An employee check-in and payroll ecosystem for small and medium businesses, built to run entirely on your own devices. The boss's phone holds the data and computes the payroll; Trusted or Permanent Kiosks record check-ins; workers use MyCheckin for payslips and chat; and a web dashboard (Office Web) is served by the boss's phone to any browser on the same network.
It was built for the Bulgarian market first, with Bulgarian payroll conventions, but the architecture is universal and the apps now include 22 interface languages.
Really. There is no server to buy, no cloud account to create, and the system is fully functional with zero internet connectivity. Devices discover each other on your WiFi automatically and sync directly, device-to-device.
Really. Daily operation does not depend on our infrastructure. Online connections are used for workspace licensing and access provisioning, the optional encrypted relay, and downloading the signed KioskCheckin module when you choose a Permanent Kiosk. None of those services receives readable payroll, employee records, messages, photos or documents.
Minimum: one Android phone for the boss. That alone gives you employees, check-in records, payroll, reports and Office Web. Add as you grow:
The worker app runs on both Android and iPhone.
The employer currently matches new employee devices in BossCheckin. Other ongoing work can be delegated to helper roles:
No. BossCheckin and MyCheckin include 22 interface languages. Users can choose the app language independently of the phone language; this website is currently in English.
The worker opens their app and taps Start or Finish. The app renders a short-lived QR code carrying a digitally signed token — who they are, what they intend (start/finish), and when. The kiosk's camera scans it and verifies the signature locally, on the spot. Green means started, red means finished, and the record lands in payroll immediately. No internet is involved at any step.
The worker simply taps their phone on the kiosk (~4 cm range). The kiosk issues a one-time challenge and the worker's phone answers with a signed response bound to that exact challenge — so it cannot be replayed, photographed, or forwarded to a friend.
Two practical perks: it's faster than aiming a camera, and the kiosk works while locked, even with the screen off — a phone in a drawer becomes a check-in terminal. You choose QR or NFC per kiosk; devices without NFC hardware use the QR path.
We recommend NFC wherever the hardware allows it: it's faster (a tap instead of aiming a camera), it can't be photographed or replayed, and the kiosk keeps working locked with its screen off. For best compatibility, use an Android 12 or newer phone or tablet as the NFC kiosk.
Worth knowing: some competitors also say “NFC”, but they typically mean a passive tag stuck on a wall or a badge card on a dedicated reader — a tag identifies a place, can be cloned, and proves nothing about who tapped it. As far as we know, BossCheckin is the only attendance app where both ends are ordinary phones: every check-in is a live, single-use cryptographic exchange between the worker's phone and the kiosk phone.
QR is the universal fallback — it works on any device with a camera and a screen, and you can mix methods per kiosk: NFC at the main entrance, QR at a remote site.
Yes. An integration API lets you connect BossCheckin to an existing access system — an electric door, a gate or a parking barrier — so that a valid, signed check-in triggers it to open. The integration runs on your premises, like everything else. Tell us about your hardware and we'll help you wire it up.
Not realistically. Check-in tokens are signed by the worker's unique device key and verified by the kiosk; NFC adds a challenge-response that requires the actual phone to be physically at the kiosk. A photo or screenshot of a QR expires; a forwarded NFC exchange doesn't validate. The only thing that produces a valid record is the right phone, at the kiosk, at that moment.
Yes — each worker has a live calendar showing today's start/finish as it happens, plus their full month and payslip. Unfinished shifts are flagged, so “I forgot to check out” gets noticed the same day, not at month's end.
On devices and optional backup destinations chosen by the employer — never as a readable copy on Stenli Apps infrastructure. The boss's phone is the source of truth: its core database is SQLCipher-encrypted, and managed photos and documents live in an encrypted vault. MyCheckin also uses an SQLCipher database.
On a clean Trusted or Permanent Kiosk installation, app-managed personal payloads and private kiosk secrets are encrypted with device-local keys protected by AndroidKeyStore. Limited operational metadata and temporary preview/share files may remain inside Android app-private storage.
You restore from backups you control. Protected payroll and file payloads remain encrypted with the owner's keys across backup kiosks, courier phones, your own Google Drive and your own NAS. The backup package is not one opaque encrypted container: a limited signed manifest and operational profile metadata may remain visible.
You can designate an unlimited number of backup kiosks and couriers across your locations. On a new phone you enter your 12-word recovery phrase, re-pair, and records, photos and documents come back.
Guard the phrase. It is the cryptographic root of the protected payloads. We never see it and cannot reset it, so losing the phrase together with every device and backup can make those payloads permanently unrecoverable.
No. All device-to-device traffic is sealed end-to-end with libsodium; chat is additionally sealed per message and per photo. The relay and Cloudflare see ciphertext frames with routing metadata (which tenant, what size, when) — never content. Records themselves are Ed25519-signed in an append-only chain, so tampering is detectable.
No. Chat is deliberately split into three separate spaces with different privacy rules:
Workers get a genuinely private space; the business keeps its official paper trail. Both, without compromise.
Worth knowing: a few competing apps also promise that admins can't read workers' private chats — but as a vendor policy, applied to messages stored readable in the vendor's cloud (and in some products the account owner can export every worker's private messages). As far as we know, BossCheckin is the only workforce app where that promise is cryptography, not policy: colleague messages are end-to-end encrypted, so nobody can read them — including us. As of June 2026, none of the leading workforce apps we surveyed offers end-to-end encryption for messages.
It's GDPR-friendly by architecture: Stenli Apps receives no readable employee records, payroll, messages, photos or documents. Optional relay traffic is end-to-end encrypted, and backups go only to destinations chosen by the employer. On top of that:
On a clean installation, both kiosk types use an SQLCipher database, authenticated encryption for app-managed payload files and AndroidKeyStore-backed protection for private kiosk secrets. Public operational metadata such as format markers, hashes, sizes and status flags may remain visible.
A Trusted Kiosk uses the owner's PIN to leave check-in mode; a correctly provisioned Permanent Kiosk additionally uses Android Device Owner to block normal Home, Recents and uninstall access. Either kiosk can be unpaired by the boss. Owner-sealed payroll and file payloads carried for backup remain unreadable to the kiosk, although limited signed manifest and operational profile metadata are not hidden as one opaque archive.
Previously used test kiosks must have their app data cleared — or be factory-reset for Permanent Kiosk — and then be provisioned again. The encrypted kiosk format deliberately has no unsafe plaintext migration.
The boss's phone runs a small embedded HTTPS web server. Any laptop or tablet on the same WiFi opens the phone's local address and gets the full dashboard — the “website” travels a few metres across the room, not across the internet. Unplug the router from the world and it still works.
Pretty much everything, comfortably: manage employees and sites, enter days and payments in bulk, see check-ins, review absences and paid leave, chat with workers (with photos), upload employee documents with expiry dates, build reports, restore from the recycle bin, and tune settings — including GDPR retention.
Yes. Create a restricted account that only sees Reports. The accountant gets monthly payroll, payments, absences and leave-balance reports, with named report templates and one-click CSV export formatted to open cleanly in spreadsheet software.
An opt-in, read-only endpoint (standard MCP protocol) on Office Web. If you enable it and mint an access token, an AI assistant you run can answer questions over the sections you grant — sites, employees, money summaries, leave, reports. It's off by default, token-protected, read-only, and chat messages are never exposed. The app itself sends nothing to any AI provider.
Two things make this different from the “AI features” others advertise. First, where the data lives: a few cloud suites have started shipping MCP endpoints too, but theirs run in the vendor's cloud, against the vendor's copy of your data. BossCheckin's MCP endpoint runs on your own phone — to our knowledge, the only workforce app where AI access involves no vendor cloud at all. Second, because MCP is an open standard, the AI you connect can be fully local — a model running on your own computer — so even your questions about the business never leave the building.
Each site runs its own kiosk(s). When kiosks share a network with the boss's phone they sync directly; kiosks also relay colleague chat between each other. For sites the boss rarely visits, you can enable internet mode — or use a courier phone that physically carries encrypted data between locations. A remote mountain site with zero coverage is a supported scenario, not an error message.
Devices that can't reach each other locally start syncing through a relay server — payslips, chat, the works — as end-to-end sealed frames. Messages and data sync have separate switches, so you can allow chat over the internet while keeping payroll sync strictly local. Check-ins themselves remain a physical act at the kiosk. Flip everything off and you're back to pure LAN, nothing lost.
No. Checking in works at the kiosk with no connectivity at all. Payslips and chat sync whenever the worker's phone shares WiFi with the office. A data plan only matters if you enable internet mode and the worker is away from the office network.
BossCheckin is a business-to-business workspace license. The employer obtains employee access seats in BossCheckin for Android through Google Play: €10 per employee seat, paid once, with no monthly subscription. A 10-person team therefore costs about €100 total, while a typical cloud suite runs ~$2,160 for the same team over three years — making BossCheckin ≈95% cheaper (see the pricing math on the home page).
MyCheckin is the free employee client. The employee does not buy a key, subscription or feature in MyCheckin. The worker enters their name and taps Find BossCheckin. When both devices are on the same local network, the employer matches the waiting device to the employee and the already licensed access is delivered automatically over the live LAN connection — no activation QR is scanned. The technical activation credential is bound to that employee device as part of the security model; a replacement device requires the employer to allocate another seat. For larger seat packs, get in touch.
No. MyCheckin itself is free to download and contains no employee purchase or subscription; on supported platforms it is distributed through Google Play or the Apple App Store. It works as the employee-facing client of a BossCheckin workspace. Access is provided and managed by the employer and delivered directly from BossCheckin over the local network. There is no employee payment request and no activation QR.
A new phone has a new cryptographic identity, so the employer must allocate another employee access seat. The worker enters their name and taps Find BossCheckin; the employer matches the waiting phone to that employee in BossCheckin, and access is delivered over the local network. The worker never has to buy anything in MyCheckin, and their payslips and calendar re-sync automatically from the office.
The provisioned access is bound to the device's cryptographic identity, which lives in the app's data. That means it is lost on a factory reset or if you clear the app's data — those destroy the identity, and the employer must allocate another seat to the replacement identity. Simply reinstalling or updating the app does not lose the provisioned access.
Note the distinction: your business data is a separate matter — protected payroll and file payloads come back from your chosen backups with the 12-word recovery phrase. It is the device-bound access that a reset consumes, so don't wipe a working device casually.
Your unused employee access seats belong to your BossCheckin workspace — the ecosystem identity anchored in your 12-word recovery phrase. If you set up a brand-new workspace with a fresh phrase, it starts fresh with the one free trial seat every new workspace receives; purchased seats do not automatically move to a separate workspace.
To recover them, restore the same workspace with its recovery phrase — its unused seat pool comes back with it. Keep the 12 words safe: they are what ties the workspace, its protected data and its unused seats to you.
Install BossCheckin, create the employer workspace, obtain the required employee access seats and add your employees. Workers download the free MyCheckin client, enter their name and tap Find BossCheckin. On the same local network, the employer selects the waiting device and matches it to the employee; access then arrives automatically over the live LAN connection. No employee activation QR is used. For a quick dedicated terminal, use the built-in Trusted Kiosk on a clean, separate Android device and pair it with the boss's phone. For a fully locked terminal, follow the Permanent Kiosk setup below.
Nothing dramatic — it's on your devices, and the app keeps working offline regardless of anyone's servers. Export what you need (reports/CSV), keep your backups, and uninstall when you're done. Your data was never hostage to a subscription.
By design, Office Web is local-network only — it is never exposed to the public internet, which is exactly why there's no web server for a stranger to attack. For most needs you don't need remote panel access at all: workers' payslips and chat already sync from anywhere through the encrypted relay, and you can hand an accountant reports/CSV.
If you specifically want the panel from afar and you're comfortable with a bit of setup, you can run your own VPN (e.g. WireGuard or Tailscale) on the boss's phone and on the device you'll view from. The panel then travels over your private tunnel — nothing is opened to the internet, and the app doesn't even need to know about it. One caveat: a point-to-point tunnel reaches only the device you connect, not the whole office network (an Android device can't route traffic for others). This is an advanced, do-it-yourself option — BossCheckin neither requires nor bundles a VPN.
Trusted Kiosk is a mode built into BossCheckin. Put BossCheckin on a clean, separate Android phone or tablet, set a 6-digit exit PIN, turn on Trusted Kiosk and pair it with the boss's phone. It is the simpler option when you want a dedicated terminal that the owner can deliberately return to normal app use.
Permanent Kiosk uses the separate KioskCheckin app (com.bosscheckin.kioskcheckin) on an employer-owned, factory-reset Android device. It is provisioned as Android Device Owner, becomes the device's Home screen and runs in true lock-task mode, so workers cannot browse, open Recents or uninstall it through the normal interface.
There is also a Temporary Kiosk inside BossCheckin for briefly opening the scanner on the boss's current phone; it is not a dedicated-device setup.
In BossCheckin, open Permanent Kiosk and approve the one-time download of the signed KioskCheckin module. Enter the WiFi name and password, factory-reset the new kiosk device, then tap the first Android Welcome screen 6–8 times to open its QR scanner. Scan the setup QR shown by BossCheckin and keep both devices on the same WiFi.
The new device receives KioskCheckin from the boss's phone over the local network and completes Android Device Owner provisioning. A computer and USB/ADB are not required for the normal setup.
BossCheckin also manages updates. It can check daily when Automatic update is on, or the owner can use Check now and Update now. The boss's phone downloads and verifies the module, then serves it to Permanent Kiosks over the LAN. A kiosk accepts only a newer package signed with the expected certificate.