TRUST CENTER, SICHERHEIT & TECHNOLOGISCHE SOUVERÄNITÄT

Überprüfbare Compliance-Architektur für Datenschutzbeauftragte, IT-Sicherheit & Arbeitsaufsicht.

Alle technischen, kryptografischen und vertraglichen Nachweise zur schnellen Freigabe von Sekia HR: dedizierte EU-Server, manipulationssichere SHA-256-Verkettung, null invasive Biometrie und lokale KI.

Auditor- & DSB-Kit herunterladen AVV-Vertrag prüfen (Art. 28 DSGVO)

100% EU

Physische Datenhaltung für DB, S3 & lokale KI

SHA-256

Unveränderliche Kette ab GENESIS-Block

0 Biometrie

Strikte DSGVO- & AEPD-Konformität

4 Jahre

Garantierte revisionssichere Aufbewahrung

SÄULE 01 · EU-DATENSOUVERÄNITÄT & INFRASTRUKTUR

Ihre Personaldaten verlassen niemals die EU und fließen in keine externen KI-APIs

Engineered under strict European data sovereignty to eliminate Schrems II / US CLOUD Act exposure and enforce strict tenant isolation.

Dedicated Servers in Spain / EU

PostgreSQL databases, S3-compatible document vaults, and application nodes operate exclusively under European Union jurisdiction.

Strict Multi-Tenant Isolation

Mandatory companyId scoping across every query and service boundary prevents cross-organization data leakage by design.

100% Local Sovereign AI OCR

Expense receipts, tax IDs, and VAT breakdowns are parsed on our isolated local inference engine—never sent to OpenAI or third-party cloud APIs.

Encrypted 3-2-1 Off-Site Backups

Automated nightly backup pipeline maintaining 3 copies across 2 distinct media types with 1 isolated, encrypted off-site replica.

SÄULE 02 · KRYPTOGRAFISCHE SHA-256-UNVERÄNDERLICHKEIT

Mathematisch prüfbarer Manipulationsschutz für Zeiterfassungsdaten

Every clock event seals a SHA-256 digest incorporating the exact previousHash of the preceding record. Any silent database edit immediately breaks downstream hashes.

Production sealing payload (TimeRecordsService)

Dual-Hash Auditable Amendment Workflow

When an employee forgets to clock out, Sekia HR never overwrites history: it records a justified amendment request, preserves the original entry intact, and chains the bilaterally approved correction.

LIVE CRYPTOGRAPHIC SANDBOX

Interactive SHA-256 Chain Integrity Verifier

Test how the audit engine reacts to an unauthorized retroactive 30-minute overtime edit.

KETTE VERIFIZIERT · 100 % INTEGRITÄT

All 3 time blocks preserve continuous cryptographic linkage from GENESIS. Ready for instant Labor Inspectorate (ITSS) export.

#012026-10-28 · 08:00:00 → 14:00:00

VALID

previousHash: GENESIS

recordHash (SHA-256): 9f4a81c2...e73b04d1

#022026-10-28 · 15:00:00 → 17:30:00

VALID

previousHash: 9f4a81c2...e73b04d1

recordHash (SHA-256): 3c8e50b9...a120f84e

#032026-10-29 · 08:02:14 → 16:04:09

VALID

previousHash: 3c8e50b9...a120f84e

recordHash (SHA-256): 7a02d6f1...c49b81e3

SÄULE 03 · DSGVO-KONFORMITÄT & NULL BIOMETRIE

Privacy by Design: keine Fingerabdrücke, keine Gesichtserkennung, kein Dauer-GPS

Spanish & EU data protection authorities heavily fine biometric timekeeping. Sekia HR shields your company with asymmetric FIDO2 Passkeys and strict data minimization.

GDPR Art. 9 · AEPD Ruling

Zero Server Biometrics (AEPD Standard)

Architectural prohibition against storing fingerprint or facial vectors—eliminating Art. 9 GDPR special-category fines at the root.

FIDO2 · Public Key

Native FIDO2 / WebAuthn Passkeys

Standards-based @simplewebauthn/server public-key cryptography: local device unlock never leaves the employee's hardware Secure Enclave.

TLS 1.3 · AES-256

TLS 1.3 Transit & AES-256 Storage

End-to-end TLS 1.3 + strict HSTS in transit paired with AES-256 encrypted storage volumes and adaptive secret hashing.

OWASP ASVS · 5 Roles

HttpOnly Cookies, CSRF Shield & RBAC

JavaScript-inaccessible session cookies (XSS mitigation), double-submit CSRF tokens, and 5-role RBAC enforcement.

SÄULE 04 · GARANTIERTE 4-JÄHRIGE AUFBEWAHRUNG

Unveränderliche 4-Jahres-Archivierung, 1-Klick-Prüfungsexport & volle Portabilität

Spanish labor law (Art. 34.9 ET) mandates keeping unaltered daily time records accessible for four full years.

4 Years of Active Signed Custody

Every clock-in, break, overtime balance, and leave certificate stays indexed with its SHA-256 verification chain for a minimum of 48 months.

1-Click Electronic Audit Export

Generate structured CSV and PDF audit bundles filtered by workplace, date range, and tax ID with verifiable hashes during any inspection.

Full Data Portability (Zero Lock-in)

Your company retains 100% ownership of its records with unrestricted export in standard open formats (CSV, JSON, PDF, XML) at any time.

SÄULE 05 · GOVERNANCE-KIT FÜR PRÜFER & DSB

Unterschriftsreife Datenschutz- und Richtlinienvorlagen

Save days of legal drafting for your DPO or external counsel with templates aligned to 2026 labor and GDPR requirements.

Data Processing Agreement (Official GDPR DPA)Review the binding GDPR Article 28 terms between your company (Controller) and Sekia Technologies S.L. (Processor).Vollständigen AVV öffnen

ISO/IEC 27001 Aligned Security ControlsInspect our logical access controls, cryptographic audit logging, and operational resilience architecture.Sicherheitskontrollen ansehen

FULL DOCUMENT PREVIEW

Employee Timekeeping Privacy Notice (Art. 34.9 ET & GDPR)

# EMPLOYEE PRIVACY NOTICE TEMPLATE — DIGITAL TIMEKEEPING (SPANISH ART. 34.9 ET & GDPR ART. 13)

**Data Controller:** [COMPANY LEGAL NAME] — Tax ID: [TAX ID / CIF]
**Registered Office:** [FULL ADDRESS] | **Privacy / DPO Contact:** [DPO EMAIL]
**EU Data Processor (SaaS):** Sekia Technologies S.L. (Sovereign EU/Spain infrastructure)

## 1. Purpose and Legal Basis
Pursuant to **Article 34.9 of the Spanish Workers' Statute** and **Article 6(1)(c) GDPR**, the Company records daily clock-in, break, and clock-out timestamps through **Sekia HR**.

## 2. Data Minimization & Zero Invasive Biometrics (AEPD Standard)
- **Zero server-side biometric templates:** No fingerprints or facial recognition vectors are captured or stored. Optional device unlock via **FIDO2 Passkeys / WebAuthn** stays exclusively inside the employee's local Secure Enclave.
- **Point-in-time geolocation only:** For mobile staff, GPS coordinates are captured solely at the exact moment of clocking in/out—never via continuous background tracking.

## 3. SHA-256 Cryptographic Integrity & 4-Year Legal Retention
Every time record generates a chained **SHA-256** digest (`previousHash -> recordHash`) preventing silent retroactive edits. Amendments preserve the original record alongside a timestamped audit reason. Records are retained unaltered for **four (4) years** for employees, union representatives, and Labor Inspectorate (ITSS) audits.

## 4. Data Subject Rights
Employees may exercise access, rectification, restriction, and objection rights at [DPO EMAIL] or lodge a complaint with the supervisory authority (www.aepd.es).

Häufige Fragen von Datenschutzbeauftragten & IT-Prüfern

Direct technical answers for privacy impact assessments, InfoSec reviews, and labor inspections.

Where are databases and uploaded HR documents physically hosted?

100% of production compute, PostgreSQL databases, S3 document storage, and local AI OCR engines run within Spain and the European Union, with zero unauthorized third-country transfers.

Does Sekia HR use fingerprint scanners or facial recognition?

No. In strict compliance with the AEPD November 2023 guidelines and GDPR data minimization, Sekia HR never captures or stores biometric data. Optional FIDO2 WebAuthn Passkeys keep local unlock strictly inside the employee's device.

How are forgotten clock-outs corrected if SHA-256 records are immutable?

Through a transparent amendment workflow: the original record is never overwritten or deleted. Instead, a justified correction entry is linked and re-sealed into the SHA-256 chain, preserving complete auditability.

Does the expense receipt scanner send images or tax IDs to OpenAI?

Never. Optical character recognition runs on our own sovereign local inference engine inside Sekia HR's private EU infrastructure at zero per-scan cost.

SCHNELLE SICHERHEITSFREIGABE

Starten Sie rechtlich und kryptografisch geschützte Zeiterfassung in 3 Minuten

14-day free trial with built-in GDPR DPA, EU data sovereignty, and transparent flat-rate pricing.

Rechtskonformes Konto starten Pauschaltarife ansehen

ART. 88 LOPDGDD · GESETZ 10/2021 · AUTOMATISCHER WÄCHTER

Automatischer Wächter für Digitale Nichterreichbarkeit & Ruhezeiten

Hält nicht dringende Benachrichtigungen nach Feierabend oder im Urlaub automatisch zurück, verhindert Schichtpläne mit unter 12 Stunden Ruhezeit und erstellt das offizielle Betriebsprotokoll für die Arbeitnehmervertretung.

Ruhezeit-WächterAktiv · 19:00 – 08:30 CET

Reales Compliance-Szenario simulieren

Echtzeit-Engine für Zustellaufschub & Ruhezeiten

Art. 88.1 LOPDGDD · Cláusula 2.2

Ereigniszeitpunkt19:42 CET

Zustellfenster / Maßnahme08:30 CET (Turno Mañana)

Benachrichtigung sicher bis 08:30 Uhr zurückgestellt

Sekia HR erkennt das Schichtende und stellt Push- sowie Systemmeldungen erst zum nächsten Dienstbeginn zu.

Offizieller Protokoll-Generator (Art. 88 LOPDGDD)

PROT-ART88-2026-RLT · Vorausgefüllt mit Steuernummer, Ruhefenster und RLT-Unterschriftsfeld

Ohne Aufpreis enthalten · Schützt vor Bußgeldern bis 7.500 €

Wächter kostenlos testen

Überprüfbare Compliance-Architektur für Datenschutzbeauftragte, IT-Sicherheit & Arbeitsaufsicht.

100% EU

Physische Datenhaltung für DB, S3 & lokale KI

SHA-256

Unveränderliche Kette ab GENESIS-Block

0 Biometrie

Strikte DSGVO- & AEPD-Konformität

4 Jahre

Garantierte revisionssichere Aufbewahrung

# EMPLOYEE PRIVACY NOTICE TEMPLATE — DIGITAL TIMEKEEPING (SPANISH ART. 34.9 ET & GDPR ART. 13) **Data Controller:** [COMPANY LEGAL NAME] — Tax ID: [TAX ID / CIF] **Registered Office:** [FULL ADDRESS] | **Privacy / DPO Contact:** [DPO EMAIL] **EU Data Processor (SaaS):** Sekia Technologies S.L. (Sovereign EU/Spain infrastructure) ## 1. Purpose and Legal Basis Pursuant to **Article 34.9 of the Spanish Workers' Statute** and **Article 6(1)(c) GDPR**, the Company records daily clock-in, break, and clock-out timestamps through **Sekia HR**. ## 2. Data Minimization & Zero Invasive Biometrics (AEPD Standard) - **Zero server-side biometric templates:** No fingerprints or facial recognition vectors are captured or stored. Optional device unlock via **FIDO2 Passkeys / WebAuthn** stays exclusively inside the employee's local Secure Enclave. - **Point-in-time geolocation only:** For mobile staff, GPS coordinates are captured solely at the exact moment of clocking in/out—never via continuous background tracking. ## 3. SHA-256 Cryptographic Integrity & 4-Year Legal Retention Every time record generates a chained **SHA-256** digest (`previousHash -> recordHash`) preventing silent retroactive edits. Amendments preserve the original record alongside a timestamped audit reason. Records are retained unaltered for **four (4) years** for employees, union representatives, and Labor Inspectorate (ITSS) audits. ## 4. Data Subject Rights Employees may exercise access, rectification, restriction, and objection rights at [DPO EMAIL] or lodge a complaint with the supervisory authority (www.aepd.es).

Ihre Personaldaten verlassen niemals die EU und fließen in keine externen KI-APIs

Dedicated Servers in Spain / EU

Strict Multi-Tenant Isolation

100% Local Sovereign AI OCR

Encrypted 3-2-1 Off-Site Backups

Mathematisch prüfbarer Manipulationsschutz für Zeiterfassungsdaten

Dual-Hash Auditable Amendment Workflow

Interactive SHA-256 Chain Integrity Verifier

Privacy by Design: keine Fingerabdrücke, keine Gesichtserkennung, kein Dauer-GPS

Zero Server Biometrics (AEPD Standard)

Native FIDO2 / WebAuthn Passkeys

TLS 1.3 Transit & AES-256 Storage

HttpOnly Cookies, CSRF Shield & RBAC

Unveränderliche 4-Jahres-Archivierung, 1-Klick-Prüfungsexport & volle Portabilität

4 Years of Active Signed Custody

1-Click Electronic Audit Export

Full Data Portability (Zero Lock-in)

Unterschriftsreife Datenschutz- und Richtlinienvorlagen

Employee Timekeeping Privacy Notice (Art. 34.9 ET & GDPR)

Internal Digital Disconnection Policy (Art. 88 LOPDGDD)

DPO Technical & Security Controls Annex (GDPR Art. 28 & 32)

Employee Timekeeping Privacy Notice (Art. 34.9 ET & GDPR)

Häufige Fragen von Datenschutzbeauftragten & IT-Prüfern

Where are databases and uploaded HR documents physically hosted?

Does Sekia HR use fingerprint scanners or facial recognition?

How are forgotten clock-outs corrected if SHA-256 records are immutable?

Does the expense receipt scanner send images or tax IDs to OpenAI?

Starten Sie rechtlich und kryptografisch geschützte Zeiterfassung in 3 Minuten

Automatischer Wächter für Digitale Nichterreichbarkeit & Ruhezeiten

Ihre Personaldaten verlassen niemals die EU und fließen in keine externen KI-APIs

Dedicated Servers in Spain / EU

Strict Multi-Tenant Isolation

100% Local Sovereign AI OCR

Encrypted 3-2-1 Off-Site Backups

Mathematisch prüfbarer Manipulationsschutz für Zeiterfassungsdaten

Dual-Hash Auditable Amendment Workflow

Interactive SHA-256 Chain Integrity Verifier

Privacy by Design: keine Fingerabdrücke, keine Gesichtserkennung, kein Dauer-GPS

Zero Server Biometrics (AEPD Standard)

Native FIDO2 / WebAuthn Passkeys

TLS 1.3 Transit & AES-256 Storage

HttpOnly Cookies, CSRF Shield & RBAC

Unveränderliche 4-Jahres-Archivierung, 1-Klick-Prüfungsexport & volle Portabilität

4 Years of Active Signed Custody

1-Click Electronic Audit Export

Full Data Portability (Zero Lock-in)

Unterschriftsreife Datenschutz- und Richtlinienvorlagen

Employee Timekeeping Privacy Notice (Art. 34.9 ET & GDPR)

Internal Digital Disconnection Policy (Art. 88 LOPDGDD)

DPO Technical & Security Controls Annex (GDPR Art. 28 & 32)

Employee Timekeeping Privacy Notice (Art. 34.9 ET & GDPR)

Häufige Fragen von Datenschutzbeauftragten & IT-Prüfern

Where are databases and uploaded HR documents physically hosted?

Does Sekia HR use fingerprint scanners or facial recognition?

How are forgotten clock-outs corrected if SHA-256 records are immutable?

Does the expense receipt scanner send images or tax IDs to OpenAI?

Starten Sie rechtlich und kryptografisch geschützte Zeiterfassung in 3 Minuten

Automatischer Wächter für Digitale Nichterreichbarkeit & Ruhezeiten