HRIS (BambooHR, Rippling, Workday, …)
HR · merge_link · Daily
Unified HRIS integration via Merge.dev. One connector reaches 50+ HR platforms; customers pick their provider during setup. Pulls active employee count, recent terminations, and onboarding-task completion rate for SOC 2 CC1.4 + CC6.3 personnel-control evidence.
- Authentication
- merge_link
- Sync cadence
- Daily
- Stale threshold
- Every 2 days
- Category
- HR
Evidence this connector produces
Every sync writes typed evidence rows linked to the controls below. Evidence is immutable once attached to an approved assessment, fingerprinted for de-dup, and surfaced in the control coverage calculation on your dashboard.
How to connect
Click Connect to launch the Merge Magic Link flow. You'll pick your HRIS, sign in to that provider, and authorize read-only access. No credentials are pasted into ThirdSentry — Merge holds the tokens and we only see normalized data.
- 1Pick your HRIS provider in Merge Link
Merge's hosted picker lists every HRIS they support: BambooHR, Rippling, Workday, Gusto, Justworks, ADP, Paychex, HiBob, Personio, Sage HR, and 40+ more. Pick yours.
- 2Authorize read-only access
Merge handles your provider's OAuth (or API-key) flow. We never receive the underlying credentials — they live in Merge and rotate automatically.
- 3Sync starts immediately
First pull collects active-employee snapshot, recent terminations (30d window), and onboarding-task completion. Daily syncs thereafter; manual sync is available from the connection detail page.
Security model
Every connector ships behind the same auditor-grade primitives — not just RBAC config, but architectural enforcement.
Tokens, client secrets, and service-account keys are encrypted under a per-tenant AWS KMS data key. The plaintext is never persisted, never logged, and never leaves the FastAPI process boundary.
Every Connection, ConnectorRun, and emitted Evidence row carries an organization ObjectId. The scheduler never iterates without an org-scoped filter; cross-tenant evidence bleed is impossible at the data layer.
Connect, sync, sync-failure, re-auth, and revoke each write a row to the immutable AuditLog. The full lifecycle is reconstructable for any examiner.
Revoking a connection sets deletedAt and clears the encrypted credential blob, but the historical evidence + sync log stays queryable for the retention window. Auditors can still trace what was attested when.
If this connector hasn't synced in Every 2 days, control coverage degrades automatically and an alert fires. Auditors don't trust stale evidence — neither do we.
We request the minimum read-only scopes needed for the listed evidence. No write scopes, no admin scopes, no scopes outside the documented set.
Ready to connect HRIS (BambooHR, Rippling, Workday, …)?
Connect from Settings → Integrations — typically under 5 minutes. Or talk to us first.