Security and certifications

Evidence you can review before entrusting us with your HR data

When assessing an HR and payroll partner, your HR, IT and finance teams need evidence. We provide three ISO certifications and an ISAE 3402 report to support an informed decision.

What the documents attest to and what they mean for you

Information security, personal data protection, quality management and internal controls offer complementary perspectives when assessing a vendor.

ISO/IEC 27001

Information security management · certified. The standard addresses information security management and the associated risks. For your team, certification provides a verifiable reference when assessing how sensitive HR and payroll data is protected.

ISO/IEC 27701

Privacy information management · certified. The standard addresses the management of personal data protection. Certification supports your assessment of the vendor's practices in the context of GDPR requirements and responsibilities for employee data.

ISO 9001

Quality management · certified. The standard addresses quality management processes and their continual improvement. For HR and finance, it provides a reference when assessing consistent payroll processes and service quality.

ISAE 3402

Independently audited controls · report. This is an independent assurance report on a service organisation's internal controls. Your company's financial auditors can rely on the report when assessing relevant controls, within the scope described in the document.

Documents for vendor assessment

Preparing a security assessment or vendor due diligence? We provide the documents and answers your colleagues need.

The certificates and report are not published on the website. They are available on request, typically under confidentiality arrangements. The scope of coverage is stated in each document.

Request the documents
  • ISO/IEC 27001, ISO/IEC 27701 and ISO 9001 certificates
  • The ISAE 3402 report on controls audited by an independent auditor
  • Answers to your company's security questionnaires

How we protect data in HRImage

Access controls in the platform and a local team that understands your processes.

A separate database per client

Each company's data is isolated. Access to the company, module and action is checked on the server on every request.

Secure sign-in

SSO with Microsoft Entra ID and two-factor authentication with authenticator apps.

Access only to what is needed

Permissions per user, group and role. Managers see only their reports, and dashboards filter data on the server.

Complete history

Changes to the employee file, approvals and REGES Online submissions stay in the history, with author and date.

GDPR by design

General reports show aggregated data, and small groups can be hidden so individuals cannot be identified.

A local team in Bucharest

HR and payroll specialists and developers who know Romanian legislation and your processes.

Questions about the certifications and report

Can we see the certificates and report?

Yes. The ISO certificates and ISAE 3402 report are available on request, typically under confidentiality arrangements. Request the documents and tell us what you need for your vendor assessment.

What is ISAE 3402 and why does it matter for outsourced payroll?

ISAE 3402 is a standard for assurance reports on a service organisation's controls. Our report concerns controls audited by an independent auditor; it is a report, not a certificate. For outsourced payroll, the client's financial auditors can rely on it when assessing relevant controls, within the limits described in the document.

Do the documents cover the HRImage platform and outsourced services?

The scope of coverage is stated in each certificate and in the ISAE 3402 report. We provide the documents on request so that you and your company's auditors can check their relevance to the platform and services you are assessing.

Personalised demo, no commitment

See the platform running on your company's processes

We show you the relevant modules, configured on an example close to your organisation: approval workflows, permissions, reports and integrations.