Personio

hr · personio.com · last read 2026-10-07

Identity

No identity observation recorded yet.

Data location

No data-location observation recorded yet.

Subprocessor chain

No subprocessor list transcribed. Either the vendor does not publish one where we could reach it, or it is gated — see the documents table below for which.

Assurance

Scheme	Status	Scope	Source	Observed
GDPR	Claimed	—	trust.personio.com	2026-10-05
ISO 27001 · ISO27001	Claimed	—	trust.personio.com	2026-10-05
ISO/IEC 27001:2022 · ISO27001	Available on request	—	trust.personio.com	2026-10-05
ISO/IEC 27017:2015 · ISO27017	Available on request	—	trust.personio.com	2026-10-05

Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.

Official registers

Register	Offering, as the register names it	Status	Level	Valid until	Observed
Data Privacy Framework List (US)	EU-U.S. Data Privacy Framework · Personio Corp	Active	non-HR data	2027-09-16	2026-10-07
Data Privacy Framework List (US)	Swiss-U.S. Data Privacy Framework · Personio Corp	Active	non-HR data	2027-09-16	2026-10-07
Data Privacy Framework List (US)	UK Extension to the EU-U.S. DPF · Personio Corp	Active	non-HR data	2027-09-16	2026-10-07

ACN qualified cloud (Italy): checked 2026-10-07, no entry under Personio
Data Privacy Framework List (US): checked 2026-10-07, 3 entries under Personio
FedRAMP Marketplace (US): checked 2026-10-07, no entry under Personio

What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.

Support window

Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.

Documents

What we read, how it was disclosed, and when.
Document	Disclosure	Transcription	HTTP	Observed
certifications	Public	full	200	2026-10-05
residency	Refused	partial	429	2026-10-05

History

Nothing has moved since we started watching this vendor on 2026-10-05. Changes appear here only after a human has reviewed them.