Guides, glossaries and calculators to help you scope, cost and run an ERPNext implementation — from GST and e-invoicing setup to module-by-module walkthroughs.
Quick definitions of key terms
Expert insights and updates
Simple step-by-step resources
Easy explanations through videos.
Complete IRN flow in ERPNext (2026)
ERPNext HRMS for India's Labour Codes
ERPNext for Indian hospitals (NABH, ABDM, DPDP)
DPDP Act 2023 Compliance in ERPNext
From the punch to the payslip, with nothing in between. Almost every factory already has a biometric device, and almost every one of them also has somebody re-keying its output into a spreadsheet before payroll. The device is not the missing piece. The join between the device log and the attendance record is.
Devices are typically polled over the local network using their own SDK, with the open-source sync tool as the usual starting point.
Yes. Punch logs from ESSL, ZKTeco and compatible devices are pulled over the network and pushed into ERPNext as Employee Checkin records. Shift rules then convert those check-ins into attendance, calculating late marks, early exits and overtime, which flow into payroll without a separate register.
The hardware works. What breaks is everything around it, and it breaks in the same four places every time.
The device knows enrolment number 214. HR knows an employee code. Nobody maintained the mapping, so leavers stay enrolled, new joiners punch into nothing, and the log needs manual translation before it means anything.
Night shifts cross midnight, rotating patterns change weekly, and a general shift employee covering a night is an exception. Raw punch times cannot be turned into attendance without shift logic, so someone applies it by hand.
People forget, devices fail to read, and the gate is busy at shift change. A single missing punch makes the day unusable and, without a regularisation workflow, becomes a WhatsApp message to the supervisor and a manual edit.
Several units each with their own device, some on networks that are not always reachable. Attendance is consolidated at month end by collecting exports, which is exactly when there is no time to investigate discrepancies.
The measure is whether payroll can be run from the system without anyone opening a spreadsheet first.
A sync agent on your network polls each device on a short interval and pushes punch records into ERPNext as Employee Checkin entries, holding position so nothing is re-imported or missed.
Because the agent runs inside your network, devices do not need to be exposed to the internet — which is both simpler and considerably safer.
Enrolment numbers are mapped to ERPNext employee records, with joiners and leavers reflected so the mapping does not silently rot.
Unmapped punches raise an exception rather than being discarded, which is how you find out somebody is still enrolled six months after leaving.
Check-ins are converted to attendance using your shift definitions, including night shifts that cross midnight, rotating rosters and grace periods, producing late marks, early exits and overtime.
This is where the real work is. Getting shift rules right is most of the project; the device connection is the easy half.
Missed punches raise a request the employee submits and a supervisor approves, with the correction recorded against the day rather than edited into the record.
The audit trail matters. A manually altered attendance record with no approval behind it is a problem in any labour inspection.
Approved attendance feeds leave balances and payroll directly, so present days, overtime hours and deductions are calculated from the same records that came off the device.
Removing the spreadsheet stage removes the transcription errors that come with it, which is usually the change people actually notice.
Each stage keeps its own record, so a payroll figure can always be traced back to the punch that produced it.
| Source | ERPNext record | Direction | Notes |
|---|---|---|---|
| Punch log entry | Employee Checkin | Device → ERPNext | Timestamp, device ID and in/out direction |
| Enrolment number | Employee link | Mapping | Unmapped punches raise an exception, not a silent drop |
| Device location | Shift Location / branch | Mapping | Supports multi-site consolidation |
| Check-in pairs | Attendance | Derived | Shift rules applied, including midnight crossings |
| First-in and last-out | Working hours & overtime | Derived | Grace periods and rounding as configured |
| Missing punch | Attendance Request | Employee → Supervisor | Approved correction, retaining the audit trail |
| Approved leave | Attendance marked on leave | Derived | Leave and attendance reconcile rather than conflicting |
| Attendance | Salary Slip inputs | Derived | Present days, overtime and deductions |
| Device offline | Sync exception alert | Agent → ERPNext | Surfaced immediately, not at month end |
Shift rules first. Connecting the device to a system that cannot interpret its output achieves nothing.
Every shift actually worked, including rotations, night crossings, half days, grace periods and how overtime is currently calculated. This usually surfaces rules that exist only in one supervisor's head.
Enrolment numbers are matched against current employees, leavers are removed and joiners enrolled. Most sites find a meaningful number of stale enrolments at this stage.
The agent is deployed inside your network with access to each device, and connectivity is proved from every site including the ones with unreliable links.
System attendance and the existing register run side by side for a full payroll cycle and are compared. Differences are investigated before anyone is paid from the new source.
Payroll runs from system attendance, with the regularisation workflow already in use so missed punches have a route that is not a message to a supervisor.
Timeline shown is indicative and assumes devices are on a reachable network. Sites with intermittent connectivity need buffering and take longer to prove.
Attendance projects fail on expectations more than on technology, so these are worth being blunt about.
Where biometric data is processed, obligations under applicable data protection rules apply. Retention and access should be reviewed with your own advisors.
ESSL, ZKTeco and compatible units are the common cases, connected over the local network through their own SDK. Support depends on the specific model exposing a usable interface, so the model number is worth checking early rather than assuming.
No. Only the punch event — enrolment number, timestamp and direction — is transferred. Biometric templates stay on the device. Keeping them out of the ERP is deliberate and removes an entire category of obligation.
Yes. Shift definitions carry the crossing explicitly, so an employee punching in at 22:00 and out at 06:00 is one shift rather than two partial days. Rotating rosters and grace periods are configured the same way.
The day is flagged rather than silently marked absent, and the employee raises a regularisation request their supervisor approves. The correction is recorded with its approval, which matters if attendance records are ever inspected.
Yes. Each device is polled independently and mapped to its location, so attendance consolidates across sites in one system while remaining reportable per unit. Sites with intermittent connectivity buffer locally and catch up.
Sync failures raise an alert rather than waiting to be noticed. Without that, a device that stopped reporting on the fourth of the month is discovered during payroll, which is the worst possible time.
A short call about your devices, your shifts and how much of payroll is still assembled by hand.
ESSL and ZKTeco are trademarks of their respective owners. ERPNext and Frappe are trademarks of Frappe Technologies Pvt. Ltd. These names are used here only to identify the hardware described. Finstein is not affiliated with or endorsed by any device manufacturer, and hardware is procured directly by you.
