For IT, HR, privacy and procurement
Implementation, architecture and compliance
We work with your existing systems, security requirements and implementation schedule. From initial data loads and testing to go-live and support, we agree how the HR integration fits your IT landscape.
During an HRIS or payroll implementation
The integration is one track in the implementation plan. We follow the implementation schedule, not the other way round.
“When I first saw the project plan, I was hesitant whether it would be feasible to develop the integration in such a short time. But thanks to a joint effort, the go-live of 1 January was met.”
- Together with the implementation partner
- We agree up front who does which part and who your point of contact is. We also work as a subcontractor of an implementation partner or payroll provider. The design is complete once the setup of the new system is fixed, such as departments, jobs and pay components; that dependency is in the plan.
- Access in time
- The biggest delay is usually waiting for access or for an API module from the vendor. We tell you exactly what to request, so you can arrange it alongside the implementation.
- Initial load and changes
- At the start the integration fetches all employees and puts them in the target system, or compares them with what is already there. After that only changes are transferred. For IAM, the comparison between HR and the directory shows the differences per employee before go-live. We do not do one-off data migrations.
- Test and acceptance
- If a system has a test or acceptance environment, we build and test there first, with the test scenarios from the design. If it does not, we agree how to test safely in production, for example with a small group of test employees. On our side every change runs on a separate test environment of the platform first.
- Parallel run and cut-over
- For payroll, a pay run can run in parallel to compare the results. Testing with real data is agreed in advance and recorded in the data processing agreement, with deletion afterwards. Until the agreed moment, the old process stays leading.
- Go-live
- You choose the moment. For payroll we plan it around the pay run, not just before the period closes. We watch the first runs extra closely. At Waterschap Drents Overijsselse Delta and Waterschap Vechtstromen the integration went live on the same day as YouForce: 1 January 2024.
Place in your architecture
- Managed integration layer
- Each integration connects two systems in a fixed direction. They all run on the KoppelHet platform, with the same logging, monitoring and support. No loose scripts per system, and for each integration a design that describes field by field what happens.
- Next to an ESB or iPaaS
- KoppelHet is not an ESB or iPaaS and focuses on the flows around HR. The integration talks to the APIs of the systems themselves. If you already have an integration layer, KoppelHet runs next to it for HR; which flow goes through which layer is recorded in the design.
- Source of truth
- Each data item has one source. Usually that is the HR system for person, employment and organisation. Sometimes another system is the source for a field, such as the ERP for cost centres. That choice is recorded per field in the design.
- Identity and access
- KoppelHet sets up accounts, attributes, groups and licences from HR in Entra ID, Active Directory and other directories, following the rules in the design. If you want an IAM product rather than a custom integration, Joinly from the same makers is built for that.
- No data store of its own
- The platform keeps no register of its own. It fetches data, transforms it and passes it on. Only the fields in the design are transferred. What it holds temporarily disappears with the log retention period.
- Network
- No VPN or network link into your internal network. For systems in your own network, such as Active Directory, an agent runs that only makes outbound connections.
- Logging and monitoring
- Every run, and per employee every field change with the value before and after. On an error your administrator gets a notification with the reason. We monitor the platform 24/7. Security and audit logs can go to your SIEM as JSON, as a separate change.
- Ownership and exit
- The design with all mappings is your document. When the contract ends you receive the configuration in a readable format and the audit logs as JSON, so another party can rebuild the integration. After that we delete your data, with a written statement.
Compliance and governance
In short. The full answers are in the Trust Center.
- GDPR
- You are the controller, KoppelHet is the processor. Standard data processing agreement with a register of sub-processors. Data protection officer in place.
- Data minimisation
- Only the fields the target system needs, listed field by field in the design you approve in advance. Logs are kept for one to twelve months, set per integration.
- Hosting and certification
- Data centre in Amsterdam, inside the EU. ISO 27001, audited externally every year by DigiTrust. Yearly external pentest.
- Access management
- Per system a dedicated system account or API key with only the rights needed, which you issue and revoke. Your users sign in to the platform through Entra ID, or with a password, with mandatory two-factor authentication for administrators. Our staff use personal accounts with MFA.
- Audit trail and change management
- Sign-ins, admin actions and changes to settings and mappings are logged with timestamp, actor and outcome. A new field or different rule is a change: estimated up front, design updated and tested before it goes live. More rights only after your approval.
- DPIA
- The DPIA is yours as controller. We provide what you need for it: which fields, for what purpose, where they are stored, for how long and who can access them. That is in the design and the data processing agreement.
- Availability and continuity
- Average uptime 99.9 percent, minimum 99.7 percent. Response times and recovery time per integration are set in the agreement. Business continuity plan and yearly restore test. If the platform goes down, your data stays in your own systems.
Supplier selection: who wants to know what
In an organisation this size, one person rarely decides alone. This is what those involved usually ask, and what they get from us.
| Who | Usually asks | Gets from us |
|---|---|---|
| IT manager or architect | Does it fit our landscape, how is it secured, who runs it? | The field-by-field design with the technical arrangements on connections, authentication and access. |
| HR manager or HR project lead | Is the process right, what do we need to do, when does it go live? | The design with changes, exceptions and test scenarios, and an overview of who does what. |
| Privacy officer or DPO | Which data, for what, where and for how long? | The data processing agreement with the register of sub-processors, and the fields per integration from the design. |
| Security officer | Certification, pentest, incidents, continuity? | ISO 27001 certificate, Statement of Applicability, summaries of the pentest and continuity plan, and your completed questionnaire or security annex. |
| Procurement | Price, terms, notice and handover? | A quote with a one-off amount and a monthly fee, valid for 30 days, the terms and conditions, and the arrangements for notice and handover. |
Questions
Can you connect to our ESB or iPaaS?
KoppelHet does not provide an ESB or iPaaS. Usually the integration talks directly to the APIs of the HR system and the target systems and runs next to your existing integration layer. If a flow has to go through your own layer, we discuss in the intake whether that fits.
Do you also migrate data into our new HR system?
No. We do not do one-off data migrations; that usually sits with the implementation partner. The initial load of the target system through the integration is part of our work.
When should we involve KoppelHet in an implementation?
As soon as it is clear which systems will be connected. You can then arrange access and any API modules in time, and the integration moves along with the implementation plan.