID, name, email, status (active/inactive)
• Outgoing: AttendanceRecord must include timestamp, action, and confidence score
• Webhook URLs: Must use HTTPS and respond within 5 seconds

Core rules & state transitions

• On employee create in HRIS: Auto-provision in ChronoFace; send enrollment invite
• On deactivation: Block future scans; retain historical data
• On attendance sync: HRIS updates time log; ChronoFace confirms receipt

Side effects & integrations

• Retry: Failed syncs retried 3x with exponential backoff (1min, 5min, 15min)
• Idempotency: Each event has unique ID — duplicates ignored
• Webhook: sync_failed sent to Admin and monitoring system

Error handling & empty/loading states

• “Integration disconnected” — shown in dashboard if >3 failed retries
• Partial sync: Log failed records; continue with valid ones
• No data: Send empty payload with status 200

Audit & security notes

• All API calls logged with IP, API key, and payload hash [Target]
• OAuth 2.0 or API key authentication required
• Data encrypted in transit (TLS 1.3+) and at rest [Validated]

Key insight: Reliable, idempotent integration ensures ChronoFace fits into existing HR workflows — not the other way around.

3.3.7 Sources

https://www.okulr.com/Face-recognition-time-attendance-management-system-Indonesia https://scholar.its.ac.id/en/publications/enhancing-face-recognition-attendance-system-utilizing-real-time- https://journal.pandawan.id/italic/article/download/924/619 https://www.facebook.com/groups/asiantrainguide/posts/924003803496552 https://tracxn.com/d/explore/image-recognition-startups-in-indonesia/__XEhuuVQxx5jYB3nEhWsY6He61qBlNNUWuyP3m6KhllU/companies https://www.researchandmarkets.com/reports/5986449/indonesia-digital-media-market-share-analysis https://www.gmiresearch.com/report/indonesia-cloud-computing-market-share-size-growth-industry https://www.mfat.govt.nz/en/trade/mfat-market-reports/indonesias-digital-economy https://www.softwaresuggest.com/hr-software/indonesia https://www.fortehris.com/en/Pricing https://www.hono.ai/hr-software/indonesia https://www.lmiconsultancy.com/indonesia-reinstates-biometric-requirement-for-visa-extensions-effective-21-may-2025 https://www.biometricupdate.com/202606/indonesia-to-require-face-biometrics-for-new-mobile-numbers https://iccms.ifrel.org/index.php/ICCMS/article/view/157 https://www.preprints.org/manuscript/202309.0547

3.4Integration Catalog

3.4.1 Integration Table

Key insight: The integration stack balances global scalability with compliance — using providers with built-in support for data protection laws (e.g., PDP Law in Indonesia, GDPR in EU) ensures ChronoFace can operate securely across regions without custom legal engineering.

3.4.2 Integration Flow Diagram

sequenceDiagram
    participant User as Employee (App)
    participant ChronoFace as ChronoFace System
    participant Auth as Auth0
    participant Storage as Google Cloud Storage
    participant Alert as Twilio/SendGrid
    participant HRIS as Workday/SAP
    participant Analytics as Mixpanel

    User->>ChronoFace: Initiate Face Scan
    ChronoFace->>Auth: Verify Session Token
    Auth-->>ChronoFace: Valid Token
    ChronoFace->>Storage: Retrieve FaceTemplate
    Storage-->>ChronoFace: Encrypted Template
    ChronoFace->>ChronoFace: Run Liveness + Recognition (≤1.5s)
    ChronoFace->>Storage: Log RecognitionEvent
    ChronoFace->>Alert: Send Attendance Alert
    Alert-->>User: Push/Email/SMS
    ChronoFace->>HRIS: Sync Attendance (daily or real-time)
    HRIS-->>ChronoFace: Sync Acknowledged
    ChronoFace->>Analytics: Track Scan Event (anonymized)

Key insight: Real-time attendance flow is secured and traceable — every step from scan to alert is logged, verified, and protected, ensuring both user trust and audit readiness for government and enterprise clients.

3.4.3 Data Flow Notes

All integrations use event-driven architecture with secure, asynchronous communication:

• Webhooks are used for payment updates (Stripe), HRIS syncs, and alert delivery confirmations. Each webhook includes a HMAC signature to prevent spoofing.
• Idempotency keys are required for all write operations (e.g., recording attendance, processing payments) to prevent duplicates during retries.
• Retry logic is built into the system: failed syncs (e.g., HRIS offline) are retried with exponential backoff (up to 3 times over 24 hours).
• Data in transit is encrypted using TLS 1.3; data at rest (especially biometrics) is AES-256 encrypted with customer-controlled keys where possible.
• Event logging captures all API calls and integration responses for audit trails, supporting compliance with biometric data laws in Indonesia and other markets.

3.4.4 Rate Limiting & Cost Controls

• API rate limits are enforced at the client level (100 requests/minute per company) to prevent abuse and ensure fair usage [Validated].
• Cost controls include:
  • Monthly caps on SMS/email alerts (configurable per tier)
  • Automated alerts when cloud storage or analytics usage exceeds 80% of expected threshold
  • Usage-based billing passed through from providers (e.g., Twilio, GCS) with transparent reporting in the Admin dashboard
• Caching is used for frequently accessed data (e.g., employee lists, face templates) to reduce API calls and latency.

3.4.5 Vendor Risk & Fallback Strategies

• Stripe: Fallback to PayPal for payment processing in regions where Stripe is unavailable; both support USD and global cards.
• Auth0: Can switch to AWS Cognito or Azure AD with minimal rework due to standardized OAuth flows.
• Twilio/SendGrid: Dual-configured; if one service fails, alerts route through the other.
• Google Cloud Storage: Data is replicated across regions; in case of outage, system switches to secondary regional bucket.
• HRIS Integrations: If Workday/SAP API is down, data is queued and synced upon recovery using idempotent transactions.

Key insight: Redundancy and standardization reduce vendor lock-in and ensure uptime — even during third-party outages, ChronoFace maintains core functionality and data integrity.

3.5Database Schema Core Entities

3.5.1 Entity List

Note: MVP = Minimum Viable Product — the initial launch version with core features. MMP = Minimum Marketable Product — the first fully valuable, sellable version including integrations and reporting.

3.5.2 Attributes per Entity

3.5.3 Relationships

• Company ||--o{ Employee : "employs"
  One company has many employees (1-to-many)

• Employee ||--|| FaceTemplate : "enrolls"
  Each employee has exactly one facial template (1-to-1)

• Employee ||--o{ AttendanceRecord : "generates"
  An employee can have multiple attendance records (1-to-many)

• Employee ||--o{ RecognitionEvent : "triggers"
  Each scan attempt is logged per employee (1-to-many)

• RecognitionEvent ||--|| AttendanceRecord : "creates"
  A successful recognition event generates one attendance record (1-to-1)

• Company ||--o{ Report : "receives"
  One company receives many daily reports (1-to-many)

• Employee ||--o{ Alert : "receives"
  Alerts are sent to individual employees (1-to-many)

• Company ||--|| Subscription : "holds"
  Each company has one active subscription (1-to-1)

• Employee ||--|| Admin / Manager : "assigned as"
  Roles are assigned to specific employees (1-to-1)

erDiagram
    Company ||--o{ Employee : employs
    Company ||--|| Subscription : holds
    Company ||--o{ Report : receives
    Employee ||--|| FaceTemplate : enrolls
    Employee ||--o{ AttendanceRecord : generates
    Employee ||--o{ RecognitionEvent : triggers
    Employee ||--o{ Alert : receives
    Employee ||--|| Admin : assigned_as
    Employee ||--|| Manager : assigned_as
    RecognitionEvent ||--|| AttendanceRecord : creates

    Company {
        string id PK
        string name
        string industry
        string timezone
        datetime createdAt
    }
    Employee {
        string id PK
        string companyId FK
        string fullName
        string email
        string jobTitle
        enum role
        datetime createdAt
        datetime updatedAt
    }
    FaceTemplate {
        string id PK
        string employeeId FK
        binary encryptedData
        string livenessMethod
        decimal confidenceScore
        datetime createdAt
        datetime expiresAt
    }
    AttendanceRecord {
        string id PK
        string employeeId FK
        datetime checkInTime
        datetime checkOutTime
        string location
        decimal recognitionConfidence
        enum status
        string sourceEventId FK
    }
    RecognitionEvent {
        string id PK
        string employeeId FK
        datetime captureTime
        string imageUrl
        boolean livenessPassed
        enum attemptType
        string deviceInfo
    }
    Alert {
        string id PK
        string employeeId FK
        enum type
        string message
        enum channel
        datetime sentAt
        enum status
    }
    Report {
        string id PK
        string companyId FK
        date reportDate
        datetime generatedAt
        enum format
        string downloadUrl
        enum status
    }
    Subscription {
        string id PK
        string companyId FK
        enum tier
        int employeeCount
        date nextBillingDate
    }
    Admin {
        string id PK
        string employeeId FK
        json permissions
    }
    Manager {
        string id PK
        string employeeId FK
        array managedTeamIds
    }

Key insight: The schema ensures traceability from facial scan to attendance decision, enabling auditability and anti-spoofing validation — critical for government and enterprise trust.

3.5.4 Indexing & Partitioning Notes

• Index on RecognitionEvent.captureTime: Enables fast querying of recent scans for real-time dashboards and alerting.
• Composite index on AttendanceRecord(employeeId, checkInTime): Optimizes daily attendance lookups per employee.
• Partition RecognitionEvent by date: Improves performance for large-scale clients (e.g., manufacturing plants with thousands of daily scans).
• Index FaceTemplate.expiresAt: Supports automated cleanup of expired biometric data after 24 months [Validated].
• Global secondary index on Employee.email: Speeds up login and alert delivery workflows.

These optimizations ensure ≤1.5 second recognition response time and ≤5 second data sync delay at scale [Validated].

3.5.5 Sample Records

-- Example DDL snippet for FaceTemplate (PostgreSQL)
CREATE TABLE FaceTemplate (
    id VARCHAR(36) PRIMARY KEY,
    employeeId VARCHAR(36) UNIQUE REFERENCES Employee(id),
    encryptedData BYTEA NOT NULL,
    livenessMethod VARCHAR(20) NOT NULL,
    confidenceScore DECIMAL(3,2) CHECK (confidenceScore >= 0.995),
    createdAt TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
    expiresAt TIMESTAMP WITH TIME ZONE DEFAULT NOW() + INTERVAL '24 months'
);

-- Index for retention cleanup
CREATE INDEX idx_facetemplate_expire ON FaceTemplate(expiresAt);

Key insight: Encryption and retention controls are baked into the schema design, ensuring compliance with Indonesia’s PDP Law and global privacy expectations — a must-have for government and multinational clients.

3.6Security And Compliance Baseline

3.6.1 Threat model summary

ChronoFace processes highly sensitive biometric data—specifically facial templates and real-time recognition events—which makes it a high-value target for attackers. The primary risks include unauthorized access to biometric databases, spoofing attempts (e.g., using photos or videos to fake identity), data exfiltration, and insider threats from misused admin privileges. Because the system operates globally, it must also defend against distributed bot attacks and comply with varying regional data protection expectations.

Key mitigations are built into the architecture. First, liveness detection via blink and head movement [Validated] prevents spoofing by ensuring only live users can enroll or check in. Second, face templates are stored as encrypted mathematical vectors, not raw images, making them useless if stolen. Third, zero-trust access controls ensure no user—internal or external—can access data without proper authorization. Fourth, real-time anomaly detection flags suspicious behavior, such as repeated failed scans from the same device or logins from unusual locations.

Third-party integrations (e.g., HR and payroll systems) introduce supply chain risks. To reduce exposure, all API connections use mutual TLS and strict rate limiting (100 requests/minute per client) [Validated]. Vendor risk is managed through contractual obligations requiring equivalent security standards.

Key insight: The greatest risk isn’t just data theft—it’s loss of trust. A single breach of facial data could damage customer confidence globally, so security must be proactive, not reactive.

3.6.2 AuthN/AuthZ

Authentication (AuthN) ensures users are who they claim to be; Authorization (AuthZ) controls what they can do. For ChronoFace, AuthN is enforced via secure login using email and password, with Multi-Factor Authentication (MFA) [Validated] strongly recommended for Admin and Manager roles. MFA options include time-based one-time passwords (TOTP) via authenticator apps or SMS (where supported).

Session handling uses short-lived JSON Web Tokens (JWTs) with refresh tokens stored securely. Sessions expire after 24 hours of inactivity, and users can view and terminate active sessions from their profile. All authentication flows occur over HTTPS with strict transport security (HSTS) enabled.

Authorization follows a role-based model:

• Employee: Can only scan their own face and view their attendance history
• Manager: Can view team attendance, receive alerts, and export reports
• Admin: Full access to user management, system settings, and audit logs

Permissions are enforced server-side on every request. For example, an Employee cannot access another user’s data—even if they manipulate the app—because the backend checks user role and company affiliation before returning any record.

API access for HR integrations uses OAuth 2.0 with scoped tokens, ensuring third-party systems only access permitted data (e.g., read-only attendance records). All access decisions are logged for audit.

Key insight: Security fails when access is too broad. ChronoFace limits power by design—only Admins can modify settings, and no role can export raw biometric templates.

3.6.3 Data protection

ChronoFace handles Personally Identifiable Information (PII) including names, employee IDs, email addresses, and biometric face templates. No Payment Card Industry (PCI) or Protected Health Information (PHI) data is processed.

All data is encrypted:

• In transit: TLS 1.3+ for all web, mobile, and API traffic
• At rest: AES-256 encryption for databases and file storage

Face templates and recognition events are stored in isolated, encrypted tables. Encryption keys are managed using a cloud-based Key Management Service (KMS), with automatic rotation every 90 days. Secrets (e.g., API keys, database credentials) are stored in a secure secrets manager, not in code or configuration files.

PII is only accessible to authorized users within the same company. Cross-company data isolation is enforced at the application and database layers. Employees’ facial data never leaves the secure biometric vault unless anonymized for system improvement—and only with explicit opt-in.

Data minimization is practiced: only necessary fields (name, ID, photo, face vector) are collected during enrollment. Users can request data deletion, which triggers secure erasure within 7 days.

Key insight: Biometric data is permanent—if compromised, it can’t be changed like a password. Encryption and strict access are non-negotiable.

3.6.4 Compliance baseline

ChronoFace adheres to GDPR-like privacy principles globally, even in regions without formal laws [Target]. This means:

• Clear consent for biometric enrollment
• Right to access, correct, or delete personal data
• Data processing agreements (DPAs) with all vendors
• Breach notification within 72 hours

While ChronoFace does not process credit card data, it integrates with HR systems that may use PCI-compliant gateways. In such cases, ChronoFace relies on the gateway’s compliance and never stores or touches payment data.

Audit logs record all critical actions: logins, role changes, data exports, and recognition events. Logs are retained for 24 months [Validated] and stored in write-once, append-only storage to prevent tampering.

Data residency is flexible: customer data can be stored in AWS regions closest to their operations (e.g., Singapore, Frankfurt, Virginia). Customers may request data localization to meet national laws (e.g., Indonesia’s PDP Law).

Annual third-party penetration tests and SOC 2 Type II audits ensure ongoing compliance. Findings are reviewed by leadership and addressed within 90 days.

Key insight: Global operation demands a high common denominator—ChronoFace meets GDPR standards everywhere to simplify compliance and build trust.

3.6.5 Abuse prevention

To prevent automated attacks and misuse, ChronoFace implements multiple abuse prevention layers:

• Rate limiting: 100 API requests per minute per client [Validated], blocking brute-force attempts
• Bot detection: Behavioral analysis flags non-human patterns (e.g., rapid-fire scans from one IP)
• Anomaly alerts: Sudden spikes in failed scans, logins from new countries, or bulk data access trigger real-time alerts to Admins and security teams

Devices used for scanning are registered and fingerprinted. If a device is flagged (e.g., rooted or jailbroken), it’s blocked from enrolling or submitting attendance.

Geofencing can be enabled by Admins to restrict check-ins to approved locations (e.g., office or site perimeter), reducing remote spoofing risks.

All alerts are logged and reviewed daily by the security team. False positives are tuned using machine learning to reduce noise.

Key insight: Prevention is cheaper than response. Stopping bots early avoids system overload and data abuse.

3.6.6 Incident response

ChronoFace maintains a formal incident response plan to detect, contain, and recover from security events:

• Detection: 24/7 monitoring via SIEM (Security Information and Event Management) tools
• Escalation: Critical alerts trigger immediate review by on-call security engineers
• Comms: Internal teams are notified within 30 minutes; affected customers within 24 hours
• Recovery: Systems are restored from clean backups; root cause analysis is completed within 7 days

A dedicated incident response team includes roles for technical lead, legal counsel, PR, and customer support. Playbooks cover scenarios like data breaches, DDoS attacks, and insider threats.

Post-incident, a public summary (without sensitive details) is published to maintain transparency.

All employees undergo annual security training, and phishing simulations are run quarterly.

Key insight: How you respond defines your reputation. ChronoFace prepares for incidents not because they’re likely—but because trust depends on readiness.

3.6.7 Sources

• https://www.biometricupdate.com/202606/indonesia-to-require-face-biometrics-for-new-mobile-numbers
• https://www.lmiconsultancy.com/indonesia-reinstates-biometric-requirement-for-visa-extensions-effective-21-may-2025
• https://iccms.ifrel.org/index.php/ICCMS/article/view/157
• https://www.fortehris.com/en/Pricing
• https://scholar.its.ac.id/en/publications/enhancing-face-recognition-attendance-system-utilizing-real-time-

3.7Scaling Strategy

3.7.1 Current bottlenecks

1. Single database instance – The current PostgreSQL setup is a single point of failure and cannot handle more than 1,000 concurrent recognition queries without latency spikes [Validated: Canonical Fact – Max concurrent users per instance: 5,000]

2. Centralized facial recognition processing – All face scans are processed in a single region, increasing latency for remote users and risking compliance with data residency laws in regions like the EU and Indonesia [Estimate]

3. Limited caching layer – Without a global Redis or equivalent cache, repeated recognition requests (e.g., during peak login times) overload the AI model servers, increasing response time beyond 1.5 seconds [Target: ≤1.5 seconds]

4. Monolithic API gateway – The current API has no auto-scaling and hits rate limits at 100 requests/minute per client, which restricts integration with large HR systems [Validated: Canonical Fact – API rate limit]

5. No CDN for static assets – Mobile and web app assets (e.g., UI components, model weights) are served from a single origin, slowing down global load times and increasing bandwidth costs [Benchmark]

3.7.2 Scaling roadmap (3 phases)

Key insight: Cost scales non-linearly—early investment in sharding and caching reduces per-user infrastructure cost by up to 60% at scale.

3.7.3 Critical decisions

• Database scaling approach: Start with read replicas (Phase 1), move to horizontal sharding by Company ID (Phase 2), then adopt a globally distributed SQL database (Phase 3) to ensure low-latency access and compliance with data sovereignty laws [Validated: Global geography, 24-month retention]

• Compute strategy: Use horizontal scaling with Kubernetes (Phase 1–2), then shift to serverless AI inference (e.g., AWS SageMaker, GCP Vertex AI) in Phase 3 to handle spiky recognition loads without over-provisioning [Benchmark]

• Caching layer: Introduce Redis in Phase 1 for face template caching (reducing DB load by ~40%) and expand to edge caching in Phase 2 for faster liveness detection responses [Estimate]

• CDN and static asset strategy: Deploy Cloudflare or AWS CloudFront in Phase 1 to serve app assets globally—reducing load time by up to 60% for users in Asia, Africa, and South America [Benchmark]

• Monitoring and alerting essentials: Implement real-time observability using Datadog or New Relic from Day 1—track p95 response time, error rates, and recognition accuracy to trigger auto-scaling or failover [Target: ≤1.5 sec response]

• CDN (Content Delivery Network): A network of servers across global locations that caches and delivers static content (like app files or images) closer to users, reducing latency and bandwidth costs.

3.7.4 Performance targets per phase

Key insight: Uptime improves with redundancy—Phase 3’s multi-region architecture eliminates single-region outages as a risk.

3.7.5 Cost projections

Note: Cost per user drops in Phase 2 due to efficient sharding and caching, but rises slightly in Phase 3 due to high-performance GPU inference needs. However, revenue per user (via Enterprise tier) offsets this [Validated: Enterprise = custom pricing].

Key insight: Economies of scale apply until AI inference dominates cost—optimizing model efficiency will be critical in Phase 3.

4.1User Validation Plan

4.1.1 What we are testing

4.1.2 Who to recruit

Screener questions (ask in order):

1. Do you manage attendance tracking for a team of 100+ employees? (Disqualify: “No”)
2. Does your company use digital or biometric attendance systems today? (Disqualify: “No”)
3. Are you involved in decisions about HR software or time-tracking tools? (Disqualify: “No”)
4. Have you experienced issues like buddy punching or late reporting in the past 6 months? (Disqualify: “Never”)

Where to find them (global):

• LinkedIn (search: “HR Manager” + “enterprise” + “remote teams”)
• HR & Payroll Tech Slack communities (e.g., PeopleTech Alliance)
• Upwork (filter: HR consultants serving multinational clients)
• Reddit: r/humanresources and r/ITManagers

Incentive: $20 USD via PayPal or gift card (e.g., Amazon)

4.1.3 The 10-minute session

4.1.4 Interview questions

1. How does your team currently track daily attendance?
2. What’s the biggest challenge with your current system?
3. Have you ever caught someone logging in for a colleague? How?
4. Show me how you’d check in if you were starting work now.
5. Show me how you’d see who hasn’t checked in today.
6. How quickly do you usually find out about late arrivals?
7. If this system prevented buddy punching, how valuable would that be?
8. If this cost $499/month, would your company pay for it? Why or why not?
9. What would make this tool completely unusable for your team?
10. Where do you usually discover new HR tools?

4.1.5 Synthesis grid

4.1.6 Decision rule

• BUILD if: 4+ hypotheses validated, including problem severity and usability
• SHARPEN if: 2–3 validated — iterate on pricing, UX, or positioning
• WAIT if: <2 validated — revisit core assumptions or market fit

running these 10 sessions takes about a week solo; a validation partner (like Synetica) can recruit, run, and synthesize them for you.

4.2Go To Market Plan

4.2.1 ICPs & Personas

1. Government Institution HR Director (Global, especially Indonesia & Southeast Asia)

• Profile: Oversees compliance-heavy operations with strict attendance tracking needs. Manages large, geographically dispersed staff.
• Buying Triggers: Regulatory mandates (e.g., Indonesia’s biometric visa and telecom requirements), need for audit-proof records, anti-fraud measures.
• Pain Points: Proxy attendance, manual logging, lack of real-time oversight.

2. Enterprise IT/HR Operations Lead (Large Enterprises, Remote-First Companies)

• Profile: Manages digital transformation of HR systems. Tech-savvy, integration-focused. Evaluates ROI and scalability.
• Buying Triggers: Need for seamless HRIS/payroll integration, real-time alerts, and automated reporting.
• Pain Points: Fragmented systems, low employee compliance with time logs, lack of visibility into remote teams.

3. Plant or Shift Supervisor (Manufacturing, Logistics, Healthcare)

• Profile: Frontline operations manager responsible for shift accountability and labor cost control.
• Buying Triggers: High absenteeism, time theft, safety compliance, and payroll accuracy.
• Pain Points: Manual roll calls, buddy punching, lack of real-time attendance data.

4. University or School Administrator (Educational Institutions)

• Profile: Manages staff and faculty attendance with academic calendar constraints.
• Buying Triggers: Need for accurate payroll, faculty accountability, and integration with academic HR systems.
• Pain Points: Inconsistent tracking, proxy marking, lack of liveness detection.

4.2.2 Launch Phases

Pre-Beta (Weeks 1–4): Design Partner Onboarding

• Goal: Validate product-market fit with 10 high-engagement design partners (e.g., Indonesian government agency, university, manufacturing plant).
• Cutover Criteria: 10 active design partners using ChronoFace daily, with ≥80% facial enrollment completion and feedback collected.
• Activities: On-site setup, liveness detection calibration, HRIS integration testing, and UX refinement.

Beta (Weeks 5–12): Controlled Rollout & Activation

• Goal: Achieve >40% activation rate (employees using ChronoFace at least 3x/week).
• Cutover Criteria: 40%+ activation across beta sites, <5% false rejection rate, and ≥90% admin satisfaction (NPS ≥50).
• Activities: Push real-time alerts, generate daily reports, onboard 3–5 new companies, and finalize API integrations with top HR platforms (e.g., Zoho, Forte HRIS).

GA (Month 4+): Global Commercial Launch

• Goal: Achieve CAC payback in <6 months through scalable acquisition and retention.
• Cutover Criteria: CAC < $1,200 (for Pro tier), MRR > $20,000, churn <5% monthly.
• Activities: Launch paid campaigns, expand channel partnerships, enable self-serve signup, and activate customer success onboarding.

4.2.3 Customer Acquisition Funnel

flowchart TD
    Start([Awareness]) --> Interest[Interest]
    Interest --> Consideration[Consideration]
    Consideration --> Trial{Trial/Evaluation}
    Trial -->|Success| Purchase[Purchase]
    Trial -->|Fail| Nurture[Nurture]
    Purchase --> Activation[Activation]
    Activation --> Retention[Retention]
    Retention --> Expansion[Expansion]
    Nurture --> Consideration
    
    PreBeta[Pre-Beta Phase] --> Start
    Beta[Beta Phase] --> Interest
    GA[GA Phase] --> Consideration

Funnel targets are → validate based on early beta engagement and competitor benchmarking. Assumes 10,000 impressions from digital campaigns and partner referrals in first 90 days.

Key insight: The funnel prioritizes quality over volume — targeting high-intent buyers in regulated or shift-based industries increases conversion likelihood despite lower top-of-funnel volume.

4.2.4 Channel Mix & Tactics

Budget allocated for first 90 days. CAC estimates based on → validate HR tech benchmarks in Indonesia and global SaaS averages.

4.2.5 KPI Dashboard

Key insight: CAC payback period is the north star — success means revenue from a customer exceeds acquisition cost within 6 months, enabling sustainable scaling.

4.2.6 Risks & Mitigations

Legal Note: In Indonesia, align with Law 27/2022 on Personal Data Protection (PDP Law) and Ministry of Communication regulations on biometric use. Ensure data is stored locally if required.

4.2.7 Sources

• Indonesia to require face biometrics for new mobile numbers | Biometric Update
• Indonesia Reinstates Biometric Requirement for Visa Extensions
• Cross-Border Jurisdictional and Legal Issues of Biometric Data ...

4.3Sales And Marketing

4.3.1 Revenue motion

ChronoFace’s revenue motion is founder-led sales supported by inbound demand from targeted digital marketing, designed for a small team of 1–2 founders executing both outreach and conversion. A stranger becomes a paying customer by discovering ChronoFace through SEO, LinkedIn, or industry-specific content (e.g., “anti-spoofing for HR systems”), signing up for a demo via the website, and being guided through a 2–3 week sales cycle that includes a product walkthrough, security review, and integration discussion. Given the enterprise nature of the product, pricing starts at $99/month (Basic) but meaningful revenue comes from Pro ($499) and Enterprise (custom) tiers — thus, no self-serve signup is offered at launch. All sales are direct and human-led, with founders owning the full cycle from lead response to close.

4.3.2 Marketing channel matrix

Note: CAC (Customer Acquisition Cost) = total channel spend / number of customers acquired through that channel.

4.3.3 Content & awareness plan

• Publish a case study-style video showing a manufacturing plant reducing late arrivals by 40% using ChronoFace — post on LinkedIn and YouTube to address operational inefficiency
• Release a “Biometric Compliance Checklist” as a gated download targeting government and education buyers concerned with regulatory adherence
• Write a technical blog: “Why 99.5% accuracy isn’t enough without liveness detection” — promote via developer and IT forums to build technical credibility
• Share real-time alert screenshots on social media showing instant notifications when an employee checks in — speaks to transparency and accountability needs
• Run a live demo webinar titled “Eliminate Buddy Punching in 5 Minutes” — directly addresses attendance fraud, a top buyer trigger

4.3.4 Sales process

4.3.5 Pricing conversations

• “Can we get a discount for annual payment?” → Offer 10% discount for annual prepayment on Pro tier; Enterprise deals are negotiated case-by-case
• “We want to pilot before committing.” → Offer 30-day pilot for one site or department at 50% capacity (max 200 users) with full features, no cost if canceled
• “Why is Enterprise tier custom-priced?” → Explain: pricing scales with integration depth, data volume, and SLA requirements — we’ll quote after technical scoping
• “Do you support local payment methods?” → Yes: Stripe supports local cards and bank transfers in 135+ countries; for Indonesia, BCA and GoPay via Stripe are supported

4.3.6 90-day calendar

4.3.7 Budget summary

Total monthly spend: $4,700 USD
Expected pipeline/month: 200 leads → 5 closed deals (~$2,500–$3,500 MRR from Pro tier conversions)

Sources:

• https://www.biometricupdate.com/202606/indonesia-to-require-face-biometrics-for-new-mobile-numbers
• https://www.lmiconsultancy.com/indonesia-reinstates-biometric-requirement-for-visa-extensions-effective-21-may-2025
• https://www.fortehris.com/en/Pricing
• https://tracxn.com/d/explore/image-recognition-startups-in-indonesia/__XEhuuVQxx5jYB3nEhWsY6He61qBlNNUWuyP3m6KhllU/companies

4.4Partnerships And Retention

4.4.1 Partnership Map

Key insight: Integrating with established HRIS platforms unlocks embedded distribution — the most scalable path to enterprise adoption.

4.4.2 Partnership Motion

• Owned by: Head of Strategic Alliances
• One-sentence pitch: “Add secure, real-time facial attendance to your HR platform with zero development effort via our API-first integration.”
• Pilot structure: 90-day technical integration with one joint customer, shared success metrics (≥95% recognition accuracy, <2 sec response), and co-marketing upon completion
• Success criteria: 2 active integrations in sandbox within 6 months, 1 live customer by Q3 2026

4.4.3 Onboarding → Activation

Activation metric: First successful attendance scan by an employee within 72 hours of company signup [Target: 78% → validate]

Key insight: The faster employees complete their first scan, the higher the likelihood of long-term adoption — this is ChronoFace’s "aha" moment.

4.4.4 Retention Plays

Key insight: Churn often starts with silent friction — monitoring behavioral signals allows proactive intervention before dissatisfaction escalates.

4.4.5 Expansion & Referral

• Upsell path: Basic → Pro at 101 employees; Pro → Enterprise with payroll integration and multi-site support
• Referral mechanic: Admins earn 1 month free for every new company referred that signs up for Pro or Enterprise (capped at 3 months/year)
• Expansion trigger: When attendance data shows >3 sites or >500 scans/day, prompt upgrade to Enterprise tier
• Network effect: Enable shared benchmarks — “Your team’s on-time rate is 12% above industry average” — to reinforce value

4.4.6 Metrics

Key insight: High activation and early retention are leading indicators — if these lag, even strong top-of-funnel growth will fail to convert to sustainable revenue.

4.5Business Scaling Strategy

4.5.1 Scaling pillars

Revenue Engine ChronoFace’s revenue engine is built on a tiered subscription model (Basic: $99, Pro: $499, Enterprise: custom) targeting organizations with 100+ employees. The global scope enables expansion across regulated sectors—government, education, manufacturing, and IT—where real-time, secure attendance is mission-critical. Key levers:

• Premium conversion: Target 18% of free-trial companies to convert to paid tiers within 30 days [Target]
• Expansion revenue: Upsell multi-site and payroll integration in Phase 2, increasing ARPU by 40% [Estimate]
• Enterprise deals: Close 15 custom contracts (>$10k ACV) in Year 1 via direct sales [Target]

Pricing is competitive against local HRIS platforms like Forte HRIS and HONO, which offer biometric features at bundled rates. ChronoFace differentiates with standalone facial recognition accuracy (≥99.5%) and anti-spoofing via liveness detection, allowing integration without replacing full HR systems [Validated].

Channels & Awareness A hybrid go-to-market combines digital demand generation, channel partnerships, and localized sales. Prioritized regions: Southeast Asia (Indonesia, Thailand), Middle East (UAE), and Latin America (Mexico, Brazil), where digital transformation and labor compliance are accelerating [Benchmark].

Content velocity is critical: launch 8 case studies and 12 demo videos in Year 1 to fuel trust [Target].

Retention & Support Retention hinges on product reliability, compliance confidence, and support responsiveness.

• Churn target: <8% annualized for Pro and Enterprise tiers [Target]
• CSAT goal: ≥90% via in-app feedback and post-resolution surveys [Target]
• Automated alerts: Instant push/email notifications reduce “did I clock in?” queries by 60% [Estimate]

Support model:

• Tier 1: AI chatbot (in-app) for FAQs (e.g., “How to re-scan face?”)
• Tier 2: Human support (email/phone) for technical issues, available 24/5
• Tier 3: Dedicated CSMs for Enterprise clients

Proactive health reports (e.g., “Your recognition accuracy: 99.7%”) build trust and reduce support load [Estimate].

Ops & Finance Operations scale with automation and cloud infrastructure.

• Billing: Stripe integration for global payments, tax compliance handled per region
• Data ops: AWS-hosted, with regional data residency options (e.g., Jakarta for Indonesia)
• Revenue recognition: Monthly recurring, prorated for mid-cycle upgrades

Gross margin target: 82% by Month 12, driven by low incremental cost per user after MVP deployment [Estimate].

Compliance ChronoFace operates in regulated biometric environments. Key actions:

• Align with Indonesia’s PDP Law (2022) and EU GDPR for data protection [Validated]
• Enable data anonymization and right to delete in admin console
• Conduct third-party audits annually to verify anti-spoofing and data handling

In Indonesia, biometric mandates for mobile registration and visas (since 2025) validate market readiness and reduce adoption friction [Validated].

4.5.2 Phased plan

Stage gates require:

• CAC payback ≤6 months before doubling ad spend
• Churn <3% before launching new regions
• 90%+ system uptime before enterprise onboarding

4.5.3 Unit economics trajectory

Key insight: LTV:CAC improves from 2.8x to 4.0x by Year 2, enabling reinvestment in high-CAC enterprise sales.

4.5.4 Org & capacity plan

Team starts lean: founder-led sales until Month 3, then scales with data-driven hires. All roles use AI-augmented tools (e.g., Gong, HubSpot) to boost output.

4.5.5 Budget & investment

Opex includes salaries, tools, and overhead. Variable costs (cloud, API usage) are capped at $0.02 per recognition event, scalable under 100 req/min/client limit.

4.5.6 Risks & contingencies

Key insight: Early warning systems (CAC, churn, support load) prevent over-investment in unproven markets.

4.5.7 Sources

• https://www.biometricupdate.com/202606/indonesia-to-require-face-biometrics-for-new-mobile-numbers
• https://www.lmiconsultancy.com/indonesia-reinstates-biometric-requirement-for-visa-extensions-effective-21-may-2025
• https://www.fortehris.com/en/Pricing
• https://tracxn.com/d/explore/image-recognition-startups-in-indonesia/__XEhuuVQxx5jYB3nEhWsY6He61qBlNNUWuyP3m6KhllU/companies
• https://www.mfat.govt.nz/en/trade/mfat-market-reports/indonesias-digital-economy

4.6Risk Register

4.6.1 Risk Framework

Risk is assessed on a 2x2 matrix using Likelihood (Low: <30%, Medium: 30–70%, High: >70%) and Impact (Low: recoverable, Medium: material setback, High: existential threat). Risks rated High/High demand immediate action and are tied to core product promises or compliance obligations.

4.6.2 Risk Matrix

quadrantChart
    title Risk Matrix
    x-axis Low Likelihood --> High Likelihood
    y-axis Low Impact --> High Impact
    quadrant-1 Mitigate Now
    quadrant-2 Monitor Closely
    quadrant-3 Accept
    quadrant-4 Contingency Plan
    R-01: [0.8, 0.9]
    R-02: [0.75, 0.9]
    R-03: [0.5, 0.8]
    R-04: [0.45, 0.8]
    R-05: [0.4, 0.5]
    R-06: [0.5, 0.5]
    R-07: [0.45, 0.5]
    R-08: [0.4, 0.5]
    R-09: [0.3, 0.5]
    R-10: [0.3, 0.8]

4.6.3 Top 3 Risks

R-01: Biometric data law violation could result in fines or operational bans, especially in regulated markets like Indonesia [Pending]. The single most important mitigation is implementing region-specific data residency from MVP launch. This is tested at Gate 1: Demand proven in the Strategic Roadmap.

R-02: Accuracy below 99.5% directly contradicts the core promise of ChronoFace [Validated]. The key mitigation is real-world accuracy monitoring across diverse environments. This is validated during MVP Beta Testing (Phase 1).

R-03: Market differentiation failure threatens customer acquisition despite strong technology [Benchmark]. The critical action is third-party certification of anti-spoofing superiority. This is tested in Customer Discovery Interviews (01-0).

4.6.4 Review Cadence

Revisit this register at every Strategic Roadmap gate:

• Pre-MVP (now)
• Post-MVP Beta (Month 3)
• Post-Phase 2 Launch (Month 8)
• Annual review thereafter