CENTRE DE CONFIANCE, SÉCURITÉ ET SOUVERAINETÉ TECHNOLOGIQUE

Architecture vérifiable pour DPO, Comités de Sécurité et Inspections du Travail.

Toutes les preuves techniques, cryptographiques et contractuelles pour valider Sekia HR en quelques minutes : serveurs dédiés en UE, chaînage SHA-256 inaltérable, zéro biométrie invasive et IA locale souveraine.

Télécharger le Kit Auditeur & DPO Consulter l'Accord DPA (Art. 28 RGPD)

100% UE

Résidence physique BDD, S3 et IA locale

SHA-256

Chaîne immuable depuis le bloc GENESIS

0 Biométrie

Conformité stricte RGPD / AEPD

4 Ans

Conservation légale intégrale garantie

PILIER 01 · SOUVERAINETÉ DES DONNÉES & INFRASTRUCTURE UE

Vos données RH ne traversent jamais l'Atlantique et n'alimentent aucune IA externe

Engineered under strict European data sovereignty to eliminate Schrems II / US CLOUD Act exposure and enforce strict tenant isolation.

Dedicated Servers in Spain / EU

PostgreSQL databases, S3-compatible document vaults, and application nodes operate exclusively under European Union jurisdiction.

Strict Multi-Tenant Isolation

Mandatory companyId scoping across every query and service boundary prevents cross-organization data leakage by design.

100% Local Sovereign AI OCR

Expense receipts, tax IDs, and VAT breakdowns are parsed on our isolated local inference engine—never sent to OpenAI or third-party cloud APIs.

Encrypted 3-2-1 Off-Site Backups

Automated nightly backup pipeline maintaining 3 copies across 2 distinct media types with 1 isolated, encrypted off-site replica.

PILIER 02 · IMMUABILITÉ CRYPTOGRAPHIQUE SHA-256

Traçabilité antifraude mathématiquement vérifiable

Every clock event seals a SHA-256 digest incorporating the exact previousHash of the preceding record. Any silent database edit immediately breaks downstream hashes.

Production sealing payload (TimeRecordsService)

Dual-Hash Auditable Amendment Workflow

When an employee forgets to clock out, Sekia HR never overwrites history: it records a justified amendment request, preserves the original entry intact, and chains the bilaterally approved correction.

LIVE CRYPTOGRAPHIC SANDBOX

Interactive SHA-256 Chain Integrity Verifier

Test how the audit engine reacts to an unauthorized retroactive 30-minute overtime edit.

CHAÎNE VÉRIFIÉE · INTÉGRITÉ 100 %

All 3 time blocks preserve continuous cryptographic linkage from GENESIS. Ready for instant Labor Inspectorate (ITSS) export.

#012026-10-28 · 08:00:00 → 14:00:00

VALID

previousHash: GENESIS

recordHash (SHA-256): 9f4a81c2...e73b04d1

#022026-10-28 · 15:00:00 → 17:30:00

VALID

previousHash: 9f4a81c2...e73b04d1

recordHash (SHA-256): 3c8e50b9...a120f84e

#032026-10-29 · 08:02:14 → 16:04:09

VALID

previousHash: 3c8e50b9...a120f84e

recordHash (SHA-256): 7a02d6f1...c49b81e3

PILIER 03 · CONFORMITÉ RGPD & ZÉRO BIOMÉTRIE

Confidentialité dès la conception : sans empreinte digitale ni suivi invasif

Spanish & EU data protection authorities heavily fine biometric timekeeping. Sekia HR shields your company with asymmetric FIDO2 Passkeys and strict data minimization.

GDPR Art. 9 · AEPD Ruling

Zero Server Biometrics (AEPD Standard)

Architectural prohibition against storing fingerprint or facial vectors—eliminating Art. 9 GDPR special-category fines at the root.

FIDO2 · Public Key

Native FIDO2 / WebAuthn Passkeys

Standards-based @simplewebauthn/server public-key cryptography: local device unlock never leaves the employee's hardware Secure Enclave.

TLS 1.3 · AES-256

TLS 1.3 Transit & AES-256 Storage

End-to-end TLS 1.3 + strict HSTS in transit paired with AES-256 encrypted storage volumes and adaptive secret hashing.

OWASP ASVS · 5 Roles

HttpOnly Cookies, CSRF Shield & RBAC

JavaScript-inaccessible session cookies (XSS mitigation), double-submit CSRF tokens, and 5-role RBAC enforcement.

PILIER 04 · CONSERVATION LÉGALE GARANTIE DE 4 ANS

Conservation inaltérable pendant 4 ans, export en 1 clic et portabilité totale

Spanish labor law (Art. 34.9 ET) mandates keeping unaltered daily time records accessible for four full years.

4 Years of Active Signed Custody

Every clock-in, break, overtime balance, and leave certificate stays indexed with its SHA-256 verification chain for a minimum of 48 months.

1-Click Electronic Audit Export

Generate structured CSV and PDF audit bundles filtered by workplace, date range, and tax ID with verifiable hashes during any inspection.

Full Data Portability (Zero Lock-in)

Your company retains 100% ownership of its records with unrestricted export in standard open formats (CSV, JSON, PDF, XML) at any time.

PILIER 05 · KIT DE GOUVERNANCE POUR AUDITEURS ET DPO

Modèles juridiques et RGPD prêts à signer et déployer

Save days of legal drafting for your DPO or external counsel with templates aligned to 2026 labor and GDPR requirements.

Data Processing Agreement (Official GDPR DPA)Review the binding GDPR Article 28 terms between your company (Controller) and Sekia Technologies S.L. (Processor).Ouvrir le contrat DPA complet

ISO/IEC 27001 Aligned Security ControlsInspect our logical access controls, cryptographic audit logging, and operational resilience architecture.Voir les contrôles de sécurité

FULL DOCUMENT PREVIEW

Employee Timekeeping Privacy Notice (Art. 34.9 ET & GDPR)

# EMPLOYEE PRIVACY NOTICE TEMPLATE — DIGITAL TIMEKEEPING (SPANISH ART. 34.9 ET & GDPR ART. 13)

**Data Controller:** [COMPANY LEGAL NAME] — Tax ID: [TAX ID / CIF]
**Registered Office:** [FULL ADDRESS] | **Privacy / DPO Contact:** [DPO EMAIL]
**EU Data Processor (SaaS):** Sekia Technologies S.L. (Sovereign EU/Spain infrastructure)

## 1. Purpose and Legal Basis
Pursuant to **Article 34.9 of the Spanish Workers' Statute** and **Article 6(1)(c) GDPR**, the Company records daily clock-in, break, and clock-out timestamps through **Sekia HR**.

## 2. Data Minimization & Zero Invasive Biometrics (AEPD Standard)
- **Zero server-side biometric templates:** No fingerprints or facial recognition vectors are captured or stored. Optional device unlock via **FIDO2 Passkeys / WebAuthn** stays exclusively inside the employee's local Secure Enclave.
- **Point-in-time geolocation only:** For mobile staff, GPS coordinates are captured solely at the exact moment of clocking in/out—never via continuous background tracking.

## 3. SHA-256 Cryptographic Integrity & 4-Year Legal Retention
Every time record generates a chained **SHA-256** digest (`previousHash -> recordHash`) preventing silent retroactive edits. Amendments preserve the original record alongside a timestamped audit reason. Records are retained unaltered for **four (4) years** for employees, union representatives, and Labor Inspectorate (ITSS) audits.

## 4. Data Subject Rights
Employees may exercise access, rectification, restriction, and objection rights at [DPO EMAIL] or lodge a complaint with the supervisory authority (www.aepd.es).

Questions fréquentes des DPO et Auditeurs IT

Direct technical answers for privacy impact assessments, InfoSec reviews, and labor inspections.

Where are databases and uploaded HR documents physically hosted?

100% of production compute, PostgreSQL databases, S3 document storage, and local AI OCR engines run within Spain and the European Union, with zero unauthorized third-country transfers.

Does Sekia HR use fingerprint scanners or facial recognition?

No. In strict compliance with the AEPD November 2023 guidelines and GDPR data minimization, Sekia HR never captures or stores biometric data. Optional FIDO2 WebAuthn Passkeys keep local unlock strictly inside the employee's device.

How are forgotten clock-outs corrected if SHA-256 records are immutable?

Through a transparent amendment workflow: the original record is never overwritten or deleted. Instead, a justified correction entry is linked and re-sealed into the SHA-256 chain, preserving complete auditability.

Does the expense receipt scanner send images or tax IDs to OpenAI?

Never. Optical character recognition runs on our own sovereign local inference engine inside Sekia HR's private EU infrastructure at zero per-scan cost.

VALIDATION SÉCURITÉ SANS FRICTION

Déployez un suivi du temps blindé juridiquement et cryptographiquement en 3 minutes

14-day free trial with built-in GDPR DPA, EU data sovereignty, and transparent flat-rate pricing.

Créer un compte conforme Voir les Forfaits Fixes

ART. 88 LOPDGDD · LOI 10/2021 · GARDIEN AUTOMATISÉ

Gardien Automatisé du Droit à la Déconnexion et des Repos

Met automatiquement en file d’attente les notifications hors horaires ou pendant les congés, bloque les plannings avec moins de 12h de repos quotidien et génère le protocole officiel prêt à signer avec les représentants du personnel.

Gardien DéconnexionActif · 19:00 – 08:30 CET

Simulez un scénario réel de conformité sociale

Moteur de Rétention et de Repos Légal en Temps Réel

Art. 88.1 LOPDGDD · Cláusula 2.2

Heure de l’événement19:42 CET

Créneau de remise / Action08:30 CET (Turno Mañana)

Notification retenue en file sécurisée jusqu’à 08h30

Sekia HR détecte la sortie enregistrée et reporte automatiquement l’alerte jusqu’au début du prochain service planifié.

Générateur de Protocole Officiel Art. 88 LOPDGDD

PROT-ART88-2026-RLT · Pré-rempli avec identifiant fiscal, plage de silence et signature CSE/RLT

Inclus sans surcoût · Prévient les sanctions d’inspection jusqu’à 7 500 €

Activer le Gardien

Architecture vérifiable pour DPO, Comités de Sécurité et Inspections du Travail.

100% UE

Résidence physique BDD, S3 et IA locale

SHA-256

Chaîne immuable depuis le bloc GENESIS

0 Biométrie

Conformité stricte RGPD / AEPD

4 Ans

Conservation légale intégrale garantie

# EMPLOYEE PRIVACY NOTICE TEMPLATE — DIGITAL TIMEKEEPING (SPANISH ART. 34.9 ET & GDPR ART. 13) **Data Controller:** [COMPANY LEGAL NAME] — Tax ID: [TAX ID / CIF] **Registered Office:** [FULL ADDRESS] | **Privacy / DPO Contact:** [DPO EMAIL] **EU Data Processor (SaaS):** Sekia Technologies S.L. (Sovereign EU/Spain infrastructure) ## 1. Purpose and Legal Basis Pursuant to **Article 34.9 of the Spanish Workers' Statute** and **Article 6(1)(c) GDPR**, the Company records daily clock-in, break, and clock-out timestamps through **Sekia HR**. ## 2. Data Minimization & Zero Invasive Biometrics (AEPD Standard) - **Zero server-side biometric templates:** No fingerprints or facial recognition vectors are captured or stored. Optional device unlock via **FIDO2 Passkeys / WebAuthn** stays exclusively inside the employee's local Secure Enclave. - **Point-in-time geolocation only:** For mobile staff, GPS coordinates are captured solely at the exact moment of clocking in/out—never via continuous background tracking. ## 3. SHA-256 Cryptographic Integrity & 4-Year Legal Retention Every time record generates a chained **SHA-256** digest (`previousHash -> recordHash`) preventing silent retroactive edits. Amendments preserve the original record alongside a timestamped audit reason. Records are retained unaltered for **four (4) years** for employees, union representatives, and Labor Inspectorate (ITSS) audits. ## 4. Data Subject Rights Employees may exercise access, rectification, restriction, and objection rights at [DPO EMAIL] or lodge a complaint with the supervisory authority (www.aepd.es).

Vos données RH ne traversent jamais l'Atlantique et n'alimentent aucune IA externe

Dedicated Servers in Spain / EU

Strict Multi-Tenant Isolation

100% Local Sovereign AI OCR

Encrypted 3-2-1 Off-Site Backups

Traçabilité antifraude mathématiquement vérifiable

Dual-Hash Auditable Amendment Workflow

Interactive SHA-256 Chain Integrity Verifier

Confidentialité dès la conception : sans empreinte digitale ni suivi invasif

Zero Server Biometrics (AEPD Standard)

Native FIDO2 / WebAuthn Passkeys

TLS 1.3 Transit & AES-256 Storage

HttpOnly Cookies, CSRF Shield & RBAC

Conservation inaltérable pendant 4 ans, export en 1 clic et portabilité totale

4 Years of Active Signed Custody

1-Click Electronic Audit Export

Full Data Portability (Zero Lock-in)

Modèles juridiques et RGPD prêts à signer et déployer

Employee Timekeeping Privacy Notice (Art. 34.9 ET & GDPR)

Internal Digital Disconnection Policy (Art. 88 LOPDGDD)

DPO Technical & Security Controls Annex (GDPR Art. 28 & 32)

Employee Timekeeping Privacy Notice (Art. 34.9 ET & GDPR)

Questions fréquentes des DPO et Auditeurs IT

Where are databases and uploaded HR documents physically hosted?

Does Sekia HR use fingerprint scanners or facial recognition?

How are forgotten clock-outs corrected if SHA-256 records are immutable?

Does the expense receipt scanner send images or tax IDs to OpenAI?

Déployez un suivi du temps blindé juridiquement et cryptographiquement en 3 minutes

Gardien Automatisé du Droit à la Déconnexion et des Repos

Vos données RH ne traversent jamais l'Atlantique et n'alimentent aucune IA externe

Dedicated Servers in Spain / EU

Strict Multi-Tenant Isolation

100% Local Sovereign AI OCR

Encrypted 3-2-1 Off-Site Backups

Traçabilité antifraude mathématiquement vérifiable

Dual-Hash Auditable Amendment Workflow

Interactive SHA-256 Chain Integrity Verifier

Confidentialité dès la conception : sans empreinte digitale ni suivi invasif

Zero Server Biometrics (AEPD Standard)

Native FIDO2 / WebAuthn Passkeys

TLS 1.3 Transit & AES-256 Storage

HttpOnly Cookies, CSRF Shield & RBAC

Conservation inaltérable pendant 4 ans, export en 1 clic et portabilité totale

4 Years of Active Signed Custody

1-Click Electronic Audit Export

Full Data Portability (Zero Lock-in)

Modèles juridiques et RGPD prêts à signer et déployer

Employee Timekeeping Privacy Notice (Art. 34.9 ET & GDPR)

Internal Digital Disconnection Policy (Art. 88 LOPDGDD)

DPO Technical & Security Controls Annex (GDPR Art. 28 & 32)

Employee Timekeeping Privacy Notice (Art. 34.9 ET & GDPR)

Questions fréquentes des DPO et Auditeurs IT

Where are databases and uploaded HR documents physically hosted?

Does Sekia HR use fingerprint scanners or facial recognition?

How are forgotten clock-outs corrected if SHA-256 records are immutable?

Does the expense receipt scanner send images or tax IDs to OpenAI?

Déployez un suivi du temps blindé juridiquement et cryptographiquement en 3 minutes

Gardien Automatisé du Droit à la Déconnexion et des Repos