← All integrations
People & process · integration
BambooHR
People-and-process evidence (HRIS) from BambooHR — the non-IT controls that are ~40% of an audit.
ISO 27001SOC 2DPDPA
What ProofLayer proves
Read-only evidence, evaluated against versioned rules.
- Employees have a completed background check and current security-awareness training
- Staff have acknowledged the acceptable-use / security policy
- Departed employees have completed offboarding (pairs with the deprovisioning check)
- Only status booleans and a hashed person reference are stored — never names or emails (DPDPA minimisation)
Configure in ProofLayer
Live in minutes.
- Connections → New connection → pick this provider and name the account.
- Enter your company subdomain (the {company} in api.bamboohr.com/api/gateway.php/{company}) and paste a read-only API key. The subdomain shows on every manifest; the key is stored write-only and sealed.
- Click Test connection — ProofLayer verifies read access from the control plane and reports a clear reason if anything is off.
- Set the scan schedule; every run appends to the evidence chain for this account.
- Choose the framework mapping(s) and, optionally, a push target (CISO Assistant, a Jira/ServiceNow ticket on failure, or a scheduled auditor pack).
Grant access from your side
Read-only, least-privilege, revocable.
You create the access in your own console and paste a credential ProofLayer stores sealed — it never writes to your systems.
- BambooHR has no OAuth app for this — access is a company subdomain plus an API key, and the key inherits the permissions of the user who created it. So create a dedicated read-only service-account user, sign in as them, and generate the key under Account → API Keys.
- ProofLayer authenticates with HTTP Basic auth (the API key as the username, an ignored password) over the read-only REST API — nothing is ever written back.
- Give that user read access to the fields that carry the compliance signals: backgroundCheckStatus, securityTrainingDate, policyAcknowledgedDate, offboardingCompletedDate (add them as custom fields if you do not already track them).
- DPDPA minimisation: the collector records only status booleans and a hashed person reference on the manifest — never names or emails.
In-account agent option. Run the agent with BAMBOOHR_URL and BAMBOOHR_TOKEN on your host. The collector posts evidence outbound-only, so ProofLayer holds no credential into your environment.