HR Management
HiBob
Rest of world Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Hibob Inc. · www.hibob.com
Compare with Workday HCM → Report an error on this page Is this your product? →
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
HiBob is a broad HCM platform (Hibob Inc., entities across the US, UK and Israel) judged on homepage module names and a privacy policy. Its strongest rows are recruiting & onboarding and digital personnel file & data model: a 'Hiring Module' and automated onboarding workflows are named, and a 'Core HR system of record' with eSign is claimed — though the evidence shows no careers page, applicant-data deletion, dated change history, org structure or custom fields. Among the weighted criteria, sovereignty is the weakest: personal data is 'maintained, processed and stored' in the US, EU, UK, Australia, Canada and Israel, with no published subprocessor list; SCCs and DPF certification are the named safeguards. Judges spread 2-4 on employee data protection & co-determination — the people lead and payroll officer scored 4 for the named DPO (PrivacyTeam Ltd.) and SCCs, while the data protection officer's 2 weighed unpublished retention, the missing audit log and absent field-level permissions. Payroll handoff and absence & working-time run 2-4: no payroll system or export format is named (no DATEV appears) and nothing covers the ArbZG/BAG recording duty. No prices are public.
Speaks for it
- Recruiting & onboarding scores 3-4 on a named 'Hiring Module' and automated onboarding workflows.
- Digital personnel file & data model holds 3-4 on a claimed 'Core HR system of record' with eSign and document management.
- The privacy policy names an external DPO (PrivacyTeam Ltd.), SCCs for EU/UK/Switzerland, and DPF certification for the US subsidiary Hi Bob, Inc.
- The controller/processor split is stated outright, with HiBob as processor for End User data.
- AI auto-populated fields remain editable and can be enabled or disabled through the organization's Bob AI settings.
Held against it
- Personal data is 'maintained, processed and stored' in the US, EU, UK, Australia, Canada and Israel with no stated default region or residency commitment.
- No subprocessor list is published; Refinitiv Limited (World-Check) surfaces only as an example inside the policy text.
- Retention is 'contact us by e-mail' (support@hibob.com), with no published periods, no executable deletion and no DPA confirmed on the captured pages.
- No payroll system or export format is named — DATEV or any German-language payroll path is absent from the evidence.
- Time and attendance is a single homepage bullet, with nothing on entitlement, carry-over, sickness recording or the ArbZG/BAG recording duty.
Best for
- You are buying primarily for hiring and onboarding automation and can verify applicant-data retention and the candidate-to-employee handover during the sales process.
- Your compliance sign-off rests on documented safeguards — an external DPO, SCCs for EU/UK/Switzerland, DPF certification — rather than on EU-default hosting.
- You want one HCM suite spanning core HR, payroll integrations, benefits administration and financial planning rather than best-of-breed tools.
- You want AI assistance (auto-population, content generation) that admins can switch off through Bob AI settings.
Avoid if
- You must pin personal data to EU residency — ask the vendor: the public pages we read do not show it
- Your works council requires published retention periods, a read-access audit log and field-level permissions before approving the rollout.
- You close German payroll into DATEV or a tax adviser and need a named system, defined export format or mid-month joiner/leaver handling.
- You need ArbZG/BAG-compliant, tamper-evident working-time recording out of the box.
The scores
Digital personnel file & data model
Show reasoningHide reasoning
How this is scored
The system of record: employee master data, the digital personnel file, org structure, custom fields, and whether history is kept rather than overwritten.
0 — A contact list with job titles; no document storage, no org structure, no history — changes overwrite what was there.
3 — Employee records with document upload, but a flat structure: no org chart, few or no custom fields, and no dated history of contract or salary changes.
5 — Digital personnel file with structured document types, an org chart, custom fields, and change history on the core employment fields.
8 — Complete record: versioned contract and compensation history with effective dates, document templates with e-signature, org structure supporting multiple entities and cost centres, and granular field-level permissions.
10 — The file is the single source of truth an auditor could work from: full effective-dated history on every field, retention rules per document type, delegated administration per entity, and export that reproduces the record intact.
The People Lead
"Core HR system of record" plus "eSign and document management" is a real claim set, more than a flat file with uploads. But nothing evidences org structure, custom fields, effective-dated contract or salary history, or multi-entity/cost-centre support — the evidence never shows the record keeping its past, so I can't call it true. 1
The Payroll Officer
The entire evidence for a personnel file is a homepage bullet: 'Core HR system of record' and 'eSign and document management'. Not one word on effective-dated salary or contract history, org structure or custom fields — and backdated change history is exactly what I need before a retro run, so silence is a red flag, not neutral. 1 3
The Works Council Advocate
"Core HR system of record" with eSign and document management is claimed on the homepage, but the evidence says nothing about org structure, custom fields, or whether contract and salary history is kept effective-dated rather than overwritten. A personnel file without evidenced change history is something a Betriebsrat cannot audit, so this sits below the anchor that requires dated history on core employment fields. 1 3
The Data Protection Officer
"Core HR system of record" with "eSign and document management" is claimed at marketing level, but the evidence evidences nothing on org structure, custom fields, or effective-dated change history — the personnel file's history is exactly the part nobody documented. I cannot credit a system of record whose record-keeping behaviour is unevidenced. 1 3
The IT Integrator
Marketing names a 'Core HR system of record' with eSign and document management, but the evidence evidences no org structure, no custom fields, and no dated history — I cannot confirm it keeps contract or salary history rather than overwriting it. The API and data-model documentation that would let me build identity on top of it are entirely absent from the evidence. 1 3
Payroll handoff
Show reasoningHide reasoning
How this is scored
Whether the month closes cleanly into payroll — DATEV, Lohn und Gehalt, an in-house system or an external tax adviser — and how much of that is automated rather than re-typed.
0 — No payroll path stated at all; whatever leaves the system leaves as a spreadsheet somebody retypes.
3 — Generic CSV export said to be usable for payroll, with no named payroll system, no defined format and no handling of mid-month changes.
5 — A named payroll integration or a documented export format for at least one major system (e.g. DATEV LODAS/Lohn und Gehalt), covering the recurring monthly fields.
8 — Certified or vendor-maintained integration with a named payroll provider, covering variable pay, absences and mid-month joiners and leavers, with a documented pre-payroll check.
10 — Payroll is a first-class part of the product: maintained bidirectional integrations with several named systems, an auditable approval and lock step before transmission, retro-accounting for backdated changes, and the tax adviser given their own access.
The People Lead
Payroll is claimed as a module with "Payroll integrations", "UK payroll, US payroll", which is above a retyped spreadsheet but names no system, no format, no mid-month joiner/leaver handling and no pre-payroll check. For a DACH close into DATEV or a tax adviser there is literally nothing here I could hand over. 1 3
The Payroll Officer
'Payroll integrations', 'UK payroll', 'US payroll' — no named payroll system, no defined export format, and nothing whatsoever on mid-month joiners/leavers, variable pay or backdated corrections. Note there isn't even a German payroll mentioned; for my tax adviser this is a nameless promise, which is rubric level 3 territory. 1 3
The Works Council Advocate
Payroll exists as a module with "Payroll integrations, UK payroll, US payroll", but no German system (DATEV, Lohn und Gehalt) appears anywhere in the evidence, and nothing documents an export format, variable pay, or mid-month joiners and leavers. For a German buyer this is a named capability without a documented handoff. 1 3
The Data Protection Officer
The entire payroll story is "Payroll integrations" plus "UK payroll, US payroll" — no named system, no defined export format, no DATEV or any German-language payroll path, no mid-month or pre-payroll check. For a German buyer the month-end handoff is wholly unverified. 1 3
The IT Integrator
'Payroll integrations' plus native UK and US payroll are claimed, but not one payroll system is named, no export format is defined, and mid-month joiners and leavers are unhandled in the evidence — no DATEV, no Lohn und Gehalt, nothing German at all. A stated path with no definition is the generic-export level. 1 3
Absence & working-time
Show reasoningHide reasoning
How this is scored
Vacation, sickness and working-time recording — including whether the product meets the German recording duty (BAG 2022, ArbZG) rather than merely offering a timer.
0 — No absence or time handling; both live in a spreadsheet elsewhere.
3 — Vacation requests with an approval step, but entitlement is manual, carry-over is not handled and there is no working-time recording.
5 — Automatic entitlement and carry-over, sickness recording, an absence calendar, and basic working-time capture with a report per employee.
8 — Configurable per country and contract: pro-rata entitlement, public-holiday calendars per location, break and rest-period rules, overtime accounts, and an export the employer can hand to a labour inspection.
10 — Working-time recording built as a legal obligation rather than a feature: tamper-evident records, documented compliance with the ArbZG recording duty, works-council-configurable monitoring limits, and shift or on-call models handled without add-ons.
The People Lead
"Time and attendance tracking" is claimed as a core module, which clears the bar of having any time capture at all. But the evidence is silent on entitlement calculation, carry-over, sickness, holiday calendars and any ArbZG/BAG recording-duty positioning — a timer next to an unmentioned vacation calculation is exactly what I don't buy. 1
The Payroll Officer
'Time and attendance tracking' as a homepage bullet and nothing else: no entitlement calculation, no carry-over, no sickness recording, no absence calendar, and certainly no evidence of the ArbZG/BAG recording duty or a labour-inspection-ready export. A timer named is not the obligation met. 1
The Works Council Advocate
All the evidence offers is a "Time and attendance tracking" bullet — no vacation entitlement, carry-over, sickness recording, break or overtime rules, and not one word on the ArbZG recording duty or tamper-evidence. A tracking feature whose monitoring behaviour and compliance basis are undocumented is precisely what I cannot approve. 1
The Data Protection Officer
"Time and attendance tracking" is a single module name on the homepage; there is no evidence of vacation entitlement, carry-over, sickness recording, or an absence calendar, and — the point that decides it for me — not one word on ArbZG/BAG recording duty or record integrity. A timer with no compliance story is a 3 at best. 1
The IT Integrator
'Time and attendance tracking' appears as a core module, but the evidence is silent on vacation entitlement, carry-over, sickness recording, and the German recording duty — no tamper-evidence, no ArbZG/BAG compliance claim anywhere. A module name on a homepage is not working-time recording a labour inspection could work from. 1
The Skeptic
A single bullet — 'Time and attendance tracking' — with no vacation requests, entitlement, carry-over or sickness recording evidenced, and not one word on the BAG 2022/ArbZG recording duty. For a German buyer, silence on the legal obligation is the finding. 1
Recruiting & onboarding
Show reasoningHide reasoning
How this is scored
The join path — vacancy to signed contract to a person who has an account, equipment and a plan on day one.
0 — Neither applicant tracking nor onboarding exists; hiring happens in a shared inbox.
3 — A basic applicant list with statuses, or an onboarding checklist — one of the two, without the handover between them.
5 — Applicant tracking with a careers page, structured stages and rejection handling, plus a checklist-driven onboarding that carries the hired candidate over into an employee record without re-entry.
8 — Multi-posting to named job boards, interview scheduling and scorecards, GDPR-conscious applicant retention and deletion, e-signed contracts, and onboarding that triggers tasks in IT and payroll.
10 — The whole join is one governed flow: approval-gated requisitions with budget, structured and bias-conscious evaluation, automated applicant deletion at the stated deadline, and provisioning driven from the record so day one needs no HR intervention.
The People Lead
Both halves exist by name — "Hiring and onboarding", a "Hiring Module", automated onboarding workflows with claimed 2–4 hours saved per hire — and a Recruiter role shows up in the privacy policy. No evidence of careers page, stages, candidate-to-employee carry-over, applicant retention/deletion or e-signed contracts, so the join path is asserted rather than shown. 1 3
The Payroll Officer
'Hiring and onboarding', a 'Hiring Module' and a marketing claim about saving 2–4 hours per hire — no careers page, no structured stages, no applicant retention/deletion handling, and no evidence the hired candidate lands in an employee record without re-entry. Bare module names with no mechanics. 1 3
The Works Council Advocate
Both halves exist on paper — a "Hiring Module" and automated onboarding workflows with time-saved figures — but there is no evidence of structured applicant stages, GDPR retention/deletion of applicant data, or a handover into the employee record without re-entry. Applicant-data deletion deadlines are a co-determination topic, and their absence caps this score. 1 3
The Data Protection Officer
Both a "Hiring Module" and automated onboarding workflows are claimed, but there is no careers page, no stages or rejection handling evidenced, and — decisive for me — the privacy policy states no applicant retention period and no automated deletion at a deadline. Applicant data that doesn't delete itself on the stated date cannot score higher. 1 3
The IT Integrator
A Hiring Module and onboarding automation are both named, but there is no evidence of the candidate-to-employee handover or of structured recruiting stages. The part I judge onboarding by is completely missing: no account creation, no IT task triggers, no SCIM, no SSO — the join path is a workflow claim, not a provisioning flow. 1 3
The Skeptic
Both a 'Hiring Module' and automated onboarding with per-hire savings claims are named, but the evidence shows no careers page, no structured stages, no rejection handling, and no evidence a hired candidate lands in an employee record without re-entry. Two module names sit between the 3 and 5 anchors, with marketing math doing the work structure should. 1 3
Employee data protection & co-determination
Show reasoningHide reasoning
How this is scored
How the product handles the most sensitive personal data a company holds — retention, deletion, role separation, subject rights — and whether it can pass a works council (BetrVG §87) rather than merely a procurement checklist.
0 — No stated retention or deletion handling, no role model beyond admin-or-not, and no DPA offered on the site.
3 — A DPA exists on request and roles are coarse; retention and deletion are described as something the customer arranges themselves.
5 — A signable DPA is published, roles are configurable per module, applicant and employee retention periods are stated, and deletion can be executed rather than only promised.
8 — Field-level access control with an audit log of who read what, configurable retention per data category with automatic deletion, documented subject-rights support, and monitoring or analytics features that can be switched off for co-determination.
10 — Built for the works council to say yes: published processing documentation and subprocessor list, per-entity data separation, tamper-evident audit trail, evaluation and behavioural-analysis features off by default with their scope documented, and a data-protection impact assessment the customer can build on.
The People Lead
The privacy policy is substantive: an appointed DPO (PrivacyTeam Ltd.), SCCs for EU/UK/Switzerland, DPF certification, and a clean controller-vs-processor role split. But retention is only "contact us by e-mail", no published DPA, no field-level permissions or read-audit, and data sits across six regions including the US and Israel with Google Analytics running — I could not walk this into a works council meeting. 3
The Payroll Officer
Credit for a named DPO (PrivacyTeam Ltd.), SCCs for EU/UK/Switzerland, DPF certification and a subject-rights contact. But retention is literally 'contact us by e-mail for our data retention policy', no published DPA, no audit log of who read what, no field-level permissions — a works council would ask for all three and get none from these pages. 3
The Works Council Advocate
Retention periods are not published — the policy tells you to email support@hibob.com — and there is no evidence of a read-access audit log, field-level permissions, or executable deletion; meanwhile employee data is disclosed to Refinitiv World-Check for screening with no documented switch-off. The only evidenced opt-out is AI auto-population via "Bob AI settings"; DPO and SCCs are a compliance layer, not works-council readiness. 3
The Data Protection Officer
The DPA is nowhere on the captured site — I treat that as a finding — retention is a pointer to "contact us by e-mail" with no stated periods and no deletion that executes, the subprocessor list is unpublished (only Refinitiv and Google Analytics surface incidentally), and there is no role model, audit log, or field-level access evidence. A named external DPO (PrivacyTeam Ltd.) and SCCs/DPF are the only facts keeping this above zero. 3 1
The IT Integrator
A DPO (PrivacyTeam Ltd.), SCCs and DPF certification exist, but retention is only 'contact us by e-mail' — no published periods, no role model beyond Admins/Recruiters, no audit log, no deletion that can be executed. The AI auto-population toggle is the only concrete control evidenced; nothing here is assessable by a works council. 1 3
The Skeptic
The privacy policy is real — DPO (PrivacyTeam), SCCs for EU/UK/Switzerland, a controller/processor split — but retention is something you must email support@hibob.com about, no published retention periods or executable deletion, no field-level roles or read-audit, and applicant/employee data goes to Refinitiv World-Check for screening. A signable DPA is nowhere confirmed on the captured pages. 3 1
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Where the data lives, who the contracting entity is, who the subprocessors are, and whether the answer is documented rather than assumed. Independently sourced by the sovereignty pipeline; scored here as the buyer would weigh it.
0 — US-headquartered vendor, US contracting entity, hosting region unstated or US, subprocessors not named.
3 — EU hosting is offered as an option but the contracting entity is non-EU, or the subprocessor list is incomplete or absent.
5 — EU hosting stated as standard and an EU contracting entity, but the subprocessor chain includes non-EU providers without an explained safeguard.
8 — EU or DACH hosting with a named data-centre provider, an EU contracting entity, the full subprocessor list published, and any non-EU processing named with its legal basis.
10 — Sovereign end to end and evidenced: vendor, contracting entity, hosting and every subprocessor in the EU, certification of the data centres published, and an on-premises or private-cloud option for buyers who need it.
The People Lead
US-headquartered vendor (Hi Bob, Inc.), contracting entity non-EU (Hi Bob Limited, with an Israeli database-controller role), hosting disclosed across the US, EU, UK, Australia, Canada and Israel with no EU commitment, and no published subprocessor list — Refinitiv surfaces only incidentally. SCCs and DPF paperwork are the sole safeguard; every substantive sovereignty marker fails. 1 3
The Payroll Officer
Personal data 'maintained, processed and stored' in the US, EU, UK, Australia, Canada and Israel, the US parent Hi Bob, Inc. on the copyright, and no published subprocessor list — Refinitiv surfaces only as an example inside the privacy policy. SCCs and DPF certification are transfer safeguards, not European residency; EU is one of six processing regions, not the standard. 1 3
The Works Council Advocate
Personal data may be maintained in the US, EU, UK, Australia, Canada and Israel — six regions with no residency commitment for a given customer — the vendor has a US subsidiary certified under the EU-US DPF, and the only named processor is Refinitiv for screening, with no published subprocessor list. The pipeline marks legal entity, ownership and data residency all unknown, which for a German rollout is not a documentable answer. 3
The Data Protection Officer
The vendor is Hi Bob, Inc. (US, DPF-certified), personal data is stored "in the US, EU, UK, Australia, Canada and Israel" with EU nowhere stated as standard, and no subprocessor list is published; Google Analytics runs on the sites. Only the UK notice address (Hi Bob (UK) Limited) keeps this off the floor. 1 3
The IT Integrator
The pipeline marks every sovereignty attribute unknown, and the vendor's own privacy policy names processing in the US, EU, UK, Australia, Canada and Israel with legal entities spanning the US, UK and Israel. Only Refinitiv surfaces as a processor — the chain is incomplete, no default region is stated, and no certification or data-centre provider is published. 1 3
The Skeptic
US/Israeli vendor group with data 'maintained, processed and stored' across six regions including the US and Israel — that's not an EU-hosting option, it's wherever the vendor puts it — and no published subprocessor list (Google Analytics and Refinitiv surface only as examples inside the policy text). Named safeguards (SCCs, DPF) keep this just off the floor. 3
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether an HR lead can compute the real annual invoice for their headcount — including the modules they actually need — from public pages alone.
0 — No public prices at all; every tier is a sales conversation.
3 — An entry price per employee exists, but the modules most buyers need are unpriced, or a minimum headcount, setup fee or mandatory onboarding package is not stated publicly.
5 — Per-employee prices are public for the main tiers with the billing period stated, but at least one commonly needed module (payroll, time, recruiting) hides in an unpriced bundle.
8 — Every tier and module priced publicly with per-employee maths, billing period, minimum term and VAT treatment stated; only genuinely custom enterprise work lacks a number.
10 — Complete price computability: a calculator or table that produces the annual invoice for a given headcount and module selection, including setup, minimums and renewal terms.
The People Lead
A pricing page is linked in the nav, but the captured page yields only a free-demo offer and the homepage pushes "GET A FREE DEMO" with no numbers. I cannot compute even a rough annual invoice for 400 people from public pages; the ROI dollar figures are marketing, not prices. 1 2
The Payroll Officer
The pricing page was captured and produced exactly one fact: a free demo offer; no per-employee price, no tier, no billing period, no term — the homepage confirms prices are not stated publicly. No HR lead can compute an annual invoice from these pages; it is a sales conversation, full stop. 1 2
The Works Council Advocate
A pricing page is linked in the navigation, but the capture of that page shows only a free-demo offer — no price, tier, billing period or module cost is public anywhere in the evidence. An HR lead cannot compute even a rough annual invoice from this. 1 2
The Data Protection Officer
A pricing page is linked in the nav, but the captured page contains nothing but a free-demo funnel — no tier, no per-employee rate, no billing period, no minimums. An HR lead cannot compute even a rough annual invoice from what is public here. 1 2
The IT Integrator
A pricing page exists but the only thing evidenced on it is a free-demo CTA, and the homepage links 'Pricing' without a single number. No per-employee price, no tiers, no billing period — an HR lead cannot compute any invoice from these pages. 1 2
European sovereignty — proven facts
0 of 4 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Ownership | Not determined | — | uncited Report an error |
| Data residency | Not determined ⚠ unverified | — | uncited Report an error |
| Subprocessors | Not determined ⚠ unverified | — | uncited Report an error |
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 15 Sep 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data residency, Subprocessors. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 8 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 8 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 6 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 data facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 subprocessors fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (9)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage www.hibob.com Checked 15 Sep 2026 Details →
- 2 Pricing www.hibob.com Checked 15 Sep 2026 Details →
- 3 Privacy policy www.hibob.com Checked 15 Sep 2026 Details →
- 4 Security / trust page — found from the homepage www.hibob.com Checked 30 Sep 2026 Details →
- 5 Digital personnel file & data model — found from sitemap www.hibob.com Checked 1 Oct 2026 Details →
- 6 Payroll handoff — found from sitemap www.hibob.com Checked 1 Oct 2026 Details →
- 7 Payroll handoff — found from sitemap www.hibob.com Checked 1 Oct 2026 Details →
- 8 Recruiting & onboarding — found from sitemap www.hibob.com Checked 1 Oct 2026 Details →
- 9 Recruiting & onboarding — found from sitemap www.hibob.com Checked 1 Oct 2026 Details →