Workday, Inc. (HiredScore AI Division)

Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.

• IDENTITY: HiredScore is now fully part of Workday, Inc. (acquired). The hiredscore.com domain redirects to workday.com. No dedicated trust center; uses Workday's shared compliance documentation. This is not a vendor over-claim but important context: HiredScore compliance is inseparable from Workday's broader security posture.
• CERT-SOURCING: On Workday's own compliance page, HiredScore AI for Recruiting and HiredScore AI for Talent Mobility are explicitly enumerated ONLY under the Data Privacy Framework, the TRUSTe Enterprise Privacy & Data Privacy Governance Practices Certification, and the Global CBPRs and PRP Certification. Workday holds SOC 2 Type II, ISO 27001, HIPAA (Enterprise Products), FedRAMP Moderate, and CSA STAR at the organization level, but the page does NOT name HiredScore products within the ISO 27001 certificate scope, the HIPAA attestation scope, or the FedRAMP authorization boundary. QA correction: the first-pass draft's held=true proof quotes for ISO 27001, HIPAA, and FedRAMP were fabricated (they conflated the TRUSTe Enterprise Privacy certification with ISO 27001 / HIPAA compliance, and asserted HiredScore FedRAMP inclusion). Those three are downgraded to held=false with no-public-evidence wording. SOC 2 (org-wide) and CSA STAR (org-wide self-assessment) are retained as held=true at the Workday level with corrected proof quotes; GDPR is retained because HiredScore is explicitly listed under TRUSTe/DPF/CBPR.
• AI-TRAINING-OPACITY: Workday states it does not sell customer data, but does not explicitly document whether customer applicant data is used to train or improve HiredScore Spotlight's grading model. Court litigation (2026) has required Workday to disclose customer lists for HiredScore use, indicating regulatory scrutiny of AI training practices.
• LITIGATION: Workday has been ordered by a court (2026) to provide a customer list of organizations that enabled HiredScore AI features during a relevant period. This reflects ongoing legal challenges regarding algorithmic fairness, transparency, and potential bias in AI hiring tools. Independent audit (Secretariat, March 2026) found no disparate impact in one test scenario, but applicability is limited to Workday's own applicant data.
• EU-DATA-RESIDENCY: No option for EU-only data residency documented. HiredScore uses Standard Contractual Clauses for GDPR compliance, but data processing may occur in multiple regions on AWS. Organizations with strict residency requirements should clarify with Workday.
• HIPAA-SCOPE: HIPAA is NOT confirmed for HiredScore. Workday's HIPAA third-party attestation is scoped to the Workday Enterprise Products; HiredScore AI products are not named, and TRUSTe Enterprise Privacy certification does not demonstrate HIPAA compliance. HiredScore is a recruiting/talent tool, not a healthcare platform. Any healthcare customer processing PHI would need to confirm HIPAA coverage and a Business Associate Agreement (BAA) directly with Workday.
• NO-DEDICATED-TRUST-CENTER: HiredScore has no standalone trust center or security page. All compliance information is hosted on Workday's pages. This is not unusual for acquired products but reduces direct vendor transparency.
• ISO-42001-ABSENT: As an AI-driven recruiting product, HiredScore does not have published ISO/IEC 42001 (AI governance) certification. Workday emphasizes responsible AI practices but has not pursued formal AI governance certification.