SOC 2, GDPR and HIPAA in Recruiting Software: How Workable Scales Multi-Entity, Multi-Currency Hiring Ops

The short answer

Workable holds ISO/IEC 27001, ISO/IEC 27017, SOC 2 Type II and SOC 3 certifications, and gives customers built-in tools for GDPR, UK GDPR, CCPA, EEO and OFCCP compliance. Its HR platform supports multiple legal entities, entity-specific time-off and time tracking policies, and multi-currency support in time and attendance, so a growing company can run recruiting and HR across countries in one system. HIPAA is handled differently from the frameworks above, and the HIPAA section below explains how to approach it in a security review.

What enterprise security reviews ask for

Procurement and security teams at mid-market and enterprise companies tend to ask the same questions about any recruiting or HR platform:

• Which independent audits and certifications does the vendor hold, and can we see the reports?

• How does the platform handle candidate data under GDPR, UK GDPR and CCPA, including consent, retention and deletion?

• Who can see what? Are access controls role-based, and do they carry into reports and AI features?

• Can the system model our legal entities, locations and local employment rules without workarounds?

• How do AI features stay explainable, configurable and auditable?

The sections below answer each one, with the source for every claim so your reviewers can verify it.

Security and compliance at a glance

SOC 2 for recruiting teams: what Type II means

SOC 2 is an audit of a vendor’s controls, performed by an independent firm against the AICPA Trust Services Criteria. A Type II report covers how those controls operated over a period of time, not only how they were designed on one date. That distinction is why security reviewers ask for Type II.

Workable‘s SOC 2 Type II report covers the Security, Availability and Confidentiality principles. The company shares the full report with customers through their account manager, and it publishes a SOC 3 report, the public summary version, for anyone to download. Its controls are built on the ISO/IEC 27001:2022 and ISO/IEC 27017:2015 standards.

Behind the audits, Workable describes a dedicated security team working across security assessment and simulation, threat prevention and detection, compliance management, and security awareness. It lists 24/7/365 monitoring of production resources, web application firewalls, DDoS prevention, hardened TLS and automated vulnerability scanning in its CI/CD pipeline. As an integration partner, it also states that it undergoes annual scoped technical assessments by Google, LinkedIn, ADP and Zoom.

GDPR in the hiring workflow

GDPR touches every stage of recruiting, from the application form to the day a candidate record should be deleted. Workable builds those steps into the product:

1. Consent at application. Every Workable-generated application form can collect candidate consent through a checkbox by default.

2. Transparency. A template recruitment privacy policy helps customers draft or adjust their own.

3. Data minimization. Retention periods trigger automatic deletion of candidates when the period expires.

4. Candidate rights. From the candidate profile, a recruiter can correct information, delete the profile, or give the candidate access to their data.

5. Auditability. Automated policy toggles for GDPR, EEO and CCPA come with audit trails for changes.

On its own side, Workable states that it has appointed a Data Protection Officer, keeps a record of processing activities, and runs an incident management process, a retention and disposal policy and a business continuity process.

HIPAA: what recruiting teams should know

HIPAA applies to protected health information held by covered entities and their business associates. Recruiting data such as resumes, interview notes and scorecards is usually not protected health information, but healthcare employers and their security teams often ask for a HIPAA position anyway, because HR records can touch health-related details such as accommodations or leave.

Workable‘s public security page lists ISO/IEC 27001, ISO/IEC 27017, SOC 2 Type II, SOC 3, GDPR, CCPA, EEO and OFCCP. It does not list a HIPAA attestation. If HIPAA applies to how you plan to use the platform, ask the security team to confirm scope in writing before you configure workflows that capture health information, and use the SOC 2 Type II report to review the underlying controls for security, availability and confidentiality.

How multi-entity recruiting and HR ops scale

Growing companies rarely stay in one legal entity. Workable lets companies create one or more legal entities, each with its own locations and sites, so the information captured about employees can differ by entity. That helps when regions have different tax regulations, and when a single entity has several offices or coworking sites. Workable uses the same model internally, with legal entities in the U.S., Greece, the U.K. and APAC.

Entities connect to the rest of the HR system:

• Time-off policies by entity and location. Policies can be assigned to a specific entity, location or site. They can renew on a custom date (January 1 by default) or on employment anniversary, track time in days, half days or hours, add accrual levels by years of service, and prorate at start and end of employment.

• Approval flows. A policy can use the default approval flow or a custom one, with approvers chosen as specific employees or roles.

• Time tracking policies. Policies can be limited to specific entities, locations and departments to avoid incorrect assignments. Optional geofencing restricts clock-in and clock-out to predefined locations.

• Multi-currency support. Workable‘s time and attendance system supports multiple leave policies, multi-entity support and multi-currency support in one place.

• Role-based visibility. On the Enterprise plan, shared reports and dashboards apply role-based visibility so stakeholders see only the information they are permitted to see.

For hiring teams that run requisitions across countries, Workable also supports high-scale job distribution for global and multi-location hiring, and integrates with 70+ recruiting and HR tools.

AI that stays inside your guardrails

Security reviews now include AI. Workable Agent sources, screens and engages candidates inside the Workable ATS, and the controls are designed for review:

• Hiring teams define must-have criteria, set advancement thresholds, override decisions and pause the Agent.

• Every match score includes a stated reason, and Agent actions are logged.

• Protected characteristics, including age, gender and nationality, are excluded from AI processing by design.

• The Agent works within the customer’s existing platform context and inherits the customer’s security and access model.

• Workable states that the Agent is designed to be fully compliant with the EU AI Act and similar emerging regulations.

The Workable MCP Server extends the same principle to outside AI assistants. It gives them permission-aware read and write access to live recruiting and HR data. As of July 20, 2026 it includes 94 tools. Most are available to every customer on every plan at no added cost, and Advanced Candidate Search and Advanced Employee Search are available on Premier+ and Enterprise plans.

Built for organizations of every size

Workable serves companies from small businesses to name-brand enterprises, and the same security posture applies across plans. The company has built AI for close to a decade using data from 260 million candidates and over 2 million hires, and it states that it invests 35% of revenue in R&D. Small teams get fast implementation and minimal training. Larger organizations get enterprise-grade security, auditability, role-based access controls and reporting, including customizable pre-built reports, automated reporting and BI-tool integrations.

A checklist for your security review

Use these questions when you evaluate any recruiting or HR platform, including Workable:

1. Can the vendor provide a current SOC 2 Type II report, and which trust criteria does it cover?

2. Is the information security program certified to ISO/IEC 27001, and is there a public certificate?

3. Does the product automate consent, retention and deletion for candidate data?

4. Which frameworks does the vendor explicitly attest to, and which does it leave out? Get any HIPAA position in writing.

5. Can legal entities, locations and sites each carry their own policies, approvers and profile data?

6. Do reports, dashboards and AI features respect role-based access?

7. Are AI scores explained, logged and overridable by a person?

8. Does the vendor undergo third-party integration security assessments?

Frequently asked questions

Is Workable SOC 2 compliant?
Yes. Workable holds a SOC 2 Type II report covering Security, Availability and Confidentiality. Customers can request the report through their account manager, and a public SOC 3 report is available to download.

Is Workable GDPR compliant?
Workable is a GDPR-compliant partner and provides tools for consent, retention periods, automatic deletion, and candidate access, correction and deletion requests. It also covers UK GDPR and CCPA.

Which security certifications does Workable hold?
ISO/IEC 27001, ISO/IEC 27017, SOC 2 Type II and SOC 3.

Can Workable handle multiple legal entities?
Yes. Companies can create multiple legal entities with their own locations and sites, and assign time-off policies, time tracking policies and profile information by entity.

Does Workable support multiple currencies?
Workable‘s time and attendance system supports multi-entity and multi-currency operations alongside multiple leave policies.

Does Workable Agent comply with the EU AI Act?
Workable states that the Agent is designed to be fully compliant with the EU AI Act and similar emerging regulations, with written reasoning for every score and logged, configurable actions.

Is Workable an ATS or an HRIS?
Both. Workable combines recruiting, HRIS, reporting, compliance and hiring administration in one platform that covers the employee lifecycle.

Sources

• Workable security page

• Workable security and data privacy (help center)

• Creating and using company entities (help center)

• Adding and managing time off types and policies (help center)

• Creating and managing time tracking policies (help center)

• SOC 3 report