Geo-Validated Workforce Governance Platform

It kicked off with a straightforward ask from a large field-ops telecommunication client: stop payroll disputes by proving workers were actually at assigned sites. Old-school check-ins were laughably fakeable - GPS spoofing apps, buddy punching on shared devices, proxies clocking in for absent colleagues, and spotty reports that turned audits into finger-pointing sessions. As systems architect and lead engineer, I took full ownership, treating every attendance event as something that had to be verifiable, traceable, and practically impossible to tamper with.

The core principle became multi-factor validation right at check-in: no single signal trusted alone. In the mobile field app (React Native for cross-platform), I layered Haversine formula geofencing (calculating great-circle distance between worker GPS and site centroid, with configurable radius like 50-200m) against strict GPS accuracy thresholds (rejecting if >20-30m horizontal error), device fingerprinting (hashing hardware IDs, OS version, app install traits), mock-location detection (Android's isFromMockProvider/isMock flags plus behavioral checks; iOS integrity signals via jailbreak/emulator probes), and forced biometric selfie capture (liveness-checked where possible). Only when identity + device integrity + geo constraints aligned did the check-in commit - otherwise, graceful failure with user prompts.

But check-in was just the start; workers could dip out after. So we added continuous low-power tracking: buffered GPS sampling (every 5-15 min depending on motion/activity), status logs (on-site/off-site transitions), and task updates. All events got cryptographically signed (HMAC or JWT with device keys), deduplicated by unique event IDs, and queued for upload. Field network hell (Bangladesh rural drops, spotty 4G) meant robust offline buffering with exponential backoff retries and replay safety - no data lost silently.

To lock in payroll integrity, I built an immutable append-only ledger: every state change (check-in, movement, checkout) stored as timestamped, signed events. Redis powered low-latency real-time validation (e.g., active session checks), MongoDB ingested enriched streams for flexible querying, and MySQL held structured, audit-ready summaries with foreign-key integrity. No overwrites - only appends and compensating events if corrections needed (rare, audited).

Backend evolved event-driven: field app → auth API gateway → validation core (rules engine + spoof detectors) → processing layer (dedup, enrichment) → ledger stores → role-based dashboards for supervisors (real-time site heatmaps, violation alerts via push/email). Payroll exports pulled clean, traceable summaries; compliance audits could drill into any event chain.

By launch, a full shift flowed like: geo+biometric check-in → continuous sampled tracking → immutable event logging → payroll-safe checkout. What began as basic attendance hardened into a governed ops backbone - anti-spoofing layers, network-resilient, transparent under scrutiny.

The hardest part wasn't math or maps - it was layering enough signals to build real trust without making the app unusable in the field. Late nights tuning thresholds after test failures, watching mock-location apps get blocked live, and seeing payroll disputes vanish made every refactor worth it. Trust isn't a feature; it's engineered event by event.