Notice: this article explains how the product works. It is not legal advice. How long you should keep each document and what an inspector will ask you for in your specific case is something you should consult with your employment adviser.
The problem: a record that can be changed proves nothing
A time entry, a signed payslip or an approved leave request only serve as proof if nobody has been able to delete or alter them. If anyone with access can delete a line, the record loses value exactly when you need it most: in an inspection or in a conflict with an employee.
That is why BionicAdri does not just hide the delete button. The protection is in the database itself, which is where the data is really stored. Even if someone tried it by another route, the database rejects it.
Time entries: they are not deleted and are kept for at least 4 years
The working time record and its change history cannot be deleted. They are kept for at least 4 years from their creation, and that period cannot be shortened, neither when creating the time entry nor when editing it.
What if someone makes a mistake when clocking in? It is corrected, but the correction does not overwrite the original. Each change is recorded in a history with three pieces of data:
- Who made the change.
- When they did it.
- Why: the reason given.
That history is insert-only: new lines can be added, but existing ones cannot be edited or deleted.
Signed payslips and documents: they are voided, not deleted
Once a payslip or document is signed, it cannot be deleted by any means until 4 years have passed since the first signature. Anything that is not signed is deleted as usual.
If there is an error in something signed, it is voided by indicating a reason. The document does not disappear: it remains visible marked as “Voided”, with its signed PDF and all its history. This shows what was signed, when, and why it was voided.
| Situation | What happens |
|---|---|
| Payslip or unsigned document | It can be deleted as usual |
| Signed, error detected | It is voided with a reason; it remains visible with its signed PDF and its history |
| Signed, attempt to delete it | Not allowed until 4 years after the first signature |
Holidays and leave: same approach
Holidays and leave follow the same rule: insert-only history, protected for 4 years and also copied to the chained record. What was approved, what was rejected and what was voided is recorded and cannot be rewritten afterwards.
The chained fingerprint: any alteration is noticeable
Each entry in the history is copied to a chained log. A hash is calculated for each entry using SHA-256 (a kind of unique “summary” of the content) and that hash depends on the previous entry. It is like a chain of links: if you change one, the following ones no longer fit together and it shows.
Important privacy detail: the log stores only hashes, not personal data in plain text.
An automatic check, which runs every day, recalculates the chains and warns if any has been broken. You can see the result in Settings → Security, in the “Signature integrity” card.
What it is and what it is not. It is BionicAdri's own chained log. It does not have external time stamping, so it is not a notarial seal or a public blockchain. Its value is that any alteration within the system leaves a trace.
Backups also leave a trail
Every action on a database backup (create, download, restore and others) is recorded with who, when and why. And if a backup ever has to be restored, the process preserves the chained log and the traces. That way a restoration does not wipe out the evidence.
Chat with ADRI: hidden, not deleted
Chat conversations with ADRI are not deleted manually either: they are hidden. Cleanup is only done by a scheduled retention process, so no one can make a conversation disappear at will.
A simple example
An employee forgets to clock out and HR corrects the time the next day. The original clock-in/out remains. Next to it there is a new entry in the history: who corrected it, at what time and the reason (“forgot to clock out, confirmed with the employee”). Months later, if there is a claim, the full sequence can be shown and it can be checked that the chain of hashes has not been broken.
Something similar happens with a payslip. If it was signed with the wrong amount, it is not “deleted and uploaded again”: it is voided with a reason, and the new one sits alongside it. Anyone reviewing the file sees both and understands what happened.
What it gives you in practice
- Before the Labour Inspectorate: you can show a record with a full change history, including who made the change, the date and the reason.
- In the event of a dispute with an employee: there is a timeline that cannot be rewritten, not by you or anyone else.
- For your internal peace of mind: errors are corrected without losing the original and without arguments about “who touched what”.
- With privacy taken care of: verification relies on hashes, not personal data.
Before deciding, talk to your adviser
Every company has its own collective agreement, sector and obligations. Check with your employment adviser which documents you must keep, for how long and what you may be asked for. BionicAdri gives you the tool to keep and prove; what the law requires in your case is confirmed by a professional.
If you want to see it working with an example clock-in and payslip, request a demo or write to us at [email protected]. You can also read the HR and time tracking guide.
- RRHH
- Clock-ins
- Payslips
- Labour Inspectorate
- Security