This is a print-friendly report. Click Print and choose “Save as PDF” in the destination dropdown to download.

SaaSGuard Risk Report

BambooHR

bamboohr.com

Generated May 4, 2026

Grade D

Score: 54 / 100

Executive summary

We analyzed BambooHR’s Terms of Service across 8 risk dimensions and found 9 flagged clauses across 7 categories.

Flagged clauses by category

AI training on your data (1)

  • Severity 1 · low

    BambooHR AI features are offered by BambooHR as a part of the Services. If you utilize the BambooHR AI Features, by accepting this Agreement, you are deemed to have accepted the AI Addendum which is incorporated herein by reference.

    By using BambooHR's AI features, you agree to their AI Addendum, which is incorporated into the main agreement.

    You are agreeing to terms regarding AI usage without seeing them explicitly laid out here.

Auto-renewal traps (1)

  • Severity 3 · notable

    For customers with a Month-to-Month Subscription, your subscription to the service will automatically renew for successive Month-to-Month terms. For customers with an Extended Term Subscription, your subscription to the service will automatically renew for twelve (12) month terms upon the expiration of your initial term specified in your Order Form (see Section 2.1). For customers with an Extended Term Subscription, if you do not want your existing term to automatically renew, you must provide BambooHR a minimum of sixty (60) days notice before the expiration of your existing Term.

    BambooHR automatically renews your subscription for month-to-month plans and for extended terms, requiring 60 days' notice to cancel extended terms.

    You could be locked into another year or month of service if you forget to cancel within the strict notice period.

    Matches FTC v. Amazon (Iliad Flow / Prime Enrollment) (2023)

Surprise price hikes (2)

  • Severity 4 · material

    Month-to-Month-Subscription BambooHR may at any time, upon notice of at least 60 days, or a longer period if required by Applicable Law, change the price of your subscription or any part thereof, or institute new charges or fees; notwithstanding the foregoing, we shall not change the price of any subscription package (e.g. Core, Pro, Elite, Payroll, BenAdmin) more than once in a calendar year. If you have prepaid your month-to-month subscription service, price changes and institution of new charges implemented after your payment in advance will go into effect for your next monthly Subscription Term after the 60 days' notice and the updated fees will be subtracted from your payment in advance. If you do not agree to any such price changes, then your sole remedy is to cancel your subscription and stop using the Service prior to the commencement of the renewal subscription period for which the price change applies.

    BambooHR can change prices for month-to-month plans with 60 days' notice, and you can only cancel if you disagree with the new price.

    Your monthly bill could increase significantly, and you'll have to cancel to avoid it.

    Matches FTC v. MoviePass / Helios and Matheson Analytics (2021)

  • Severity 3 · notable

    Extended Term Subscription BambooHR may not change the price of your existing subscription during the Term (other than standard price fluctuations that may occur if you change employee headcount or add additional services). Upon notice of at least 30 days before the expiration of your existing Subscription Term, BambooHR may change the price of your subscription for the next renewal term. Any price changes will apply only to your next renewal term.

    BambooHR may change prices for your next renewal term with at least 30 days' notice.

    Your renewal price could be higher than your current rate, but it won't change mid-term.

    Matches FTC v. MoviePass / Helios and Matheson Analytics (2021)

Termination friction (2)

  • Severity 3 · notable

    Customer Data Downloads and Deletion. In the event your subscription is not renewed, other than in instances where it is terminated by BambooHR for your nonpayment or violation of Sections 4.1, 4.2 or 13, you will continue to have the ability to download the information provided, inputted, or uploaded to your databases in the BambooHR® Service by you or on your behalf (“Customer Data”) for 30 days after the effective date of expiration or termination of your subscription. After such 30-day period or if your subscription is terminated due to your nonpayment or violation of Sections 4.1, 4.2 or 13, BambooHR shall have no obligation to maintain any Customer Data and shall thereafter, unless legally prohibited from doing so, or required pursuant to Additional Terms, delete all of your Customer Data contained in the BambooHR® Service.

    BambooHR will delete your data 30 days after your subscription ends, unless they terminated it for your non-payment or violation.

    You risk losing access to your critical business data if you don't download it within the short window after cancellation.

    Matches Bungie / Destiny 2 Account Termination Litigation (2023)

  • Severity 3 · notable

    Extended Term Subscription Except as provided below and in Section 2.4, your subscription is non-cancelable until the end of the Term (see Section 5.1) and all fees paid hereunder are non-refundable. If you attempt to terminate this Agreement without cause or you deactivate the Service, you will owe any unpaid fees for the remainder of the term.

    You cannot cancel your extended term subscription early, and all payments are final unless BambooHR terminates the agreement.

    You'll have to pay for the full contract term even if you stop using the service or it doesn't meet your needs.

    Matches FTC v. Match Group (Match.com) (2019)

Liability caps (1)

  • Severity 4 · material

    EXCEPT FOR (I) A PARTY’S VIOLATION OF THE OTHER PARTY’S INTELLECTUAL PROPERTY RIGHTS, (II) EITHER PARTY’S INDEMNIFICATION OBLIGATIONS HEREUNDER, OR (III) EITHER PARTY’S GROSS NEGLIGENCE OR WILLFUL MISCONDUCT, (A) IN NO EVENT WILL EITHER PARTY BE LIABLE FOR ANY INDIRECT, CONSEQUENTIAL, SPECIAL, PUNITIVE, OR EXEMPLARY DAMAGES ARISING OUT OF THIS AGREEMENT, AND (B) THE AGGREGATE LIABILITY OF EITHER PARTY TO THE OTHER WITH RESPECT TO THIS AGREEMENT IS LIMITED, TO THE EXTENT PERMITTED UNDER APPLICABLE LAW, TO THE FEES COLLECTED BY OR PAYABLE TO BAMBOOHR FROM YOU PURSUANT TO THIS AGREEMENT IN THE TWELVE MONTHS PRECEDING THE EVENT FROM WHICH THE LIABILITY AROSE. THE FOREGOING LIMITATIONS APPLY EVEN IF SUCH PARTY KNEW OR SHOULD HAVE KNOWN OF THE POSSIBILITY OF SUCH DAMAGES AND NOTWITHSTANDING THE FAILURE OF ESSENTIAL PURPOSE OF ANY LIMITED REMEDY HEREIN. THE FOREGOING LIMITATIONS DO NOT APPLY TO YOUR PAYMENT OBLIGATIONS UNDER THIS AGREEMENT.

    BambooHR's total liability is capped at the amount you paid them in the prior 12 months, except for IP violations or gross negligence.

    If BambooHR's service causes significant financial damage, your recovery is limited to what you've already paid them.

    Matches Capital One Data Breach Class Action — settled for $190M (2022)

Indemnification (1)

  • Severity 3 · notable

    You agree to indemnify, defend and hold harmless BambooHR, and its subsidiaries, affiliates, assigns, officers, directors, agents, and employees from and against any costs, damages, expenses (including reasonable attorneys’ fees), judgments, losses and other liabilities (including amounts paid in settlement) (“Liabilities”) incurred as a result of any third-party action, claim, demand, proceeding or suit (“Claim”) to the extent arising from or in connection with (a) your access or use of the Software, Beta Service and/or Service in violation of this Agreement, (b) any employment decision or action you take due to information available through or your use of the Service or relating to the inaccuracy or incompleteness of any information you make available to your employees, independent contractors or candidates by or through the Services, including, without limitation, the inaccuracy or incompleteness of any information relating to the actual or proposed compensation of, or equity ownership by, such employees, independent contractors or candidates, (c) User Content or Customer Data provided by you, your end users, or other third parties, (d) your violation or alleged violation of any third party right, including without limitation any right of privacy or any right provided by labor or employment law, and (e) your violation or alleged violation of this Agreement.

    You must defend BambooHR against any claims arising from your use of the service, your data, or your violation of third-party rights.

    You could be responsible for legal fees and damages if your actions lead to a lawsuit against BambooHR.

    Matches T-Mobile Data Breach Settlement — settled for $350M (2022)

Right to silently change terms (1)

  • Severity 4 · material

    For customers with an Extended Term Subscription, if any material modifications are made to this Agreement, such modifications will not take effect until the beginning of the next renewal term. Notwithstanding the foregoing, any modifications made to address new products or services will automatically apply to you if and when you begin using such products or services. Failure to accept the material modifications may result in termination or suspension of this Agreement and/or your access to the Service as described in Section 2.4.

    BambooHR can make material changes to the agreement that automatically apply if you start using new products or services.

    You might unknowingly agree to new terms by simply using a new feature.

    Matches Italian DPA (Garante) v. WhatsApp — settled for $6M (2022)

Methodology

SaaSGuard uses an automated pipeline: a daily Playwright crawler captures each vendor’s public Terms of Service, Privacy Policy, and DPA. Google’s Gemini 2.5 Flash classifies each clause into one of 8 risk categories with a severity score (1–5). Clauses are cross-referenced against a curated database of real lawsuits and FTC actions via embedding-based similarity matching. Grades are computed from per-category max severity; full source code is available on request.

Built for educational and informational purposes. Not legal advice. Always have your own counsel review SaaS contracts before signing.

View live page →