Do I have to make my HR system available externally for halion clock:it go?

No. Communication with the local HR system only ever takes place via the clock:it AppService, which is also installed locally. This in turn communicates with the clock:it MobileService in such a way that no permanently open and externally accessible ports and connections are required in the firewall. We developed clock:it go with high security requirements in mind right from the start!