A one-page summary of how sign-in, permissions and sensitive data work in Revolut People, for the IT, security or data protection lead who joins the evaluation. Every point links to the public documentation. It covers the controls you configure, not certifications or hosting.
Need certifications, hosting or a security questionnaire answered? Ask on the call and I’ll send the security pack.
Sign-in and provisioning
| Option | What the docs say | Source |
|---|---|---|
| Google SSO | Employees sign in with their Google Workspace accounts, without keeping a separate password. Set up by a System Admin. | Google SSO |
| Microsoft SSO | Sign-in through Microsoft Entra ID; once enabled it applies to the whole platform. Needs an Entra admin on your side. | Microsoft SSO |
| Okta | SSO plus SCIM provisioning. Only one SCIM token is valid at a time. Just-in-time provisioning, SP-initiated single log-out and force authentication are not supported. | Okta SSO and SCIM |
| OneLogin | SSO with OneLogin (released September 2026). Needs a OneLogin admin and a Revolut People System Admin. | OneLogin SSO |
Using another identity provider? Ask on the call; it is not in the public docs.
Who can see what
- Two layers of permissions. Object-based permissions come from someone’s place in the organisation (for example line manager or team owner). Permission groups add role-based access on top, per module (permissions guide).
- Default groups split personal, performance and salary data. For example, the Employee group sees only their own data, a Payroll Manager sees personal and salary data but not performance data, and a Performance Manager sees performance and salary data but not personal data (permissions guide).
- Colleagues’ sensitive data is hidden. Employees can view colleagues’ work details and reporting lines, but specific ratings, grade history and feedback are not visible unless the feedback was public or their own (permissions guide).
- Regional HR access. Access Policies can limit HR managers to employees in a given country, location or entity. They currently apply to the HR scope only (access policies).
- AI follows the same rules. The AI Assistant only sees what the user can already see, and the MCP server (Beta) works within the user’s existing permissions through OAuth (September 2026 update · MCP permissions). More on the AI and MCP page.
Sensitive data controls
- Data retention policies per location: set the data categories, the event that starts the clock, the retention period and an owner for each location. The docs say to confirm periods with your legal or data protection team (data retention).
- Masked statuses: Terminated, Gardening Leave and Not Hired can show as “Inactive” to users without elevated permissions (mask sensitive statuses).
- Survey anonymity: set a minimum number of responses and a minimum group size before engagement results are shown (anonymity settings).
- Candidate anonymisation: permanently removes a candidate’s personal data after the retention period or on a deletion request. It cannot be undone (anonymising candidates).
- Confidential requisitions: by default only the creator can see them, and they grant access to others (confidential requisitions).
For your security review
- Decide your identity provider and who on your side configures it (System Admin in Revolut People plus an admin in your identity provider).
- Map your HR, payroll and performance roles to the default permission groups and note any regional limits for Access Policies.
- List the retention periods your legal team has set for each location.
- Send me your questionnaire or list of required documents. I’ll send the security pack after the call.
Planning dates as well? Use the go-live planner. Checking integrations? Use the stack-fit checker.
Bring your security lead
A 15-minute discovery call is enough to cover sign-in, permissions and what is in the security pack.
FAQ
Where is Revolut People hosted, and which certifications does it hold?
This page sticks to what the public docs describe. Ask on the call and I’ll send the security pack.
Does Okta provisioning support just-in-time user creation?
No. The Okta guide covers SSO and SCIM, and says just-in-time provisioning, SP-initiated single log-out and force authentication are not supported. Source.
Can we limit HR managers to their own country?
Yes. Access Policies limit HR access by country, location or entity. They currently apply to the HR scope only. Source.
Can a payroll manager see performance ratings?
Not with the default Payroll Manager group: it covers personal and salary data, not performance data. Source.
Can we set data retention periods?
Yes, per location: data categories, the triggering event, the retention period and a policy owner. Your organisation decides the periods. Source.