Rippling

Connection methods

• REST API with OAuth or API keys
• SCIM outbound provisioning
• Scheduled CSV/SFTP exports
• Webhook event notifications

Documentation topics

Review the following areas in Rippling admin and product documentation before connecting to ComplAI:

• Admin console setup and service account creation
• API authentication, scopes, and rate limits
• Audit log export and retention settings
• Security hardening and least-privilege configuration

ComplAI integration overview

Rippling integrates with ComplAI to support Propel Ready Solutions's GRC program. Unified HR, IT, and app provisioning from hire to retire. This guide covers product context, the recommended connection process, prerequisites, and verification steps for audit-ready evidence collection.

Last updated: 2026-06-24

GRC evidence available

• Employee status and termination dates
• Department and role changes
• Manager approval chains
• Integration sync audit logs
• Device management metrics and configuration evidence
• App provisioning metrics and configuration evidence

Prerequisites

• Named integration owner and backup contact at Propel Ready Solutions
• Change request approved per Propel Ready Solutions change management policy
• Network egress allowlisting completed if required by vendor
• ComplAI organization administrator access
• Admin or integration-builder role in Rippling
• Rippling product documentation reviewed (see Documentation topics below)

Integration process

1. Step 1

   Plan Rippling integration scope

   Confirm which Device management and App provisioning capabilities will be connected first. Start with read-only ingestion before enabling write actions.

2. Step 2

   Define scope and data contract

   Identify which HR events (hire, transfer, termination, contractor end) must sync to identity and access systems.

   • Document authoritative HR source fields (employee ID, department, manager, status, last day)
   • Agree retention and privacy classification for HR data in transit
   • Map events to IAM provisioning actions in ComplAI

3. Step 3

   Configure API or file integration

   Establish a secure connection from the HRMS to ComplAI or your IAM middleware using vendor-supported APIs, SCIM, or scheduled SFTP.

   • Create a dedicated integration service account with least privilege
   • Enable audit logging on the integration account
   • Configure IP allowlists or OAuth client credentials as required

4. Step 4

   Validate joiner/mover/leaver workflows

   Run test employees through hire, role change, and termination scenarios and confirm downstream access changes within SLA.

5. Step 5

   Enable monitoring and evidence collection

   Schedule daily sync health checks and store integration run logs as compliance evidence in ComplAI.

6. Step 6

   Mark integration complete in ComplAI

   Update integration status to Connected, attach configuration evidence, and link mapped controls in the Controls library.

GRC benefits

• Automated joiner/mover/leaver feeds for access provisioning and deprovisioning
• Evidence for ISO 27001 A.5.15–A.5.18 and SOC 2 CC6.2 personnel controls
• Audit trail linking HR termination dates to IAM account disablement
• Centralized identity evidence for access control and privileged access audits

Related controls

Verification checklist

• ☐Integration credentials stored securely and rotation scheduled
• ☐Test sync completed successfully with sample records
• ☐Error alerting configured for failed sync or API rate limits
• ☐Control mappings documented in ComplAI
• ☐Evidence sample exported and reviewed by control owner
• ☐Runbook link attached to related controls

Troubleshooting