Audit-proof records for workforce compliance.
A formal inquiry, verification request, or internal audit requires clear, unalterable historical records. This page covers the categories of compliance records an hourly employer must maintain, what makes them audit-ready and authoritative, and how Hirebase secures them.
Workforce Compliance Architecture & Audit Defense Decision Matrix
Compare Hirebase customer-controlled Azure compliance records against legacy paper files and generic multi-tenant HR platforms across statutory onboarding custody, break verification, biometric privacy, and OSHA readiness:
| Compliance & Audit Vector | Hirebase (BYOC Single-Tenant Azure) | Paper & Dispersed Cloud Folders | Generic Multi-Tenant HR SaaS |
|---|---|---|---|
| Federal & State Onboarding (I-9 / W-4 / EDD) | Attributable digital vault with named-admin timestamps, individual document slots, and statutory audit export. | ~Physical folders or unverified desktop scans; high document loss rate and zero verifiable filing timestamps. | ~Shared multi-tenant document repository; basic aggregate completion flags without granular policy audit trail. |
| Shift & Break Verification (FLSA / Meal & Rest) | Geofence distance check against job perimeter + live facial photo liveness + mandatory pre-shift safety questionnaires. | ~Honor-system sign-in sheets or manual timesheets; completely undefensible during FLSA collective actions. | ~Unvalidated mobile GPS pins without boundary enforcement; break deductions inferred post-hoc without worker sign-off. |
| Biometric & Location Privacy (BIPA / GDPR) | 100% customer cloud ownership (BYOC Azure PaaS); facial vectors and GPS data never leave customer enterprise boundary. | ~No biometric controls; vulnerable badge sharing and PIN transfers causing rampant buddy punching. | ~Biometric vectors commingled in multi-tenant vendor databases; creates third-party vendor breach and BIPA exposure. |
| Incident & Workers' Comp (OSHA 300 / DWC-1) | Structured 5-category incident records with up to 5 scene photos, real-time DWC intake, and defensible claim logs. | ~Handwritten accident notes recorded weeks later; lost photographs; disputed injury timelines and inflated reserves. | ~Unstructured free-text fields disconnected from shift punch history; requires manual reconciliation for carrier claims. |
FLSA Wage & Hour Defense
Immutable GPS boundary validation, facial liveness corroboration, and attributable meal break timestamps eliminate exposure to unpaid wage disputes and class-action settlements.
Zero Biometric Privacy Liability
Deploying single-tenant within the employer's own Microsoft Azure subscription ensures biometric vectors remain strictly under corporate governance, neutralizing third-party BIPA liability.
What every new hire signs before a first shift.
A set of federal and state forms is generated for nearly every hire, establishing clear, verified records of worker eligibility and identity.
I-9, identity and work authorization
Form I-9 verifies an employee's identity and authorization to work in the United States, completed for every new hire regardless of citizenship status, referencing the specific identity and work-authorization documents the worker presented. It is a federal requirement, not an optional HR form.
For it to survive scrutiny, a system needs to hold a complete, dated I-9 tied to the correct hire, the specific documents relied on to complete it, and a retrieval path that does not depend on a manager remembering where a paper copy is filed.
W-4, federal withholding
Form W-4 is the federal form an employee completes to set how much federal income tax is withheld from their pay, based on filing status, dependents and other adjustments, typically completed at hire and updated when circumstances change.
An authoritative record ties the signed form to the specific worker and hire date, and demonstrates completion before the first payroll run it affected.
State withholding and new-hire registration (EDD or equivalent)
States generally require employers to register new hires with a state agency, both for state tax withholding and for new-hire reporting used in programs such as child-support enforcement. The specific agency and form vary by state; EDD is California's name for the function.
An authoritative record ties the state registration, including any state-issued reference, to the correct worker and filing date, providing verified submission tracking.
A signature on a bundle proves less than a signature on a policy.
Handbook and individual policy sign-off
A handbook typically bundles a code of conduct, a safety policy, an anti-harassment policy, and other client-specific rules. A single acceptance click at the end of the bundle acknowledges that the document was presented, but it cannot show which specific policy inside it a worker actually read and agreed to.
An authoritative record acknowledges each policy independently, with a timestamp and a signature or initial attributable to that one item, not to the bundle as a whole.
What matters is not that training happened, but that it can be shown to.
Course completion and knowledge assessment
Many roles require documented completion of a safety or skills course before a worker starts. A certificate alone shows attendance; a scored knowledge assessment shows the worker demonstrated a minimum standard of understanding, which is a stronger record in a dispute over whether someone was actually qualified.
An authoritative training record holds which course was assigned, the completion progress, the score and pass or fail result, and the date, not only a headline "trained" flag.
What makes a punch record hold up in an audit.
A punch record is the most critical operational record in an hourly workforce. Its audit-readiness does not come from the total. It comes from the verified corroborating evidence attached to it.
The punch itself
A bare clock-in and clock-out time proves very little on its own. What makes a punch record authoritative and defensible is the corroborating evidence attached to it at the moment it was made: where the worker was, whether their identity was confirmed, and whether they were briefed before starting.
An audit-ready record holds the timestamp, the location at the time of the punch, an identity confirmation, and any check the worker had to clear before the punch was accepted, all written at the time, not added afterward.
Adjustments to the record
The original punch is rarely the final word. Corrections happen constantly: a late clock-in caused by a device issue, a shift charged to the wrong job, a forgotten punch. What matters for a dispute is not that a correction happened, but whether it is traceable.
An audit-ready adjustment record holds the original value, the requested value, who requested the change, who reviewed it, and, for a rejection, the stated reason.
Meal and rest break timing
Many jurisdictions require non-exempt employees to receive breaks of a defined length and timing during a shift, and require the employer to keep a record showing the break was actually taken. Requirements vary significantly by state and by industry.
A verified, compliant record shows the duration of each break against the shift it belongs to, not a total inferred after the fact from a longer gap in the punch log.
Filed the way it is later read.
OSHA recordability
US employers subject to OSHA recordkeeping requirements generally must log work-related injuries and illnesses that meet OSHA's recordability criteria, typically involving medical treatment beyond first aid, lost work time, restricted duty, or certain other defined outcomes. Not every incident is recordable, and the recordability determination itself is a judgment the employer makes against OSHA's specific criteria; a workforce system does not make that determination automatically.
What a system needs to hold is the detail a recordability determination is made from: the date, the employee and job context, a description of what happened, the treatment received, and enough medical and incident detail to apply the criteria after the fact, not a headline summary written days later.
DWC first report of injury
The DWC first report of injury is the workers' compensation intake document many US states require after a work-related injury, capturing what happened, who was involved, and the nature of the injury, submitted to the state workers' compensation authority. It is a separate requirement from OSHA recordkeeping, even though the same incident frequently triggers both.
An authoritative compliance record ties the DWC form status and dates to the same incident record the rest of the file is built on.
Workers' compensation
Workers' compensation is a state-mandated insurance system providing wage replacement and medical benefits to employees injured in the course of employment. A claim typically starts with a first report of injury, and the documentation an employer keeps at the time of the incident ensures claims are resolved swiftly and accurately.
An authoritative incident record shows the incident detail was captured close to the time it happened, not assembled from memory once a claim is filed.
Governed by the client's policy, not the vendor's.
How long a record has to be held
How long a record has to be held, whether it is a hiring form, a payroll record, or an incident record, is set by the client's own document retention schedule and the jurisdiction the work was performed in, not by a default built into any vendor's platform. Retention periods differ by record type and by jurisdiction, and they are a decision the client makes with its own counsel, not one a software vendor should set on the client's behalf.
Frequently Asked Questions on Workforce Compliance
Direct operational and legal answers regarding Form I-9 custody, punch record defensibility, biometric privacy, and document retention:
What is Form I-9 and why is attributable storage required?
Form I-9 verifies an employee's identity and authorization to work in the United States, completed for every new hire regardless of citizenship status, referencing the specific identity and work-authorization documents the worker presented. It is a federal requirement, not an optional HR form.
What makes a punch record authoritative and audit-ready?
An authoritative punch record requires immutable corroborating evidence: geofence distance verification against the site boundary, biometric facial liveness confirmation, mandatory pre-shift safety questionnaires, and an immutable server timestamp with zero post-hoc alteration.
How does Hirebase protect biometric data under BIPA and GDPR?
Hirebase deploys as a dedicated single-tenant instance inside the client's own Microsoft Azure subscription (BYOC). Biometric face vectors, photos, and GPS coordinates remain strictly within the client's corporate cloud boundary, preventing multi-tenant vendor commingling and supporting compliance under Illinois BIPA, Texas CUBI, and GDPR Article 9. Because statutory compliance under BIPA and similar privacy laws requires specific employee notices, written consent, and retention schedules, Hirebase provides the technical controls and data isolation while employers manage their legal compliance policies.
How does Hirebase handle state-specific new-hire reporting (e.g. California EDD)?
States require employers to register new hires within specific statutory windows. Hirebase stores state withholding and registration documents (such as California EDD) in dedicated, timestamped slots in the employee repository, with named administrator attribution showing who filed the document and when.
Who controls document retention schedules in Hirebase?
Document retention periods are governed by the client's own legal policy and jurisdictional labor laws, not by arbitrary vendor defaults. Hirebase configures automated capture and archiving to the client's exact compliance specifications.
One record.
Holds up under scrutiny.
We will map Hirebase to your compliance framework,
your ERP and your region.

