OneTap compliance pack
Draft for legal review. Not yet published. This pack describes what OneTap is built to do. Counsel and Oltin's security lead must review it, and complete every part in square brackets, before OneTap goes live. To keep a copy, print this page or save it as a PDF.
Contents
- Roles and the agreement
- The data OneTap processes
- Where the data is kept
- Security controls
- How long data is kept
- Personal data breaches
- Employees' rights and grievances
- Statutory records
- Template: your data protection impact assessment
- Security testing
- Accessibility
1. Roles and the agreement
Your company is the Data Fiduciary under the Digital Personal Data Protection Act, 2023: it decides why and how its employees' attendance is recorded. Oltin, of 431 Fen Street, Brooklands, Milton Keynes, MK10 7PE, is its Data Processor and processes the data only to provide OneTap, on the instructions in the Data Processing Agreement and the settings your admins choose. The person who signs your company up accepts the agreement; OneTap records the version, the time and who accepted it.
2. The data OneTap processes
| About | Data | Why |
|---|---|---|
| Employees | Name, work email, employee ID, role, the offices they may check in at. If your company gives them, the details attendance registers ask for: designation, gender, date of birth, father's or spouse's name, and date of joining. | To know who is checking in, and where they may. |
| Attendance | Check-in and check-out times as the server records them, the office matched, which checks passed, the trust level, and any review decision with its reason. | To record attendance and keep the statutory registers. |
| Linked phones | Model, operating system, app version, the phone's public keys, and the results of Apple App Attest or Google Play Integrity checks. | So only the employee's own, genuine phone can check them in. |
| At the moment of a check-in only | The office Wi-Fi router's hardware ID and name, and the public address of the request. | To confirm the check-in happened at the office. |
| Admins | Name, work email, sign-in records and the audit trail of their changes. | To secure OneTap Admin and show who changed what. |
OneTap keeps no location trails, stores no coordinates of people and processes no biometrics. At an office with an area set, the phone sends one position at each tap; OneTap compares it with the area and keeps only whether it was inside, how far it was and how accurate the reading was, never the position. If the person allows location all the time, the phone also says when it leaves the office's area after a check-in, so OneTap can check them out; it reports nothing else. Face ID and fingerprint stay on the phone: OneTap receives only a signature the phone makes after it unlocks its key.
3. Where the data is kept
The data is stored and processed in Google Cloud's Belgium region, in the European Union. It leaves the European Union only for the phone checks Apple and Google run, and in transit across the network edge. The sub-processors are listed in the trust center, and every company gets at least 30 days' notice of a change, and may object by writing to Oltin at the address in section 1.
4. Security controls
| Area | What OneTap does |
|---|---|
| Encryption | TLS 1.2 or newer in transit; encryption at rest for the database and files. |
| Keeping companies apart | Row-level security in the database for every company's tables, with tests that one company can never read or change another's data, run on every change. |
| Check-ins | Decided on the server, never by the app: the linked phone's key, unlocked by Face ID or fingerprint, signs a single-use challenge, and the server checks the office network and its own time. |
| Admins' sign-in | Email codes, and an authenticator app for everyone who signs in on the web; sessions end after inactivity. |
| Oltin's staff | The operator console is reachable only from allowed networks, through single sign-on and a code from an authenticator app, for 15 minutes of inactivity at most. Staff see counts and set-up. To help a company, a named member of staff can open its OneTap Admin for two hours at most, with the reason recorded, as far as its owner allows: to see it only (where a new company starts), to see it and make the changes an admin can, or not at all. They never act as the owner, and everything they do is in the company's audit trail as well as the platform audit. |
| Tamper evidence | Attendance records, their edits and the audit trail are chained by hashes, so a change made outside OneTap can be detected. Admins can run the check from OneTap Admin. |
| Logs | Security logs are kept for at least one year in the European Union, with clocks synchronised to India's standard time sources. |
| Development | Every change passes automated checks before release: type checks, tests including tenant isolation, dependency rules, a secret scan and accessibility tests. Security controls are aligned with ISO/IEC 27001, and the application is built to OWASP ASVS level 2. |
5. How long data is kept
| Data | Kept for |
|---|---|
| Attendance records and statutory registers | At least five years, as the Labour Codes require, on every plan; six for a company with an office in Uttar Pradesh, as its rules require. |
| Everything else about your company | While your company uses OneTap. When it leaves, it can download everything first; the data is then deleted within 30 days and a certificate of deletion is issued. |
| Records the law requires after you leave | Until their period ends, then deleted. |
| Security logs | At least one year. |
| Sign-in codes and sessions | Removed automatically once they have expired. |
6. Personal data breaches
- Where the CERT-In directions require it, Oltin reports the incident within 6 hours.
- Oltin tells your company within 24 hours of becoming aware of a breach, with what is known and what is being done.
- Your company informs the Data Protection Board of India and the people affected within 72 hours. Your owner names a breach contact in OneTap Admin, so the notice reaches the right person.
7. Employees' rights and grievances
Employees read the privacy notice in English or any of the 22 languages of the Eighth Schedule, and acknowledge it again when it changes. They can ask your company for a copy of their data or a correction from the app, and your admins see each request with its due date. Your company names a grievance officer, whom employees can reach in the app.
8. Statutory records
OneTap keeps the attendance register in the central Labour Code format and the formats of the states it supports, as a spreadsheet and a signed PDF. When a state's rules change, Oltin updates the formats without an app release, and your admins see what changed and from when.
9. Template: your data protection impact assessment
Your company may assess OneTap before it uses it. The answers below describe OneTap; add your own context where the square brackets ask.
| Question | Answer |
|---|---|
| What is the purpose? | Recording attendance for employment and keeping the attendance register the Labour Codes require. [Add your own purposes, such as payroll.] |
| What is the lawful basis? | Processing for the purposes of employment, under section 7 of the Digital Personal Data Protection Act, 2023. [Confirm with your counsel.] |
| Whose data, and how much? | [Number] employees at [number] offices. The data is listed in section 2. |
| Is the data the least needed? | Yes: no location trails, no stored coordinates and no biometrics. Network details and a position are read only at the moment of a tap, and the position isn't kept. |
| Who can see it? | Your owners and admins, and each employee for their own records. Oltin's staff see counts and set-up, and the rest only while supporting you, as far as your owner allows. |
| What could go wrong for employees? | A wrong record, such as a check-in refused at the office. Each refusal shows its reason, failed check-outs go to a review queue, and every edit needs a reason and is recorded. |
| How are employees told? | Through the privacy notice in the app, in their language, before they first check in, and again when it changes. |
| Residual risk and decision | [Your assessment, who approved it, and the date.] |
10. Security testing
Before launch, an internal security review read the code (October 2026) and found nothing critical or high; its ten medium and low findings were fixed or accepted with reasons. An internal penetration test then attacked the running services (27 October 2026): company boundaries, sign-in, protection from cross-site requests, owner-only rules and the escaping of exports held, and its two high findings, at the network edge and in Oltin support's powers, were fixed with eleven lower ones before launch. Every fix has a test that runs on each change. [Independent penetration test: provider, scope and date.]
11. Accessibility
OneTap Admin is built to WCAG 2.1 AA and checked automatically on every change. The app supports screen readers, larger text and large touch targets. The accessibility statement says how it is checked and how to report a barrier.