Trion’s public Worksite Employee Privacy Policy gives unusually useful insight into the information flows behind a PEO relationship.
The policy describes information processed about worksite employees and, in some cases, their family members, dependents and beneficiaries.
This is useful for employers conducting HR-vendor due diligence because it shows how broad PEO data processing can become.
Personal Identifiers
The policy identifies data such as:
- name;
- Social Security number;
- date of birth;
- driver’s-license information;
- passport information;
- employee IDs.
These are necessary for many HR and payroll functions but create obvious identity-theft risk if mishandled.
Financial Information
Trion’s policy includes bank-account information used for direct deposit and other financial account information among the data categories it may process.
That connects payroll security directly to information-security controls.
Employment and Payroll Records
The policy describes personnel and employment information including:
new-hire records;
I-9 forms;
tax records;
time and attendance;
workplace-injury records;
safety records;
performance and discipline records;
compensation;
benefits;
retirement;
COBRA;
expenses;
payroll records.
A PEO therefore can sit near the center of an organization’s workforce-data architecture.
Sensitive Information Can Extend Further
The same policy identifies categories including medical and health information, protected classifications, biometric information in applicable contexts, and geolocation information produced by certain timekeeping applications.
This is one reason a PEO security review should not be limited to the payroll database.
Data Moves to Other Service Providers
Trion’s policy describes potential disclosures to categories including:
- financial institutions;
- government agencies;
- benefits administrators;
- 401(k) administrators;
- workers’ compensation and unemployment administrators;
- insurance carriers and brokers;
- talent-management systems;
- payroll and timekeeping vendors;
- HRIS vendors;
- communications providers;
- the worksite employer;
- IT and cybersecurity vendors.
This is normal for a complex HR ecosystem.
It also means that vendor governance should consider subprocessors and integrations rather than only Trion itself.
PrismHR Is Named in the Privacy Policy
The policy specifically references securing the online portal PrismHR as part of Trion’s electronic-security measures.
That provides a clearer picture of one platform component behind the service infrastructure.
Employers should still confirm their own current environment because vendor stacks can change.
Trion States It Is SOC 2 Certified
Trion’s public About page states that the company is SOC 2 certified.
A vendor review can go beyond the logo by asking:
which SOC 2 report applies;
which period it covers;
which systems are in scope;
whether relevant subcontractors are included;
how exceptions are handled.
A certification statement is useful evidence, but scope matters.
Employers Should Minimize Their Own Copies
Outsourcing can paradoxically increase privacy exposure if the employer keeps unnecessary duplicates.
For example, sensitive records may exist in:
Trion’s system;
the employer HR drive;
a payroll spreadsheet;
email;
manager downloads.
Good governance asks whether every copy is actually required.
Access Review Matters
HR data should be accessible according to role.
Managers may need limited employee information.
Payroll staff need financial data.
Benefits teams may need dependent information.
IT administrators may need system access without needing payroll content.
The control objective is simple:
enough access to do the job, but not every record for every user.
Privacy Belongs in PEO Due Diligence
Before signing or renewing a PEO arrangement, review:
data categories;
hosting and systems;
security assurance;
access controls;
incident notification;
subprocessors;
retention;
termination/export procedures;
privacy obligations;
employee notices.
A PEO relationship is partly an HR service contract and partly a sensitive-data relationship.