Skip to main content
Homebase logo

Homebase

Security and trust center evidence

Build schedules, track time, run payroll and hire in one easy

joinhomebase.comPayrollLast verified 18 Sep 2026
Request the report Are you Homebase?

Summary

SOC 2 mark, CertReports state Vendor-stated as of 18 Sep 2026SOC 2Vendor-statedPCI DSS mark, CertReports state Vendor-stated as of 18 Sep 2026PCI DSSVendor-statedSOC 3 mark, CertReports state Vendor-stated as of 18 Sep 2026SOC 3Vendor-statedCCPA / CPRA mark, CertReports state Vendor-stated as of 18 Sep 2026CCPAVendor-stated

Homebase has 4 vendor-stated rows in the CertReports index, last verified 18 Sep 2026. The strongest row is SOC 2: Vendor states SOC 2 Type 2 on its trust centre. This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.

Reviewer brief

As of 18 Sep 2026, CertReports holds 4 vendor-stated rows for Homebase, drawn from its trust centre (Drata). Homebase states on its trust centre that it holds a SOC 2 Type II report, a PCI DSS attestation of compliance, a public SOC 3 report and an CCPA / CPRA privacy notice, captured 18 Sep 2026; these are vendor statements, not independent confirmations. No public evidence was found for ISO/IEC 27001, HIPAA, GDPR and FedRAMP as of 18 Sep 2026; that is a gap in the public record, not a finding of non-coverage, and the vendor can supply it under NDA.

  • SOC 2: Vendor states SOC 2 Type 2 on its trust centre, vendor-stated as of 18 Sep 2026
  • PCI DSS: Vendor states PCI DSS on its trust centre, vendor-stated as of 18 Sep 2026

Facts only, each dated; nothing here is inferred, scored or advised.

Among payroll vendors

0verified rows

Category median 1, across 4 indexed payroll vendors. Homebase has more verified rows than 25 percent of them.

Compare with similar vendors

Pick your own comparison

Compliance grid

No public evidence yet for HIPAA, GDPR, FedRAMP, ISO 27001, CSA STAR, Cyber Essentials, ISO 27701, ISO 42001. This does not mean the vendor lacks them; it means nothing public was found at the last check.

Subprocessors

No subprocessor list captured yet.

Change history

  1. 18 Sep 2026First indexed by CertReports4 evidence rows across 4 frameworks entered the index.