// Trust & Security Report
Airbase Inc. (acquired by Paylocity Corporation, October 2024)
Spend management and financial operations platform combining bill pay, accounts payable automation, expense management, corporate cards, and procurement capabilities.
Certifications held
4
Maturity
Enterprise
Trains on your data
No
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on paylocity.com“Paylocity engages reputable audit firms who perform annual independent attestations for SOC 1 and SOC 2 Type II, which cover controls related to financial reporting, security, confidentiality, and availability.”
Verify on paylocity.com“Paylocity engages reputable audit firms who perform annual independent attestations for SOC 1 and SOC 2 Type II, which cover controls related to financial reporting, security, confidentiality, and availability.”
Verify on paylocity.com“Paylocity is ISO 27001:2022 certified, which is an internationally recognized framework that demonstrates controls in data security and risk management and continuous improvement in protecting sensitive information.”
Verify on paylocity.com“Paylocity commits to compliance with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other US and international privacy or data protection laws.”
> Show 4 unconfirmed / not-held certifications
source: paylocity.comNo direct vendor-domain proof_quote asserting PCI DSS compliance was located. The vendor's own pages reference PCI-DSS requirements but do not publicly claim certification; the only affirmative 'PCI Compliant' assertion comes from a third-party profile (Nudge Security), which also over-claims FedRAMP for this vendor and is therefore not reliable evidence.
source: paubox.comNo direct vendor-domain proof_quote confirms HIPAA compliance or BAA availability for the Airbase spend product. A 2023 third-party assessment (Paubox) found no BAA capability on Airbase's site; post-acquisition, Paylocity signs BAAs at the parent level, but product-level coverage for the Airbase spend platform is not publicly documented.
source: marketplace.fedramp.govNo evidence found in FedRAMP marketplace or official vendor documentation. Nudge Security profile claims 'FedRAMP Compliant' but this is unverified and does not appear in official FedRAMP Marketplace product listings.
source: trustfinance.paylocity.comNo public vendor-domain evidence of CSA STAR Level 1 registration or certification was located on the vendor's trust center or security pages. The only assertion comes from a third-party profile (Nudge Security), which also over-claims FedRAMP for this vendor and is therefore not reliable evidence.
// Privacy & AI training
Trains on customer data
No
Data processing agreement
Offered
Data region
Not publicly specified; hosted on infrastructure with controls documented in SOC 2 reports
No public evidence of using customer data for model training. Spend management platform does not mention AI training on customer financial data.
// Security controls
Multi-Factor Authentication
Two-factor authentication options including SMS and email
security-profiles.nudgesecurity.comThird-party integrations
Integrates with security vendors including Sophos and Very Good Security
security-profiles.nudgesecurity.com// Products & data scope
data: Customer financial data, vendor information, payment records, corporate card transactions, procurement data
Now operated as Airbase by Paylocity following October 2024 acquisition for $325M. Targets finance and HR leaders managing spend across payroll and non-payroll expenses on unified platform.
// What to watch
- OVER-CLAIM: FedRAMP - Nudge Security profile claims 'FedRAMP Compliant' but no evidence found in FedRAMP Marketplace or official vendor documentation. Neither Airbase nor Paylocity appears to be FedRAMP authorized.
- CORRECTED PROOF QUOTES: The SOC 1, SOC 2 Type II, and ISO 27001 proof_quotes previously named 'Airbase' as the subject, but the live vendor-domain source attributes them to 'Paylocity' (the parent). The cited airbase.com pages now 301-redirect to paylocity.com. Quotes and source URLs were corrected. These are Paylocity parent-company certifications that cover the Airbase-by-Paylocity product.
- DOWNGRADED (PCI DSS and CSA STAR Level 1): Both were previously marked held=true sourced only from a third-party profile (Nudge Security). That profile also over-claims FedRAMP for this vendor and is not reliable. No vendor-domain proof_quote was located for either, so both are now held=false with 'no public vendor-domain evidence' wording.
- CONFLICTING EVIDENCE: HIPAA - Nudge Security claims HIPAA compliance, but an independent assessment (Paubox, March 2023) found no mention of BAA capability on Airbase's public site. Post-acquisition, Paylocity signs BAAs at the parent level, but product-level BAA availability for the Airbase spend platform is not publicly confirmed. Kept held=false.
- THIN EVIDENCE: The originally captured primary URL (airbase.io) is inaccessible (Cloudflare CNAME error), and airbase.com pages now redirect to the Paylocity domain. Verification was performed against paylocity.com, trustfinance.paylocity.com, and trust.paylocity.com.
- ACQUISITION IMPACT: Paylocity completed its acquisition on October 1, 2024. The vendor is now 'Airbase, a Paylocity Company'. Certifications shown are the parent's (Paylocity) and are presumed to cover the Airbase product; product-specific scoping is not separately published.
// At a glance
Pricing model
Subscription-based SaaS; pricing not publicly specified
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Airbase Inc. (acquired by Paylocity Corporation, October 2024)'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-06. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
trustfinance.paylocity.com