# Personio

> Personio keeps the personnel file, absences, time tracking, applications and either preparatory or full payroll in one data set that HR, managers and employees reach with different permissions.

- Vendor: Personio SE & Co. KG, Munich
- Canonical URL: https://www.convios.com/en/toolbox/personio
- Language version: https://www.convios.com/de/werkzeugkasten/personio
- Area: Operations & finance · Cluster: HR processes
- Role: Off-the-shelf product · Origin: Established, AI retrofitted
- As of: 2026-08-10 · Reviewed: 2026-08-10 · Author: Dr. Oliver Gausmann, Convios GmbH
- Toolbox: https://www.convios.com/en/toolbox — Markdown: https://www.convios.com/en/toolbox.md

## Verdict

Prevents falling behind: From around a hundred employees, the spreadsheet stops carrying the load. Working time has to be recorded, personnel data needs a permission model, and salary changes and absences need a traceable history. Solving that puts you level with the rest of your market and not one step ahead. 16,000 companies with 1.5 million employees between them work on the same foundation, according to the vendor on 22 April 2026, and a competitor can buy the same licence on the same day. That is why the verdict reads as preventing a backlog. The AI features change little about this for now. They sit on the same bought-in foundation, and the one place where they would be governed in binding form stays silent: across the general terms (AGB) and the data processing addendum, 87,362 characters together on 10 August 2026, the words KI, AI, training and model do not appear once.

## Suitability by company size

- Solo: not suitable — Personio names ten employees as its lower bound, and below that the arithmetic does not work. On top of the monthly per-head price comes a one-off setup fee whose size depends on company size, and the annual contract commits you for at least twelve months. For a handful of personnel files, the effort outweighs the time saved.
- Mid-market: suitable — This is what the product is built for. From fifty employees, the HR plans start at EUR 7.60 per month per head and payroll at EUR 5, both as of 10 August 2026. The entry plan, Core, covers the personnel file, absences, time tracking, approval routes and reporting. Anyone who needs position management, workforce planning or e-signatures beyond the cap at eight per cent of headcount ends up on Core Pro.
- Enterprise: suitable with caveats — The vendor names ten thousand employees as the upper bound, yet three points settle the question earlier. Okta and Microsoft Entra ID only arrive with Core Pro; the entry plan carries Google sign-in alone. The availability commitment sits at 99 per cent as an annual average, which works out at roughly three and a half days of downtime a year. And the audit log leaves Personio as a CSV file into your own Personio inbox; forwarding into security monitoring is not described in the public help as of 10 August 2026.

## Vendor staying power

Established: The origin has been in the commercial register (Handelsregister) since 26 July 2014, then as Bladebyte UG, from 3 March 2016 as Personio GmbH and since 13 January 2023 as Personio Group SE. Anyone reviewing the contract should still know two numbers: the contracting party is Personio SE & Co. KG under HRA 115934, entered in the register only on 18 March 2022 and spun out of Personio GmbH in June 2022. Personio Group SE is its general partner and sole shareholder.

- Register and origin: Personio SE & Co. KG, Munich local court (Amtsgericht München) HRA 115934, entered on 18 March 2022; general partner Personio Group SE, Amtsgericht München HRB 281581, whose predecessor Bladebyte UG has been registered since 26 July 2014 (source: https://www.northdata.de/Personio+Group+SE,+M%C3%BCnchen/HRB+281581, as of 2026-08-10)
- Funding: second closing of the Series E at USD 200 million led by Greenoaks, announced on 22 June 2022, taking the round together with the October 2021 financing to USD 470 million at a stated valuation of USD 8.5 billion (source: https://www.personio.com/about-personio/press/personio-raises-200m-second-series-e/, as of 2026-08-10)
- Earnings position: first profitable quarter, reached in the first quarter of 2026 according to the company itself and announced on 22 April 2026 together with the acquisition of the Munich recruiting-AI provider aurio; the same release puts payroll growth at 80 per cent a year across more than 1,500 customers (source: https://www.personio.de/ueber-uns/presse/personio-wird-profitabel-und-erwirbt-aurio/, as of 2026-08-10)
- Supervision and management: Hanno Renner as management board member (Vorstand) and Roman Schumacher as chair of the supervisory board (Aufsichtsrat) per the legal notice; the supervisory board was extended on 26 June 2026 by Judith Dada and Darragh Curran, and a supervisory board list was published on 11 July 2026 (source: https://www.personio.de/ueber-uns/presse/personio-holt-zwei-fuehrende-ki-koepfe-in-den-aufsichtsrat/, as of 2026-08-10)
- Financial reporting: consolidated annual accounts as at 31 December 2024 published on 26 February 2026 and those as at 31 December 2023 on 30 April 2025; the capital of Personio Group SE was last entered on 13 August 2025 at EUR 224,544 (source: https://www.northdata.de/Personio+Group+SE,+M%C3%BCnchen/HRB+281581, as of 2026-08-10)
- Reach: 16,000 companies with 1.5 million employees between them, according to the vendor on 22 April 2026; over the same period more than 300 new features and a doubling of support capacity, again on the vendor’s own account (source: https://www.personio.de/ueber-uns/presse/personio-wird-profitabel-und-erwirbt-aurio/, as of 2026-08-10)

## Cost of leaving

High: The master data comes out. Clause 10 of the addendum grants thirty days after the end of the contract in which the customer can demand release in machine-readable format or download the data themselves; after that Personio deletes it, and responsibility for exporting in time rests expressly with the customer. What the export does not survive is the machinery around it: working-time models, absence rules, approval routes, document templates, roles and permissions, and with payroll the running payroll history including year-to-date figures. The exit also starts earlier than the notice period suggests. An annual contract renews automatically unless terminated ninety days before the renewal date, and the agreed seat count can only be increased during the term.

## Regulation and data

| Point | Finding | Evidence | As of |
|---|---|---|---|
| Data processing agreement | a data processing addendum, publicly available in full text and, since 1 September 2024, part of the contract without any further condition — Clause 11.1 of the general terms sets the roles: Personio is the processor for the customer data held in the software and the customer is the controller. Anyone who concluded a separate processing agreement before 1 September 2024 keeps it; for everyone else the addendum on the website is incorporated automatically. In case of conflict it takes precedence over the general terms. Both texts sit on the same page without a sign-in, and that is the difference from many providers in this cluster. | evidenced | 2026-08-10 |
| Storage location | customer data stored in the European Union, with no tier requirement and no surcharge — The privacy notice carries the one sentence that speaks about customer content rather than about the website: all personal data recorded by customers in Personio is stored in the European Union. The addendum is broader at this point; clause 1.2.4 permits, alongside the EU and the EEA, countries covered by an adequacy decision under Article 45 GDPR. Both statements stand side by side, and the contractually binding one is the broader. | evidenced | 2026-08-10 |
| Subprocessors | a maintained list exists and is named in the contract, yet cannot be read without access to the product or the trust centre — Clause 7.1 of the addendum points to the software for the list, under Settings, Support, Subscription and Invoice, Data Protection Information. Clause 6.1 sends you the same way for the technical and organisational measures. In the trust centre the Subprocessors entry sits under Legal and opens a work-email prompt, checked on 10 August 2026. Anyone wanting to know before signing who else processes the data will not learn it publicly. For changes, clause 7.3 applies: notice by email, silence for fourteen days counts as consent, and if no agreement follows an objection, Personio may terminate with immediate effect. | partially evidenced | 2026-08-10 |
| Third-country transfer | processing limited to the EU, the EEA and countries with an adequacy decision, with the basis set out in the addendum — Clause 1.2.4 limits the contractually agreed processing to the EU, the EEA and countries with an adequacy decision, and clause 1.2.5 requires GDPR safeguards for any transfer beyond that. For the Assistant, Personio names the route more precisely than most: the language model runs on AWS Bedrock inside Personio’s own AWS environment, in the same region as the rest of the service, covered by the existing standard contractual clauses with AWS Sarl. Personio did not consider a separate notice under clause 7.3 necessary here, because AWS is already listed as a subprocessor. | evidenced | 2026-08-10 |
| Training on customer data | training on customer content is ruled out, though the commitment sits in a help-centre article rather than in the contract — The Assistant help article, dated 30 April 2026, is unambiguous: neither customer input nor customer output is used for training by Personio or any third party. Both are stored all the same, for quality assurance and service improvement, with an opt-out on request. None of this appears in the contract. Across the general terms and the addendum, 87,362 characters together on 10 August 2026, the words KI, AI, training and model do not appear once. What does appear is clause 6.3 of the general terms: Personio may anonymise the data held in the software, holds all rights to that anonymous data and may use it in any way for development, diagnostics, security and marketing. No objection right is provided for. | partially evidenced | 2026-08-10 |
| Retention and deletion | thirty days of retention after the end of the contract, deletion thereafter, and release in machine-readable format on request — Clause 10 of the addendum puts a number on the period, which is the exception in this cluster. Personio retains the personal data supplied for thirty days after the end of the contract. Within that window the controller can demand release in machine-readable format or deletion, or pull the data straight from the software; if they demand nothing, Personio deletes once the window closes. Earlier deletion on instruction is possible, save for data subject to a statutory retention duty. Under clause 10.2, exporting in time is the customer’s responsibility alone. | evidenced | 2026-08-10 |
| Certifications | ISO/IEC 27001:2022 and ISO/IEC 27017:2015 listed in the trust centre, with the certificates and the audit report behind a sign-in — The trust centre runs on SafeBase and lists, under Compliance, the GDPR, ISO/IEC 27001:2022, the matching statement of applicability and ISO/IEC 27017:2015. The German page adds an annual review by an independent external audit firm. That does not yet make the evidence readable: the certificate, the statement of applicability, the penetration test report and the technical and organisational measures all sit behind Get access and ask for a work email address, checked on 10 August 2026. No SOC 2 report is listed in the portal. For vulnerability reports Personio runs a programme on Intigriti. | partially evidenced | 2026-08-10 |
| EU AI Act, Article 50 | a self-assessment of the Assistant as a limited-risk system, with no public classification for the recruiting AI — In its help article Personio classifies the Assistant as a Limited Risk AI System, denies high-risk status and names the transparency obligations as what has to be met; the language model comes from a third party and is merely fine-tuned by Personio. The classification is a self-assessment without evidence, and it covers exactly one feature. For the recruiting AI, which since the aurio acquisition on 22 April 2026 searches for profiles and automatically scores and prioritises incoming applications, a comparable classification is missing. Annex III of Regulation (EU) 2024/1689 describes precisely this function for the employment field; on the current state of the deadlines it applies from 2 December 2027. The help article passes the deployer duties expressly to the customer: their own usage policies, transparency and explainability notices, any consents required and sufficient human oversight. | partially evidenced | 2026-08-10 |
| Audit logging | an audit log covering changes and read access, export only as CSV, and a display defect affecting the acting person that the vendor documents itself — The audit log covers changes and read access and names the acting person, the affected person, the action type and the timestamp; entries cannot be altered, and the help lists the scope in detail, from salary and compensation changes through documents and retention rules to sign-ins and sign-outs, expressly including those of Personio support staff. Three limits sit alongside. The log holds no IP addresses. From recruiting, only the deletion of an application is captured. And Personio itself records a defect that leaves a small share of entries permanently without the acting person. The export arrives as a CSV file in the Personio inbox; forwarding into your own security monitoring is not described in the public help as of 10 August 2026. | partially evidenced | 2026-08-10 |

## Cost

- Entry: From fifty employees, the HR plans start at EUR 7.60 per month per head and payroll at EUR 5. Up to forty-nine employees, Personio quotes EUR 14 per month per head for HR and payroll together. On top comes a one-off initial setup fee whose size depends on company size. The trial runs fourteen days, after which the account is locked. All figures as of 10 August 2026. (as of 2026-08-10)
- Where it gets expensive: The price hangs on headcount, and the agreed seat count can only be raised during the term. Sign in January for four hundred heads and stand at three hundred and fifty in June, and you keep paying for four hundred; clause 8.2 of the general terms allows only the upward move, notice periods apply to downgrades and cancelled apps, and clause 3.4 gives no claim to a pro-rata refund. The second driver is the step from Core to Core Pro, rarely taken for a single feature: Okta and Microsoft Entra ID, custom integrations, position management, workforce planning, unlimited legal entities and uncapped e-signature all live there. Paid job-board postings run through the software on top.

## Three routes compared

### Take the enterprise suite that runs HR off the core

SAP SuccessFactors and Workday are the names that come up first from a few thousand employees, and in the German Mittelstand the payroll suite from DATEV alongside them, because payroll already sits there. Large groups stay with these for three reasons. The permission and role model reaches deeper, separation across country entities and collective agreements is built in, and the evidence a group audit wants to see exists as a document rather than behind a work-email prompt. The price is implementation projects measured in person-years, and a configuration that will not be maintained without in-house specialists.

### Assemble the HR record from specialist providers

Deel and Remote cover cross-border employment including payroll and have built the personnel record around it. It rarely turns out cheaper. On 10 August 2026 Deel lists its Equip recruiting module at USD 14 per person per month, which for the applicant track alone is roughly double what Personio charges for the HR foundation. The real price lies elsewhere: once master data, absences and payroll sit in three contracts, there is no longer a place where headcount reconciles by itself, and the reconciliation moves back into a spreadsheet. The applicant track is where the calculation is most open, and Personio answered it for itself by acquiring aurio.

### Build the layer around the personnel record yourself

Building the personnel record itself does not pay. What can be built is the layer around it. n8n chains joining, accounts, hardware and leaving through Personio’s public API, which also carries webhooks for the Person entity. Sanity holds templates and policies, Ory provides sign-in and roles where your own applications need the same permissions, and Infisical keeps the credentials of the chain. Building stops at payroll, because the filing routes to social insurance and the tax office require certification. Failure rarely comes at the first build. It comes in operation: whoever built the chain eventually leaves, and then a system with no on-call and no maintenance stands between joining and the salary run. Add the evidence duties that no self-build ships with, from the permission model through the log of read access to salary data to the deletion concept. As an assumption for the calculation: fifteen to twenty-five person-days for a dependable joiner and leaver chain, then one to two days a month for upkeep (estimate).

Recommendation by size:

- Solo: Only worth it from around ten employees. Below that, keep absences and time tracking in the tool you already run.
- Mid-market: Buy it, and set two numbers deliberately before signing: the seat count, because it only moves upward during the term, and the termination date, because ninety days before renewal is easily missed.
- Enterprise: Request the subprocessor list and the technical and organisational measures in writing before selecting, since both live inside the product alone. Then check sign-in and log forwarding against Core Pro before negotiating the per-head price.

## Context

- Implements method: [Value Metric Pricing](https://www.convios.com/en/methods/value-metric-pricing) — The pricing unit is the head, and it ratchets one way: clause 8.2 of the general terms lets the agreed seat count only rise during the term, showing how a value metric turns into a ratchet.
- Implements method: [Regulatory Density Test](https://www.convios.com/en/methods/regulatory-density-test) — Personnel data is the most densely regulated record a company holds, and from 2 December 2027 the recruiting AI meets Annex III of the AI Regulation, which makes the test playable on a concrete case.
- Implements method: [Data Monetization: Improve, Wrap, Sell](https://www.convios.com/en/methods/data-monetization-improve-wrap-sell) — Clause 6.3 of the general terms is a textbook case of the improve tier: the vendor anonymises customer data, holds all rights to it and may use it for product development, with no objection right provided for.
- Implements method: [RPV Organizational Fit Test (Resources, Processes, Values)](https://www.convios.com/en/methods/rpv-organisationsfit) — Resources, processes and values explain why a product built for ten to ten thousand employees runs into sign-in, log forwarding and evidence in a large group rather than into the feature list.
- Alternative: [DATEV](https://www.convios.com/en/toolbox/datev)
- Displaces: Paper personnel files and folders on a network drive, Holiday and absence requests by email and form, Time tracking in spreadsheets and on timesheets, Applicant lists kept beside the HR mailbox, Monthly handover lists to payroll

## Evidence

- Legal form, address, VAT identification number, register court and register number, general partner, management board member and chair of the supervisory board — https://www.personio.de/impressum/ (as of 2026-08-10)
- Register history of both entities: Personio SE & Co. KG entered on 18 March 2022, spun out of Personio GmbH in June 2022, origin Bladebyte UG since 26 July 2014, conversion into Personio Group SE on 13 January 2023, consolidated annual accounts as at 31 December 2023 and 31 December 2024 — https://www.northdata.de/Personio+Group+SE,+M%C3%BCnchen/HRB+281581 (as of 2026-08-10)
- General terms and data processing addendum in full text: 99 per cent availability as an annual average (4.1), rights to anonymised data (6.3), notice periods of 15 and 90 days (7.2 and 7.3), seat count increases only (8.2), roles and incorporation of the addendum since 1 September 2024 (11.1), processing in the EU, the EEA and adequacy countries (1.2.4), audit rights (5.2), subprocessors and the 14-day window (7.1 to 7.3), retention of 30 days after the contract ends (10.2 to 10.4) — https://www.personio.de/agb/ (as of 2026-08-10)
- Privacy notice: applies to the website and expressly not to processing inside the software, plus the sentence on storing all personal data recorded by customers in Personio within the European Union — https://www.personio.de/datenschutzerklaerung/ (as of 2026-08-10)
- Prices per month and head: from 50 employees HR from EUR 7.60 and payroll from EUR 5, up to 49 employees HR and payroll from EUR 14, a one-off setup fee by company size, suitability for 10 to 10,000 employees, more than 200 integrations, the scope of Core and Core Pro including Okta and Microsoft Entra ID and the e-signature cap at 8 per cent of headcount — https://www.personio.de/preise/ (as of 2026-08-10)
- Personio Assistant help article, dated 30 April 2026: classification as a Limited Risk AI System, exclusion of training use for input and output, storage for quality assurance with an opt-out on request, hosting of the language model on AWS Bedrock inside its own AWS environment, standard contractual clauses with AWS Sarl, and deployer duties passed to the customer — https://support.personio.de/hc/en-us/articles/32032660454813-Frequently-asked-questions-about-Personio-Assistant (as of 2026-08-10)
- Audit log help article, dated 29 July 2026: access for administrators only, changes and read access, immutable entries, CSV export into the Personio inbox, no IP addresses, capture of support staff sign-ins and sign-outs, only application deletion from recruiting, and a documented defect in the acting-person column — https://support.personio.de/hc/en-us/articles/18906413010589-Use-the-Personio-Audit-Log (as of 2026-08-10)
- Trust centre on SafeBase: GDPR, ISO/IEC 27001:2022, the statement of applicability and ISO/IEC 27017:2015 as compliance entries, penetration test report and technical and organisational measures behind a work-email prompt, and no SOC 2 report listed — https://trust.personio.com/ (as of 2026-08-10)
- German security page: reference to the trust centre, ISO 27001 certification with an annual review by an independent external audit firm, the processor list inside the customer account, and principles for responsible AI — https://www.personio.de/datenschutz/ (as of 2026-08-10)
- Press release of 22 April 2026: first profitable quarter, acquisition of the Munich recruiting-AI provider aurio with automated candidate search and the scoring and prioritisation of incoming applications, 16,000 customers with 1.5 million employees, payroll growing 80 per cent a year across more than 1,500 customers, and over 300 new features in the prior year — https://www.personio.de/ueber-uns/presse/personio-wird-profitabel-und-erwirbt-aurio/ (as of 2026-08-10)
- Press release of 26 June 2026: Judith Dada and Darragh Curran join the supervisory board, confirming the profitability reached in the first quarter of 2026 — https://www.personio.de/ueber-uns/presse/personio-holt-zwei-fuehrende-ki-koepfe-in-den-aufsichtsrat/ (as of 2026-08-10)
- Press release of 22 June 2022: second closing of the Series E at USD 200 million led by Greenoaks, USD 470 million in total, a stated valuation of USD 8.5 billion, and the prior acquisition of Back — https://www.personio.com/about-personio/press/personio-raises-200m-second-series-e/ (as of 2026-08-10)
- Developer portal: a public API with its own documentation and webhooks for the Person entity for all customers with access to the Public API — https://developer.personio.de/ (as of 2026-08-10)
- Regulation (EU) 2024/1689 on artificial intelligence, Annex III on employment and worker management as the basis for classifying selection and scoring systems in recruiting as high risk — https://eur-lex.europa.eu/eli/reg/2024/1689/oj (as of 2026-08-10)
- Deel pricing page, as of 10 August 2026: Equip at USD 14 per person per month, contractor at USD 49, and employer of record at USD 599 per employee per month — https://www.deel.com/pricing/ (as of 2026-08-10)