Explainers
The EU-US Data Privacy Framework, explained for vendor reviews
Solomon Amos · 7 Sep 2026 · 10 min read
EH Financial Services
Regulatory evidence
Recruitment, HR, Payroll & Benefits in one place - designed for small & medium businesses to be efficient, compliant &
EH Financial Services against third-party requirements
For each regulation, how many of the requirements it places on your vendors EH Financial Services’s public evidence reaches. Open one for every item with its date and source.
- GDPR70%3 evidence found1 partial evidence1 no public evidence
- UK GDPR63%2 evidence found1 partial evidence1 no public evidence
- DORA88%4 evidence found1 available on request1 partial evidence
- NIS292%2 evidence found1 available on request
- HIPAA67%2 evidence found1 no public evidence
- PCI DSS25%1 partial evidence1 no public evidence
- EU AI Act17%1 partial evidence2 no public evidence
- ISO 27001 Annex A75%3 evidence found1 no public evidence
- SOC 2 CC9.275%1 evidence found1 partial evidence
Documents on the trust centre
What the vendor lists, typed; public items can be read now, the rest are available on request.
18 documents listed on EH Financial Services’s trust centre
trust.employmenthero.com- Business continuity and disaster recovery plan
- Business Continuity Plan (Sanitised)on request · seen 21 Sep 2026
- Disaster Recovery Plan (Cloud Services) (Sanitised)on request · seen 21 Sep 2026
- Disaster Recovery Plan (Information Security) (Sanitised)on request · seen 21 Sep 2026
- Incident response plan
- Information Security Incident Response Plan (Sanitised)on request · seen 21 Sep 2026
- Cyber insurance certificate
- 202508 Financial Institution Professional Indemnity Insurance Certificate of Currencyon request · seen 21 Sep 2026
- 202508 Information Technology Insurance Certificate of Currencyon request · seen 21 Sep 2026
- Penetration test report
- [Sanitised] EHWork - EmploymentHero - Pentest - 2026.pdfon request · seen 21 Sep 2026
- [Sanitised] HR - EmploymentHero - Pentest - 2026.pdfon request · seen 21 Sep 2026
- [Sanitised] Payroll - EmploymentHero - Pentest - 2026.pdfon request · seen 21 Sep 2026
- Security policy or overview
- Access Control Policy (Sanitised)on request · seen 21 Sep 2026
- Cloud Security Policy (Sanitised)on request · seen 21 Sep 2026
- Cryptography Policy (Sanitised)on request · seen 21 Sep 2026
- Information Security Management System (ISMS) Plan (Sanitised)on request · seen 21 Sep 2026
- Information Security Policy (Sanitised)on request · seen 21 Sep 2026
- Information Security Risk Management Policy (Sanitised)on request · seen 21 Sep 2026
- Physical Security Policy (Sanitised)on request · seen 21 Sep 2026
- Vulnerability Management Policy (Sanitised)on request · seen 21 Sep 2026
- SOC 2 report
- 202508 [Sanitised] SOC2 Type2 Report Employment Heroon request · seen 21 Sep 2026
What the vendor says
Answers the vendor publishes to questions buyers ask, quoted with the link to where it says so.
Where data is hosted or processed
Where is customer data stored?
“Employment Hero primarily stores customer data in AWS data centres located in Australia, Ireland and Canada. For HR customers and non-UK Payroll customers, data is hosted in Australia, UK-based Payroll customer data is stored in Ireland, Canadian personal payroll data is stored in Canada. Backups are distributed across geographically redundant AWS data centres in Australia and Europe, ensuring data resilience and...”
Regions named: EU, UK, Ireland, Canada, Australiaas of 21 Sep 2026Source
Encryption
Do you encrypt tenant data at rest?
“Yes, AES-256 encryption via AWS KMS, plus full disk encryption for devices.”
as of 21 Sep 2026Source
Encryption
Do you encrypt data in transit?
“Yes. Employment Hero primarily considers symmetric TLS 1.2 as its minimum encryption standard when transferring classified data due to its strength.”
as of 21 Sep 2026Source
Encryption
Do you encrypt data at rest?
“Yes. Employment Hero primarily considers symmetric AES-256 as its minimum encryption standard when handling classified data due to its strength.”
as of 21 Sep 2026Source
Incident and breach notification
Do you have breach/anomaly detection with alerting?
“Yes, supported by ISO 27001–certified policies and controls.”
as of 21 Sep 2026Source
Incident and breach notification
Do you have a breach notification process?
“Yes, via Data Breach Policy and Incident Response Plan. Customers are notified promptly if affected.”
as of 21 Sep 2026Source
Use of customer data to train models
Is customer data used to train the AI model?
“No, personal data is not used to train our AI model.”
as of 21 Sep 2026Source
Penetration testing
Do you conduct penetration tests?
“Yes, annually by independent testers, plus a private Bug Bounty program.”
as of 21 Sep 2026Source
Reviewing a vendor against regulations
All articlesAnalysis
The state of public compliance evidence in 2026: what 3,000 vendors actually publish
CertReports Research · 18 Sep 2026 · 12 min read
This maps third-party obligations to the vendor evidence that may support them. It is not legal advice and never a statement that a vendor or its customers comply; confirm scope and sufficiency with your counsel or auditor. “No public evidence” means nothing public was found at the last check. Citations link to the official text.