The master Terms of Service list optional services and features that are governed by separate addenda. Several of those addenda are of direct interest to a licence manager because they control who may use which data, how output may be reused and which third parties become part of the service. This article covers the Artificial Intelligence Addendum, the developer and API terms, and the addenda for compensation benchmarking, employer of record, e-signature and third-party services.
Editions
AI is offered in three tiers by package, according to the pricing page: an AI Assistant for HR data questions in Core, an upgraded assistant covering company policies and documents in Pro, and an advanced assistant for benchmark questions and analysis in Elite.[9] The Terms of Service say that BambooHR AI features “are offered by BambooHR as a part of the Services” and that a customer using them accepts the AI Addendum.[3] The catalog row is BambooHR AI.
Compensation Management (planning, benchmarking, levels and bands) is part of the Elite package and is governed by the Compensation Management Addendum, recorded as Compensation Management.[5] Global Employment, recorded as Global Employment, is sold as an add-on with the Employer of Record service powered by Remote.[8]
Metrics
BambooHR names few metrics in these documents. Two appear. The Developer Terms limit a Developer to “no more than two (2) BambooHR Test Accounts at any time” unless BambooHR approves otherwise in writing, recorded as Developer Test Account.[2] The Global Employment page describes the EOR service as available in 90+ countries, recorded as Country (Employer of Record).[8]
AI usage has no stated unit. Instead, the AI Addendum says that “customer’s use of Bamboo AI is subject to fair usage restrictions that BambooHR may determine in its sole discretion” and that if the customer exceeds what BambooHR determines to be fair, BambooHR “may disable or degrade performance of Bamboo AI”.[1] Without a published number the fair usage limit cannot be planned against.
Counting and floors
The AI Addendum gives these operative terms. Output “shall be customer Data”, the customer is responsible for Inputs and Data, and Output “may not be unique” because the same or similar output may be generated for others.[1] The customer must not input sensitive or regulated information such as protected health information, government-issued identification numbers or personal financial or bank account information, and must not use Bamboo AI to develop competing foundation models, to mislead anyone that output was solely human-generated, or “for high-risk, significant or consequential decisions under Applicable Law”.[1] The customer is solely responsible for its own AI use policies, transparency and explainability notices, consents and human oversight.[1]
BambooHR owns Bamboo AI and any resulting Performance Data. If it uses customer Data, Input and Output to fine-tune models, it does so “just to provide the Bamboo AI features to you” as a Customer Trained Model that it will not otherwise use for other customers.[1] The addendum defines “AI Providers” as OpenAI and Cohere and prohibits uses that violate their policies.[1] The Terms of Service add trade-secret language for BambooHR AI, listing system prompts, model weights, tool definitions and reasoning traces, and prohibit using output to train or benchmark any machine learning model and publishing benchmarks of the Service without consent.[3]
For API use the Terms provide that API keys “are provided solely for your internal business use in systems or applications operated directly by you” and “may not be used for any third-party integrations under any circumstances”; authentication for third parties “must be exclusively via BambooHR’s OAuth-based authentication framework through BambooHR’s developer portal or marketplace program”.[3] The customer must avoid “an excessive number of requests to be made in too short a period of time, as-determined solely by BambooHR” or face throttling, suspension or termination of API use.[3] Any “third-party agent, MCP server, or automated system” the customer authorizes must be bound by confidentiality terms at least as protective as section 6.5, and the customer remains liable for its behavior.[3] This is a notable commercial constraint for organisations that connect HR data to automation platforms or AI agents: a key issued to the customer cannot be handed to a vendor.
The Developer Terms apply to anyone using BambooHR’s Developer Tools. They grant “a limited, revocable, non-exclusive, non-transferable, non-sublicensable, royalty-free license” to build an Integration, allow BambooHR to adjust rate limits or discontinue endpoints, and state that API keys are issued to customers for internal business purposes and must be used only in systems “operated and controlled directly by the BambooHR Customer”, with contractors permitted only where the resulting system and credentials remain under the customer’s direct control.[2] The row is Developer Tools license.
Virtualization and partitioning
Not applicable. All services are hosted; no installable software is delivered other than the embedded software of time clock devices.
Cloud and BYOL
Third-party and embedded services complicate the picture. The Third-Party Services Addendum defines marketplace partner services, embedded partner services and broker services, and states that “some Third-Party Services (including certain Embedded Partner Services) may be automatically enabled within the Services for eligible customers and may require you to opt out”.[4] By enabling or using a third-party service, the customer authorizes BambooHR “to share Customer Data and, where applicable, employee data with the relevant third-party provider”, and warrants that it has the necessary consents.[4] Where a provider acts as an independent controller, BambooHR’s Terms and privacy agreements do not apply to the processing once data is transmitted.[4] A licence manager who counts subprocessors and data flows should therefore check which embedded services are enabled in the account.
Two embedded relationships are named in the addenda. For Employer of Record, “all EOR employees hired by Remote through the EOR Services are employees of Remote”, not of BambooHR, and the customer must accept Remote’s Terms of Service before using the service; BambooHR’s cost calculations are estimates.[6] The Global Employment page adds that hiring and onboarding start in BambooHR while payroll and benefits are handled in the Remote platform.[8] For Compensation Management, benchmarking data is owned by BambooHR or its licensors, including Mercer, which is an express third-party beneficiary and may enforce the addendum; the customer may not redistribute, sublicense, publish or disclose benchmarking data.[5]
The eSignature Addendum states that BambooHR “is not a party to the document” signed with its service and disclaims responsibility for the validity of electronically signed documents.[7]
Programs
The Developer Tools license and the broader program of Additional Services and Addenda are the programs of record. The Terms of Service provide that the Additional Terms “become part of this Agreement by reference” and apply in preference to the main terms where they directly conflict.[3] In practice a customer who uses AI, an embedded partner or the API accepts the corresponding addendum by use, so the set of terms applicable to an account depends on which features have been enabled.
Out of scope
This article does not cover package prices, the main subscription terms, payroll, benefits or time clock addenda (see the other articles), the Data Processing Agreement, the Business Associate Agreement or the subcontractor list. It does not assess the lawfulness of AI use in employment decisions, which depends on jurisdiction. It does not cover the Human Interest, I-9, ACA, EasyLlama, VirgilHR or Turn addenda listed in the Legal Hub.