- Security
Security and Reliability
With a global audience of 120,000+ businesses across the UK, Ireland, Canada, Australia and New Zealand, BrightHR has been a trusted partner for businesses since launching in 2015.
BrightHR is committed to keeping your employee and business information safe and secure. This page explains how we protect, safeguard and store your data.
How does BrightHR perform?
We know how important it is for you to access your business data quickly. That's why we host several instances of our software in multiple data centres and use traffic management technology to direct traffic to the fastest responding service in your region. As a result, our software always operates at a high level of speed and reliability.
What security measures do you have in place?
With our two-factor authentication feature, a BrightHR user has to enter a unique code sent to their mobile to access their BrightHR account.
We also ask users to follow strong password complexity rules. Plus, we monitor any changes to admin accounts to make sure they're genuine.
Useful Links
BrightHR is certified to ISO/IEC 27001 and Cyber Essentials Plus, holds a SOC 2 Type I report, and is PCI DSS compliant and registered with the ICO.
To learn more about how our BrightHR accounts operate, you can access the full terms and conditions on our website.
Got more security questions? No problem. Head to our Support Hub to browse our most frequently asked questions now.
Your data and where it's held
We hold your data in highly secure data centres. For customers subscribing in the Republic of Ireland we store data in the European Union. For Customers subscribing in Canada or the United Kingdom we store data in the country of subscription. For Customers subscribing in Australia or New Zealand we store data in Australia.
This complies with the Data Protection Act (DPA) and the General Data Protection Regulation (GDPR) and local data protection legislation.
How we comply with GDPR
Data Encryption
When you subscribe to BrightHR, we become the data processor and you remain the data controller. We always store data local to the company that are using it and use encryption to protect it.
Secure Protocols
We also use secure protocols for transporting the data and when asked to delete the data, we remove it permanently from the system.
ICO Guidelines
It's highly unlikely that there will ever be a data breach, but if there is, we will inform you immediately. Under the ICO guidelines for breaches, we must inform the ICO within 72 hours of becoming aware of a breach.
How we monitor access to your data
The security of your data is our top priority, which is why we have a dedicated information and cyber security team.
We use standard authentication mechanisms to identify users, so we know exactly who's accessing your data. We also restrict or allow access to data based on a user's role and their need to access the data, to make sure that information stays confidential.
To prevent external access to your data, we deploy our system in Microsoft's Azure platform.
Azure has in-built protection and controls access to our systems and data. We also run regular internal vulnerability tests and address any issues found.
BrightHR has achieved SOC 2 Type I
BrightHR has completed an independent SOC 2 Type I assessment carried out by A-LIGN, a specialist provider of security compliance audits.
A-LIGN concluded that BrightHR's controls were suitably designed as of 3rd June 2026 to meet the SOC 2 criteria for Security. Independent assurance is an ongoing commitment at BrightHR rather than a one-off exercise. We continue to invest in our security programme and to have it examined by independent auditors, so that our customers can rely on evidence rather than assertion.
ISO Certificates
A-LIGN certifies that BrightHR operates an Information Security Management System that conforms to the requirements of ISO/IEC 27001:2022.
BrightHR holds a certificate for ISO 9001. Operating a Quliaty Management System which complies with the requirements of ISO 9001:2015.
BrightHR holds a certificate and operates an Environmental Management System which complies with the requirements of ISO 14001:2015.
BrightHR is certified for and operates the Occupational Health and Safety Management System which complies with the requirements of ISO 45001:2018.
BrightHR operates an Energy Management System which complies with the requirements of ISO 50001:2018 for the scope of Provision of legal, health & safety and advisory services.