Workday
Hr · workday.com · last read 2026-10-12
Identity
| Legal entity | Workday, Inc. |
|---|---|
| HQ | US |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | Workday Limited |
| LEI | 549300J0DYC0N31V7G13 |
| US CLOUD Act reach | Contracting entity incorporated in the US |
| Source | workday.com · 2026-10-08 |
Legal entity from the vendor's own terms. LEI, registered country and parent company from the Global LEI Index (GLEIF); ownership is left empty where GLEIF names no parent. The CLOUD Act row is arithmetic over those countries, not an assessment of risk.
Data location
No data-location observation recorded yet.
Subprocessor chain
No subprocessor list transcribed. Either the vendor does not publish one where we could reach it, or it is gated — see the documents table below for which.
Processing terms
No data processing agreement read yet.
Assurance
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| Global Cross Border Privacy Rules (CBPRs) Certification · APECCBPR | Claimed | Workday Enterprise Products, Workday Adaptive Planning, Workday Strategic Sourcing, Workday Peakon Employee Voice, Workday VNDLY, HiredScore AI for Recruiting, HiredScore AI for Talent Mobility, Workday Contract Lifecycle Management, powered by Evisort AI. | workday.com | 2026-10-08 |
| Global Privacy Recognition for Processors (PRP) Certification · APECPRP | Claimed | Workday Enterprise Products, Workday Adaptive Planning, Workday Strategic Sourcing, Workday Peakon Employee Voice, Workday VNDLY, HiredScore AI for Recruiting, HiredScore AI for Talent Mobility, Workday Contract Lifecycle Management, powered by Evisort AI. | workday.com | 2026-10-08 |
| CSA STAR Self-Assessment · CSA | Claimed | Workday Enterprise Products, Workday Adaptive Planning, Workday Strategic Sourcing, Workday Peakon Employee Voice, Workday VNDLY; STAR Level 1 | workday.com | 2026-10-08 |
| CSA Trusted Cloud Provider · CSA | Claimed | Workday Enterprise Products, Workday Adaptive Planning, Workday Strategic Sourcing, Workday Peakon Employee Voice, Workday VNDLY | workday.com | 2026-10-08 |
| Cyber Essentials Plus · CyberEssentialsPlus | Certificate published | Workday Enterprise Products, Workday Adaptive Planning, Workday Strategic Sourcing, Workday Peakon Employee Voice, Workday VNDLY | workday.com | 2026-10-08 |
| Data Privacy Framework · DPF | Certificate published | Workday Enterprise Products, Workday Adaptive Planning, Workday Strategic Sourcing, Workday VNDLY, HiredScore AI for Recruiting, HiredScore AI for Talent Mobility, Workday Contract Lifecycle Management, powered by Evisort AI. | workday.com | 2026-10-08 |
| EU Cloud Code of Conduct · EUCloudCoC | Certificate published | Workday Enterprise Products, Workday Adaptive Planning; Adherence ID: 2019LVL02SCOPE001 | workday.com | 2026-10-08 |
| FedRAMP Moderate · FedRAMP | Claimed | Workday Enterprise Products, Adaptive from Workday. FedRAMP Authorized status at the Moderate security impact level for Workday Government Cloud. | workday.com | 2026-10-08 |
| HIPAA | Claimed | Workday Enterprise Products (third-party attestation) | workday.com | 2026-10-08 |
| Australian IRAP · IRAP | Claimed | Workday Enterprise Products, Workday Adaptive Planning; Workday Production environments at the PROTECTED level | workday.com | 2026-10-08 |
| ISO 27001 · ISO27001 | Certificate published | VNDLY | workday.com | 2026-10-08 |
| ISO 27001/27017/27018/27701 · ISO27001 | Certificate published | — | workday.com | 2026-10-08 |
| ISO/IEC 27001:2022 · ISO27001 | Certificate published | Information Security Scope (ISO 27001, 27017, 27018): Adaptive Planning, Analytics and Reporting, Contract Lifecycle Management (CLM) and Contract & Document Intelligence, Financial Management, HiredScore, Human Capital Management, Payroll, Peakon, Platform and Product Extensions, Spend Management, Student, Talent Management, Workforce Management, and Sana (Core/Enterprise, Learn, Agents). Certified by Schellman Compliance, LLC. | workday.com | 2026-10-08 |
| ISO/IEC 27017:2015 · ISO27017 | Claimed | Information Security Scope (ISO 27001, 27017, 27018): Adaptive Planning, Analytics and Reporting, Contract Lifecycle Management (CLM) and Contract & Document Intelligence, Financial Management, HiredScore, Human Capital Management, Payroll, Peakon, Platform and Product Extensions, Spend Management, Student, Talent Management, Workforce Management, and Sana (Core/Enterprise, Learn, Agents). | workday.com | 2026-10-08 |
| ISO/IEC 27018:2019 · ISO27018 | Claimed | Information Security Scope (ISO 27001, 27017, 27018): Adaptive Planning, Analytics and Reporting, Contract Lifecycle Management (CLM) and Contract & Document Intelligence, Financial Management, HiredScore, Human Capital Management, Payroll, Peakon, Platform and Product Extensions, Spend Management, Student, Talent Management, Workforce Management, and Sana (Core/Enterprise, Learn, Agents). | workday.com | 2026-10-08 |
| ISO/IEC 27701:2019 · ISO27701 | Claimed | Privacy Governance Scope (ISO 27701): Adaptive Planning, Analytics and Reporting, Contract Lifecycle Management (CLM) and Workday Contract & Document Intelligence, Financial Management, Human Capital Management, Payroll, Peakon, Platform and Product Extensions, Spend Management, Student, Talent Management, and Workforce Management. | workday.com | 2026-10-08 |
| ISO 42001 · ISO42001 | Certificate published | Workday Human Capital Management, Workday Financial Management, Workday Student, Workday Spend Management, Workday Adaptive Planning, Workday Peakon Employee Voice, Workday Payroll, Workday Workforce Management, Workday Talent Management, Workday Analytics and Reporting, Workday Platform, Product Extensions, Contract Management and Document Intelligence | workday.com | 2026-10-08 |
| CCCS CSP ITS Assessment | Claimed | Workday Enterprise Products; GC public cloud security requirements up to Protected B, Medium Integrity, and Medium Availability (PB/M/M) | workday.com | 2026-10-08 |
| Enterprise Privacy & Data Privacy Governance Practices Certification | Claimed | Workday Enterprise Products, Workday Adaptive Planning, Workday Strategic Sourcing, Workday VNDLY, HiredScore AI for Recruiting, HiredScore AI for Talent Mobility, Workday Contract Lifecycle Management, powered by Evisort AI. | workday.com | 2026-10-08 |
| G-Cloud | Claimed | Workday Enterprise Products, Workday Adaptive Planning, Workday Peakon Employee Voice | workday.com | 2026-10-08 |
| NIST 800-171 | Claimed | Addressed in the SOC 2 report as part of the SOC 2+ Additional Subject Matter process, which includes an audited mapping of Workday controls against these frameworks. | workday.com | 2026-10-08 |
| NIST AI Risk Management Framework (NIST AI RMF) | Claimed | Workday, Inc. | workday.com | 2026-10-08 |
| NIST CSF and NIST 800-171 | Claimed | Workday Enterprise Products; SOC 2 controls mapped to the standards, mapping audited as part of the Workday SOC 2+ report | workday.com | 2026-10-08 |
| NIST Cybersecurity Framework | Claimed | Addressed in the SOC 2 report as part of the SOC 2+ Additional Subject Matter process, which includes an audited mapping of Workday controls against these frameworks. | workday.com | 2026-10-08 |
| NIST PF | Claimed | Workday Enterprise Products; SOC 2 controls mapped, mapping audited as part of the Workday SOC 2+ report | workday.com | 2026-10-08 |
| TRUSTe certification | Claimed | — | workday.com | 2026-10-08 |
| SIG Questionnaire · SIG | Available on request | Workday Enterprise Products, Workday Adaptive Planning, Workday Strategic Sourcing, Workday Peakon Employee Voice, Workday VNDLY; self-assessed annually | workday.com | 2026-10-08 |
| SOC 1 Type II · SOC1 | Claimed | Applies to: Workday Enterprise Products, Workday Adaptive Planning, Workday VNDLY. Issued in accordance with ISAE 3402; covers the design and operating effectiveness of controls relevant to Workday enterprise cloud applications. | workday.com | 2026-10-08 |
| SOC 2 Type II · SOC2T2 | Claimed | Applies to: Workday Enterprise Products, Workday Adaptive Planning, Workday Strategic Sourcing, Workday Peakon Employee Voice, Workday VNDLY, HiredScore AI for Recruiting, HiredScore AI for Talent Mobility, Workday Contract Lifecycle Management, powered by Evisort AI. The Workday Enterprise Products SOC 2 report addresses all of the Trust Services Criteria (Security, Availability, Confidentiality, Processing Integrity, and Privacy). | workday.com | 2026-10-08 |
| SOC 2+ · SOC2T2 | Claimed | — | workday.com | 2026-10-08 |
| SOC 3 · SOC3 | Certificate published | Applies to: Workday Enterprise Products, Workday Adaptive Planning, Workday Peakon Employee Voice, Workday Strategic Sourcing; reports also linked for Workday Contract Intelligence and Contract Lifecycle Management (Evisort). | workday.com | 2026-10-08 |
| TX-RAMP Level 2 · TXRAMP | Claimed | Workday Enterprise Products, Workday Adaptive Planning, Workday Strategic Sourcing, Workday Peakon Employee Voice, Workday VNDLY | workday.com | 2026-10-08 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · Workday, Inc. | Active | HR data, non-HR data | 2027-05-28 | 2026-10-09 |
| Data Privacy Framework List (US) | Swiss-U.S. Data Privacy Framework · Workday, Inc. | Active | HR data, non-HR data | 2027-05-28 | 2026-10-09 |
| Data Privacy Framework List (US) | UK Extension to the EU-U.S. DPF · Workday, Inc. | Active | HR data, non-HR data | 2027-05-28 | 2026-10-09 |
| EU Cloud Code of Conduct (GDPR Art. 40) | Workday Limited (workday.com) · Workday Limited | adherent | Level 2 | 2027-08-04 | 2026-10-09 |
| FedRAMP Marketplace (US) | Workday Government Cloud (WGC) · Workday Inc. | FedRAMP Authorized | Moderate | — | 2026-10-09 |
| Global LEI Index (GLEIF) | WORKDAY LIMITED · WORKDAY LIMITED | ISSUED | IE | 2027-06-15 | 2026-10-09 |
| Global LEI Index (GLEIF) | WORKDAY, INC. · WORKDAY, INC. | ISSUED | US-DE | 2027-06-07 | 2026-10-09 |
- ACN qualified cloud (Italy): checked 2026-10-12, no entry under Workday; Workday Limited; Workday, Inc.
- DORA critical ICT third-party providers (ESAs): checked 2026-10-12, no entry under Workday; Workday Limited; Workday, Inc.
- Data Privacy Framework List (US): checked 2026-10-12, 3 entries under Workday; Workday Limited; Workday, Inc.
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-10-12, 1 entry under Workday; Workday Limited; Workday, Inc.
- FedRAMP Marketplace (US): checked 2026-10-12, 1 entry under Workday; Workday Limited; Workday, Inc.
- SecNumCloud qualified services (ANSSI, France): checked 2026-10-12, no entry under Workday; Workday Limited; Workday, Inc.
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Vulnerability reporting: no security.txt at the well-known path (read 2026-10-11)
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-08 |
| subprocessors | Refused | partial | — | 2026-10-09 |
History
Nothing has moved since we started watching this vendor on 2026-10-08. Changes appear here only after a human has reviewed them.