Reporting requirements
Generated from bs_payroll/reporting.py (python3 -m bs_payroll.cli reporting). Each country's legal entity files its own returns; nothing is combined across countries.
CH: Swiss entity, canton Basel-Stadt
Retention: 10 years for payroll records and accounting vouchers (OR art. 958f).
| Filing | Recipient | Frequency | Deadline | Output |
|---|---|---|---|---|
| Payslip (Lohnabrechnung) | Employee | monthly | with each salary payment (OR art. 323b) | {period}_{id}_payslip.pdf |
| Salary payment file (pain.001, CHF) | Company bank | monthly | before pay day | pain001_salaries_{period}.xml |
| Quellensteuer statement | Steuerverwaltung Basel-Stadt | monthly | within 30 days after the end of the month (ELM-QST or e-portal) | quellensteuer_BS_{period}.csv + _summary.json |
| Payroll journal | Accounting | monthly | month end close | journal_{period}.csv |
| AHV/IV/EO, ALV, FAK annual wage declaration | Ausgleichskasse / FAK Basel-Stadt | annual (advance payments monthly or quarterly) | 30 January | ahv_annual_{year}.csv, fak_annual_{year}.csv |
| UVG / KTG wage declaration | Accident and sickness insurer | annual | per insurer (usually end of January or February) | uvg_annual_{year}.csv |
| BVG salary and contribution statement | Pension fund | annual | per pension fund regulations | bvg_annual_{year}.csv |
| Quellensteuer annual statement | Steuerverwaltung Basel-Stadt | annual | with the December statement | quellensteuer_annual_{year}.csv |
| Lohnausweis (Form 11) | Employee (copy to tax office where the canton requires it) | annual | end of January | {year}_{id}_lohnausweis.pdf |
ES: Spanish entity, Valencia
Retention: 4 years for tax, social security and labour records (LGT art. 66, LISOS art. 21); 6 years for accounting books and vouchers (Código de Comercio art. 30).
| Filing | Recipient | Frequency | Deadline | Output |
|---|---|---|---|---|
| Recibo de salarios (nómina) | Employee | monthly | with each salary payment (ET art. 29, Orden ESS/2098/2014) | {period}_{id}_payslip.pdf |
| Salary payment file (SEPA pain.001, EUR) | Entity bank | monthly | before pay day | ES_pain001_salaries_{period}.xml |
| Seguridad Social liquidation (RNT per worker, RLC totals) | TGSS via SILTRA / Sistema RED | monthly | last calendar day of the following month | ES_seguridad_social_{period}.csv + _summary.json |
| Modelo 111 (IRPF withholding) | AEAT | quarterly (monthly for large companies) | 1-20 of the month after the quarter (4T: by 20 January) | ES_modelo111_{period}.json; ES_modelo111_{year}_quarters.json |
| Payroll journal | Accounting | monthly | month end close | ES_journal_{period}.csv |
| Modelo 190 (annual withholding summary) | AEAT | annual | 1-31 January | ES_modelo190_{year}.csv + _summary.json |
| Certificado de retenciones | Employee | annual | before the IRPF return period opens (RIRPF art. 108.3) | {year}_{id}_certificado.pdf |
| Afiliación, alta and baja of workers | TGSS (Sistema RED) | per event | before the start of work; baja within 3 days | not produced by the platform |
| Contract communication (Contrat@) | SEPE | per contract | within 10 days of signing | not produced by the platform |
| Registro de jornada and registro retributivo | Kept by the entity (Inspección de Trabajo) | daily / annual | available on request (ET arts. 34.9, 28.2) | not produced by the platform |
One TEE or one per country
Recommendation: one TEE for both countries. Run a single enclave image (one attested measurement) in one warm pool in Zurich, and keep the countries apart with keys and outputs rather than with separate enclaves: one AWS KMS key per legal entity, released only to the approved enclave measurement, and payslips, returns and retention handled per entity.
Why
- The law does not require a Spanish or EU location. Switzerland has an EU adequacy decision, so the Spanish entity's employee data can be processed in Zurich without standard contractual clauses. Spanish law requires payroll, tax and social security records to be kept and produced on request (AEAT, TGSS, Inspección de Trabajo), not to be processed in Spain.
- The roles are the same in both countries. Each entity is the controller for its own employees (Swiss entity under the DSG, Spanish entity under the GDPR and LOPDGDD) and the platform is their processor. One enclave changes nothing here; what changes is the agreement, which needs GDPR Art. 28 terms for the Spanish entity.
- One measurement to attest and audit. The calculation code is the same image for both countries. Two TEEs would mean two sets of PCRs to register on Sui, two deployments to patch and two attestations to review, with no legal gain.
- Isolation comes from keys, not from enclave count. With a KMS key per entity, the Spanish data is encrypted under the Spanish entity's key and the Swiss data under the Swiss one. Losing one key does not open the other, and each entity can be deleted on its own schedule by destroying its key (Spain: 4 years for tax, social security and labour records, 6 years for accounting; Switzerland: 10 years).
- Cheaper and simpler to run. One warm pool serves both entities, and a run covers both in one call, as the code does today (
run_payrollpays CH and ES together and writes separate reports per entity).
When to split
Run a second enclave in an EU region (for example Frankfurt or Madrid) only if a Spanish customer or collective agreement requires EU hosting by contract, or if a lawyer concludes that the onward transfers below need it.
What a lawyer should confirm
- The GDPR Art. 28 addendum to the processing agreement for the Spanish entity, and that the platform, as a Swiss processor serving an EU controller, does not need an Art. 27 EU representative.
- Group access: when one company account sees both entities, the Swiss entity's users see Spanish employee data. That needs an intra-group basis, or access limited per entity in the portal.
- Onward transfers of Spanish employees' data to US or third-country sub-processors (Resend payslip e-mail, the LLM host): the EU-US Data Privacy Framework certification of each recipient, not only the Swiss-US one.
- Retention by key destruction meeting the Spanish periods (LGT art. 66, LISOS art. 21, Código de Comercio art. 30) alongside the Swiss 10 years (OR art. 958f).
- Whether employee representatives or the Inspección de Trabajo must have access to the registro retributivo and registro de jornada from Spain, which the platform does not produce yet.
Processing agreement
Draft. The text of the processing agreement is still to be provided. Accepting it at sign-up records the date and the version ("draft") on the account.