No vendor sells a module called "non-compliance," so almost everyone claims to be compliant. The question worth asking isn't whether they are -it's how. Is compliance a consequence of how the system is built, or a layer bolted on top that an administrator can bypass in two clicks? That gap shows up first in the details nobody asks about during a sales call -what an admin account can quietly do, and whether the system notices when it does.
There's a simple way to tell the difference: look at what happens when someone with admin rights tries to do something they shouldn't. If the system lets them, with no trace left behind, compliance is a promise. If it doesn't let them -or lets them but records it- compliance is in the design.
Time tracking: the requirement is traceability
Time tracking has been mandatory in Spain since 2019 (Article 34.9 of the Workers' Statute), but what an inspector from Spain's labor inspectorate actually checks, per Technical Criterion 101/2019, is whether the record is reliable. Cantevia logs clock-ins with a hash chain built precisely to withstand that kind of inspection: an entry is never deleted, only voided, with a record of who did it and why, and the original always still available.
Occupational safety: training and monitoring aren't a PDF filed away
Occupational risk prevention isn't satisfied by filing a training PDF once a year. Cantevia's People module tracks training, issued protective equipment and health monitoring (under Article 22 of Spain's occupational risk prevention law) per person, making it possible to know at any moment who has a check-up pending or a course that's expired -instead of reconstructing that answer during an audit, when it's already too late to be useful.
E-signatures: evidence that doesn't depend on anyone's memory
Every signature on Cantevia adds an RFC 3161 timestamp, issued by FreeTSA, an independent timestamping authority, verifiable with standard tools without depending on Cantevia still being around. It's not an EU eIDAS-qualified timestamp, which matters if you need that specific level of legal recognition -but it does produce an evidence file per document: who signed, when, from what IP, whether the signature was drawn or typed. That's what a client or a court eventually asks for, not the promise that "e-signature exists."
Isolation between companies is compliance too
Regulatory compliance doesn't stop at time tracking, occupational safety and e-signatures -it also depends on one company's data never mixing with another's. Cantevia isolates data, including file storage, by company, which matters especially for occupational health records, payslips or contracts.
An accidental mix-up between organizations on a multi-tenant platform isn't a cosmetic bug -it's a data protection breach with its own legal consequences, regardless of how well time tracking or health monitoring are handled elsewhere. The design has to hold up on both fronts at once.
Regulatory compliance isn't something you buy as a checked box on a comparison table. You verify it by asking exactly what happens when something is done wrong, and seeing whether the system leaves a trace or erases one.