Deputy vs Workleap (2026)

Integrations reach across several system classes and write into them. Nearly every piece of the application is available for integration, with developer guides for three classes (point of sale, payroll and HR) and a REST surface for writing employees, timesheets, leave, availability, budgets, locations and sales metrics.

The integration catalog covers payroll and accounting (ADP, Paychex, Gusto, Xero, QuickBooks, MYOB), point of sale (Square) and identity (Okta, Azure, Oracle through SSO). Zapier, Workato and a Singer tap let a customer add integrations of their own.

Hours captured in Deputy are pushed into the payroll system as authenticated writes instead of exported for someone to type in again, and demand signals are pulled from point of sale systems to drive scheduling.

Sourcedeveloper.deputy.com and deputy.com/integrationsread 2026-09-08

By its own count Workleap has "100+ vendors supported, native or via custom MCP," with Teams, Slack and HubSpot shown as representative connectors. The custom MCP route lets a customer extend the set instead of waiting for Workleap to build a connector. HRIS connections cover Workday, BambooHR and ADP and run through Merge API, Inc., a processor described as a "unified API tool for provisioning multiple human resources information software."

Collaboration runs through Slack and Microsoft Teams, productivity through Google Workspace and Microsoft 365, and Zoom handles virtual meetings and video recording for Workleap Onboarding. The agent acts through these systems. Meetings and 1:1s "schedules meetings, preps agendas, takes notes, follows-up," so scheduling writes into the customer's calendar and following up sends into their inbox or Slack. The Slack integration was built in partnership with Slack and has rolled out to all customers.

Inside Slack it offers search and context retrieval today, with an MCP based architecture "laying the foundation for future AI-assisted actions within Slack workflows," so write actions there are still to come while calendar scheduling and HRIS provisioning work now. Workleap also runs its own inbound MCP server, and the people data the connectors deliver feeds the AI stack behind the agent (Anthropic, Cohere and Azure AI Foundry).

Sourceworkleap.com integrations navigation entry, the sub-processor register and the Slack agent announcementread 2026-09-12

The Labor Model is a rule engine addressed through the developer API, with operations to create a rule, list rules, update a model and run a model, and DeXML is a server side scripting language per install. Nothing ties Deputy AI to either. Deputy AI is a conversational agent that drafts a schedule from recent patterns, finds a replacement across several days, extends shifts, updates availability and approves timesheets, each on explicit confirmation.

The runtime is a deterministic engine that API callers drive, and the agent works beside it instead of through it, as one agent taking many steps, not a named runtime the agent orchestrates. Work does run across participants, with shift offers taken up by workers, roster swaps that need a counterparty, task groups assigning across a team, and approvals routing to a manager. Scheduling connecting to time, attendance and payroll is data flow, not orchestration.

Sourcedeputy.com/ai and developer.deputy.com Smart Scheduling guidesread 2026-09-08

Each of Workleap's six agent capabilities runs as a sequence of steps. Meetings and 1:1s "schedules meetings, preps agendas, takes notes, follows-up," four ordered steps that span a calendar, a document and a follow up action with the meeting itself in the middle, so the process holds state across a gap it does not control. Performance Reviews puts a person in the loop by design. It "gathers the evidence, drafts in your voice, refines with the manager, and preps the conversation," so the sequence pauses on a human turn and then resumes.

Goals "drafts goals, checks the cascade, flags gaps, tracks progress," which means validating each goal against the org hierarchy above it and keeping a long running commitment open. The product acts on its own initiative instead of waiting to be invoked. Briefing delivers "your daily read on what to know, do, and unblock," composed across the other capabilities, and Team Health and Feedback "spots engagement issues early, before they become problems."

Four kinds of participant take part, namely the manager the agent works for, the HR administrator who sets the cadences and rubrics that bound it, the employee on the other side of a one on one or a review, and the connected systems the agent reads and writes. All the sequences draw on one shared context layer, which is why they compose, so a review draft can draw on engagement signals and a one on one agenda on what the review surfaced.

Sourceworkleap.com agent capability descriptionsread 2026-09-12

Webhooks set up inside the Deputy install deliver data as soon as an update is made instead of waiting to be polled. There is a published webhook action list, worked timesheet and new employee examples, manual webhook configuration, a Webhook resource object, and AWS SQS as a queue target. Zapier and Workato add event routing without code.

Channels include web, the mobile app, chat, voice actions in the worker's own language, SMS with its own SmsLog resource, and push notifications for schedule changes, open shifts and swap approvals. The AI layer flags coverage gaps and schedule issues ahead of the shift. A manager starts Deputy AI itself. It does not start on its own, so events reach the platform and the customer's integrations.

Sourcedeveloper.deputy.com/docs/webhook-overview and deputy.com/airead 2026-09-08

Workleap is proactive by design and builds a whole capability around a schedule. Briefing, "your daily read on what to know, do, and unblock," is a morning brief that assembles itself and arrives without being asked for, a scheduled run with a composed output instead of a report a manager opens. Condition based triggers fire on the data instead of the clock.

Team Health and Feedback "spots engagement issues early, before they become problems," and Goals "checks the cascade, flags gaps, tracks progress," with the agent watching the people data and raising something when a threshold HR calibrates is crossed. Calendar and lifecycle events drive a third kind. Meetings and 1:1s schedules the meeting, preps the agenda ahead of it, takes notes during and follows up after, three actions hung off one dated event, and review cycles run on cadences HR sets.

Slack and Microsoft Teams are both connectors, and the Slack integration, built in partnership with Slack and rolled out to all customers, delivers search and context retrieval inside Slack. Email notifications go through Courier and Mailchimp, and there is an in app surface plus the MCP path from Claude, Gemini or ChatGPT, so a manager meets the agent in the tool they already use. Workleap says the Slack MCP architecture "lays the foundation for future AI-assisted actions within Slack workflows", so Slack delivers and retrieves today but does not yet act. Events, schedules and multiple channels are all generally available.

Sourceworkleap.com briefing and team health capability descriptions, with the Slack agent announcementread 2026-09-12

The agent grounds in records that persist between runs. Employee records, availability, qualifications, training and role requirements, historical demand, wage and labor budgets, and an encoded labor law and pay rules layer all live in the platform, kept current by continuous HRIS synchronization, and are read on every request.

Deputy AI follows the same rules the team already uses and weighs availability, leave, shift conflicts and role or training requirements when preparing an action. The encoded compliance layer spanning multiple jurisdictions persists, scales past any context window across a whole workforce, and stays queryable. There is no index, graph or embeddings layer.

Sourcedeputy.com/ai and developer.deputy.comread 2026-09-08

The agent grounds in the customer's own people data, centralized and kept current. Workleap unifies engagement, performance, onboarding, learning, skills and compensation data into one layer that gives the agent the organization's context. People and Org is "a living directory that surfaces relationship patterns, roles, expertise, and team health," refreshed from connected systems instead of snapshotted for each run.

Cohere Inc. serves as a "search result ranking tool" for Workleap AI and AI Features, processing all categories of personal information a customer may disclose, "including data provided through third-party integrations," so a dedicated ranking model sits over the corpus. Unstructured Technologies, Inc. parses documents uploaded through the services, giving an ingestion path, and Rockset runs as a real time analytics database with MongoDB and Snowflake underneath.

Ranking, parsing and a real time index together make up a RAG stack. HRIS connectors via Merge bring worker records from Workday, BambooHR and ADP into the same layer, so the agent reasons over the customer's systems of record, not only what Workleap holds. The grounding shows in the output, since Performance Reviews "gathers the evidence" before drafting and Meetings and 1:1s preps agendas from what has been tracked. Anthropic's model, hosted for inference on Azure AI Foundry, works over this corpus.

Sourceworkleap.com/trust-center/workleap-sub-processors and the agent capability descriptionsread 2026-09-12

Deputy AI is a conversational agent operating through chat, on the web and in the mobile app by text or voice, with core scheduling and timesheet actions completed via chat. That surface implies conversation state within a session. Persistent records of employee availability, qualifications and historical demand are business records, not agent memory. There is no memory layer with a stated scope or lifetime, per user, team or workflow, and no retention or deletion control over agent memory. Deputy does not say what is kept between turns.

Sourcedeputy.com/airead 2026-09-08

What Workleap offers is learning and a corpus, not agent memory. An insight layer continuously teaches the agent about business context, but there is no distinct persistent memory store, and context folded into how the agent behaves is not state it keeps and can retrieve. Nothing says whether what it learns is scoped, inspectable, editable or tied to a run. The insight layer itself is the centralized people data across engagement, performance and onboarding, which the agent queries.

MongoDB and Snowflake hold the data, Rockset runs real time analytics, Cohere ranks search results and Unstructured parses files, which together make a retrieval stack. People and Org is "a living directory that surfaces relationship patterns, roles, expertise, and team health," kept current from the customer's own connected systems.

Performance Reviews comes closest, since it "gathers the evidence, drafts in your voice, refines with the manager," and drafting in a specific manager's voice suggests something retained about that manager across reviews. Workleap does not say whether that voice is learned and stored, inferred on each run from earlier writing, or configured.

There is no named memory component, no retained preference or correction applied to the next cycle, no decision trace between runs, no stated scope or lifetime, and no way to inspect, edit, export or purge agent state apart from the people records.

Sourceworkleap.com/trust-center sub-processor register and the agent capability descriptionsread 2026-09-12

Deputy AI cannot finalize anything without the user's confirmation, and the product shows it. Deputy AI follows a human in the loop approach. It cannot publish a schedule or approve a timesheet without explicit confirmation, and it shows a summary of the action it is about to take, with nothing finalized unless the user confirms.

In the product, a tap to confirm step shows a clear plan for every action before it goes ahead, voice actions on mobile are ready to review first, and relevant warnings appear in the preview so the manager can decide before anything is updated. Deputy built this review and approve surface itself, over the agent's actions. Scope is bounded by the role based permissions the account already uses, so the agent can only act where the user could.

Sourcedeputy.com/airead 2026-09-08

Oversight works at two levels. Before the agent does anything, HR calibrates the cadences, frameworks, rubrics, tone and thresholds that define how it behaves, drawing on a growing library of skills or writing custom ones, and hands over more work as trust builds. The customer decides what the agent may do and how, and can widen that scope deliberately. Tone and rubric settings govern how the output reads as well as whether the agent acts, which is unusual. At run time the gate sits inside the capability.

Performance Reviews "gathers the evidence, drafts in your voice, refines with the manager, and preps the conversation," so refining with the manager is a step in the sequence and a draft never leaves the agent without a human turn on it. A performance review is the most consequential document the product produces. Meetings and 1:1s has the same shape, with the agent preparing the agenda and taking the notes while the manager runs the conversation. The agent's outputs are briefs, drafts, agendas, flags and nudges directed at a manager, who then acts.

None of the six capabilities completes an irreversible action against an employee on its own, so there is no automated review submission, compensation change or message to an employee without a manager in between. On the Slack path the MCP architecture would let Workleap AI "act on a user's behalf when explicitly authorized," but that action set is still to come. Workleap describes no reviewer queue, approval object, escalation path or audit of overrides.

Sourceworkleap.com performance and meetings capability descriptions, with the Slack agent announcementread 2026-09-12

Deputy is ISO 27001 certified, UK Cyber Essentials certified and SOC 2 Type II compliant, handles PCI-DSS as a level 3 merchant on an annual SAQ A self assessment with quarterly scans by an Approved Scanning Vendor, and is listed with the Cloud Security Alliance at CSA STAR Level 1. Certificates, attestation reports and security documentation can be downloaded from Deputy's trust center.

On access, corporate customers get single sign on through Okta, Azure and Oracle, multi factor authentication is available on every account, and customizable role based access levels show employees, managers and administrators only what is relevant to them. The agent inherits this. Deputy AI respects the role based permissions already configured in the account and can only show and act on what that user already can. ISO 27001 and Cyber Essentials are certifications. SOC 2 Type II is a compliance claim, and PCI-DSS is a self assessment.

Sourcedeputy.com/security and deputy.com/airead 2026-09-08

Governance is well documented, but no SOC 2, ISO or other certification is claimed on Workleap's main site. A Security Trust Center at security.workleap.com, hosted on Drata and linked from the main trust center, covers "key organizational and technical measures to safeguard customer data," and nothing from Workleap backs a SOC 2 claim.

The main trust center carries Terms of Service, a Privacy Policy, a Data Processing Addendum that explicitly covers international transfers, a full processor register, a modern slavery statement, separate Barley Inc. agreements following that acquisition, a status page and a security@ reporting address, and it names a Data Protection Officer.

The register gives 32 processors with the nature of processing, categories of personal information, countries, transfer mechanism and product scope for each, and marks Standard Contractual Clauses and EU-US Data Privacy Framework self certification per entry. FusionAuth appears there as a "security access management tool" handling usernames, passwords and email, stored and processed in Canada, which points to the identity layer. Workleap describes no single sign on, SCIM or role based access control for customers.

Sourceworkleap.com/trust-center and /trust-center/workleap-sub-processorsread 2026-09-12

Changes inside the platform are recorded, but not what the agent did or why. The Resource API exposes change history and journal objects, among them EmployeeHistory, EmployeeAgreementHistory, Journal, SmsLog and SystemUsageTracking, so Deputy supplies a retrievable record of changes inside its own system.

Projected labor cost while building schedules, GPS verified time tracking, adherence and analytics dashboards measure the customer's workforce, not the agent. There is no agent run trace, decision record, or attribution separating a change made by Deputy AI from one made by a manager, so a customer cannot reconstruct why the agent did what it did.

Sourcedeveloper.deputy.com/docs/getting-started-with-the-deputy-apiread 2026-09-08

The product shows what the agent produced, not what it did. Briefing delivers a daily read a manager can inspect, Performance Reviews "gathers the evidence" so the evidence is attached to the draft, Team Health surfaces the engagement signals behind a flag, and Goals "flags gaps" and "tracks progress" against a visible cascade.

Real time engagement and performance dashboards run underneath, with Rockset serving as a "real-time analytics database service." A manager can see the reasoning attached to an output and the data it came from. There is no run log, action history, execution trace, export or retention policy for agent activity.

For an agent that schedules meetings, drafts reviews in a manager's voice and nudges on engagement signals, there is no way to reconstruct which actions it took, on whose behalf, and when. Workleap's own monitoring is a separate matter.

Datadog handles "cloud infrastructure logging, analysis and monitoring," processing logs, traces, error reports and session replay data, and Sentry handles "application performance monitoring and error tracking," both for Workleap Compensation, so those tools watch Workleap's own systems.

Sourceworkleap.com/trust-center, the sub-processor register and the agent capability descriptionsread 2026-09-12

Customers can meet data sovereignty needs in three regions, Australia, the United Kingdom and the United States, with services hosted in one of the AWS regions in those countries and customer data kept logically separate through sharded database partitions and deployment across regions. The customer chooses among these regions, so they are more than a fact about where Deputy happens to run. Operating in more than eighty countries is market coverage, not hosting. There is no VPC, on premises or customer tenant option.

Sourcedeputy.com/securityread 2026-09-08

Where data is processed is disclosed in unusual detail, but the customer gets no choice over it. Microsoft Corporation provides general cloud services and AI inference through Azure AI Foundry for all products and Workleap AI, with processing in eighteen countries, which are Australia, Brazil, Canada, the United States, France, Germany, Italy, Japan, South Korea, Norway, Poland, South Africa, India, Spain, Sweden, Switzerland, the United Arab Emirates and the United Kingdom.

Anthropic processes in the USA, and MongoDB, AWS, Snowflake, Merge, FusionAuth and Rockset in the USA and Canada. The list tells a customer where their data could end up without letting them choose. Each processor carries its transfer mechanism, with Standard Contractual Clauses throughout, an adequacy decision for Canada on Cohere, and EU-US Data Privacy Framework self certification on most entries.

A customer with an EU localization obligation cannot get EU only processing, and there is no region selection, customer environment, single tenant option or self hosting. The disclosure itself is thorough, with 32 processors each given their nature of processing, data categories, countries, transfer mechanism and product scope, alongside a DPA that explicitly covers international transfers.

Sourceworkleap.com/trust-center/workleap-sub-processors and /trust-centerread 2026-09-12

There is one agent, not a set of agents a customer selects among, and Deputy says so directly. It is a single assistant for admins and managers, scoped by their role.

What a customer can adopt is a browsable AI prompt library, with named entries such as real time floor view, build a schedule from past patterns, peak demand cover, leave and availability, payrun readiness check, and multi day sick cover.

Alongside it sit industry configurations for retail, hospitality and healthcare, regional compliance rule sets and configurable labor model rules. Those are ways of asking one agent to do things, not separate products a customer adopts on their own.

Sourcedeputy.com/airead 2026-09-08

Six named agent capabilities, each with its own page, now make up the product instead of a single Manager Agent, and each does a distinct job. Briefing is "your daily read on what to know, do, and unblock." Performance Reviews "gathers the evidence, drafts in your voice, refines with the manager, and preps the conversation." Team Health and Feedback "spots engagement issues early, before they become problems." People and Org is "a living directory that surfaces relationship patterns, roles, expertise, and team health."

Meetings and 1:1s "schedules meetings, preps agendas, takes notes, follows-up." Goals "drafts goals, checks the cascade, flags gaps, tracks progress." Each stands on its own, serving one customer at different moments and on different objects. Two more libraries sit underneath. HR calibrates agent behavior "using a growing library of skills or custom ones," a set Workleap supplies for the customer to choose from, with authoring as the fallback.

A separate template library at workleap.com/template-categories is organized by category and reachable from the main navigation. Prebuilt review cycles, question banks and engagement frameworks ship with the performance and Officevibe modules, so a customer can run a cycle in week one. There is no third party or community contribution path and no marketplace of outside agents, so everything in the catalog comes from Workleap.

Sourceworkleap.com navigation agent capability set, template library entry and skills calibration descriptionread 2026-09-12

The customer does not choose the model. There is no model picker, admin model setting or routing control, and Deputy discusses the LLMs that power Deputy AI without offering a choice. Deputy built the platform with Amazon Web Services generative AI services, a disclosed provider, and AWS is also the cloud host. With one named provider, the lack of choice is clear. Customer information is not used to train the models, and customer data is not processed by the LLM itself. That is a data handling boundary, not a choice of model.

Sourcedeputy.com/ai and news.deputy.comread 2026-09-08

Several models run behind the agent and the stack is disclosed, but Workleap makes the choice, not the customer. Anthropic PBC provides the large language model for Workleap AI and AI Features, processing in the USA. Microsoft Corporation provides general cloud services (data hosting) and hosts and processes data for AI inference through Microsoft Azure AI Foundry, across all products and Workleap AI.

Cohere Inc. ranks search results and Unstructured Technologies parses files, both for Workleap AI and AI Features. So Anthropic generates, Azure AI Foundry hosts the inference, and Cohere ranks. There is no model picker, admin setting, assignment per capability or bring your own key path, and nothing lets a customer substitute a provider. The MCP server works the other way round.

Workleap's terms define AI Integration Features as letting a customer's third party AI tools "connect to, query, retrieve data from, transmit data to, or otherwise interact with the products" through the Model Context Protocol, which is the customer's assistant calling Workleap. Claude, Gemini and ChatGPT are named as clients that can connect, not as models that run the agent, and Workleap offers no way to connect a customer's preferred LLM.

Sourceworkleap.com/trust-center/workleap-sub-processors and /trust-center/termsread 2026-09-12

Deputy calls itself the API-first workforce management platform, with nearly every piece of the application available for integration.

It offers an ungated REST API on v1 and v2 addressed at the customer's own subdomain, OAuth 2.0 or permanent token authentication, an API reference that can be tried in the browser, a Postman collection, a changelog, an OpenAPI index at developer.deputy.com/llms.txt, and roughly sixty documented resource objects spanning employees, timesheets, rosters, leave, pay rules, tasks and webhooks.

Beyond REST there is Deputy Embed, with a provisioning API, calls made on behalf of an embedded account and an iFrame embed for putting Deputy inside a partner's product. There is also a Singer tap, Zapier and Workato, and DeXML, a server side scripting language per install. All of these let outside callers drive the platform. There is no public agent SDK or MCP server.

Sourcedeveloper.deputy.com/docs/getting-started-with-the-deputy-apiread 2026-09-08

An MCP server is written into Workleap's terms of service, which define AI Integration Features as "the functionality within the products that enables customer's third-party AI tools to connect to, query, retrieve data from, transmit data to, or otherwise interact with the products through standardized integration protocols, including the Model Context Protocol (MCP) and any successor or alternative protocols supported by Workleap."

It reads and writes, since "transmit data to" and "otherwise interact with" sit alongside query and retrieve, so an outside caller can put data into Workleap as well as read from it. The named clients are Claude, Gemini and ChatGPT. The Slack launch describes the MCP based architecture as laying the foundation for AI assisted actions in Slack workflows, "enabling Workleap AI to act on a user's behalf when explicitly authorized," which is still to come. MCP also works in the other direction.

Workleap lists "100+ vendors supported, native or via custom MCP," so a customer can extend the connector set through MCP instead of waiting for a native build, an extension surface separate from the inbound server. Workleap describes APIs and webhooks, and Merge API, the "unified API tool for provisioning multiple human resources information software," powers the HRIS connectors. There is no developer portal, endpoint reference, SDK or MCP tool list for a builder.

Sourceworkleap.com/trust-center/terms, with the integrations description and the Slack agent announcementread 2026-09-12

There is no evaluation harness, scored test cases, simulation surface, quality gate in a release path, or optimization loop run against the agent. Previewing projected labor cost and validating compliance before a schedule is published checks each roster, not a change under test. Demand forecasting from point of sale data measures demand, not the agent. Running a Labor Model executes a rule set instead of testing one. Deputy's accuracy and time saving claims are marketing.

Sourcedeputy.com/ai and developer.deputy.comread 2026-09-08

Nothing puts a change to the agent under test. There is no test environment, sandbox, dry run, holdout, A/B comparison, versioning of agent configuration, evaluator or scored verdict on agent behavior. An HR admin can retune a rubric or threshold and it governs the next cycle, but nothing runs that change against known cases first, and no result compares before with after.

Workleap's benchmarks, performance summaries and analytics measure the customer's workforce as assessed by its managers (engagement scores and trends, team health, review completion and individual performance), not the agent. The one check on agent output is the manager refining a draft before it goes out. Datadog for infrastructure logging and traces and Sentry for application performance and error tracking cover Workleap Compensation and watch Workleap's own systems.

Sourceworkleap.com/trust-center, sub-processor register and agent capability descriptionsread 2026-09-12

There is no hosted or local browser, desktop session, or remote or local computer control. Deputy AI acts inside Deputy's own workflows through its own APIs, and the platform reaches outside systems through a REST API, webhooks and an integration catalog, all programmatic. Two features come close, but neither is computer control.

Voice actions on mobile let a manager speak a change instead of typing it, so voice is an input channel to the agent. The time clock Kiosk, which has its own API resource, is a purpose built device app Deputy controls, not an agent driving software it does not control.

Sourcedeputy.com/ai and developer.deputy.comread 2026-09-08

Every path in and out of Workleap is a protocol, not a screen. It reaches other systems through named connectors, with HRIS via Merge API, Slack and Microsoft Teams through their own platform integrations, calendars for meeting scheduling, and Zoom for onboarding video. It extends that set "native or via custom MCP," and its own inbound surface is an MCP server that works through "standardized integration protocols" under the terms of service.

The agent reads people data from a central layer and writes calendar events, drafts and notifications through APIs, so a third party redesigning its interface does not touch it. There is no hosted or local browser, desktop session, remote or local computer control, RPA or recorder.

A browser automation or virtual desktop component would have to appear among Workleap's processors, and none does, since the 32 entries cover cloud hosting, databases, analytics, model providers, notification and support tooling. Meetings and 1:1s "takes notes," which on some products means joining a call as a participant bot, but nothing says that here.

Zoom is scoped to Workleap Onboarding for video recording, not to the meetings capability, and taking notes from a transcript or recording is document processing, not operating an interface.

Sourceworkleap.com/trust-center, the sub-processor register, /trust-center/terms and the agent capability descriptionsread 2026-09-12