Where the reviewed products stand
Compare documented control across the named products and routes. Open a review for its plan, region and agreement (this is a selected sample).
0–10 on both axes · Higher and further right means more documented control
Exact scores & review links (15)
| Vendor | Data access & portability | Build & act |
|---|---|---|
| ADP Workforce Now ↗ | 5.6* | 3.9* |
| Gusto ↗ | 6.6* | 5.3* |
| Paycor HCM ↗ | 7.3* | 5.3* |
| Workday ↗ | 4.7* | 2.2* |
| Rippling ↗ | 4.7* | 4.4* |
| BambooHR ↗ | 4.7* | 4.8* |
| Paylocity ↗ | 6.1* | 5.0* |
| Deel ↗ | 6.6* | 4.6* |
| UKG ↗ | 4.3* | 2.6* |
| HiBob ↗ | 7.6* | 5.7* |
| Personio ↗ | 7.6* | 5.7* |
| Paychex ↗ | 6.2* | 5.0* |
| Paycom ↗ | 4.5* | 1.7* |
| Dayforce ↗ | 4.7* | 4.8* |
| Permute ↗Publisher self-assessment | 8.0* | 7.1* |
Axes average three dimensions each: access, third-party access and exit horizontally; action, continuity and business logic vertically. Fixed 0–10 scale, midlines at 5 (overall grades use separate weights). * Some evidence is unresolved. Marker colors identify companies, not score bands. How to read the map ↗
Permute is included as a reference (it owns this site and is a publisher self-assessment). Its score is excluded from sample averages. Read the Permute review ↗
Reviews identify the assessed HR or payroll interfaces. Available employee fields do not establish complete payroll history, documents or customer configuration portability.
Compare the six dimensions
| Overall control | |
|---|---|
| Data access | |
| Third-party accessibility | |
| External action | |
| Continuity | |
| Data exit | |
| Business logic and customization | |
Product scopes, dates & reviews
ADP Workforce Now
HR and payroll · Checked 2026-10-16
ADP Workforce Now / subscribed Job Applications V2 reads, Worker Hire Event and ADP event notifications. Partner Marketplace approval, API Central and client certificates are separate.
Read findings and sources ↗Gusto
HR and payroll · Checked 2026-10-12
Gusto App Integrations / production-approved OAuth application, employee records and webhooks. Embedded Payroll onboarding and authority are separate.
Read findings and sources ↗| Customer control | ADP Workforce Now ↗ | Gusto ↗ | Paycor HCM ↗ | Workday ↗ | Rippling ↗ | BambooHR ↗ | Paylocity ↗ | Deel ↗ | UKG ↗ | HiBob ↗ | Personio ↗ | Paychex ↗ | Paycom ↗ | Dayforce ↗ | Permute ↗ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Category | HR and payroll | HR and payroll | HR and payroll | HR and payroll | HR and payroll | HR and payroll | HR and payroll | HR and payroll | HR and payroll | HR and payroll | HR and payroll | HR and payroll | HR and payroll | HR and payroll | Databases and data platforms |
| Overall control | |||||||||||||||
| Data access | |||||||||||||||
| Third-party accessibility | |||||||||||||||
| External action | |||||||||||||||
| Continuity | |||||||||||||||
| Data exit | |||||||||||||||
| Business logic and customization | |||||||||||||||
| Assessment scope | ADP Workforce Now / subscribed Job Applications V2 reads, Worker Hire Event and ADP event notifications. Partner Marketplace approval, API Central and client certificates are separate. | Gusto App Integrations / production-approved OAuth application, employee records and webhooks. Embedded Payroll onboarding and authority are separate. | Paycor / Alliance partner application, activated customer HCM API entitlements, dual OAuth/APIm authorization and event subscriptions. Customer Standard Applications have a separate eligibility boundary. | Workday HCM / permission-scoped Common REST workers, worker organizations and business-title changes; Financial Management, tenant reports and Extend entitlements are not combined into this route. | Rippling V2 REST / company workers and employee-document attachment; customer API tokens and App Shop partner OAuth are distinct routes. | BambooHR employee records / customer API key plus new-integration OAuth guidance; employee change IDs and permission-scoped updates. | Paylocity Payroll/HR Weblink v2 employee API through approved customer or partner integration credentials; other API families have distinct limits. | Deel API 2026-01-01 / organization people and contractor contract operations; partner App Store OAuth and organization tokens are distinct routes, with worker tokens separately scoped. | UKG Pro HCM / permission-scoped web-service account for employee demographics and HCM employee-change webhooks; UKG Pro WFM and HR Service Delivery are excluded. | HiBob / current employee profile fields through customer-managed service users, including inactive people when explicitly selected and permitted. Employee history tables, payroll, time off and productized partner OAuth are separate. | Personio / v2 Persons current profile collection, person creation with its associated employment, profile PATCH and person webhooks. Recruiting, payroll, full employment history and unrelated v1 endpoints are excluded. | Paychex Flex / authorized-company worker collection, worker updates and creation of in-progress workers through an approved partner application. Customer-built company apps, completed hiring, payroll execution and complete HR history are separate. | Paycom / customer-generated Report Center outputs and GL Concierge payroll-ledger export files; the Data Services agreement separately describes API/SFTP access, whose technical object, mutation and synchronization contracts remain unverified. | Dayforce / REST employee HR identities and permitted current-as-of employee details, plus employee create/PATCH under Web Services roles. Reports, payroll execution, full effective-dated history and other product APIs are separate. | Permute hosted workspaces / scoped REST and TypeScript SDK access to connected query sources, file datasets, managed database records, operation code and custom apps. Signed enterprise contracts and upstream vendor rights remain separate; no live tenant migration or reliability test was performed. |
| Assessment checked | 2026-10-16 | 2026-10-12 | 2026-10-12 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-12 |
| Read the findings | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ |
Scores are out of 10. * Incomplete evidence discounts verified capabilities (unknown answers stay unknown). Planned migration drives data exit. Scoring method ↗
Who can connect?
Yes No- Unknown
A check means the column applies to that route (customer credentials can still require provider approval). Report exports use the customer account without separate API credentials. Open a connection method for its authentication, requirements and last review date.
What each review covers
ADP Workforce Now ↗
ADP’s APIs are product- and subscription-specific. A certificate and a partner listing do not grant every Workforce Now field.
ADP Workforce Now / subscribed Job Applications V2 reads, Worker Hire Event and ADP event notifications. Partner Marketplace approval, API Central and client certificates are separate.
Gusto ↗
Gusto requires production preapproval and a security review. Fine-grained scopes distinguish basic employee metadata from compensation.
Gusto App Integrations / production-approved OAuth application, employee records and webhooks. Embedded Payroll onboarding and authority are separate.
Paycor HCM ↗
Paycor’s partner agreement requires written approval before production. Client Developer Portal access is a different route and should not inherit that claim automatically.
Paycor / Alliance partner application, activated customer HCM API entitlements, dual OAuth/APIm authorization and event subscriptions. Customer Standard Applications have a separate eligibility boundary.
Workday ↗
Workday HCM exposes worker data through security-scoped REST resources. Its Common worker endpoint supports paging and name search, while a separate business-title operation supports a narrow write.
Workday HCM / permission-scoped Common REST workers, worker organizations and business-title changes; Financial Management, tenant reports and Extend entitlements are not combined into this route.
Rippling ↗
Rippling V2 provides filtered worker lists with explicit scopes and redacted fields. Its current platform also supports native functions, while partner distribution needs a separate access review.
Rippling V2 REST / company workers and employee-document attachment; customer API tokens and App Shop partner OAuth are distinct routes.
BambooHR ↗
BambooHR provides a change-ID API that names inserted, updated and deleted employees. New integrations should use OAuth; legacy OpenID Connect key retrieval is deprecated.
BambooHR employee records / customer API key plus new-integration OAuth guidance; employee change IDs and permission-scoped updates.
Paylocity ↗
Paylocity documents employee reads and updates, but credential issuance and go-live access require review. Weblink rate limits must be kept separate from its newer API families.
Paylocity Payroll/HR Weblink v2 employee API through approved customer or partner integration credentials; other API families have distinct limits.
Deel ↗
Deel separates organization and worker identities and documents scoped contract operations. Published App Store distribution requires review, while webhook redelivery has a bounded retry policy.
Deel API 2026-01-01 / organization people and contractor contract operations; partner App Store OAuth and organization tokens are distinct routes, with worker tokens separately scoped.
UKG ↗
UKG Pro HCM uses customer-created web-service identities with granular method grants. Its demographic webhook example requires a separate API refetch rather than delivering the whole changed employee.
UKG Pro HCM / permission-scoped web-service account for employee demographics and HCM employee-change webhooks; UKG Pro WFM and HR Service Delivery are excluded.
HiBob ↗
Customer service users can read and change scoped employee profiles. Current profiles are fully retrievable, while history tables and calculated-field changes require separate handling.
HiBob / current employee profile fields through customer-managed service users, including inactive people when explicitly selected and permitted. Employee history tables, payroll, time off and productized partner OAuth are separate.
Personio ↗
Personio v2 supports current person records, profile writes and deletion events. Customer custom integrations are distinct from marketplace partnership; webhook retries do not provide a retained replay API.
Personio / v2 Persons current profile collection, person creation with its associated employment, profile PATCH and person webhooks. Recruiting, payroll, full employment history and unrelated v1 endpoints are excluded.
Paychex ↗
Paychex separates partner production approval from each customer’s consent. Worker data is iterable, but creation filters are not update cursors and in-progress worker creation still requires Flex completion.
Paychex Flex / authorized-company worker collection, worker updates and creation of in-progress workers through an approved partner application. Customer-built company apps, completed hiring, payroll execution and complete HR history are separate.
Paycom ↗
Paycom documents report and ledger-file exports, and its terms explicitly recognize API/SFTP services. Public evidence does not establish their technical coverage, chosen-provider key issuance or replay contract.
Paycom / customer-generated Report Center outputs and GL Concierge payroll-ledger export files; the Data Services agreement separately describes API/SFTP access, whose technical object, mutation and synchronization contracts remain unverified.
Dayforce ↗
Dayforce documents current-as-of employee APIs and create/PATCH operations with role controls. Effective-date windows and sequential detail retrieval matter; chosen-provider commercial eligibility remains unresolved.
Dayforce / REST employee HR identities and permitted current-as-of employee details, plus employee create/PATCH under Web Services roles. Reports, payroll execution, full effective-dated history and other product APIs are separate.
Permute ↗
Scoped APIs expose SQL reads, managed records and customer-authored operation code. Customer-built apps are supported, while complete workspace recovery, outbound CDC and minimum-plan access terms remain unresolved.
Permute hosted workspaces / scoped REST and TypeScript SDK access to connected query sources, file datasets, managed database records, operation code and custom apps. Signed enterprise contracts and upstream vendor rights remain separate; no live tenant migration or reliability test was performed.