SOC 2 for HR tech: payroll, HR and recruiting software

The table maps what an HR buyer’s review asks against the part of a SOC 2 report that answers it. Where the report answers only in part, a written answer covers the rest.

Why HR and payroll buyers review you

The data is the reason. An employee did not choose your product. Their employer did, and the employer carries the duty to protect what it hands you. Two laws make that concrete.

In California, the Privacy Protection Agency says the exemptions the California Consumer Privacy Act (CCPA) gave to employment-related personal information have expired.³ The law applies to businesses and also to service providers, contractors and third parties, as the Civil Code defines them. Employee data is no longer exempt. Ask counsel which of those roles you play for each customer.

Where the General Data Protection Regulation (GDPR) applies to your customer, Article 28 tells it to use only processors that give sufficient guarantees of appropriate technical and organizational measures.⁴ The contract must also require the processor to make available the information needed to demonstrate compliance, and to allow for audits. A SOC 2 report is one document a customer can review against that. It does not replace the contract.

Privacy or Confidentiality

Security is in every SOC 2. For HR software the next question is which of two optional categories fits your commitments.²

Confidentiality

Tests how you identify information designated as confidential, protect it, and dispose of it as committed. It fits when your promises run to the employer about its data, such as compensation files and bank details.

Privacy

Tests how personal information is collected, used, retained, disclosed and disposed of in line with the notice you publish, including individuals’ access to their own data. It fits when you answer to people directly, as a candidate portal or employee app may. It carries the most work of the five.

Pick the one your contracts actually promise. The scoping tool walks it, and the buyer who asked for the report should confirm it before it goes into the engagement letter. In Polara GRC you add either in the assessment or from your account settings, until the engagement letter is signed or the audit is requested.

Sub-processors

An HR product can depend on several vendors. A cloud host, a bank or payments partner, a background check provider, an email service and an identity check can each touch employee data. Each one is a sub-processor to your customer.

The GDPR sets the rule for that chain. A processor may not engage another processor without the controller’s prior specific or general written authorization.⁴ Under a general authorization, you must tell the customer about any intended addition or replacement, which gives it the chance to object. The same contract terms then flow down to each sub-processor.

In the report, those vendors appear in your system description. One you depend on to meet your commitments is a subservice organization, and it can be carved out, with the controls you expect it to run listed beside it. Keep its own report on file. The guide for contractors and employers of record walks one such case, and complementary user entity controls covers what the customer must do on its side.

When payroll means a SOC 1

SOC 1 and SOC 2 answer different questions. A SOC 1 reports on controls at a service organization that are relevant to its customers’ internal control over financial reporting.⁵ A SOC 2 reports on security and the other trust services categories.¹

The test is where your output lands. Payroll produces wage expense, withholdings and payroll liabilities, and those figures flow into the customer’s financial statements. Its auditors may then ask for a SOC 1 on your processing. An applicant tracking system does not produce such figures. A benefits or expense tool may.

If a buyer names SOC 1, a SOC 2 will not substitute for it. We offer SOC 2, not SOC 1, so in that case a CPA firm that performs SOC 1 examinations is the right call. The fintech guide applies the same test to ledgers and balances.

What to answer in writing

A report covers controls. Some review questions are about terms, and those need a written answer that matches your agreement. Article 28 lists several of them as contract duties.⁴

• Where employee data is stored, and in which countries it is processed.
• How you help the customer answer an employee’s request to see or correct their data.
• Whether you delete or return data at the end of the service, and how fast.
• Your current sub-processor list, and how you announce a change.
• How fast you notify the customer of a security incident.
• Whether your own staff with access pass a background check.

How to answer a security questionnaire has wording for each. If you also sell to hospitals or schools, the guides for healthtech and edtech apply the same structure to their rules.