Security / trust page — found from the homepage — BrightHR

Cited by

Facts read from this source

• Certifications Report an error

  “BrightHR is certified to ISO/IEC 27001 and Cyber Essentials Plus, holds a SOC 2 Type I report, and is PCI DSS compliant and registered with the ICO.”

• SOC 2 type1 Report an error

  “A-LIGN concluded that BrightHR's controls were suitably designed as of 3rd June 2026 to meet the SOC 2 criteria for Security.”

• ISO 27001 certificate Report an error

  “A-LIGN certifies that BrightHR operates an Information Security Management System that conforms to the requirements of ISO/IEC 27001:2022.”

• Iso9001 Report an error

  “BrightHR holds a certificate for ISO 9001. Operating a Quliaty Management System which complies with the requirements of ISO 9001:2015.”

• Iso14001 Report an error

  “BrightHR holds a certificate and operates an Environmental Management System which complies with the requirements of ISO 14001:2015.”

• Iso45001 Report an error

  “BrightHR is certified for and operates the Occupational Health and Safety Management System which complies with the requirements of ISO 45001:2018.”

• Iso50001 Report an error

  “BrightHR operates an Energy Management System which complies with the requirements of ISO 50001:2018 for the scope of Provision of legal, health & safety and advisory services.”

• Data residency Report an error

  “For customers subscribing in the Republic of Ireland we store data in the European Union. For Customers subscribing in Canada or the United Kingdom we store data in the country of subscription. For Customers subscribing in Australia or New Zealand we store data in Australia.”

• Platform Report an error

  “To prevent external access to your data, we deploy our system in Microsoft's Azure platform.”

• Multi datacentre hosting Report an error

  “we host several instances of our software in multiple data centres and use traffic management technology to direct traffic to the fastest responding service in your region”

• Two factor authentication Report an error

  “With our two-factor authentication feature, a BrightHR user has to enter a unique code sent to their mobile to access their BrightHR account.”

• Password complexity rules Report an error

  “We also ask users to follow strong password complexity rules.”

• Admin change monitoring Report an error

  “Plus, we monitor any changes to admin accounts to make sure they're genuine.”

• Encryption Report an error

  “We always store data local to the company that are using it and use encryption to protect it.”

• Data deletion Report an error

  “We also use secure protocols for transporting the data and when asked to delete the data, we remove it permanently from the system.”

• Breach notification Report an error

  “Under the ICO guidelines for breaches, we must inform the ICO within 72 hours of becoming aware of a breach.”

• DPA GDPR Report an error

  “This complies with the Data Protection Act (DPA) and the General Data Protection Regulation (GDPR) and local data protection legislation.”

• Role based access control Report an error

  “We also restrict or allow access to data based on a user's role and their need to access the data, to make sure that information stays confidential.”

• Security team Report an error

  “we have a dedicated information and cyber security team”

• Vulnerability testing Report an error

  “We also run regular internal vulnerability tests and address any issues found.”

• Registered office Report an error

  “Registered Office (UK): Bright HR Limited, The Peninsula, Victoria Place, Manchester, M4 4FB. Registered in England and Wales No: 09283467.”

• Fca regulated Report an error

  “Bright HR Ltd is authorised and regulated by the Financial Conduct Authority in respect of non-investment insurance products. FCA Number: 1042221”

• Markets Report an error

  “With a global audience of 120,000+ businesses across the UK, Ireland, Canada, Australia and New Zealand, BrightHR has been a trusted partner for businesses since launching in 2015.”

Scores citing this record

• The Data Protection Officer Health data, access & works council
• The Data Protection Officer European sovereignty
• The HR IT Integrator Health data, access & works council
• The HR IT Integrator European sovereignty
• The Payroll Accountant Health data, access & works council
• The Payroll Accountant European sovereignty
• The Skeptic Health data, access & works council
• The Skeptic European sovereignty
• The Managing Director Health data, access & works council
• The Managing Director European sovereignty
• The Team Lead Health data, access & works council
• The Team Lead European sovereignty