An integration moves data. The data is people.
A Workday integration that touches global worker records is, by definition, a privacy-grade system. Mercans architects the platform behind it, and the operations around it, to a compliance posture that holds up in front of a CISO, a DPO, and a regulator simultaneously - and we publish the audits that prove it.
Independently audited. Currently in force.
The Mercans information-security and privacy programme is audited annually by independent third parties. The certifications below are not paper exercises - they are the controls under which the Workday GPC integration runs in production today.
ISO 27001:2022
Information security management system. The foundational control framework for the entire HRBlizz platform.
Audited · In force
ISO 27017
Cloud-specific security controls - directly applicable to the SaaS perimeter the integration runs in.
Audited · In force
ISO 27018
Personally identifiable information protection in public clouds - for the worker data the integration carries.
Audited · In force
ISO 27701:2019
Privacy Information Management System (PIMS). Mercans is among the small group of payroll providers holding this certification.
Audited · Differentiator
ISO 9001:2015
Quality management system - formalised process discipline across delivery, change, and incident response.
Audited · In force
SOC 1 Type II
Internal controls over financial reporting. The control set finance teams require for SOX-relevant payroll.
Audited · KPMG
SOC 2 Type II
Security, availability, confidentiality, processing integrity. The annual audit operating-effectiveness CISOs ask for.
Audited · KPMG
Binding Corporate
Rules -EU
Approved framework for legitimate intra-group transfers of personal data outside the EEA - a regulator-approved data-protection programme.
Audited · Differentiator
You choose where the data lives. We prove it stays there.
Workday integration data is processed in customer-elected regions and persisted in Mercans' own Tier IV data-centre footprint, with disaster recovery mirroring across geographies.
Uptime SLA
99.99%
Recovery Time (RTO)
≤ 4 hours
Recovery Point (RPO)
≤ 15 min
DR Drill Schedule
Quarterly
🇪🇪 Tallinn · Estonia
EU Primary · Tier IV
EU/EEA workloads · GDPR-native residency
🇦🇪 Dubai · UAE
META Primary · Tier IV
META workloads · Sovereign residency
GDPR-native by location
EU/EEA worker data is processed and stored in Tallinn. Cross-border transfer is governed by Mercans' approved EU Binding Corporate Rules - not standard contractual clauses retro-fitted to fix a transfer chain.
Sovereign region for META
Middle East, Turkey, and Africa workloads are served from the Dubai Tier IV facility. Customer-defined residency policies are enforced at the platform layer, not negotiated per cycle.
Region pinning, on request
Customers with regulator-imposed residency requirements can pin specific country workloads to specific data centres. The pinning is enforced by routing rules, audited monthly, and surfaced in the trust dashboard.
Industry-standard ciphers, no exceptions.
The cryptographic posture across the integration channel and HRBlizz platform is uniform - no legacy fall-back, no custom protocols, no exceptions for development environments.
Every byte that crosses the wire.
Every byte that lands on disk.
OAuth 2.0
Scoped tokens, short-lived, automatically rotated. No long-lived bearer credentials in the integration path.
SAML 2.0 · OIDC
Customer's identity provider is the source of truth. No separate Mercans password for any user with access.
Role-based access
Granular roles map to the customer's HR organisation. Country-scoped access enforced at the platform layer.
Immutable logs
Every read, write, and admin action is logged with user, timestamp, and payload hash. Logs are append-only and exportable.
Ready for a technical walkthrough with our Workday integration architects?
Bring your Workday tenant configuration, country footprint, and a list of pain points - we'll bring the architecture diagram, the certification evidence, and a deployment timeline.
