TRUST CENTER, SECURITY & TECHNOLOGICAL SOVEREIGNTY

Verifiable compliance architecture for DPOs, Security Committees & Labor Auditors.

Every technical, cryptographic, and contractual safeguard your Legal and IT teams need to approve Sekia HR in minutes: dedicated EU servers, tamper-evident SHA-256 hash chaining, zero invasive biometrics, and sovereign local AI.

Download Auditor & DPO Kit Review GDPR Art. 28 DPA

100% EU

Physical residency for DB, S3 & local AI

SHA-256

Tamper-evident chain from GENESIS block

0 Biometrics

Strict compliance with AEPD 2023 ruling

4 Years

Guaranteed immutable statutory retention

PILLAR 01 · EU DATA SOVEREIGNTY & INFRASTRUCTURE

Your workforce data never crosses the Atlantic or feeds external AI APIs

Engineered under strict European data sovereignty to eliminate Schrems II / US CLOUD Act exposure and enforce strict tenant isolation.

Dedicated Servers in Spain / EU

PostgreSQL databases, S3-compatible document vaults, and application nodes operate exclusively under European Union jurisdiction.

Strict Multi-Tenant Isolation

Mandatory companyId scoping across every query and service boundary prevents cross-organization data leakage by design.

100% Local Sovereign AI OCR

Expense receipts, tax IDs, and VAT breakdowns are parsed on our isolated local inference engine—never sent to OpenAI or third-party cloud APIs.

Encrypted 3-2-1 Off-Site Backups

Automated nightly backup pipeline maintaining 3 copies across 2 distinct media types with 1 isolated, encrypted off-site replica.

PILLAR 02 · SHA-256 CRYPTOGRAPHIC IMMUTABILITY

Mathematically verifiable anti-fraud audit trail (Law 11/2021 & Art. 34.9 ET)

Every clock event seals a SHA-256 digest incorporating the exact previousHash of the preceding record. Any silent database edit immediately breaks downstream hashes.

Production sealing payload (TimeRecordsService)

Dual-Hash Auditable Amendment Workflow

When an employee forgets to clock out, Sekia HR never overwrites history: it records a justified amendment request, preserves the original entry intact, and chains the bilaterally approved correction.

LIVE CRYPTOGRAPHIC SANDBOX

Interactive SHA-256 Chain Integrity Verifier

Test how the audit engine reacts to an unauthorized retroactive 30-minute overtime edit.

CHAIN VERIFIED · 100% INTEGRITY

All 3 time blocks preserve continuous cryptographic linkage from GENESIS. Ready for instant Labor Inspectorate (ITSS) export.

#012026-10-28 · 08:00:00 → 14:00:00

VALID

previousHash: GENESIS

recordHash (SHA-256): 9f4a81c2...e73b04d1

#022026-10-28 · 15:00:00 → 17:30:00

VALID

previousHash: 9f4a81c2...e73b04d1

recordHash (SHA-256): 3c8e50b9...a120f84e

#032026-10-29 · 08:02:14 → 16:04:09

VALID

previousHash: 3c8e50b9...a120f84e

recordHash (SHA-256): 7a02d6f1...c49b81e3

PILLAR 03 · GDPR COMPLIANCE & AEPD STANDARD

Privacy by design: zero fingerprints, zero facial recognition, zero background tracking

Spanish & EU data protection authorities heavily fine biometric timekeeping. Sekia HR shields your company with asymmetric FIDO2 Passkeys and strict data minimization.

GDPR Art. 9 · AEPD Ruling

Zero Server Biometrics (AEPD Standard)

Architectural prohibition against storing fingerprint or facial vectors—eliminating Art. 9 GDPR special-category fines at the root.

FIDO2 · Public Key

Native FIDO2 / WebAuthn Passkeys

Standards-based @simplewebauthn/server public-key cryptography: local device unlock never leaves the employee's hardware Secure Enclave.

TLS 1.3 · AES-256

TLS 1.3 Transit & AES-256 Storage

End-to-end TLS 1.3 + strict HSTS in transit paired with AES-256 encrypted storage volumes and adaptive secret hashing.

OWASP ASVS · 5 Roles

HttpOnly Cookies, CSRF Shield & RBAC

JavaScript-inaccessible session cookies (XSS mitigation), double-submit CSRF tokens, and 5-role RBAC enforcement.

PILLAR 04 · GUARANTEED 4-YEAR STATUTORY RETENTION

Immutable 4-year custody, 1-click inspector export & zero vendor lock-in

Spanish labor law (Art. 34.9 ET) mandates keeping unaltered daily time records accessible for four full years.

4 Years of Active Signed Custody

Every clock-in, break, overtime balance, and leave certificate stays indexed with its SHA-256 verification chain for a minimum of 48 months.

1-Click Electronic Audit Export

Generate structured CSV and PDF audit bundles filtered by workplace, date range, and tax ID with verifiable hashes during any inspection.

Full Data Portability (Zero Lock-in)

Your company retains 100% ownership of its records with unrestricted export in standard open formats (CSV, JSON, PDF, XML) at any time.

PILLAR 05 · AUDITOR & DPO GOVERNANCE KIT

Ready-to-sign legal & privacy templates for immediate rollout

Save days of legal drafting for your DPO or external counsel with templates aligned to 2026 labor and GDPR requirements.

Data Processing Agreement (Official GDPR DPA)Review the binding GDPR Article 28 terms between your company (Controller) and Sekia Technologies S.L. (Processor).Open full DPA contract

ISO/IEC 27001 Aligned Security ControlsInspect our logical access controls, cryptographic audit logging, and operational resilience architecture.Explore security controls

FULL DOCUMENT PREVIEW

Employee Timekeeping Privacy Notice (Art. 34.9 ET & GDPR)

# EMPLOYEE PRIVACY NOTICE TEMPLATE — DIGITAL TIMEKEEPING (SPANISH ART. 34.9 ET & GDPR ART. 13)

**Data Controller:** [COMPANY LEGAL NAME] — Tax ID: [TAX ID / CIF]
**Registered Office:** [FULL ADDRESS] | **Privacy / DPO Contact:** [DPO EMAIL]
**EU Data Processor (SaaS):** Sekia Technologies S.L. (Sovereign EU/Spain infrastructure)

## 1. Purpose and Legal Basis
Pursuant to **Article 34.9 of the Spanish Workers' Statute** and **Article 6(1)(c) GDPR**, the Company records daily clock-in, break, and clock-out timestamps through **Sekia HR**.

## 2. Data Minimization & Zero Invasive Biometrics (AEPD Standard)
- **Zero server-side biometric templates:** No fingerprints or facial recognition vectors are captured or stored. Optional device unlock via **FIDO2 Passkeys / WebAuthn** stays exclusively inside the employee's local Secure Enclave.
- **Point-in-time geolocation only:** For mobile staff, GPS coordinates are captured solely at the exact moment of clocking in/out—never via continuous background tracking.

## 3. SHA-256 Cryptographic Integrity & 4-Year Legal Retention
Every time record generates a chained **SHA-256** digest (`previousHash -> recordHash`) preventing silent retroactive edits. Amendments preserve the original record alongside a timestamped audit reason. Records are retained unaltered for **four (4) years** for employees, union representatives, and Labor Inspectorate (ITSS) audits.

## 4. Data Subject Rights
Employees may exercise access, rectification, restriction, and objection rights at [DPO EMAIL] or lodge a complaint with the supervisory authority (www.aepd.es).

Frequently Asked Questions from DPOs & IT Auditors

Direct technical answers for privacy impact assessments, InfoSec reviews, and labor inspections.

Where are databases and uploaded HR documents physically hosted?

100% of production compute, PostgreSQL databases, S3 document storage, and local AI OCR engines run within Spain and the European Union, with zero unauthorized third-country transfers.

Does Sekia HR use fingerprint scanners or facial recognition?

No. In strict compliance with the AEPD November 2023 guidelines and GDPR data minimization, Sekia HR never captures or stores biometric data. Optional FIDO2 WebAuthn Passkeys keep local unlock strictly inside the employee's device.

How are forgotten clock-outs corrected if SHA-256 records are immutable?

Through a transparent amendment workflow: the original record is never overwritten or deleted. Instead, a justified correction entry is linked and re-sealed into the SHA-256 chain, preserving complete auditability.

Does the expense receipt scanner send images or tax IDs to OpenAI?

Never. Optical character recognition runs on our own sovereign local inference engine inside Sekia HR's private EU infrastructure at zero per-scan cost.

FRICTIONLESS SECURITY APPROVAL

Deploy legally and cryptographically hardened timekeeping in 3 minutes

14-day free trial with built-in GDPR DPA, EU data sovereignty, and transparent flat-rate pricing.

Start compliant workspace View Flat-Rate Plans

ART. 88 LOPDGDD · REMOTE WORK ACT · AUTOMATED GUARDIAN

Automated Right-to-Disconnect & Rest Period Guardian

Automatically queues non-urgent notifications after clock-out, during quiet hours or on approved leave, prevents shift assignments with under 12 hours of rest, and generates the official RLT-ready company protocol.

Disconnect GuardianActive · 19:00 – 08:30 CET

Simulate a real labor compliance scenario

Live Deferral & Statutory Rest Decision Engine

Art. 88.1 LOPDGDD · Cláusula 2.2

Trigger Timestamp19:42 CET

Scheduled Delivery / Action08:30 CET (Turno Mañana)

Notification safely queued until 08:30 next shift

Sekia HR detects the completed workday and holds push and inbox delivery until the employee starts their next scheduled shift.

Official Art. 88 LOPDGDD Protocol Generator

PROT-ART88-2026-RLT · Pre-filled with tax ID, quiet hours and works council signature block

Included in your flat-rate plan · Prevents labor fines up to €7,500

Activate Guardian Free

Verifiable compliance architecture for DPOs, Security Committees & Labor Auditors.

100% EU

Physical residency for DB, S3 & local AI

SHA-256

Tamper-evident chain from GENESIS block

0 Biometrics

Strict compliance with AEPD 2023 ruling

4 Years

Guaranteed immutable statutory retention

# EMPLOYEE PRIVACY NOTICE TEMPLATE — DIGITAL TIMEKEEPING (SPANISH ART. 34.9 ET & GDPR ART. 13) **Data Controller:** [COMPANY LEGAL NAME] — Tax ID: [TAX ID / CIF] **Registered Office:** [FULL ADDRESS] | **Privacy / DPO Contact:** [DPO EMAIL] **EU Data Processor (SaaS):** Sekia Technologies S.L. (Sovereign EU/Spain infrastructure) ## 1. Purpose and Legal Basis Pursuant to **Article 34.9 of the Spanish Workers' Statute** and **Article 6(1)(c) GDPR**, the Company records daily clock-in, break, and clock-out timestamps through **Sekia HR**. ## 2. Data Minimization & Zero Invasive Biometrics (AEPD Standard) - **Zero server-side biometric templates:** No fingerprints or facial recognition vectors are captured or stored. Optional device unlock via **FIDO2 Passkeys / WebAuthn** stays exclusively inside the employee's local Secure Enclave. - **Point-in-time geolocation only:** For mobile staff, GPS coordinates are captured solely at the exact moment of clocking in/out—never via continuous background tracking. ## 3. SHA-256 Cryptographic Integrity & 4-Year Legal Retention Every time record generates a chained **SHA-256** digest (`previousHash -> recordHash`) preventing silent retroactive edits. Amendments preserve the original record alongside a timestamped audit reason. Records are retained unaltered for **four (4) years** for employees, union representatives, and Labor Inspectorate (ITSS) audits. ## 4. Data Subject Rights Employees may exercise access, rectification, restriction, and objection rights at [DPO EMAIL] or lodge a complaint with the supervisory authority (www.aepd.es).

Your workforce data never crosses the Atlantic or feeds external AI APIs

Dedicated Servers in Spain / EU

Strict Multi-Tenant Isolation

100% Local Sovereign AI OCR

Encrypted 3-2-1 Off-Site Backups

Mathematically verifiable anti-fraud audit trail (Law 11/2021 & Art. 34.9 ET)

Dual-Hash Auditable Amendment Workflow

Interactive SHA-256 Chain Integrity Verifier

Privacy by design: zero fingerprints, zero facial recognition, zero background tracking

Zero Server Biometrics (AEPD Standard)

Native FIDO2 / WebAuthn Passkeys

TLS 1.3 Transit & AES-256 Storage

HttpOnly Cookies, CSRF Shield & RBAC

Immutable 4-year custody, 1-click inspector export & zero vendor lock-in

4 Years of Active Signed Custody

1-Click Electronic Audit Export

Full Data Portability (Zero Lock-in)

Ready-to-sign legal & privacy templates for immediate rollout

Employee Timekeeping Privacy Notice (Art. 34.9 ET & GDPR)

Internal Digital Disconnection Policy (Art. 88 LOPDGDD)

DPO Technical & Security Controls Annex (GDPR Art. 28 & 32)

Employee Timekeeping Privacy Notice (Art. 34.9 ET & GDPR)

Frequently Asked Questions from DPOs & IT Auditors

Where are databases and uploaded HR documents physically hosted?

Does Sekia HR use fingerprint scanners or facial recognition?

How are forgotten clock-outs corrected if SHA-256 records are immutable?

Does the expense receipt scanner send images or tax IDs to OpenAI?

Deploy legally and cryptographically hardened timekeeping in 3 minutes

Automated Right-to-Disconnect & Rest Period Guardian

Your workforce data never crosses the Atlantic or feeds external AI APIs

Dedicated Servers in Spain / EU

Strict Multi-Tenant Isolation

100% Local Sovereign AI OCR

Encrypted 3-2-1 Off-Site Backups

Mathematically verifiable anti-fraud audit trail (Law 11/2021 & Art. 34.9 ET)

Dual-Hash Auditable Amendment Workflow

Interactive SHA-256 Chain Integrity Verifier

Privacy by design: zero fingerprints, zero facial recognition, zero background tracking

Zero Server Biometrics (AEPD Standard)

Native FIDO2 / WebAuthn Passkeys

TLS 1.3 Transit & AES-256 Storage

HttpOnly Cookies, CSRF Shield & RBAC

Immutable 4-year custody, 1-click inspector export & zero vendor lock-in

4 Years of Active Signed Custody

1-Click Electronic Audit Export

Full Data Portability (Zero Lock-in)

Ready-to-sign legal & privacy templates for immediate rollout

Employee Timekeeping Privacy Notice (Art. 34.9 ET & GDPR)

Internal Digital Disconnection Policy (Art. 88 LOPDGDD)

DPO Technical & Security Controls Annex (GDPR Art. 28 & 32)

Employee Timekeeping Privacy Notice (Art. 34.9 ET & GDPR)

Frequently Asked Questions from DPOs & IT Auditors

Where are databases and uploaded HR documents physically hosted?

Does Sekia HR use fingerprint scanners or facial recognition?

How are forgotten clock-outs corrected if SHA-256 records are immutable?

Does the expense receipt scanner send images or tax IDs to OpenAI?

Deploy legally and cryptographically hardened timekeeping in 3 minutes

Automated Right-to-Disconnect & Rest Period Guardian