Informational summary. This page is an informational summary, not a warranty, service-level agreement, or certification, and it does not amend any agreement. Binding security, privacy, and breach-notification obligations arise under applicable law and any executed service agreement, DPA, BAA, or other written agreement that applies to the client relationship. Last reviewed September 11, 2026.

Where your data lives, and who handles it

What protects your data at every layer.

Your employees’ payroll and HR records pass through three layers: the people who handle them, the platform they run in, and the infrastructure underneath. Here is what protects your data at each one, and who stands behind it.

Layer 1 · The people

VertiSource HR

Utah HQ · Costa Mesa, CA

Your payroll, benefits, and HR specialists work from our Utah headquarters in Cottonwood Heights and our Costa Mesa, California office. A specialist answers security questions by phone.

We maintain administrative, technical, and physical safeguards scaled to the sensitivity of the data we handle, consistent with our Privacy Policy, and apply HIPAA Security Rule safeguards where Protected Health Information is involved.

What we handle ourselves
  • U.S.-based specialists
  • Role-based access
  • Incident response
  • Breach notification

Described in plain words in the next section. Independent attestations on this page are credited to the providers that hold them, below.

Layer 2 · The platform

The VertiSource HR Cloud

Operated by Worklio, Inc.

Our core HRIS platform, marketed by VertiSource HR as “The VertiSource HR Cloud,” is operated by Worklio, Inc. and hosted on Microsoft Azure U.S.-region infrastructure. This is the platform of record for your payroll and HRIS data.

Those attestations belong to those providers. Providers that handle client data are subject to contractual and legal safeguards appropriate to their role.

Attestations published by the platform provider
  • SOC 2 Type II
  • ISO/IEC 27001:2013
  • ISO/IEC 27018:2019

As stated in the provider’s public security documentation, checked September 11, 2026. We rely on the provider’s published attestations as part of vendor due diligence; we do not independently audit its controls.

Layer 3 · The infrastructure

Microsoft Azure

U.S.-region data centers

Core HRIS and payroll data is hosted in U.S.-region data centers on Microsoft Azure infrastructure that maintains SOC 2 Type II attestation.

Azure is the physical and network layer under the platform: the data centers, the storage, and the compute the platform provider builds on.

Attestations held by Microsoft
  • SOC 2 Type II
  • ISO/IEC 27001
  • ISO/IEC 27018

Microsoft publishes its Azure audit reports and certificates on its Service Trust Portal.

The people who handle your data

What VertiSource HR does with your data.

The platform holds the records. Our specialists are the people who work in them, and the people you call. This is the part we answer for directly, in the same words our counsel-reviewed policies use.

Meet the specialists who handle your account →

U.S.-based specialists you can call

Your payroll, benefits, and HR specialists work from our Utah headquarters in Cottonwood Heights and our Costa Mesa, California office. A specialist answers security questions by phone.

Role-based access, on your side and ours

Core HRIS and payroll data is governed by role-based access. You decide which of your managers and employees have portal access and at what level; the platform supports granular permissions configured per user and per module. On our side, access is limited to the people who need it in the course of their duties.

Safeguards scaled to sensitivity

We maintain administrative, technical, and physical safeguards scaled to the sensitivity of the data we handle, consistent with our Privacy Policy, and apply HIPAA Security Rule safeguards where Protected Health Information is involved.

Incident response

Our incident-response process addresses detection, containment, remediation, and post-incident review.

You hear from us

Confirmed security incidents affecting client data are reported to impacted clients within the timeframes required by applicable breach-notification law and the governing client agreement.

Report a vulnerability

Found a security issue? Report a suspected vulnerability to HR@VertiSourceHR.com with “Security Report” in the subject line. We acknowledge reports promptly and coordinate remediation.

The platform your data runs in

Built on a platform that publishes its controls.

The VertiSource HR Cloud is operated by Worklio, Inc., which publishes its security controls and holds independent attestations. The controls below are drawn from the provider’s public security documentation, checked September 11, 2026. They are the provider’s statements about its platform; we rely on them as part of vendor due diligence and do not independently audit the provider’s controls.

Encryption in transit

Connections between users and the platform use HTTPS with TLS.

Provider-published

Encryption at rest

Stored data is protected with Azure SQL Transparent Data Encryption and column-level encryption for sensitive fields, using layered encryption including AES-256 and RSA 2048-bit keys. Encryption keys are stored separately in Azure Key Vault.

Provider-published

Authentication controls

The platform supports two-factor authentication, IP restrictions, and strong password policies, with layered access controls that limit who can view client data.

Provider-published

Audit trail

Changes made by administrators, employees, and clients are logged in an audit trail.

Provider-published

Monitoring and testing

The provider maintains continuous security monitoring 24×7, both in-house and from multiple independent locations, and engages third-party cybersecurity firms for security testing, scanning, and threat detection.

Provider-published

Backups and recovery

Nightly backups are retained for seven days, and point-in-time restore can recover the database state to any minute within the previous 35 days. Data spans multiple physical locations with N+1 or greater redundancy.

Provider-published

Statements above reflect the provider’s documentation as of the date shown. Attestation reports, where a provider makes them available, are obtained from that provider.

How we talk about security

Where each security commitment comes from.

This page credits each attestation to the provider that holds it and states what we handle ourselves.

Attestations are credited to whoever holds them.

The SOC 2 Type II attestations on this page belong to Microsoft Azure and to the platform provider. VertiSource HR does not hold a SOC 2 attestation of its own. VertiSource HR does not represent itself as SOC 2 certified, SOC 2 compliant, or SOC 2 audited.

Every certification credited to its holder.

We do not hold ISO 27001, ISO 27018, HITRUST, or PCI DSS certifications ourselves, and we do not display them as if we did.

HIPAA terms are set in the client agreement.

HIPAA obligations depend on the service involved and are addressed in the client agreement. Where Protected Health Information is involved, we apply HIPAA Security Rule safeguards.

The contract carries the commitments.

Our internal security-controls detail is not published on this page. Contractual security, privacy, and breach-notification terms are set in your executed agreement, not here.

What clients ask before they sign

Straight answers for your security review.

Security questions

Send us your security questions.

Email HR@VertiSourceHR.com with "Security Question" in the subject line and we will connect you with the right person. Privacy questions go to privacy@vertisourcehr.com.