> ## Documentation Index
> Fetch the complete documentation index at: https://docs.matproof.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Deel Integration

> Connect Deel to sync your employee and contractor directory into Matproof — driving access reviews, training assignments, and offboarding automation.

## Overview

The Deel integration mirrors your global workforce — full-time employees, contractors, EOR-employed staff — into Matproof's [People](/features/people) module. Hires, role changes, and terminations flow through automatically, so your access-review and offboarding evidence stays current without manual sync work.

**What gets synced:**

* Employee and contractor records (name, work email, role, country of work, employment type)
* Department / team assignments
* Manager hierarchy
* Hire date, termination date
* Active / pending / terminated status
* Contract type (full-time, contractor, EOR) — drives the [Roles & Permissions](/features/rbac-roles) Employee vs Contractor distinction Matproof tracks

The integration is **read-only** — Matproof does not create, modify, or terminate Deel records.

***

## Why connect Deel

Without an HR system sync, your People list in Matproof drifts out of sync with reality the day someone joins or leaves. That breaks access-review evidence (auditors flag stale lists), it breaks offboarding (former employees still appear active), and it breaks training assignments (new hires never get auto-assigned).

With Deel connected:

* **New hires** appear in Matproof within 24 hours, ready for training assignment and onboarding-checklist auto-creation
* **Terminations** automatically trigger the offboarding workflow in Matproof, pre-populating the standard checklist
* **Contractor vs employee** distinction stays accurate for audit reporting (some frameworks require contractor counts to be disclosed separately)

***

## Prerequisites

* Deel admin or org-owner account (required to issue an API key)
* Matproof Admin or Owner role
* A Deel plan that includes API access — most paid Deel plans include this; verify in your Deel account settings

***

## Connecting Deel

<Steps>
  <Step title="Generate a Deel API key">
    In Deel: **Settings → API Keys → New API key**. Name it `matproof-readonly`. Deel issues a single token — copy it; you'll only see it once.
  </Step>

  <Step title="Add the credential in Matproof">
    Go to **Settings → Integrations**, find **Deel**, click **Connect**, paste the API key. Matproof immediately tests the connection and runs the first sync.
  </Step>

  <Step title="Map roles">
    In **Settings → Integrations → Deel → Configure**, choose how Deel employment types map to Matproof's [built-in roles](/features/rbac-roles):

    | Deel type                | Recommended Matproof role |
    | ------------------------ | ------------------------- |
    | Full-time employee       | Employee                  |
    | Contractor               | Contractor                |
    | EOR (Employer of Record) | Employee                  |
    | Independent contractor   | Contractor                |

    You can override any individual person's role in Matproof's People module — the Deel sync respects manual overrides on subsequent syncs.
  </Step>

  <Step title="Confirm the first sync">
    The first sync typically completes within 1–5 minutes for organizations under 500 people. Open **People** to see the imported list. Subsequent syncs run every 24 hours by default.
  </Step>
</Steps>

<Note>
  Matproof requests **read-only** access to your Deel directory. It cannot hire, fire, change pay, or modify any Deel record.
</Note>

***

## What gets mapped to which controls

| Evidence Collected                                   | Control Examples                                              |
| ---------------------------------------------------- | ------------------------------------------------------------- |
| Up-to-date workforce inventory                       | Asset / personnel inventory (ISO 27001 A.6.1, A.6.5)          |
| Termination dates → offboarding checklist completion | Access removal on termination (ISO 27001 A.5.11, SOC 2 CC6.4) |
| Contractor vs employee counts                        | Workforce-mix disclosure (some DORA / NIS 2 reporting fields) |
| Manager hierarchy for access-review approvals        | Access review controls (ISO 27001 A.5.18, SOC 2 CC6.2)        |
| Department assignments                               | Segregation of duties (ISO 27001 A.5.3)                       |
| Hire date                                            | Background-check timing evidence                              |

***

## Offboarding automation

When a Deel record's status changes to **Terminated** (or a future-dated termination passes), Matproof automatically:

1. Marks the matching Person as **Offboarding** in Matproof
2. Creates the standard offboarding checklist (revoke system access, collect devices, archive Matproof account, notify IT, etc.)
3. Notifies the employee's manager (or a configured offboarding owner) to work the checklist
4. On checklist completion, marks the Person as **Offboarded** — the timestamped record becomes evidence for ISO 27001 A.5.11 and SOC 2 CC6.4

The Deel-driven offboarding flow does **not** automatically revoke access in third-party systems — that requires connections to AWS / Google Workspace / Entra ID / Okta. Matproof produces the checklist and tracks completion; the actual revocation is performed via those integrations or manually.

***

## Common issues

### "API key invalid"

Deel API keys are tied to the user who created them. If the user who issued the key is offboarded from Deel, the key is revoked. Have a current admin issue a new key and update Matproof.

### "Some employees aren't appearing"

Matproof imports records that are **Active** or in **Onboarding** status by default. To include other statuses, go to **Settings → Integrations → Deel → Configure → Employee status filter** and adjust.

### "Email addresses don't match between Deel and Matproof"

Matproof matches Deel records to existing Matproof users by **work email**. If a person's Deel email is `firstname.lastname@company.com` but their Matproof account is `flastname@company.com`, the sync creates a duplicate. Two fixes:

* Update the Deel record to the canonical work email
* Or: manually merge the records in **People → \[duplicate] → Merge with…**

***

## Disconnecting

Go to **Settings → Integrations → Deel → Disconnect**. The encrypted API key is purged from Matproof's secrets store.

In Deel: also revoke the API key from **Settings → API Keys → matproof-readonly → Revoke** to fully cut access on the Deel side.

After disconnection, previously imported People records remain in Matproof (so audit history is preserved). Future hires and terminations will not sync until you reconnect.

<CardGroup cols={2}>
  <Card title="People" href="/features/people">
    Where Deel-synced records land
  </Card>

  <Card title="Roles & Permissions" href="/features/rbac-roles">
    How Employee vs Contractor distinctions work
  </Card>
</CardGroup>