Workday Kiosk Security: Protecting Pay Slips and PII on Shared Self-Service Devices

Most Workday kiosk security reviews focus on how a worker signs in. The exposure sits at the other end: how the session ends on a screen that the next person in line will touch thirty seconds later. Session guidance such as NIST SP 800-63B, which recommends an inactivity timeout of no more than one hour, assumes a device that belongs to one person. A break room tablet belongs to everyone. CloudApper builds shared-device self-service on top of Workday, and the design starts from that assumption.

What Workday Offers for Shared Devices

Workday covers time capture well. The Workday Time Kiosk app runs on approved iOS and Android tablets, and workers check in and out with their employee ID. Because it handles time events only, a shared tablet never displays a pay slip. For full self-service, admins can set the tenant session timeout in Maintain Password Rules, override it per account in Edit Workday Account, and use Manage Authentication Policies to require different sign-in rules by network or IP range.

Where Shared Devices Leak Data

Trouble starts when a site wants more than punches. Pay slips, PTO balances, and tax forms mean a full Workday session in a browser on a shared PC or tablet. A tenant timeout tuned for desk workers leaves that session open long after the worker walks away. Downloaded pay slip PDFs stay in the Downloads folder, and browsers offer to save passwords. An open session is also the shortest path to the account takeover behind direct deposit fraud. Shared screens also drive the reset volume behind frontline password and MFA resets.

What to Configure in Workday First

1. Create an authentication policy for kiosk network ranges with a shorter session timeout than desk users get.
2. Keep time capture on the Time Kiosk app so most visits never open a full session.
3. Lock shared browsers to private mode with downloads and password saving disabled.
4. Require MFA for sensitive tasks such as payment election changes.
5. Post a visible sign-out reminder at every kiosk and audit sign-in history from kiosk IP ranges.

Where Native Tools Run Out

These settings shrink the exposure. A browser session still depends on a password typed in front of coworkers, and sign-out still depends on the worker remembering it. Workers who just want to check pay stubs or PTO balances end up with full desktop sessions. This is where CloudApper hrPad changes the shared-device model rather than tightening it.

How CloudApper hrPad Handles Shared-Device Self-Service

CloudApper hrPad turns an iOS, Android, or Windows tablet into a Workday self-service kiosk where each interaction starts with biometric face recognition rather than a typed password. Role-based access limits what each worker sees to their own pay details, PTO balances, and schedules, pulled from Workday. Because it connects through a scoped integration, IT reviews it like any other app, using the checks in our integration system user security review.

Frequently Asked Questions

Q: Does Workday have a kiosk mode?

for Workday

Workday, Built Your Way

Add employee self-service and AI automation to Workday.

See How

Yes. The Workday Time Kiosk app runs on approved iOS and Android tablets and lets workers check in and out with their employee ID. It handles time events, not pay slips or PTO requests.

for Workday

Workday, Built Your Way

Extend Workday with AI, automation, and custom workflows.

Explore Solutions

Q: How do I change the session timeout in Workday?

for Workday

Workday, Built Your Way

Customize Workday without changing your core HCM.

Get Started

Set the tenant default in the Maintain Password Rules task and override individual accounts with Edit Workday Account. Authentication policies can apply stricter rules to specific networks.

Q: Is it safe to let employees access Workday on a shared computer?

for Workday

Workday, Built Your Way

Unlock more value from Workday with AI-powered extensions.

Get Started

It can be, with a short timeout, private browsing, disabled downloads, and MFA for sensitive tasks. The remaining risk is a worker who walks away without signing out.

for Workday

Workday, Built Your Way

Make Workday work smarter with AI-powered employee experiences.

Learn More

Q: How do frontline workers view pay slips without a work computer?

Options include the Workday mobile app, a shared browser kiosk, or a self-service tablet that verifies each worker before showing their data.

Q: Can Workday restrict sign-in by location or network?

Yes. Define networks with Maintain IP Ranges and reference them in Manage Authentication Policies to apply different sign-in requirements by network.

If your shared devices are carrying more Workday data than they were set up to protect, talk to the CloudApper team about a kiosk model built for the frontline.