# Humaans — HR Management

Humaans by Humaans Ltd holds a panel rating of 2.5/5 from 6 AI judges (category median 2/5), as of 2026-10-21. Provenance: provenance unknown; sovereignty: not determined.

- Vendor: Humaans Ltd (https://humaans.io)
- Category: [HR Management](https://whats-best.ai/software/hr-management.md)
- Provenance (editorial classification): provenance unknown
- Canonical page: https://whats-best.ai/software/hr-management/humaans
- Alternatives: https://whats-best.ai/software/hr-management/humaans/alternatives ([markdown](https://whats-best.ai/software/hr-management/humaans/alternatives.md))
- Data as of: 2026-10-21 · evaluated 2026-10-21 · oldest source captured 2026-10-20

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Humaans Ltd
- Headquarters: Not stated on the vendor’s pages as of 20 Oct 2026
- Data hosting: Default not stated; pages mention the EU [S4]
- Free plan: Not stated on the vendor’s pages as of 20 Oct 2026

## The panel's verdict

Humaans is an HR management platform scoring best on employee data governance and core HR records (a flat 6), and weakest on recruiting and onboarding and payroll readiness. Governance is the strength: a published DPA, permissions down to individual fields, an immutable searchable audit log, deletion within 90 days with written certification, and built-in tooling for GDPR Articles 15–22. Core records carry effective-dated, exportable compensation and role history; we found no public information on org charts or multi-entity structure. Payroll readiness splits, 3 to 4: lower scores call preliminary payroll a generic export naming no payroll system or format, higher ones credit the tracked change log while noting the same gaps. Time and absence covers fourteen leave types and 190-plus public holiday calendars but leaves working-time capture as a module name. Sovereignty sits at 4: EU hosting on Google Cloud Platform is stated, the captured pages give different figures for the contracting entity, and we found no published subprocessor list. No prices are published.

**Speaks for it:**
- Employee data governance scored 6–7 on a published DPA, field-level permissions with custom roles, an immutable searchable audit log and built-in GDPR Articles 15–22 tooling
- Core HR records scored a flat 6, with effective-dated compensation and role history that can be viewed and exported
- Absence handling scored 4–5 with fourteen leave types including sick days, custom types configurable by location or team, and 190-plus public holiday calendars
- Deletion is executed rather than promised — self-service employee-record deletion, a 90-day purge of remaining copies, and written certification on request
- Security details are published: SSO via Google Workspace, Microsoft Entra and SAML 2.0, TLS 1.3 in transit and AES-256 at rest

**Held against it:**
- Recruiting and onboarding scored 2–3 — no applicant tracking or careers page appears in the published module list
- Payroll readiness scored 3–4 — preliminary payroll names no payroll system and defines no export format, so the month-end handoff rests on trust
- Working-time capture appears only as a Timesheets module name, with no public information on entitlement, carry-over, overtime accounts or the German working-time recording duty
- AI features are enabled by default when a customer account is created, though administrators can disable them
- The captured pages give different figures for the contracting entity — Humaans Software UK LTD in the DPA, Humaans Inc. in the site footer — and we found no published subprocessor list, only fourteen days' notice of additions

**Best for:**
- You need a defensible data-protection base — field-level permissions, immutable audit logs, executed deletion and GDPR subject-rights tooling — for works council or DPO review
- You are consolidating people data out of spreadsheets and need effective-dated, exportable compensation and role history
- You manage distributed teams and need location-aware absence handling with 190-plus public holiday calendars and custom leave types
- You keep payroll with an external provider and only need a tracked, exportable change log ahead of each run

**Avoid if:**
- You expect to run hiring end to end in one system — the published list of twenty modules shows no applicant tracking or careers page
- You need payroll data to flow to a named system in a defined format — the preliminary payroll page names no provider and defines no export format
- You must document the full subprocessor chain or a single contracting entity before procurement can sign
- You must evidence German working-time recording now — working time appears only as a Timesheets module name, with no public statement on the recording duty

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price.

| Criterion | The People Lead | The Payroll Officer | The Works Council Advocate | The Data Protection Officer | The IT Integrator | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Digital personnel file & data model | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 |
| Payroll handoff | 2/5 | 2/5 | 2/5 | 2/5 | 1.5/5 | 1.5/5 |
| Absence & working-time | 2/5 | 2.5/5 | 2.5/5 | 2.5/5 | 2/5 | 2/5 |
| Recruiting & onboarding | 1.5/5 | 1.5/5 | 1/5 | 1.5/5 | 1.5/5 | 1/5 |
| Employee data protection & co-determination | 3/5 | 3.5/5 | 3.5/5 | 3/5 | 3.5/5 | 3.5/5 |
| European sovereignty | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| Pricing transparency | n/r | n/r | n/r | n/r | n/r | n/r |
| **Weighted verdict** | **2.5/5** | **2.5/5** | **2.5/5** | **2.5/5** | **2.5/5** | **2.5/5** |

### The judges

- **The People Lead** (v1.0): Runs HR for 400 people with two colleagues and is replacing a shared drive and eleven spreadsheets. Optimizes for the record being true and the month closing without chasing anyone. Buys breadth that actually connects, and is unmoved by a beautiful org chart sitting next to a manual vacation calculation.
- **The Payroll Officer** (v1.0): Closes payroll every month and answers to the tax adviser when it is wrong. Cares about one thing above all: whether the month leaves this system clean, with backdated changes, mid-month leavers and variable pay handled. Treats "CSV export" as a confession, not a feature.
- **The Works Council Advocate** (v1.0): Sits on the Betriebsrat and has to approve this rollout under BetrVG §87. Reads every feature for whether it can monitor behaviour, and asks what is logged, who can read it and what can be switched off. A tool that cannot answer those questions does not get installed, however good it is.
- **The Data Protection Officer** (v1.0): Answers for the most sensitive personal data the company holds, about people who cannot decline the processing. Wants retention that executes rather than promises, a published subprocessor list, and applicant data that deletes itself on the stated date. Treats an unpublished DPA as a finding.
- **The IT Integrator** (v1.0): Owns identity and has to make the HR system the source of truth for accounts. Wants SCIM provisioning, SSO that is not an enterprise upsell, and an API with documentation rather than a partner form. Judges onboarding by whether it can create the account, not by whether it has a checklist.
- **The Skeptic** (v1.0): Has watched three HR suites promise one system and deliver five modules with a shared logo. Reads every claim for what it does not say: which module the feature lives in, what it costs on top, and whether "integration" means a maintained connector or a documented endpoint someone could build against.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Ownership | Not determined | — | — |
| Data residency | Not determined | — | — |
| Subprocessors | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Access controls: yes · Google Workspace · Microsoft Entra · SAML 2.0 · yes [S8]
- AI default region: EEA or Switzerland · yes [S3]
- AI multi provider: yes [S3]
- AI no training on customer data: yes [S2]
- AI processing region: yes · yes · EEA · Switzerland [S2]
- Application level encryption: yes · "AES256" [S4]
- Audit log support: ISO · SOC 2 · internal policy · yes [S9]
- Audit reports available: /gcs/retail-models.org/SOC 2 Type II · ISO 27001 · 1 [S3]
- Backup frequency: daily · yes [S3]
- Breach disclosure: yes · yes [S4]
- Breach notification: yes [S2]
- Breach notification: where high risk · yes [S8]
- Breach notification hours: 72 [S3]
- Certifications: yes · yes · yes [S1]
- Certifications held: /gcs/retail-models.org/SOC 2 Type II · ISO 27001:2022 [S3]
- Complaint authority: UK Information Commissioner's Office [S2]
- Controller processor roles: processor · controller [S3]
- Cookie consent: yes · yes · yes [S2]
- Credit card storage: no · "Stripe" [S4]
- Data processing law compliance: yes [S4]
- Data subject rights: 15-22 · yes [S8]
- DPA: yes [S4]
- DPA availability: on request or via Data Processing Addendum page [S8]
- DPA dora: yes · yes [S1]
- DPA with subprocessors: yes [S2]
- Dpia assistance: yes [S3]
- Dsr notification days: 5 [S3]
- Effective date: 2026-10-06 [S2]
- Encryption: yes · yes · yes · yes [S2]
- Encryption: AES-256 · TLS 1.3 [S8]
- Encryption at rest: AES-256 [S3]
- Encryption at rest: AES256 · Google [S4]
- Encryption in transit: 1.2 · 1.3 [S3]
- Encryption in transit: ECDSA · RSA · 1.3 · 256 [S4]
- GDPR: yes · yes [S4]
- GDPR scope: EU GDPR · UK GDPR · DPA 2018 · ePrivacy [S3]
- GDPR scope: yes · yes [S8]
- Google workspace AI: yes [S2]
- Hosting certifications: Google Cloud Platform · EU · SOC 1 · SOC 2 · SOC 3 · ISO 27001 [S8]
- International transfers: Standard Contractual Clauses (SCCs) · yes [S8]
- ISO 27001: ISO27001:2022 · yes [S4]
- ISO 27001 download: yes [S4]
- MFA production access: yes [S3]
- No data sale: no [S3]
- Penetration test attestation: yes [S4]
- Penetration testing: annual · yes [S3]
- Penetration testing: yes [S4]
- Permissions audit: yes · yes [S1]
- Role: data processor · data controller [S8]
- Roles: customer data of employees; governed by Data Processing Addendum · account registration data, billing information, usage analytics, website visitor data, candidate data [S2]
- Self service rights: yes [S3]
- SOC 2: SOC2 Type 2 · yes [S4]
- SOC 2 report availability: yes [S4]
- SSO enterprise: yes [S3]
- Staff training: onboarding and annual [S8]
- Subprocessor notice days: 14 [S3]
- Subprocessor objection days: 14 [S3]
- User rights: access · correct · delete · restrict processing · data portability · object to processing [S2]

**Data**
- Deletion certificate: yes [S3]
- Deletion SLA days: 90 [S3]
- Record deletion: yes [S8]
- Retention candidates: 5 [S2]
- Retention deletion: 90 [S8]
- Retention platform: 90 · 30 [S2]
- Return window days: 30 [S3]

**Hosting**
- Cloud provider: Google Cloud Platform [S3]
- EU data residency: EU [S3]
- International transfers: adequacy mechanism · standard contractual clauses [S2]
- Provider: Google Cloud Platform [S4]
- Provider certifications: Google Cloud Platform · SOC 1 · SOC 2 · SOC 3 · ISO 27001 [S2]
- Provider certifications: SOC 1 · SOC 2 · SOC 3 · ISO27001 [S4]
- Region: yes [S2]
- Region: EU [S4]
- Region: EU [S8]

**Integrations**
- API: yes · yes · yes [S1]
- API docs: yes [S9]
- Mcp: yes [S1]
- Slack: yes · daily away summary to any Slack channel [S7]
- Webhooks: yes · instant webhook updates on changes, no polling [S9]
- Webhooks custom endpoints: yes · yes [S9]

**Legal**
- Company: Humaans Inc. · London · New York City · San Francisco [S1]
- Company locations: London · New York City · San Francisco [S3]
- Copyright entity: 2026 · Humaans Inc. [S3]
- DPA available: DPA linked in footer [S6]
- DPA effective date: 2026-10-06 [S3]
- DPA entity: Humaans Software UK LTD [S3]
- Entity: 311228354 · Humaans Software UK LTD · 11496946 [S2]
- Entity: "Humaans Inc." [S4]
- Entity: Humaans Inc. [S9]
- Entity: Humaans Inc. [S8]
- GDPR page available: /gcs/retail-models.org/GDPR · Security · Trust center · Terms · Privacy · DPA · DORA [S3]
- Jurisdiction notice: UK ICO [S2]
- Offices: London · New York City · San Francisco [S9]

**Pricing**
- Stated: Page lists a 'Plans' link but no prices shown [S1]

**Product**
- Additional capabilities: people directory · employee records · user roles · automation · remote friendly [S5]
- AI companion: AI Companion gives employees instant answers on policies and documents; helps admins create documents and view workforce insights [S1]
- AI default: yes · yes [S2]
- AI permission filtering: yes · yes [S4]
- AI processing regions enforced: yes [S3]
- Audit log filters: actor · action · field · space · yes [S9]
- Audit log metadata: ["who", "what", "when", "where"] [S4]
- Audit log searchable record: yes [S9]
- Audit log visibility: Audit Log gives full visibility into every action across the HRIS [S9]
- Audit logs: yes · yes [S4]
- Automated tests: yes [S4]
- Automation: onboarding · offboarding · compensation reviews · performance management [S1]
- Banking details: yes · yes [S5]
- Compensation details: salary · commission · bonus · effective date · historical changes · yes [S5]
- Compensation management module: Related Compensation management module [S6]
- Cookie categories: Necessary · Support (Intercom) · Analytics (Google Analytics) · Advertising (Google, Facebook, OpenAI Ads) [S2]
- Cookie types: yes · yes [S2]
- Custom time off types: yes · location · team [S7]
- Daily backups: yes [S4]
- Data portability: yes [S8]
- Dynamic databases: Dynamic databases: create and adapt custom data sets [S1]
- Employee data access audited: yes [S4]
- Employee database purpose: Central secure storage and management of people data [S5]
- Employment details: start date · probation end date · contract type · place of work [S5]
- Food preferences: yes [S5]
- HR overview: HRIS plus Agentic AI Workforce that executes admin work end-to-end [S1]
- Hsts: yes [S4]
- Leave types supported: paid time off, sick days, parental, mental health, WFH, working from another office [S7]
- Log collection: yes [S4]
- Managed migration: yes [S1]
- Modules: Agentic AI · Employee database · Documents · Workflow automation · Requests & approvals · Absence management · Performance reviews · Employee engagement · AI Companion · Timesheets · People analytics & insights · Data tables · Preliminary… [S1]
- People directory: yes [S5]
- Policy attachment: yes [S7]
- Preliminary payroll: Preliminary payroll feature: tracks and exports payroll-ready data across locations and regions [S6]
- Profile completeness: yes [S5]
- Public holiday calendars: 190 [S7]
- Public profiles: yes [S5]
- Realtime data views: Bulk editing of employee records in a central real-time view [S1]
- Reporting: turnover · headcount changes · salary spend · absence · tenure [S1]
- Right to erasure: yes [S8]
- Role based access control: field-level · yes [S4]
- Role details: title · department · line manager · effective date · historical changes · yes [S5]
- Security headers: ["X-Frame-Options", "X-XSS-Protection", "Content-Security-Policy"] [S4]
- Self service leave: yes [S7]
- SSO providers: ["Google Workspace", "Microsoft Entra", "SAML 2.0"], "passwordless_possible": true [S4]
- Third party integrations: yes [S2]
- Track paid unpaid leave: yes · yes · yes · yes [S7]
- Vulnerability monitoring: yes [S4]

**Support**
- Implementation: yes · yes [S1]
- Vulnerability reporting: "security@humaans.io" · yes · yes [S4]

## Questions

### Is Humaans European?

Not determined: the vendor’s pages as captured do not say where Humaans is based.

### Where does Humaans store data?

The default storage location for customer data is not stated on the vendor’s pages as of 20 Oct 2026. The vendor’s pages mention the EU as hosting location, per [the vendor’s page captured 20 Oct 2026](https://whats-best.ai/evidence/9506).

### Does Humaans have a free plan?

Not stated on the vendor’s pages as of 20 Oct 2026.

### What are the best alternatives to Humaans?

As of 21 Oct 2026, the panel rates [rexx systems (3.5/5)](https://whats-best.ai/software/hr-management/rexx-systems), [HRworks (3/5)](https://whats-best.ai/software/hr-management/hrworks) and [Kenjo (3/5)](https://whats-best.ai/software/hr-management/kenjo) highest among the other 30 HR Management products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [rexx systems](https://whats-best.ai/software/hr-management/rexx-systems) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Humaans alternatives](https://whats-best.ai/software/hr-management/humaans/alternatives).

## What this page leaves out

- 7 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 7 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 hosting facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.

## Sources

- [S1] Vendor page: https://humaans.io (checked 2026-10-20)
- [S2] Privacy policy — found from the homepage: https://humaans.io/privacy (checked 2026-10-20)
- [S3] Data processing agreement (dpa) — found from the homepage: https://humaans.io/data-processing (checked 2026-10-20)
- [S4] Security / trust page — found from the homepage: https://humaans.io/security (checked 2026-10-20)
- [S5] Digital personnel file & data model — found from sitemap: https://humaans.io/features/employee-database (checked 2026-10-20)
- [S6] Payroll handoff — found from sitemap: https://humaans.io/features/preliminary-payroll (checked 2026-10-20)
- [S7] Absence & working-time — found from sitemap: https://humaans.io/features/absence-tracking (checked 2026-10-20)
- [S8] Employee data protection & co-determination — found from sitemap: https://humaans.io/gdpr (checked 2026-10-20)
- [S9] Employee data protection & co-determination — found from sitemap: https://humaans.io/features/audit-log (checked 2026-10-20)

---

Cite as: whats-best.ai, "Humaans — HR Management", AI panel analysis, as of 2026-10-21. https://whats-best.ai/software/hr-management/humaans

Corrections: https://whats-best.ai/correct/913?target=page