Owner: CHRO + General Counsel (VGC LLP) · Effective Date: 2026-05-16 · Reviewed: At each ISMS Management Review and on each material change to non-US workforce composition
Why a responsibility split is needed
Workforce members are sampled the same way regardless of country — production-access timestamp, training completion, policy acknowledgement, background check, privacy notice, and any country-specific privacy filing. “Engaged via Rippling EOR” is an acceptable employment vehicle, but it does not discharge Neuroscale’s own security-program and controller-side privacy obligations. Those obligations are documented here and evidenced per the cadence in the ISMS Management Review and the quarterly access reviews.What the EOR covers vs. what Neuroscale retains
Rippling EOR is the legal employer in-country and generally carries:- Local employment contract, mandatory benefits, payroll, and tax withholding
- Local termination compliance (notice periods, severance)
- Local labor-law notices and postings
- Country-specific employee data privacy in the EOR’s capacity as employer
- Security-program obligations of every workforce member — policy acknowledgement, security-awareness training, and a background check appropriate to the role
- The data-processing relationship for any worker data that flows into Neuroscale systems (Rippling HRIS → Neuroscale systems)
- The privacy notice given to the worker about Neuroscale’s own processing
- Cross-border data-transfer compliance for Neuroscale-side flows (US ⇄ BR; US ⇄ IN)
- Treatment of the worker under Neuroscale’s policies (Code of Conduct, AI Acceptable Use, and others)
- Country-specific privacy filings where Neuroscale is the controller of the data (DPIAs, RoPA entries)
Responsibility matrix — by country
Brazil (Rippling EOR)
Rippling owns (per EOR contract): local employment contract under Brazilian CLT; Brazilian payroll and statutory withholding (INSS, FGTS, IRRF); 13th-month salary, vacation accrual, FGTS deposits; termination compliance under Brazilian labor law (aviso prévio / severance / rescisão); required labor-law notices and postings; LGPD compliance as employer for employee personnel data. Neuroscale owns: security-awareness training; acknowledgement of all in-scope policies; background screening appropriate to the role (T2 where production access); AI Acceptable Use and Code of Conduct adherence; Workplace Violence reporting channels; a Portuguese-language privacy notice for Neuroscale-side processing; LGPD compliance for any Brazilian-resident worker data Neuroscale processes in its systems, including LGPD Art. 8 valid consent where consent is the lawful basis, an LGPD Art. 33 DPIA where the processing is high-risk, a RoPA entry for the US ⇄ BR transfer, and a documented cross-border-transfer safeguard. Joint (Rippling executes, Neuroscale validates): onboarding handoff (Rippling completes local employment; Neuroscale grants system access on completion of training + acknowledgement) and offboarding handoff (Neuroscale revokes access on the offboarding signal; Rippling handles local termination).India (Rippling EOR)
The same split applies, substituting Indian law: local employment, payroll, and statutory compliance sit with the EOR; Neuroscale retains the security-program and controller-side privacy obligations. India-specific points:- Privacy notice under the Digital Personal Data Protection Act, 2023 (DPDP Act), in English (translation is not required where the worker is English-proficient, as is the case for the engineering workforce), plus a DPDP-equivalent DPIA and a RoPA entry for the US ⇄ IN flow.
- Aadhaar exclusion. No Aadhaar number is collected, stored, or used in any Neuroscale-side flow — a strict-liability prohibition for foreign entities under the Aadhaar Act 2016. This is enforced by (a) confirming Rippling does not surface Aadhaar to the Neuroscale HRIS sync in the field mapping, (b) confirming no internal form or process collects Aadhaar, and (c) a CHRO + CTO-signed statement to that effect on file.
- Background-check equivalent. Where Checkr’s India coverage does not reach, the India Police Clearance Certificate (PCC) sourcing path (via the EOR or a country-specific provider) is documented for each in-scope worker.
1099 / contractor cohort
For workers engaged directly (not via EOR):- The contractor agreement is the responsibility-allocation document, signed by Neuroscale directly.
- All Neuroscale-side privacy obligations above apply identically.
- The background-check tier matches the role (T2 where production access).
- Misclassification risk is monitored — both Brazil and India apply substance-over-form tests and can reclassify a contractor as an employee retroactively; engagement terms are reviewed by the General Counsel on each renewal.
Evidence & cadence
- Per-worker roster (by country and engagement type), the EOR responsibility matrix, the country-specific privacy artifacts, and the contractor agreements are maintained in the SOC 2 evidence library (Workforce > Non-US).
- The non-US workforce is reconciled each quarter as part of the access-review cycle, and status is reported at each ISMS Management Review.
Sign-off
| Name | Role | Status | Date |
|---|---|---|---|
| Ishan Jadhwani | CEO | Approved | 2026-05-17 |
| Sayantani Nandy | CHRO | Sign-off pending | — |
| Brandt Mori | General Counsel (VGC LLP) | Sign-off pending | — |
Version history
| Version | Date | Description | Author | Approved by |
|---|---|---|---|---|
| 1.0 | 2026-05-16 | Initial control model for non-US (Brazil + India) workforce in the Type II window; confirms Rippling Global EOR as the engagement vehicle for the majority of non-US workforce and addresses the 1099 cohort separately. | Cameron Wolfe | Ishan Jadhwani, CEO; CHRO + GC sign-off pending |
| 1.1 | 2026-06-12 | Observation window updated to June 22 – September 22, 2026 per the 2026-06-12 schedule shift. | Cameron Wolfe | Ishan Jadhwani, CEO |