12 Questions to Ask an HR Software Vendor About Security and Privacy

HR software holds a strange concentration of sensitive data. Social Security numbers, bank details, salaries, performance reviews, medical accommodation requests, immigration documents, termination reasons. If one system in a small company is going to cause a genuinely bad day when it's breached, it's this one.

And yet HR software is usually bought on features and price. The security conversation, if it happens, is a page on the vendor's website with a padlock icon and the word "enterprise-grade."

Here are twelve questions worth asking instead. None require a technical background, and the quality of the answer tells you more than the answer itself.

Data isolation

1. How is my company's data separated from other customers'?

Nearly all modern HR software is multi-tenant — your data and other companies' data live in the same database. That's normal and fine. What matters is how separation is enforced.

A good answer describes enforcement at the database layer, so a bug in application code can't expose another tenant's records. A weaker answer is "our application filters by company ID," which means the only thing standing between tenants is developers never making a mistake.

2. Has that isolation been tested, and how?

Ask whether they've actually tried to break it — signed in as one customer and attempted to reach another's data. "We designed it correctly" and "we tested it and here's what we found" are very different levels of confidence.

Access and authentication

3. Can staff at your company see my employee data?

Some vendor access is legitimate — support can't help if they can't see anything. The question is whether it's controlled. A good answer involves scoped, time-limited, logged access tied to a support ticket. A concerning answer is that any employee with database access can read any customer's records.

4. Do you support multi-factor authentication, and can I require it?

Offering MFA is table stakes. Being able to *require* it for admins is the part that matters, since an HR admin account is effectively a key to every record in the company.

5. What happens to a terminated employee's access?

This is the question that catches the most vendors. When you mark someone as terminated, does their access actually stop — immediately, across the employee portal, any mobile app, and any outstanding invite or document-signing links they were sent?

It's worth testing during a trial rather than taking on faith. Offboarding is exactly when access control matters most, and exactly where it's most often incomplete.

Sensitive fields

6. How are Social Security numbers stored?

"Encrypted at rest" usually means the whole disk is encrypted, which protects against someone stealing the physical drive and almost nothing else. A stronger answer is field-level encryption specifically for SSNs and similar identifiers, so they're protected separately from the rest of the record.

7. Who can view an SSN, and is viewing it logged?

In a well-designed system, revealing an SSN is a deliberate, permission-gated action that generates an audit entry. If any HR user can see full SSNs in a list view, that's a lot of unnecessary exposure.

Subprocessors and data flow

8. Who else touches my data?

Every SaaS product runs on other vendors — hosting, database, email delivery, payment processing, AI providers, analytics. These are subprocessors, and you're trusting all of them transitively.

Ask for the list. A good answer is a published, current list naming each subprocessor and what it does. If the list is missing, vague, or clearly out of date compared to what you can observe on their own website, that tells you something about how carefully they track it.

9. If you use AI features, what happens to my data?

Specifically: is your employee data sent to a third-party model provider, is it used to train models, and is it retained after the request? These have different answers at different vendors, and the difference matters if you're handling anything sensitive.

It's also worth asking what an AI feature is allowed to *do*. An AI that can read your data is a different risk profile from one that can modify records without a human confirming first.

Retention, export, and deletion

10. How long do you keep my data, and what happens when I cancel?

You want a specific answer with a number in it. "We retain customer data for 30 days after cancellation to allow export, then delete or anonymize it" is a real policy. "We retain data as long as necessary" is not.

Then ask the follow-up that separates policy from practice: is that deletion automated, or does someone have to remember to do it? A published retention promise with no mechanism behind it is a commitment the vendor is quietly failing to meet.

11. Can I get all my data out, in a usable format?

Test this during your trial rather than trusting the sales answer. Export everything and open it. If the export is partial, or arrives in a format you can't practically use, you're more locked in than you think.

12. Can you delete a specific individual's data on request?

Increasingly relevant under state privacy laws, and genuinely hard to build — an employee record touches dozens of tables. Ask whether deletion actually clears sensitive fields everywhere, or just hides the record from the UI while leaving the underlying data intact.

Two things to check yourself

Vendor answers are self-reported. Two checks take about five minutes and are worth doing on any shortlist:

• Read their privacy policy and compare it to their actual site. If the policy says they don't use analytics cookies, open the site with your browser's developer tools and see whether that's true. A mismatch between what a company publishes and what it does is a useful signal, and it's surprisingly common.
• Check whether their subprocessor list matches reality. If their site loads services that don't appear anywhere in their disclosures, that's a gap in how carefully they're tracking their own data flows.

Why this is worth the hour

None of these questions require you to be technical. They're the sort of thing a careful buyer asks and a well-run vendor is glad to answer clearly — and the vendors who get uncomfortable are giving you real information too.

The asymmetry is what makes it worth doing. An hour of questions before you buy, against the cost of migrating years of sensitive HR data into a system that turns out to handle it carelessly.

If a vendor can't tell you who their subprocessors are, how tenant isolation is enforced, and what happens to a terminated employee's access, those aren't hard questions they haven't gotten to yet. They're questions a mature product has already answered.

We publish our subprocessor list, enforce tenant isolation at the database level, encrypt SSNs at the field level with permission-gated and audit-logged access, and run data retention on an automated schedule. If you're evaluating HR platforms, start a free trial or read our security overview.