Personio

Personio is headquartered in Munich, Germany. The contracting entity is Personio SE & Co. KG (Amtsgericht München HRA 115934, Seidlstr. 3, 80335 München, VAT DE351718597, LEI 8945001OIB4XWY7NNA54), spun off from the original Personio GmbH on 1 July 2022. The general partner of the KG is Personio Group SE (Amtsgericht München HRB 281581) -- a Societas Europaea since 13 January 2023; the holding has been renamed multiple times since 2014 (Bladebyte UG -> Bladebyte GmbH -> Personio GmbH -> Personio Group GmbH -> Personio Group AG -> Personio Group SE). Vorstand is Hanno F. Renner (CEO and co-founder); chair of the Supervisory Board is co-founder Roman Schumacher. The Dutch entry at Van Diemenstraat 298, Amsterdam (KvK 87101416) is a secondary establishment of the SE & Co. KG, not a separate Dutch BV.

Exposure is classified as "partial-via-subprocessors". The contracting entity Personio SE & Co. KG is a German SE & Co. KG with no US parent, and customer HR data is physically stored on AWS Frankfurt (eu-central-1) under a contract with AWS EMEA SARL in Luxembourg. The US sales subsidiary Personio Inc. is being wound down following the announced full US-market exit in October-November 2025 (165 layoffs including 47 in New York). However, the upstream parent of the EU-AWS contracting entity (Amazon.com, Inc.) is US-headquartered, so CLOUD Act compulsion theoretically reaches AWS-held customer data even when contracted via Luxembourg. AWS Bedrock (the LLM service powering AI Assistant and Conversations Answers), Google Workspace (corporate email), Vercel (marketing site) and other US-controlled subprocessors (Atlassian is Australia-headquartered but its Jira/Confluence Cloud regions remain US-based for most tenants) are part of the operational stack. There is no US CLOUD-Act-free sovereign posture available.

Personio does not publish a fully public, exhaustive subprocessor list. The authoritative list is delivered inside the customer tenant at Settings -> Account -> Subscription & billing -> Data protection information tab. The DPA is downloadable through the customer's Trust Center session at https://trust.personio.com/ -- the public Trust Center index surfaces the asset names (DPA, AWS Infrastructure Details, ISO/IEC 27001:2022 certificate, Statement of Applicability, ISO/IEC 27017:2015 certificate, pen-test report, BC/DR documentation, GDPR TOMs, security-training overview) but requires a SafeBase access flow to download specific PDFs. A third-party mirror exists via Openli (https://explore.openli.com/privacy/personio/subprocessors). Indirectly confirmed subprocessors include AWS EMEA SARL (Luxembourg) + upstream AWS Inc. (US) + AWS Bedrock for LLM hosting, Google LLC for corporate email, Atlassian, Vercel, Contentful and SafeBase itself.

The public Trust Center at trust.personio.com lists ISO/IEC 27001:2022 + the corresponding Statement of Applicability, ISO/IEC 27017:2015 (cloud-security extension), GDPR Technical and Organisational Measures (TOMs), an external penetration-test report (Cobalt or equivalent third-party tester), Business Continuity / Disaster Recovery documentation, and an employee-security-training overview. SOC 2 Type II, BSI C5 and TISAX are NOT visible on the public Trust Center index and are flagged UNCONFIRMED for this preview profile -- a Personio sales contact can confirm any non-listed attestation if material to the deal. The ISO/IEC 27001 audit cadence is annual third-party (standard for ISO scheme); penetration testing is also annual.

Yes. Three significant layoff rounds happened in 2024-2025 (January 2024: about 100 product/engineering roles or ~5%; November 2024: about 115 employees; October-November 2025: 165 jobs including 47 in New York coinciding with full US-market exit). Headcount fell from a 2024 peak of about 2,000-2,300 to about 1,200-1,500 by July 2025. Customer growth continued in parallel: about 3,000 customers in 2021, 12,000+ in 2024 and roughly 15,000 across 80+ countries by 2026. Personio remained profitable in Germany per third-party reporting from Contrary. The US-market exit means new customer acquisition is now restricted to European markets; existing US customers were migrated or off-boarded as part of the 2025 wind-down.