Hirebase

Defensible records for workforce compliance.

An audit, a dispute, or an unemployment claim can ask for historical records created months ago. Explore the categories of compliance records an hourly employer must maintain, what makes them legally defensible, and how Hirebase secures them.

Regulatory Scope:This page describes categories of workforce records in general terms and the reasons employers are commonly asked to produce them. It is general information, not legal advice, and it is not a substitute for guidance from qualified counsel or the specific regulatory framework your operation is governed by. Hirebase configures what a system captures and retains; the client owns the compliance position itself.
Hiring & eligibility

What every new hire signs before a first shift.

A set of federal and state forms is generated for nearly every hire, and these are usually the first records requested in an audit or a dispute over eligibility to work.

I-9, identity and work authorization

Form I-9 verifies an employee's identity and authorization to work in the United States, completed for every new hire regardless of citizenship status, referencing the specific identity and work-authorization documents the worker presented. It is a federal requirement, not an optional HR form.

For it to survive scrutiny, a system needs to hold a complete, dated I-9 tied to the correct hire, the specific documents relied on to complete it, and a retrieval path that does not depend on a manager remembering where a paper copy is filed.

Hirebase captures.The I-9 is pre-filled from a template inside the onboarding flow, and the signed document is uploaded and stored with named-admin attribution, so the record shows not just that an I-9 exists but who added it. See Onboarding & Training.

W-4, federal withholding

Form W-4 is the federal form an employee completes to set how much federal income tax is withheld from their pay, based on filing status, dependents and other adjustments, typically completed at hire and updated when circumstances change.

A defensible record ties the signed form to the specific worker and hire date, and can show it was completed before the first payroll run it affected.

Hirebase captures.The W-4 has its own slot in the per-employee document repository, alongside the rest of a worker's onboarding paperwork, each upload timestamped and attributed to who added it. See Onboarding & Training.

State withholding and new-hire registration (EDD or equivalent)

States generally require employers to register new hires with a state agency, both for state tax withholding and for new-hire reporting used in programs such as child-support enforcement. The specific agency and form vary by state; EDD is California's name for the function.

A defensible record ties the state registration, including any state-issued reference, to the correct worker and filing date.

Hirebase captures.EDD (or the equivalent state form) is its own item in the per-employee document repository, stored alongside the I-9 and W-4 rather than as a loose file. See Onboarding & Training.
Policy acknowledgement

A signature on a bundle proves less than a signature on a policy.

Handbook and individual policy sign-off

A handbook typically bundles a code of conduct, a safety policy, an anti-harassment policy, and other client-specific rules. A single acceptance click at the end of the bundle acknowledges that the document was presented, but it cannot show which specific policy inside it a worker actually read and agreed to.

A defensible record acknowledges each policy independently, with a timestamp and a signature or initial attributable to that one item, not to the bundle as a whole.

Hirebase captures.Each policy is initialed on its own inside onboarding, including At-Will Employment, EEO, Harassment, Union-Free, FMLA and Workers' Comp, so an incomplete checklist shows exactly which policy a worker has not yet initialed, not one flag against the whole document. See Onboarding & Training.
Training & certification

What matters is not that training happened, but that it can be shown to.

Course completion and knowledge assessment

Many roles require documented completion of a safety or skills course before a worker starts. A certificate alone shows attendance; a scored knowledge assessment shows the worker demonstrated a minimum standard of understanding, which is a stronger record in a dispute over whether someone was actually qualified.

A defensible record holds which course was assigned, the completion progress, the score and pass or fail result, and the date, not only a headline "trained" flag.

Hirebase captures.Training runs as a five-stage flow, three modules then a quiz then results, with a minimum watch-progress gate before the quiz unlocks and an eleven-question knowledge assessment scored against a 75% pass mark. A worker is not eligible for scheduling until training is passed. Sexual harassment training documentation has its own slot in the document repository. See Onboarding & Training.
Time & attendance

What makes a punch record hold up in a dispute.

A punch record is the most frequently disputed record in an hourly workforce, and the one most often reconstructed from memory after the fact. Its defensibility does not come from the total. It comes from the evidence attached to it.

The punch itself

A bare clock-in and clock-out time proves very little on its own. What makes a punch record defensible is the corroborating evidence attached to it at the moment it was made: where the worker was, whether their identity was confirmed, and whether they were briefed before starting.

A defensible record holds the timestamp, the location at the time of the punch, an identity confirmation, and any check the worker had to clear before the punch was accepted, all written at the time, not added afterward.

Hirebase captures.Every punch is gated behind five checks: a geofence distance check against the job boundary, job confirmation, a required live photo, a numeric face-confidence score, and a safety Q&A, with punch-in and punch-out using different question sets, all writing to the same record before the punch completes. See Verification & Enforcement.

Adjustments to the record

The original punch is rarely the final word. Corrections happen constantly: a late clock-in caused by a device issue, a shift charged to the wrong job, a forgotten punch. What matters for a dispute is not that a correction happened, but whether it is traceable.

A defensible adjustment record holds the original value, the requested value, who requested the change, who reviewed it, and, for a rejection, the stated reason.

Hirebase captures.Time adjustments, job adjustments and missed punches each run through their own approval queue. Approval is a single click; rejection requires a typed reason, so every rejection leaves a record of why. See Time, Approvals & Payroll.

Meal and rest break timing

Many jurisdictions require non-exempt employees to receive breaks of a defined length and timing during a shift, and require the employer to keep a record showing the break was actually taken. Requirements vary significantly by state and by industry.

A defensible record shows the duration of each break against the shift it belongs to, not a total inferred after the fact from a longer gap in the punch log.

Hirebase captures.Break duration is tracked per shift and available as its own independently filterable, CSV-exportable report, separate from the enhanced punch record it sits alongside. See Reports & Analytics.
Incident & injury reporting

Filed the way it is later read.

OSHA recordability

US employers subject to OSHA recordkeeping requirements generally must log work-related injuries and illnesses that meet OSHA's recordability criteria, typically involving medical treatment beyond first aid, lost work time, restricted duty, or certain other defined outcomes. Not every incident is recordable, and the recordability determination itself is a judgment the employer makes against OSHA's specific criteria; a workforce system does not make that determination automatically.

What a system needs to hold is the detail a recordability determination is made from: the date, the employee and job context, a description of what happened, the treatment received, and enough medical and incident detail to apply the criteria after the fact, not a headline summary written days later.

Hirebase captures.Every incident record is built to OSHA and workers'-compensation-grade detail across five field categories: employee details, incident details, medical and investigation notes, workers' compensation status, and injury information, with up to five photographs attached directly to the record. See Safety & Incident Management.

DWC first report of injury

The DWC first report of injury is the workers' compensation intake document many US states require after a work-related injury, capturing what happened, who was involved, and the nature of the injury, submitted to the state workers' compensation authority. It is a separate requirement from OSHA recordkeeping, even though the same incident frequently triggers both.

A defensible record ties the DWC form status and dates to the same incident record the rest of the file is built on.

Hirebase captures.DWC first-report-of-injury status and dates are a field category inside the same incident record, alongside body part and nature of injury, rather than a separate file that has to be reconciled against it. See Safety & Incident Management.

Workers' compensation

Workers' compensation is a state-mandated insurance system providing wage replacement and medical benefits to employees injured in the course of employment. A claim typically starts with a first report of injury, and the documentation an employer keeps at the time of the incident affects how defensible the claim is later.

A defensible record shows the incident detail was captured close to the time it happened, not assembled from memory once a claim is filed.

Hirebase captures.The same structured incident record, including the DWC first report of injury field category, is what a workers' compensation claim is built from. See Safety & Incident Management.
Retention

Governed by the client's policy, not the vendor's.

How long a record has to be held

How long a record has to be held, whether it is a hiring form, a payroll record, or an incident record, is set by the client's own document retention schedule and the jurisdiction the work was performed in, not by a default built into any vendor's platform. Retention periods differ by record type and by jurisdiction, and they are a decision the client makes with its own counsel, not one a software vendor should set on the client's behalf.

Hirebase captures.Hirebase configures what a system captures and retains to the client's specification; the retention period itself follows the client's policy rather than a fixed platform default. See Resources.

One record.
Built to hold up.

We will map Hirebase to your compliance framework,
your ERP and your region.

© 2026 Hirebase. All rights reserved.