The EOR Vendor Due Diligence Checklist: 25 Questions to Ask Before Signing

The sales demo displayed a tidy dashboard. The pricing page seemed acceptable. Two of your colleagues stated they use this vendor. So you feel 80% of the way to signing.

Slow down.

An Employer of Record is not a SaaS solution that can be decommissioned in a quarter. It is the legal employer of your employees in another country. If they make a mistake with compliance, you are responsible for the fines. If they go under, your team stops getting paid. If a subprocessor leaks data, you draft the breach notification. And if you ever want to leave, the exit clauses in the MSA decide whether you can — and how much it costs.

This checklist gives you 25 questions to run every serious EOR contender through before you sign. Each one comes with what a strong answer sounds like and the specific red flag to watch for.

Why due diligence beats the demo every time

Sales demos are optimized for the middle 60% of use cases. Due diligence is where you find the edges — the countries where the vendor does not actually own an entity, the security certifications they claim but cannot produce, the auto-renewal clause tucked in on page 14 of the master services agreement.

The suppliers who win at this round are not always the largest or the cheapest. They are the ones that answer specifics with specifics. If your prospective EOR responds to “do you own your entity in Germany?” with “we have full coverage in 150+ countries,” that is not an answer. That is a deflection.

The 25 questions below are grouped into five categories: legal entity and compliance, IP and data security, payroll and benefits, contract and liability, and operations and support. Run each finalist through the full list. Score them. Compare.

Legal entity and compliance (Q1–5)

1. Do you own the local legal entity, or use a third-party partner?

A strong EOR will tell you exactly which of their countries are owned-entity and which run through an in-country partner (ICP). Neither is inherently wrong, but you need to know the split. The red flag is any answer that blurs the two, or lists “150 countries” without specifying how many are direct.

2. Which specific entity will employ our worker, and where is it registered?

Get the legal entity name and registration number. It should appear on the employment contract your worker signs. If the vendor cannot name it during diligence, that contract will be equally vague when the auditor asks.

3. How do you handle worker classification in each country we plan to hire in?

Misclassification is one of the most costly blunders in the global labor market. According to guidance from the International Labour Organization, enforcement has tightened in most OECD markets over the past five years. A strong vendor puts you through the classification tests for each country before taking a position. A weak one hedges and calls this flexibility.

4. Who bears legal responsibility if a worker gets reclassified?

Look for explicit language: the EOR is the employer of record, so the EOR carries primary liability if a labor authority opens a case. If the answer is “we work together” or “it depends on the country,” ask to see the exact contract clause. What you want is a specific indemnification, not a shared shrug.

5. How do you track and implement changes in local labor law?

You’re looking for information on a dedicated legal staff, subscriptions to local counsel networks, and a defined change-management procedure. “We have great local partners” is insufficient. Inquire about how a specific recent change – severance reform in France, remote work laws in Portugal, minimum wage changes in Poland — was identified and communicated to clients.

IP, data, and security (Q6–10)

6. How is intellectual property assigned across jurisdictions?

Not every jurisdiction automatically assigns IP addresses. Some countries demand registration, while others limit the duties that an employee may perform. Your EOR’s employment agreement should include a jurisdiction-specific intellectual property clause that survives termination. Ask for a redacted sample before you sign — not after.

7. Do you hold SOC 2 Type II and/or ISO 27001 certification?

SOC 2 Type II evaluates operational performance over a set length of time, typically 6 to 12 months. ISO 27001 describes the complete information security management system. Serious merchants have at least one, preferably both. Request the report or certifications under NDA, not just a claim on the trust site. The AICPA publishes the SOC 2 framework itself, allowing you to double-check what a genuine report should include.

8. What is your GDPR posture and what does your DPA actually cover?

Even if you never hire in the EU, your vendor will most certainly process EU data through subprocessors. Before you sign, read the Data Processing Agreement.  The GDPR requires specific clauses on subprocessors, breach notification, and data subject rights. A modern DPA reflects all three. Anything shorter than a few pages is usually a red flag.

9. Where does employee personal data reside, and can we choose the region?

Data residency is important for compliance and, increasingly, procurement teams that view cross-border transfers as a risk.Inquire about the specific hosting provider and location. If the vendor utilizes subprocessors in high-risk jurisdictions, obtain a written list and compare it to your corporate policies.

10. What is your breach notification SLA to us as the client?

GDPR requires notification to authorities within 72 hours of awareness. Your vendor should commit to notifying you well before that — typically within 24 to 48 hours of confirmed detection. Anything vaguer than a numeric SLA is a red flag, and “we will notify you promptly” without a number is not an SLA. It is a wish.

Payroll, tax, and benefits (Q11–15)

11. What is your on-time, error-free payroll accuracy rate, and how do you measure it?

A serious response contains a number (usually 98% or above for experienced providers), a definition of “error,” and a mechanism for correcting mistakes. If the number seems suspiciously high, ask how they count corrections. For a sense of what routine international payroll looks like when it is done well, look at the metrics vendors publish for clients rather than for prospects — they are different.

12. How do you handle FX conversion, and who bears the exchange-rate risk?

Some vendors set monthly rates, while others change them on a daily basis. Some pass the spread to you; others absorb it. None of this is wrong on its own, but it needs to be transparent and written into the MSA. Request a worked example from the previous quarter that uses actual numbers rather than a hypothetical.

13. What statutory benefits are included by country, and which are optional add-ons?

Statutory means legally required — 13th month pay in much of Latin America, supplementary pension in several EU markets, extended sick leave in the CIS region. Supplemental denotes market-competitive extras. Both should be listed separately for each country, rather than as “benefits included.” For a preview of how country-specific this gets in practice, see how sick leave works in Belarus for foreign employers.

14. How do you handle 13th-month, holiday allowances, and severance accruals?

Inquire about if these are prefunded, accrued monthly, or charged when triggered. Prefunded is safest for you if the vendor ever has cash-flow trouble. Pass-through-only is cheaper up front and riskier at exit. Neither is wrong — but you need to know which one you are buying.

15. Who is responsible for tax filings — you, the worker, or both?

The EOR files employer-side taxes in the country of employment. The worker files personal income tax where they live. Any confusion or overlap here is a warning that the vendor has not fully mapped the workflow. If they hand you the answer in one sentence with country nuances, that is a good sign.

Contract, liability, and exit (Q16–20)

16. What are the termination terms for both us and the worker in each country?

Termination is when EOR bills unexpectedly rise. Statutory notice might last anywhere from a few days to months. Severance can be a fixed formula or a negotiated exit package. Get the country-by-country breakdown in writing before you sign. Our EOR migration playbook covers what happens when you switch providers mid-contract in a market like Belarus, and the logic transfers to most jurisdictions.

17. What is the scope and cap of your indemnification?

A significant EOR indemnifies you for any compliance problems they cause. The cap is where negotiations happen — sometimes 12 months of fees, sometimes higher for enterprise deals. No indemnification, or an uncapped exclusion of “consequential damages” that swallows the clause, is a deal-breaker. Read the definitions section carefully; this is where the true limits exist.

18. What are the auto-renewal and price-hike terms?

Check the renewal notice period (which is usually 30, 60, or 90 days), whether the agreement contains automatic annual price hikes, and whether any charge changes require your approval or can be imposed unilaterally by the provider. Vendors who unilaterally raise prices over a “market rate” provision will be the ones you regret in year two. Ask for the last three years of blended price changes across their book.

19. If we set up our own entity in a country later, can we transfer the employee?

This is known as an employee transfer or “graduation” clause. A good seller will support it, possibly for a small one-time price. A bad vendor charges punitive termination penalties designed to trap you inside the platform for as long as possible. This clause tells you what the vendor really thinks about long-term partnership.

20. What happens to our employees if you go out of business or exit a market?

Ask about their business continuity strategy and, preferably, a wind-down provision that ensures your employees are paid during a specified transition period.  Financial statements or a bank comfort letter are not unreasonable asks for a multi-year contract. If the vendor bristles at the question, that is itself an answer.

Operations, support, and scale (Q21–25)

21. What is your average onboarding time from contract signature to worker start date, by country?

For most European countries, expect 5 to 15 business days. Some markets — Brazil, China, several African countries — are longer, and pretending otherwise is a sign the vendor over-promises to close deals. A serious provider gives you a range per country and flags the outliers.

22. Will we have a named customer success manager, and what is our escalation path?

“Ticket queue only” is fine for very small teams. For anything above ten employees or across multiple countries, you want a named CSM and a defined escalation path to legal and payroll leads. If you are unsure how to pressure-test the answer, an HR consulting review can simulate the failure modes that reveal how deep support really goes.

23. What are your support hours, and do they cover our time zones?

Urgent issues will be delayed for 12 hours if your team is in San Francisco and your EOR’s support desk is in Manila, which has no US coverage. Check coverage against the time zones where your employees live, not those listed on the marketing site. Follow-the-sun sounds excellent; inquire about the handoff processes that connect the shifts.

24. Can you share audited financial statements or evidence of financial health?

For a service that holds your workers’ payroll on a rolling basis, this is fair diligence. Mature vendors expect the question. Younger ones should at least share investor backing, runway, and unit economics. A refusal to discuss financial health at all, for a multi-year contract, is a signal to keep looking.

25. Can you provide three reference customers at our headcount and in our industry?

References are the single most predictive step. Ask each reference: “What went wrong, and how did they handle it?” Every vendor breaks something eventually — the question is what happens next. Guidance from professional bodies such as SHRM on structured vendor references is a useful benchmark if you have never run this step formally before.

Three deal-breaker red flags

For scanners, here are the three signals that should end the conversation early.

Vague on entity ownership. If the vendor will not tell you which of your target countries are owned versus partner-run, they are either hiding the ratio or do not know it. Both are disqualifying for anything beyond a one-off hire.

No SOC 2 Type II or ISO 27001. This is a must-have for a vendor who handles sensitive employment and payroll data. It is table stakes for enterprise procurement in 2026 and increasingly for mid-market buyers too.

No indemnification, or an unlimited liability carve-out. A vendor unwilling to stand behind their compliance work is telling you the risk sits with you. That may be acceptable — as long as your legal team knows and priced it in.

Next step

If you are partway through an EOR evaluation and want a second opinion on the answers you are getting, the team at eor.by is happy to review your shortlist and pressure-test the vendors on your list — starting with the 25 questions above.

About the author

John D.

Content Marketing Manager

John D. is the content Marketing Manager at EOR.by. He has a passion for simplifying complex topics. With experience creating content and developing strategies in the local market and abroad, John shares his rich experience to make easier processes in companies striving for their development and scaling.