Payroll knows everything about your people. So who runs it?

Salaries, bank accounts, National Insurance numbers, pension pots, sick records — payroll and HR software holds the most sensitive personal data a business possesses, and files it to HMRC every payday. We widened our first look from nineteen products to the full audited field: fifty-seven vendors covering payroll, HR and workforce systems sold to UK businesses, traced to ask where all of that actually sits. For once, Britain has real choices — but the fashionable newcomers are quietly moving the payslips abroad.

Payroll is the software category where the stakes are least abstract. A customer-records leak embarrasses you; a payroll leak exposes every employee’s salary, home address and bank account. It is also, like accounting, software the state is wired into: Real Time Information means your payroll system reports to His Majesty’s Revenue and Customs (HMRC) every time you pay anyone.

So, same method as the rest of this series, now run across the full audited cohort: fifty-seven vendors and sixty-nine products traced through their own published documents — who owns the vendor, where a UK employee’s data lives, what it runs on, and which artificial-intelligence (AI) suppliers, if any, the vendor names. Ownership is taken from company registries read directly this session — Companies House records of persons with significant control (PSC), United States Securities and Exchange Commission (SEC) filings, and corporate registers. One primary source is cited per vendor. Where a vendor does not publish a fact, we record it as “not disclosed” rather than guess.

The good news first — and it’s genuinely good

This is the one category where British buyers have strength in depth, at every layer: a UK owner, UK-held data and British computers are all reachable.

Zellis — “the UK and Ireland’s largest payroll provider” — is UK-run and serves the enterprise end that British vendors usually abandon. Its Companies House record now shows a 2024 restructure: an acquisition vehicle, Zorro Bidco Limited, sits above Zellis Topco as the registered controller from August 2024, with the group still ultimately held by funds advised by the London private-equity house Apax Partners. Its small-business arm Moorepay states its hosting plainly: a UK-based data centre operated by IBM, on Microsoft Azure. Two further UK firms now sit inside that same Apax-owned group — elementsuite, acquired in February 2025, and Natural HR, brought in via Moorepay.

MHR International, family-owned in Nottingham — its Companies House record names John Mills and the family holding company as the controllers — runs iTrent and People First on UK-held data. Cintra (Newcastle, owned by the UK private-equity firm Tenzing) states UK hosting first-party. Cezanne HR (UK, owned by the UK firm NorthEdge Capital) hosts exclusively in Amazon Web Services (AWS) European data centres, with a contractual no-move clause. IRIS’s Staffology, Sage Payroll, BrightHR and the BrightPay range cover the small end — BrightHR confirms in writing that UK subscribers’ data is stored in the UK, on Microsoft Azure.

And the quiet outlier is Moneysoft’s Payroll Manager — desktop software, founder-owned (George McHamish holds the controlling stake at Companies House), where the vendor holds no payroll data at all because it never leaves your machine. It is this category’s old-fashioned answer: the desktop way turns out to be the sovereign way.

The newcomers move the payslips abroad

The pattern reverses the moment you look at the products with the best marketing. Rippling — the fast-growing American platform — is controlled from the United States: its UK entity’s only person with significant control is founder Parker Conrad. Employment Hero, the Australian challenger controlled by founder Ben Thompson, states in its own privacy policy that data sits in Australia, Ireland and Canada — not the UK. Deel, also American, hosts on AWS with primary data in Ireland. ADP and Workday, the American giants that pay much of corporate Britain, don’t say on a readable public page where UK payroll data sits — we recorded both as not disclosed.

A specific correction to our first edition: HiBob. We previously framed it by where its data sits (Ireland and Germany). The audited record makes the more important point — HiBob’s ultimate control is Israeli. The group parent is Hi Bob Limited of Tel Aviv; the UK operating company (Hi Bob Limited, company number 09787994) files a “no registrable person” statement at Companies House, the pattern you see when control sits up a foreign chain, and its former controlling person, co-founder Ronni Zehavi, is recorded as Israeli and resident in Israel. So control is Israel; data location is a separate question — HiBob’s own sub-processor page names AWS in the European Union. Both facts matter, and they are not the same fact.

There’s also an ownership model here worth noticing. SD Worx, one of Europe’s biggest payroll providers, is Belgian: its UK entity’s controller at Companies House is SD Worx People Solutions of Antwerp, and the group is majority-owned by a Belgian foundation, WorxInvest — the same investor-proof structure as Germany’s DATEV in accounting. It does not disclose whose computers it runs on. Germany’s Personio doesn’t run UK payroll natively at all — it hands off to integrations — and France’s PayFit hosts on AWS in the EU.

Two quieter notes from the wider HR field. A US-owned vendor does not automatically mean US-held data: SmartRecruiters defaults its hosting to Frankfurt, and Lever can be configured to an EU region — residency is a setting, not a flag. And two vendors stand out for telling you which AI they use: Culture Amp names Anthropic’s Claude and Google’s Gemini (run through AWS Bedrock and Google Cloud), and Factorial names Microsoft Azure OpenAI and Google Gemini. Most of the field names no AI supplier at all.

The cohort, at a glance

The full audited field is fifty-seven vendors. The table below shows the payroll core plus the HR and workforce platforms that hold pay-grade personal data; the remaining recruitment and workforce tools are summarised beneath it.

Product	Owned from	UK data	Runs on	AI inside
Zellis HCM Cloud [1]	UK (private equity, Apax)	UK	Microsoft Azure	Not disclosed
Moorepay [2]	UK (private equity, Apax)	UK	Azure + UK IBM data centre	Not disclosed
iTrent / People First (MHR) [3]	UK (family-owned)	UK	Not disclosed	Not disclosed
Natural HR / elementsuite (Zellis) [4]	UK (private equity, Apax)	UK	Not disclosed	Not disclosed
Cintra Payroll [5]	UK (private equity, Tenzing)	UK	Not disclosed	Not disclosed
Cezanne HR [6]	UK (private equity, NorthEdge)	EU (AWS, no-move clause)	Amazon Web Services (EU)	Not disclosed
BrightHR Payroll [7]	UK (founder, Peninsula)	UK	Microsoft Azure	Not disclosed
BrightPay (Bright Software Group) [8]	UK (private equity, Hg)	Not disclosed	Microsoft Azure	Not disclosed
Staffology / IRIS Cascade [9]	UK (private equity, Leonard Green)	Not disclosed	Not disclosed	Not disclosed
Sage Payroll [10]	UK (listed, LSE)	Not disclosed	Not disclosed	Not disclosed
Moneysoft Payroll Manager [11]	UK (founder-owned)	Your own computer	Your own computer	None (no cloud)
ADP iHCM / GlobalView [12]	USA (listed)	Not disclosed	Not disclosed	Not disclosed
Workday HCM [13]	USA (listed)	No (EU cloud planned)	Workday data centres	Not disclosed
Deel Payroll & EOR [14]	USA (VC-backed)	Ireland (primary)	Amazon Web Services	Not disclosed
Rippling Payroll [15]	USA (VC-backed)	No — EU region	Not disclosed	Not disclosed
SD Worx Payroll [16]	Belgium (foundation, WorxInvest)	Not disclosed	Not disclosed	Not disclosed
Personio [17]	Germany (VC-backed)	EU (no native UK payroll)	Not disclosed	Not disclosed
PayFit [18]	France (VC-backed)	EU	Amazon Web Services (EU)	Not disclosed
HiBob (“Bob”) / Pento [19]	Israel (VC-backed)	EU (data); control is Israel	Amazon Web Services (EU)	Not disclosed
Employment Hero Payroll [20]	Australia (VC-backed)	Australia / Ireland / Canada	Not disclosed	None (states no AI training)
Xero Payroll [21]	New Zealand (listed)	Not disclosed	Not disclosed	Not disclosed
Frappe HR (open source) [22]	India (founder-owned)	Your choice (self-host)	Buyer’s choice	Not disclosed

The wider HR and workforce field (ownership confirmed; data residency mostly not disclosed): UK-controlled — Access PeopleHR and Eploy (The Access Group, private equity), Ciphr (ECI Partners), CharlieHR, Clear Books, StaffCircle, Sage People, Workable, Tribepad, Hireful, Hireserve (owned by XCD), Planday’s UK arm; US-controlled — BambooHR (UK/EU data in Ireland), Breathe HR (via ELMO, now US owner K1 Investment Management), Remote, Fourth, Greenhouse (AWS), Lattice (AWS), Lever (AWS, EU-configurable), SmartRecruiters (default Frankfurt; names DeepL and Textkernel as AI suppliers), Be Applied, Harri; Humaans (UK entity files a “no registrable person” statement at Companies House; its two founders ceased as controllers in January 2021, and Humaans was reported acquired by the US firm Deel in 2022 — control now sits up a foreign chain, ultimate parent not confirmed on the UK register); Spain — Factorial (EU hosting; names Azure OpenAI and Gemini); Australia — Culture Amp (names Claude and Gemini), idibu; Ireland — Bizimply, Nory, Occupop (now owned by UK firm Cezanne); Sweden — Teamtailor; Jersey — Pinpoint; India — Zoho People (own data centres, UK data to Netherlands/Ireland).

What payroll buyers should ask

The standard six questions apply (owner; data location in writing; whose cloud; whose AI; who else touches it; what happens on sale). Payroll adds two of its own. “Where does my employees’ data go when it leaves you?” — payroll systems feed pension providers, benefits platforms and HMRC, so the supplier list is longer than it looks. And “who can see pay data inside your company, and from which country?” — support staff with access from overseas offices are part of the sovereignty picture too, and almost nobody documents it.

The dial reads differently in this category. The UK position is unusually easy to reach — Zellis, MHR, Cintra and Cezanne at the larger end; BrightHR, BrightPay and Moneysoft at the small end — which makes the choices that move payslips to America, Australia or Israel-controlled platforms look more like defaults accepted than trade-offs made. Note too that ownership and data location are separate dials: a US-owned vendor can still keep UK data in Europe (SmartRecruiters, Lever), and an Israeli-controlled one can hold data in the EU (HiBob). If there’s one category where a UK business can simply choose British — owner, data and computers — it’s the one holding everyone’s bank details.

Sources

All facts are taken from each vendor’s own published documentation (security, data-location and sub-processor pages) and from company registries — Companies House persons-with-significant-control records, SEC filings and corporate registers — read directly during June 2026. One reference per vendor.

1. Zellis — Companies House PSC: https://find-and-update.company-information.service.gov.uk/company/10975156/persons-with-significant-control
2. Moorepay — technology/hosting (UK data centre, Azure): https://www.moorepay.co.uk/our-technology/
3. MHR International — Companies House PSC: https://find-and-update.company-information.service.gov.uk/company/01852206/persons-with-significant-control
4. Natural HR / elementsuite — Companies House PSC (Natural HR under Moorepay): https://find-and-update.company-information.service.gov.uk/company/08292934/persons-with-significant-control ; elementsuite under Zellis UK: https://find-and-update.company-information.service.gov.uk/company/10912451/persons-with-significant-control
5. Cintra — Companies House PSC (Payroll Software & Services Group Topco, Tenzing): https://find-and-update.company-information.service.gov.uk/company/12341491/persons-with-significant-control
6. Cezanne HR — data security (AWS EU, no-move clause): https://cezannehr.com/data-security/ ; ownership: https://find-and-update.company-information.service.gov.uk/company/08314700/persons-with-significant-control
7. BrightHR — security/data (UK storage, Azure): https://www.brighthr.com/security/
8. Bright Software Group (BrightPay) — Azure hosting: https://www.brightpay.co.uk/pages/connect-faqs ; ownership: https://find-and-update.company-information.service.gov.uk/company/14811663/persons-with-significant-control
9. IRIS (Staffology, IRIS Cascade) — Companies House PSC: https://find-and-update.company-information.service.gov.uk/company/06295385/persons-with-significant-control
10. Sage (Sage Payroll) — Companies House: https://find-and-update.company-information.service.gov.uk/company/02231246
11. Moneysoft — Companies House PSC (desktop software; vendor holds no payroll data): https://find-and-update.company-information.service.gov.uk/company/02695617/persons-with-significant-control
12. ADP — SEC EDGAR filings (UK payroll data location not disclosed): https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0000008670&type=10-K
13. Workday — SEC EDGAR filings: https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001327811&type=10-K ; data location / EU Sovereign Cloud announced Nov 2025 (no UK residency; customer-managed keys): https://www.workday.com/en-gb/why-workday/trust/security.html
14. Deel — security (AWS, data in Ireland): https://www.deel.com/security/
15. Rippling — Companies House PSC (UK entity; controller Parker Conrad, US): https://find-and-update.company-information.service.gov.uk/company/13914364/persons-with-significant-control ; EU data residency (region-locked architecture; UK not separately stated): https://www.rippling.com/blog/multiregion-data-residency-qcon-alex-strachan
16. SD Worx — Companies House PSC (UK entity controlled from Belgium; hosting not disclosed): https://find-and-update.company-information.service.gov.uk/company/03100021/persons-with-significant-control
17. Personio — legal notice (Munich; no native UK payroll): https://www.personio.com/legal-notice/
18. PayFit — legal notice (AWS EU hosting): https://payfit.com/legal-notice/
19. HiBob — Companies House PSC, UK entity (control = Israel): https://find-and-update.company-information.service.gov.uk/company/09787994/persons-with-significant-control ; sub-processors/data (AWS EU): https://www.hibob.com/privacy/hibob-subsidiaries-and-sub-processors/
20. Employment Hero — privacy policy (data in Australia/Ireland/Canada): https://employmenthero.com/legals/privacy-policy/
21. Xero (Xero Payroll) — security: https://www.xero.com/uk/security/
22. Frappe (Frappe HR) — cloud servers/region (buyer’s choice, self-host): https://frappe.io/cloud/servers