The security review, answered in advance
Gifted connects to the system holding your people data, so the questions arrive before the pilot does. Here are the certifications, the exact fields a sync reads, and the documents your legal team will ask for.
The international standard for running an information security management system. Audited by a third party, not self-declared.
Your employees keep their rights over their own data, and a data processing agreement is available for your file.
The DPA →California residents on your team keep their rights of access and deletion, set out in their own notice.
The CCPA notice →A sync reads four fields and writes nothing
Connecting your HR system is the part a security review cares about most, so it is worth being exact. Gifted reads; your HR system stays the record of truth.
What it reads
- Start datesSo a work anniversary sends on the day.
- BirthdaysSo a birthday does too.
- DepartmentsSo a campaign can be scoped to a team.
- New hiresSo a welcome kit goes out without anyone filing a ticket.
What it never does
- It never writes backYour HR system stays the record of truth. The connection is read-only.
- Nothing outside those fieldsOnly the fields that drive a gift are read.
- Nobody outside your scopeOnly the people you put in scope, not the whole directory.
- Nobody who has leftEmployment status is read, so scheduled gifts stop when someone does.
Money that never became a gift comes back
The other question finance asks: what happens to what we loaded and did not send.
Cancel an unclaimed gift within 72 hours and the full amount returns to your account. After that it is 75% for up to two years. A gift nobody opened is not a cost you absorb, and there is no platform fee sitting underneath it either, because there is no platform fee at all.
Everything your legal team will ask for
All of it public, none of it behind a sales call.
Frequently asked
Is Gifted ISO 27001 certified?
Yes, and it is a third-party audit rather than a self-assessment. Gifted is also GDPR and CCPA compliant, with a data processing agreement and a CCPA notice published rather than supplied on request.
What does Gifted read from our HR system?
Start dates, birthdays, departments and new hires, and only for the people you put in scope. Those are the fields that drive a gift; nothing outside them is read.
Can Gifted change anything in our HRIS?
No. The connection is read-only and Gifted never writes back. Your HR system stays the record of truth.
What happens when someone leaves?
Their scheduled gifts stop. Employment status is one of the things the sync reads, so nothing is sent to a person who is no longer there.
Do we have to connect an HR system at all?
No. You can upload a spreadsheet or add people manually, and connect a system later or never. The integration saves maintenance; it is not a requirement.
Is there a data processing agreement we can put on file?
Yes, published at gifted.co/data-protection-agreement. It does not require a signature request or a sales conversation to read.
Who do we contact with a security question?
Book time with the team through the link on this page and ask for security. If your review needs a questionnaire completed, say so when you book and it will be handled directly.
Still reviewing?
Send us the questionnaire
If your security review has a form, we will fill it in. Twenty minutes with the team gets most of it answered live.
Free forever. No card, no contracts, no minimums.