The processor terms, in plain English.

Roles

For the worker records you keep in Stamped HR, you are the controller and we are the processor. We process on your documented instructions.

We are a controller in our own right for your account and billing details, and for the security records we keep to run the service safely. We say this explicitly because describing the whole relationship as processor-only would be inaccurate.

What we process, and why

Identity and immigration evidence, contact details and their history, absence records, payslip records, briefing acknowledgements and the audit trail around all of it — for the purpose of providing the service to you.

Some of this is sensitive. Criminal record check information and anything revealing health is treated with additional restrictions, and the product deliberately limits what it collects: absence reasons are a fixed category rather than free text, and criminal record checks default to recording the outcome rather than storing the certificate.

Sub-processors

Named on the security page, with the country each operates in. We will tell you before adding one, and you can object.

Security

Separation between customers enforced in the database, encryption at rest with a key held per individual, access recorded in an append-only log whose head is published to your own administrator, uploads scanned and served so they cannot execute, and backups verified by restoring them.

Helping you meet your obligations

We will help you respond to requests from your workers, and provide what you need for your own impact assessments. Where a worker contacts us directly we will point them to you rather than answering for you.

Breaches

We will tell you without undue delay, with what we know and what we are doing, so you can meet your own notification duties.

Retention, holds and deletion

Retention runs on rules, keeping the longest clock that applies to an item. Nothing is disposed of while a hold is in place, and disposal produces a documented decision.

Erasure works by destroying the key for that person, which makes their records unreadable including in backups that cannot be selectively rewritten. The audit trail keeps a record that erasure happened, without keeping the personal data itself.

Return and deletion at the end

You export everything in a usable form, and we return or delete what remains as you direct.