How to choose a time-tracking app for your small business

Working time records have been mandatory in Spain since 2019, so the question is no longer whether to record but with what. There are dozens of time-tracking apps and almost all of them promise the same things. These are the criteria that actually separate a serious tool from one that will cause you problems.

1. A tamper-proof register

This is the criterion that shapes everything else. The time register has evidential value: before an inspection or in court, what matters is that nobody could have touched it up. Concrete questions to ask any vendor:

• Do punches use the server clock or the employee's device clock?
• Can an existing punch be edited or deleted? Does it leave a trace?
• Do corrections replace the original data or get added as annotations?

The right answer: server time, nothing gets deleted, and corrections are annotations with an author and a reason that never touch the original punch.

2. Inspection-ready exports

The Labour Inspectorate will not log into your application: they will ask you for the register. You need to export any period to PDF or CSV in a couple of clicks, with exact times per employee and day. If exporting is a manual process or requires a support ticket, walk away.

3. Absences and vacations built in

The register and absences are the same story told twice. If vacations live in another tool (or a shared calendar), the hour balance never adds up: approved vacation days must reduce expected hours automatically. Look for the full flow: employee request, approval with a note, team calendar and a vacation allowance per contract.

4. Punch methods that match your reality

An office, a workshop and a remote team punch in differently:

• Web and mobile for people who work at a computer or remotely.
• Kiosk mode (a shared tablet with a PIN per employee) for workshops, stores and warehouses where not everyone has a computer.
• Messaging (a Telegram bot, for instance) for teams that live on their phones.

Convenience matters more than it seems: an awkward punch gets forgotten, and a register full of gaps is almost worse than no register.

5. Sensible geolocation (and no biometrics)

The law does not require geolocation. If you enable it, the Spanish data protection authority (AEPD) sets clear limits: capture only at the moment of punching, prior information to the employee, and proportionality. Avoid continuous tracking. And be careful with biometrics: fingerprint and face recognition for punching have been effectively vetoed by the AEPD since 2023 except in exceptional cases. Passkeys (the fingerprint stays on the employee's device and never leaves it) give the same convenience without that problem.

6. Pricing that scales with your actual size

Per-user monthly pricing looks cheap until you multiply. For an 8-person company, 3 euros per user is 288 euros a year just for punching in. Tiered models (up to 5, up to 25, up to 100 employees) usually work out better and are predictable. And be wary of "free forever" with no visible business model: your working time data is sensitive labour data.

7. GDPR and data in Europe

The register holds your employees' personal data for four years. Check where the data is hosted, whether it is encrypted, and whether the vendor acts as controller or processor under a clear contract. A European vendor under GDPR makes your life simpler.

Our answer to this list

We built k-fichaje to pass this list point by point, first for our own team and then for any company: a tamper-proof register with a verification chain, PDF and CSV exports, absences and hour balance built in, punching via web, mobile, kiosk and Telegram, optional geolocation only at the moment of punching, tiered pricing and data in Europe. Free for up to two employees, no card required.

Whether with our tool or another one, the list above is the same. Print it and ask all seven questions before signing anything.