Deel Vendor Risk Assessment — Full Report

Recommended Actions

Steps to address findings for Deel

1. 1

   Request Deel's SOC 2 Type II audit report (dated within the last 12 months) and a bridge letter if needed — contact Deel's security team directly or check https://trust.deel.com. This is the single most important step for SOC 2 CC9.2 compliance documentation.

   SOC 2 Overview (AICPA)
2. 2

   Manually review https://trust.deel.com/subprocessors and document all named subprocessors, their jurisdictions, and data roles. If the page is incomplete, request the full subprocessor list in writing from Deel's DPO or legal team, referencing GDPR Article 28.

   GDPR Full TextGDPR Subprocessor Rules
3. 3

   Request Deel's current ISO 27001 certificate (including issuing certification body, certificate number, and expiry date) to verify the vendor-attested claim on their security page. Cross-reference the certificate number at https://www.iafcertsearch.org.

   ISO 27001 Standard
4. 4

   Before enabling Deel's Copilot or AI Assistant features, obtain a written statement from Deel clarifying whether HR/payroll data inputs are used to train AI models, data retention periods, and available opt-out mechanisms. Review the DPA for AI-specific clauses.

   DPA Template (GDPR Art. 28)
5. 5

   Run an independent HTTP Observatory scan against app.deel.com (https://observatory.mozilla.org) to assess security header posture on the authenticated application domain. Document the result alongside this report in your vendor risk register.

   NIST Supply Chain Risk (SP 800-161)
6. 6

   Engage your legal team to assess the ongoing Rippling v. Deel litigation and its potential implications for business continuity, executive availability, and reputational risk relevant to your organization's use of Deel.

   ISO 22301 (BCM)
7. 7

   Retain this ThirdProof investigation report with a reviewer signature and date to satisfy SOC 2 Trust Services Criterion CC9.2 third-party risk assessment evidence requirements.

   SOC 2 Overview (AICPA)NIST Risk Assessment (SP 800-30)NIST Supply Chain Risk (SP 800-161)

• Certificate Transparency log data (Certificate Transparency service) was unavailable during this investigation; subdomain enumeration was limited to data extracted from the direct TLS connection. The application subdomain (app.deel.com) was not independently scanned for security headers or SSL configuration.
• External cyber risk scoring was not available for deel.com during this investigation; no numeric cyber score could be benchmarked against the SaaS industry average.
• Subprocessor data could not be extracted from trust.deel.com via automated parsing. The page may require JavaScript rendering or manual review.
• The HITRUST certified entity directory could not be reached during this investigation; HITRUST certification status could not be confirmed or excluded.
• The AI data usage policy evidence was sourced from a blog post (deel.com) rather than a dedicated, versioned AI data processing policy page. This may not represent Deel's complete or current AI data governance commitments.
• URLhaus domain reputation data was not available during this investigation; domain blacklist status could not be fully verified through that channel, though Malware detection service and IP reputation checks returned clean results.