// Trust & Security Report
Airbase
Spend management and financial operations platform combining bill pay, accounts payable automation, expense management, corporate cards, and procurement capabilities.
Certifications held
4
Maturity
Enterprise
Trains on your data
No
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on paylocity.com“Paylocity engages reputable audit firms who perform annual independent attestations for SOC 1 and SOC 2 Type II, which cover controls related to financial reporting, security, confidentiality, and availability.”
Verify on paylocity.com“Paylocity engages reputable audit firms who perform annual independent attestations for SOC 1 and SOC 2 Type II, which cover controls related to financial reporting, security, confidentiality, and availability.”
Verify on paylocity.com“Paylocity is ISO 27001:2022 certified, which is an internationally recognized framework that demonstrates controls in data security and risk management and continuous improvement in protecting sensitive information.”
Verify on paylocity.com“Paylocity commits to compliance with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other US and international privacy or data protection laws.”
> Show 4 unconfirmed / not-held certifications
source: paylocity.comNo vendor-domain statement asserting PCI DSS compliance was found. The vendor's own pages reference PCI DSS requirements but do not publicly claim certification. The only affirmative 'PCI Compliant' assertion comes from a third-party profile, which also over-claims FedRAMP for Airbase and is not reliable evidence.
source: paubox.comNo vendor-domain statement confirms HIPAA compliance or BAA availability for the Airbase spend product. A 2023 third-party assessment (Paubox) found no BAA capability on Airbase's site. Post-acquisition, Paylocity signs BAAs at the parent level, but product-level coverage for the Airbase spend platform is not publicly documented.
source: marketplace.fedramp.govNo evidence found in FedRAMP marketplace or official vendor documentation. Nudge Security profile claims 'FedRAMP Compliant' but this is unverified and does not appear in official FedRAMP Marketplace product listings.
source: trustfinance.paylocity.comNo public vendor-domain evidence of CSA STAR Level 1 registration or certification was found on the vendor's trust center or security pages. The only assertion comes from a third-party profile, which also over-claims FedRAMP for Airbase and is not reliable evidence.
// Privacy & AI training
Trains on customer data
No
Data processing agreement
Offered
Data region
Not publicly specified; hosted on infrastructure with controls documented in SOC 2 reports
No public evidence of using customer data for model training. Spend management platform does not mention AI training on customer financial data.
// Security controls
Multi-Factor Authentication
Two-factor authentication options including SMS and email
security-profiles.nudgesecurity.comThird-party integrations
Integrates with security vendors including Sophos and Very Good Security
security-profiles.nudgesecurity.com// Products & data scope
Data it handles: Customer financial data, vendor information, payment records, corporate card transactions, procurement data
Now operated as Airbase by Paylocity following October 2024 acquisition for $325M. Targets finance and HR leaders managing spend across payroll and non-payroll expenses on unified platform.
// What to watch
- A third-party profile claims Airbase is 'FedRAMP Compliant,' but no evidence is found in the FedRAMP Marketplace or official vendor documentation. Neither Airbase nor Paylocity appears to be FedRAMP authorized.
- The SOC 1, SOC 2 Type II, and ISO 27001 certifications are held by Paylocity, the parent company, not by Airbase as a separate entity. The airbase.com pages now redirect to paylocity.com. These are Paylocity parent-company certifications that cover the Airbase-by-Paylocity product.
- A third-party profile claims Airbase has HIPAA compliance, but an independent assessment (Paubox, March 2023) found no mention of BAA capability on Airbase's public site. Post-acquisition, Paylocity signs BAAs at the parent level, but product-level BAA availability for the Airbase spend platform is not publicly confirmed.
- Paylocity completed its acquisition of Airbase on October 1, 2024. The vendor is now 'Airbase, a Paylocity Company.' Certifications shown are the parent's (Paylocity) and are presumed to cover the Airbase product; product-specific scoping is not separately published.
// At a glance
Pricing model
Subscription-based SaaS; pricing not publicly specified
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Airbase Inc. (acquired by Paylocity Corporation, October 2024)'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-06. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
trustfinance.paylocity.com