Bamboo HR LLC
Round 1 · Operational Triage · Operational Triage — Round 1 · assessed
🔴 Do Not Approve
Privacy score 82.9% · band Best
Hard no: the vendor explicitly does something disqualifying — Q16 (AI & Model-Training). An explicit gate violation beats the privacy score.
Hard-fail gate(s): Q16 — an explicit disqualifying practice. This beats the privacy score.
Quote check: 14 of 16 quotes found in the vendor's document. 2 not found (Q1, Q11). Each of those answers is set to unclear and cannot support an approval.
Q2, Q4, Q5, Q6, Q8, Q9, Q10, Q16, Q18, Q19: the quote joins separate passages with "...". Every part is in the document.
Dimension scorecard
| Dimension | Score | |
|---|
| Data Collection |
| 100.0% |
| Purpose & Use GATE |
| 60.0% |
| Data Sharing GATE |
| 100.0% |
| Data Sold GATE |
| 100.0% |
| Data Rights |
| 100.0% |
| Retention |
| 100.0% |
| Data Security | n/a | — |
| Breach Notice |
| 100.0% |
| Biometrics & Surveillance GATE | n/a | — |
| Payments | n/a | — |
| AI & Model-Training GATE ⚠ |
| 20.0% |
| Jurisdiction & Residency |
| 100.0% |
| Contract & Assurance |
| 100.0% |
Findings — 19 questions, every answer cited
Data Collection
Q1Does the vendor limit collection and use of staff personal information to what the service needs?
? Not addressed
T0
Answer: Unclear
DPA Section 2.2 establishes purpose limitation for customer data processing. · [verifier] quote not found verbatim in source
Quote not found in the document. The answer is set to unclear. What the model wrote: “BambooHR will process Personal Data only for the purpose of providing the Services to Client under the Contract and in accordance with Client's documented instructions”
Q2Does the vendor name the categories of sensitive staff data it holds (government ID or SSN, bank details, health or benefits data, biometrics)?
✓ Good
T3
Answer: Yes
“Payroll related information (including, but not limited to, salary and compensation information, tax and social security information, bank details, pensions, share options, bonuses, other benefits, etc.)... Health status, disability information.”
DPA Annex II explicitly names sensitive categories: SSN/tax info, bank details, health, disability.
Purpose & Use
Q3Does the vendor commit to use the school's data only to provide the contracted service, and not for its own purposes? GATE
✓ Good
T3
Answer: Yes
“BambooHR shall process Personal Data under the Contract only as a Processor acting on behalf of Client.”
DPA Section 2.1 establishes processor role and purpose limitation.
Q4Does the vendor use school or staff data for marketing, profiling or product analytics beyond operating the service?
✗ Concern
T3
Answer: Yes
“BambooHR owns and shall retain all right, title and interest in... all operational and performance data related to your use of the Service and Beta Service... BambooHR may collect, use, and disclose all such Performance Data for its business purposes (such as software use optimization, product marketing, industry benchmarking, training and improving AI offerings...)”
Terms of Service Section 6.1 explicitly permits use of performance data for marketing, benchmarking, and AI training.
Data Sharing
Q5Does the vendor limit sharing with third parties to the purpose for which the data was collected? GATE
✓ Good
T3
Answer: Yes
“BambooHR shall not subcontract any processing of Personal Data to a Subcontractor without the prior written consent of Client. Notwithstanding the foregoing, Client hereby expressly consents to BambooHR engaging Subcontractors to process Personal Data provided that: (a) BambooHR provides Client with a list of all Subcontractors... (b) BambooHR provides at least 30 days' prior written notice to Client of the engagement of any new Subcontractor”
DPA Section 3.1 limits sharing to subcontractors with notice and consent.
Q6Does the vendor publish or offer a list of sub-processors, naming its cloud host, and commit to notice before adding one?
✓ Good
T3
Answer: Yes
“BambooHR provides Client with a list of all Subcontractors engaged to process Personal Data on BambooHR's behalf (an up-to-date list of which is currently provided here), and shall promptly provide Client with an updated copy of, or link to, the Subcontractor list in the event BambooHR adds or replaces any Subcontractor... BambooHR provides at least 30 days' prior written notice to Client of the engagement of any new Subcontractor”
DPA Section 3.1 provides both a published subprocessor list and 30-day notice commitment. Cloud host not explicitly named in policy but referenced as available.
Data Sold
Q7Is staff or school personal information ever sold or rented to any outside party? GATE
✓ Good
T3
Answer: No
“We do not sell your Personal Information to third parties for monetary consideration.”
California Privacy Notice Section 6 explicitly states no sale of personal information.
Data Rights
Q8Does the vendor support access, correction and deletion requests from the school, with a stated process or response time?
✓ Good
T3
Answer: Yes
“You have the right to view and request copies of your Personal Information... You have the right to update the Personal Information that BambooHR has collected about you... You have the right to request that BambooHR delete your Personal Information... You may submit your request using our toll-free number or via our online form.”
General Privacy Notice Section 12 and California Privacy Notice Section 7 describe access, correction, and deletion rights with contact methods. No specific response time stated.
Q9Does the school keep ownership of its data, with return or deletion at the end of the contract?
✓ Good
T3
Answer: Yes
“You retain all right, title and ownership interest in and to Customer Data... Upon Client's request, or upon termination or expiration of this DPA, BambooHR shall, at Client's election, destroy, and certify such deletion, or return to Client all Personal Data (including copies) in its possession or control”
Terms of Service Section 6.2 confirms customer ownership; DPA Section 9.1 provides return or deletion at termination.
Retention
Q10Does the vendor state a retention period for staff data after the service ends, and whether deletion is automatic?
✓ Good
T3
Answer: Yes
“In the event your subscription is not renewed... you will continue to have the ability to download the information provided, inputted, or uploaded to your databases in the BambooHR® Service by you or on your behalf ('Customer Data') for thirty (30) days after the effective date of expiration or termination of your subscription. After such 30-day period... BambooHR shall have no obligation to maintain any Customer Data and shall thereafter, unless legally prohibited from doing so, or required pursuant to Additional Terms, delete all of your Customer Data... If you subscribe to the 'BambooHR® Payroll Service'... BambooHR may maintain your payroll data or other Customer Data for seven (7) years”
Terms of Service Section 2.5 specifies 30-day download period then deletion, with 7-year retention for payroll data. Deletion is automatic after stated periods.
Data Security
Q11Does the vendor disclose baseline safeguards: encryption in transit and at rest, single sign-on with MFA for admin roles, and an independent attestation (SOC 2, ISO 27001) or equivalent?
? Not addressed
T0
Answer: Unclear
Security page and DPA Section 6.1 confirm encryption in transit and at rest, plus SOC 2 Type II attestation. MFA mentioned in privacy policy and terms. · [verifier] quote not found verbatim in source
Quote not found in the document. The answer is set to unclear. What the model wrote: “Industry-standard encryption for information in transit and at rest... Annual third-party SOC II security audit... BambooHR maintains records in accordance with ISO 27001, SOC II or other similar Information Security Management System ('ISMS') standards”
Breach Notice
Q12Does the vendor commit to notify the customer of a security incident without undue delay, with a stated hour count?
✓ Good
T3
Answer: Yes
“In the event of a Security Incident, BambooHR shall inform Client without undue delay and provide written notification of the Security Incident.”
DPA Section 5.1 commits to notification 'without undue delay' but does not specify an hour count.
Biometrics & Surveillance
Q13For products that capture faces, fingerprints or other biometric identifiers: does the vendor require written notice and consent before collection, and publish a retention and destruction schedule? GATE
— N/A
T0
Answer: N/A
not applicable to this product type
Q14Does the vendor use customer video, images or biometric data for its own analytics or model training?
— N/A
T0
Answer: N/A
not applicable to this product type
Payments
Q15For products that take card payments: does the vendor state PCI DSS compliance and name the scope it covers for the customer?
— N/A
T0
Answer: N/A
not applicable to this product type
AI & Model-Training
Q16Does the vendor use customer or staff data, including uploaded documents, to train or improve AI or machine-learning models? GATE
✗ Concern
T3
Answer: Yes
“BambooHR owns and shall retain all right, title and interest in... all operational and performance data related to your use of the Service and Beta Service... BambooHR may collect, use, and disclose all such Performance Data for its business purposes (such as software use optimization, product marketing, industry benchmarking, training and improving AI offerings...)”
Terms of Service Section 6.1 explicitly permits use of performance data for 'training and improving AI offerings'.
Q17Does the vendor disclose automated decisions that affect staff (screening, scheduling, pay, access) and offer human review?
✗ Concern
T3
Answer: No
“BambooHR does not currently engage in automated decision-making or profiling.”
California Privacy Notice Section 7 and General Privacy Notice Section 12 state no automated decision-making.
Jurisdiction & Residency
Q18Does the vendor disclose where data is stored and which privacy laws it complies with?
✓ Good
T3
Answer: Yes
“We host customer data in state-of-the-art data centers located in the United States, Canada, or Ireland, depending on the location and needs of the individual customer and applicable laws... BambooHR complies with the General Data Protection Regulation ('EU GDPR'), the EU GDPR as it applies to the laws of England and Wales (the 'UK GDPR')... Switzerland's Federal Act on Data Protection of 1992 ('FDAP'), the California Consumer Privacy Act ('CCPA'), the California Privacy Rights Act (together with the CCPA, 'CPRA'), and all other applicable privacy laws.”
Security page and privacy policy name storage locations (US, Canada, Ireland) and multiple privacy regimes (GDPR, UK GDPR, FDAP, CCPA, CPRA).
Contract & Assurance
Q19Does the vendor offer a data-processing agreement or equivalent written terms to customers?
✓ Good
T3
Answer: Yes
“This BambooHR Data Processing Agreement (the 'DPA') is entered into by and between the BambooHR customer agreeing to these terms ('Client') and Bamboo HR, LLC... All terms of this DPA are hereby incorporated into the Contract.”
A comprehensive Data Processing Agreement is published and incorporated into the customer contract.
Jurisdiction & residency — your footprint
Vendor named 0 of 4 countries in your footprint. Shown alongside the verdict, not folded into the score —
a vendor can be strong on privacy yet leave residency gaps for specific countries.
“We host customer data in state-of-the-art data centers located in the United States, Canada, or Ireland, depending on the location and needs of the individual customer and applicable laws... BambooHR complies with the General Data Protection Regulation ('EU GDPR'), the EU GDPR as it applies to the laws of England and Wales (the 'UK GDPR')... Switzerland's Federal Act on Data Protection of 1992 ('FDAP'), the California Consumer Privacy Act ('CCPA'), the California Privacy Rights Act (together with the CCPA, 'CPRA'), and all other applicable privacy laws.”
| Country | Privacy law | Coverage |
|---|
| United States (federal) | FERPA / COPPA / PPRA | ⚠ Gap |
| Illinois | SOPPA | ⚠ Gap |
| Texas | Texas Education Code ch. 32 (student data privacy) | ⚠ Gap |
| California | SOPIPA / CCPA | ⚠ Gap |
| GDPR (overlay) | Applies when a school holds data on EU or UK students, families or staff | ✓ Named |