BambooHR
Connect BambooHR to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect BambooHR to sync people, employment status, start and end dates into the personnel register.
| Category | HRIS |
| Connect with | API token |
| What a connection produces | People sync |
| BambooHR's guide | documentation.bamboohr.com |
Connect with an API token
-
In BambooHR:
- Sign in to BambooHR as a user who can see every employee; the key carries that user's permissions.
- Click your name in the lower left-hand corner of any page to open the user context menu.
- Select API Keys (shown only if you have sufficient permissions).
- Create a new key for Safeguard and copy it.
Where to find the other values:
- Company subdomain: The part between https:// and .bamboohr.com in your BambooHR address.
BambooHR's public documentation does not cover every step.
BambooHR: 'The permissions of the user associated with the API request will determine which fields and employees each API request is allowed to view and/or edit.' The user needs access to workEmail, hireDate, supervisorEId and employmentHistoryStatus for every employee. The add-key button label and whether the key is shown only once were not on the fetched page.
Source: documentation.bamboohr.com, checked 2026-10-07.
The permissions Safeguard needs:
workEmail,hireDate,supervisorEId,employmentHistoryStatus. The credential carries its user's rights: create it as a user who can see every account. -
On Compliance › Connectors, open BambooHR, click Connect, choose API token and fill in:
Field What to enter Company subdomain Required. The part before .bamboohr.com in your BambooHR address. API key Required. Create under your BambooHR account menu → API Keys, as a user who can see every employee. Stored encrypted and never shown again. -
Click Connect with token.
Frameworks
Safeguard's automated tests read BambooHR and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC1.3, CC2.1, CC6.2 | 1 |
| ISO/IEC 27001 | Automated tests | A.5.16 | 1 |
| HIPAA Security Rule | Automated tests | 164.308(a)(3) | 1 |
| NIST CSF 2.0 | Automated tests | GV.RR-04, PR.AA-01 | 1 |
These tests are switched on per workspace by the Safeguard team.
Related
- HRIS connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks