Stop logging
compliance.
Start proving it.
Most workforce tools record what was promised. //AIRGAPT proves what actually happened, and enforces it, turning manipulable logs into evidence that holds up to any labour inspector, auditor, or court, anywhere working-time law applies.
An editable log is not evidence.
Every workforce record today can be edited, automated, or entered on someone's behalf. A timestamp a system administrator can change is an assertion, not proof. When a regulator, an auditor, or a court asks an employer to prove what actually happened, when work stopped, when rest began, whether contact occurred after hours, an editable record collapses.
This is true in every jurisdiction with working-time or wage law. The legal standard is rising toward "objective and reliable" proof, and most tools cannot meet it.
Logging is not proving.
Policy is not enforcement.
| Mechanism | Editable / gameable? | Enforces or only logs? | Court/audit-grade evidence? | Privacy posture |
|---|---|---|---|---|
| App / web punch-in | Yes, self-declared, automatable, can be entered by a third party | Logs only | No | Light, but no assurance value |
| Biometric clock | Record is still editable after capture | Logs only | No | Heavy, special-category data, consent burden under GDPR |
| GPS / geofencing | Spoofable; location ≠ work-state | Logs only | No | Heavy, continuous location tracking |
| MDM quiet-time / policy tools | Employer can reconfigure at will; produces no evidence | Neither, suppresses, doesn't prove | No | Light, but zero evidential value |
| Payroll / HRIS logging | Only as trustworthy as the editable sources feeding it | Logs only | No | Varies |
| AIRGAPT | No, a deliberate physical act on a non-exportable hardware key | Enforces AND proves | Yes, cryptographically signed, tamper-evident, attributable | Light, signed metadata only, no biometric data, no content, no location |
Hardware-anchored.
Deterministically enforced.
Cryptographically signed.
//AIRGAPT uses the FIDO2 security key your employees already use to log in. When the rest period or working-time boundary is reached, the work connection is enforced at the device. Every event, enforcement, voluntary override, reconnection, is cryptographically signed by the employee's own key and written to a tamper-evident ledger.
The result is independent, attributable, non-repudiable proof of what actually happened. No biometric data. No surveillance of content. No new hardware. Deploys through Intune, Jamf, or SCCM.
Honest scope: Today this enforces on computers (PC). Mobile and frontline/field capture are on the roadmap.
Why hardware? FIDO2 passkeys are now deployed by approximately 68% of organisations for employee authentication (FIDO Alliance State of Passkeys 2026). //AIRGAPT runs on the same token, no new infrastructure, no separate enrolment, 30-day onboarding.
Workforce Module · Live Demo
The human act behind every decision.
One engine. From working-time evidence today, to authorising machine actions tomorrow.
Make the decision count →Utilize Existing Infrastructure.
Rolling out physical compliance does not require manufacturing delays. //AIRGAPT integrates dynamically with the FIDO Alliance Metadata Service. If your workforce already carries YubiKeys or Feitian tokens for login access, our patent-pending software composes with existing hardware tokens to produce a tribunal-ready working-time evidence anchor.
The FIDO MDS is continuously queried. Any token certified by the FIDO Alliance automatically passes hardware attestation without additional procurement.
Your existing YubiKey inventory is already deployed. //AIRGAPT composes with the hardware your employees already carry.
One engine.
Every working-time obligation.
The same enforcement mechanism and the same evidence chain serve every working-time obligation your organisation faces.
Defend against wage and overtime claims.
Underpayment exposure is the fastest-growing employment liability in English-speaking markets. When an employee claims they were required to work unrecorded hours, or that rest periods were denied, the employer's defence lives or dies on the quality of its time records. An //AIRGAPT evidence chain is employer-unalterable, which means it defends the employer when claims are unfounded, and it surfaces the truth when they are not.
Prove rest and working time.
The legal standard for working-time records is "objective and reliable", set by the Court of Justice of the EU in CCOO v Deutsche Bank (C-55/18, 2019). That ruling applies to any employer with staff in the EU. //AIRGAPT is designed to meet this standard: its records are hardware-signed, continuous, and cannot be altered by the employer. This is the universal baseline, the minimum defensible record for any organisation operating under working-time law.
Comply with the right to disconnect.
Where right-to-disconnect law applies, a policy document is not enough, enforcement and proof are required. //AIRGAPT deterministically enforces the disconnection boundary and produces cryptographic evidence that it was respected. Luxembourg's Law of 28 June 2023 mandates verifiable working-time records; ITM sanctions between €251 and €25,000 are live from approximately 1 July 2026. Australia's right-to-disconnect provisions are in force for large employers since August 2024 and for all employers since August 2025.
A key, not a body.
//AIRGAPT records signed metadata about work-state events, never content, never location, never biometric data. The physical act of engaging or disengaging a hardware key is the proof; nothing about the person beyond that event is collected or transmitted.
This gives organisations a tool to be compliant with GDPR and national data-protection law, not another surveillance system to defend. Employees are not monitored. They are represented by a signed, attributable record of their own deliberate actions.
The assurance layer your stack is missing.
Workforce compliance is the first module. The same engine extends to other evidence-driven obligations as they move from documentation to demonstrable proof.
Calculate your liability.
Run a jurisdictionally-calibrated working-time exposure estimate in under 2 minutes.