Current use
The audited current web application uses authentication cookies supplied through Supabase to keep users signed in and refresh their sessions. These cookies are necessary for account access and are not described in the source as advertising cookies.
No advertising, behavioural analytics, or marketing tracker SDK was found in the audited current Next.js web application. Runtime network validation and production tag configuration remain unverified.
Browser local storage
- Attendance upload rows keyed by tenant and month, which may contain employee names or codes, dates, status, shifts, clock-in and clock-out times, and duration.
- Attendance exception rows and report state.
- Last-upload and leave-allocation metadata used by attendance and reporting screens.
- A dormant application auth store definition that can persist user ID, tenant ID, role, plan, and email under the key roster-auth; no active call site was found in the audited current app.
Mobile device storage
The employee mobile application uses AsyncStorage through the Supabase client to persist authentication sessions and support automatic token refresh. The repository hardening update disables Android application backup, but the released mobile build and device restore behaviour have not been independently verified.
Controls and retention
Authentication cookies can be removed by signing out or through browser controls, but removing them will prevent signed-in use. Browser local storage may be cleared through browser settings. The application includes some manual cache-clearing paths, but no complete logout purge or automatic expiry for attendance data was found.
The approved target clears browser workforce caches on logout and tenant change and expires them within 30 days. Production cookie names, exact lifetimes, SameSite/Secure attributes, and deployed runtime tags still require an authenticated browser trace; the cache-expiry target is not yet implemented.
Legacy surface
The retained root static application is not included in the live Next.js container and its legacy file paths redirect to the current login flow. Its historical Cloudflare Worker endpoint is still publicly reachable and rejects unauthorised requests. The Worker must be inventoried, its logs and credentials reviewed, and then disabled or fully governed before the legacy integration can be treated as retired.