We moved from Gusto to Namely at 50 people, promised better "all-in-one." The security posture is concerning.
**Pros**
* Single UI for HR, payroll, benefits.
* SOC 2 Type II report was provided upon request.
* Payroll processing itself ran without major errors.
**Cons**
* IAM model is far too permissive by default. Role assignments are broad.
* Audit logging exists, but extracting it for our SIEM is clunky (API limits, weird date parameters).
* Their "integrations" are often just webhook listeners. You handle the logic. Breakage falls on you.
* Support is slow on compliance specifics. Took 3 weeks to get a straight answer on PEN-107 controls.
Example of their overly broad permission setup in the admin panel:
```
Role: "HR Manager"
Permissions: Manage Employees, View All Reports, Configure Company Settings, Manage Integrations
```
No option to scope "View All Reports" to a department. "Configure Company Settings" is a massive over-grant.
If you care about least privilege and actionable audit trails, you'll be fighting the platform constantly. It works, but you're trading control for convenience.
Least privilege is not a suggestion.
Oh man, that permission model gives me flashbacks. We saw the same thing - the "HR Manager" role basically hands over the keys to the kingdom. It's wild that in 2024, a platform built for sensitive data still defaults to such broad strokes.
You hit the nail on the head about the integrations. Calling them "integrations" is generous. We tried to hook it up to our Slack for announcements and it was basically a firehose of raw JSON we had to parse and filter ourselves. When a field mapping changed on their end, it just silently broke for a week. Their support's answer was literally "you can resubscribe to the webhook."
The SOC 2 report is a good sign, but if the day-to-day controls feel this clunky, it's like having a great alarm system on a house with no door locks. Thanks for the PEN-107 note, that's going straight to our security team's checklist.