This article explains how Drata connects to HRIS systems, what employee data is accessed, how that data is stored and used, and what options are available if no HRIS integration is in place.

How Drata Communicates With HRIS Systems

The initial HRIS connection in Drata establishes secure authentication.
Once connected, Drata makes a limited number of API requests every 24 hours using a standardized data model that is intentionally limited to a small set of employee data points.
The HRIS system returns the requested data to Drata.

Data Points Drata Access

Drata is granted read-only access and cannot modify any employee data in the HRIS system. You can review the data imported by:

Logging into Drata
Navigating to Connections
Filter the connections by HRIS. For the desired HRIS, select Manage Accounts

The following data points may be enabled and accessed, depending on the HRIS provider:

Avatar
Company
Employee number
Employment status
First name
Last name
Groups
Hire date
Start date
Team
Termination date
Work email
Manager
Personal email
- Personal email addresses are used only to support identity matching across integrations where personal emails are required (such as background check or version control connections).
- Personal email addresses are not displayed in user profiles within Drata.

Note about ADP Workforce: The ADP Workforce integration requires a different set of API permissions in order to generate a report. This requires the Practitioner Role to be enabled which increases the scope of data points accessible by the service account, although the data utilized by Drata remains the same.

Data Points Drata Does Not Access

The following data points are never requested, never received, and never stored by Drata:

Social Security number
Date of birth
Ethnicity
Gender
Home location
Marital status
Phone number
Pay group
Work location

How Drata Stores Customer Data

Drata uses single-tenant database architecture, where each customer has their own private database (tenant) within that server, totally isolated from other customer data. The only data points that Drata stores in its secure, single-tenant databases are work email, personal email, employment start and end dates, first and last name, job title, and employment status. Each customer database is essentially its own universe and will not be mixed with other customer data.

For additional information on Drata’s monitored security practices, visit our Trust Center.

HRIS and Identity Provider (IdP) Record Mapping

Drata maps the personnel records from the identity provider connection to the employee records from the HRIS system. Drata will automatically map HRIS records to IdP records based on matching emails or standalone first and last name. In the event a match cannot be made, Drata will mark these records with an employment status of “Unknown” on the Drata Personnel page.

Importance of HRIS data

The HRIS data is the source of truth for start date, separation date, and employment status. Any changes to these values should originate in the connected HRIS.

Incorporating employee data from the HRIS system adds vital employment details for evaluating the employees’ security and compliance. The HRIS connection establishes who the in-scope personnel are for the purposes of an audit and a potential random sample selection by the auditor.

For example, hire date and termination date are key to identify current vs. terminated employees. Current employment statuses establish who needs to be monitored for onboarding and app access. Former employment statuses enable the system to track those that have left the company and check for completed off-board processes.

What Happens If No HRIS Integration Is Connected

Without an HRIS connection, Drata relies on IdP account activation and deactivation dates as the employee’s start and separation dates. These dates are used to infer employment status as either Current or Former. If IdP activation or deactivation dates differ from official HR records, hire and termination dates may require manual adjustment.

Note: Contractor employment status is not inferred automatically and must be updated manually.

Below you will find four options to update employee details in Drata.

Option 1: Manually Manage Employee Records in the UI

Update employment status, hire date, and separation date directly on the Personnel page for individual users.

In most cases (except the Okta configuration described below), manual updates cause the personnel record to stop syncing with the IdP. A Drata admin can revert the manual changes at any time to restore syncing with the IdP. Track manual updates in the Sync Status column on the Personnel page.

Option 2: Bulk import data

Upload a spreadsheet containing employee name, email, start date, separation date, and employment status.

Important:

This is a manual, ongoing process that may require additional HR resources.
Uploads may take several days to process and will need to be updated on a regular basis.
Manual updates stop IdP syncing unless reverted by a Drata admin.
An admin in Drata can revert the manual updates at any time and resync the personnel record with the IDP connected. This will be considered a manual update in Drata and the personnel record will honor the manual modifications and stop syncing with the IDP.

Option 3: Build a Custom Automation Using the API

Create and manage an automation to update employee records in Drata using the API, update their contract dates post request, update employment status post request. Learn more about Drata's API.

Important: