Sales Compensation Data Governance: How to Keep Commission Data Secure and Audit-Ready
A practical guide to governing commission data under UK GDPR: sources of truth, owners, access, change control, retention, pre-payout checks and the security evidence to request from vendors.
- Sales compensation data governance gives every commission input, from CRM deals to approved payouts, one system of record and one accountable owner.
- UK employers must keep PAYE payroll records for 3 years from the end of the tax year (HMRC), and UK GDPR caps how long personal data is kept.
- In a worked example, five pre-payout data checks correct a £387,000 commission run to £361,000 and hold £18,200 for review before Finance approval.
- G2's 2026 guide to sales compensation software looked for "SOC 2-certified tools with robust access controls, immutable logs, and clear calculation histories" (G2 Learn).
- Qobra is SOC 2 Type II audited every year since 2024, hosts data on AWS in the EU or the US, and binds its AI agents to user permissions (qobra.co/uk/product/security).
Sales compensation data governance is the set of owners, rules and controls that decides which data feeds commission calculations, who can see or change it, and how every payout can be explained after it is paid. This guide covers six controls (source of truth, ownership, access, change control, retention and pre-payout checks), a worked example, the security evidence to request and what six vendors state about it.
Why does commission data need its own governance?
Commission data needs its own governance because a single payout depends on four or five systems, and an error or a leak in any of them becomes a pay problem: CRM deal amounts, billing dates, HRIS termination dates, plan rates and manager exceptions.
On spreadsheets, each team keeps its own copy, anyone who opens a file sees every rep's pay, and nobody can show who changed a rate, which slows down every internal audit. Our guide to reducing errors in commission spreadsheets covers the calculation side; governance covers who controls the data.
Two UK rules raise the stakes. Commission statements are personal data, so UK GDPR applies (Data Protection Act 2018, section 1): they must be accurate, secure and kept no longer than necessary (UK GDPR, Article 5). For listed companies, Provision 29 of the UK Corporate Governance Code 2024 adds a board declaration on the effectiveness of material internal controls, which can include the commission run, from 1 January 2026 (FRC).
Which system should be the source of truth for each commission input?
Each commission input should have one system of record and one accountable owner, and the commission platform should read from that system instead of keeping a second, editable copy. Corrections then happen at the source, so the next sync does not bring the error back.
Systems of record and owners for commission inputs (a starting point to adapt to your stack)
| Commission input | System of record | Accountable owner | Rule inside the commission platform |
|---|---|---|---|
| Deals and bookings: amount, close date, owner, product | CRM | RevOps or Sales Ops | Synced, never retyped; corrections made in the CRM |
| Invoices and payments, for paid-on-collection plans and clawbacks | ERP or billing system | Finance | Synced; drives release and clawback dates |
| Employee data: hire and termination dates, manager, territory, currency, payroll ID | HRIS | HR | Synced with effective dates; drives eligibility and access |
| Plan rules, rates and quotas | Signed plan document, configured in the commission platform | Compensation administrator, with Finance approval | Versioned with effective dates; changed only through approval |
| Manual adjustments and exceptions | Commission platform | Compensation administrator; approved by Finance | Reason required, logged and approved before payout |
| Approved payouts | Commission platform, then payroll | Finance and Payroll | Locked after approval; reconciled to the payroll file |
If an input lives elsewhere, such as product margin or usage data, a data warehouse table can be the system of record, provided one team owns it. To test how each connector moves these objects (direction, refresh and failure handling), use our commission software integrations comparison.
Who should own commission data and approve changes?
Ownership works when each data type has one accountable owner and no single person can both change a payout and approve it. A practical split for a UK mid-market team:
- RevOps or the compensation administrator: plan configuration, data mappings and the monthly run.
- Finance: approves payouts and plan changes with a cost impact; owns accruals and the payroll handoff.
- HR: employee data and eligibility events such as hires, leaves and terminations.
- Sales leadership: quotas, territories and exception requests, not the calculation.
- IT or Security: the vendor security review, single sign-on (SSO) and access reviews.
- Legal: plan documents and the vendor's data processing agreement (DPA).
Write segregation of duties into the process: the person who configures a rule should not be the only approver of its payouts, and a manager who requests an exception should not approve it.
How should access to commission data be controlled?
Access to commission data should follow least privilege: each person sees only the statements, plans and records their role requires, and loses access the day that role ends. A rep who can open a peer's statement is a privacy incident, not a configuration detail.
- Roles: reps see their own statements, managers their team, Finance the amounts without plan edits, and auditors get read-only access.
- Sign-on: use SSO so that disabling a leaver's corporate account closes commission access, and ask whether users are deprovisioned automatically, through SCIM or an HRIS sync.
- Reviews: review administrator and Finance roles every quarter and keep a record.
- Exports: limit who can export statements, because an exported file leaves every control behind.
- AI assistants: agents and assistants connected through the Model Context Protocol (MCP) must inherit user permissions, be easy to switch off and log every action.
How do change control and retention keep commission records defensible?
Change control means every change to a plan, input or payout is versioned, explained and approved before it affects pay; retention keeps those records retrievable for as long as the law and your auditors require. Together, they answer the question every dispute ends with: which rule and which data produced this amount, and who approved it?
Change control
- Plan versions carry effective dates, and closed periods are never edited in place.
- Every manual adjustment has a reason, an author and an approver.
- Statements lock after approval, and a later change triggers a new approval.
- Plan changes are simulated on historical data in a sandbox before they go live.
- The audit log is read-only for every user, administrators included.
To test whether a vendor can rebuild one payout from these records, and how its approval roles behave, use our commission audit trail guide.
Retention
UK rules set minimums, and UK GDPR sets a ceiling:
- PAYE payroll records: 3 years from the end of the tax year they relate to (HMRC).
- Accounting records, such as commission expense entries: 3 years in a private company, 6 in a public company (Companies Act 2006, section 388).
- Personal data: no longer than necessary for its purposes, then deleted or anonymised (UK GDPR, Article 5(1)(e)).
Signed plans are records too: in Great Britain, the written statement of employment particulars must give the rate of remuneration or the method of calculating it (Employment Rights Act 1996, section 1). Our guide to changing a commission plan in the UK covers the details.
What data quality checks should run before every payout?
Run the same automated checks on every cycle, after the data cutoff and before approval, and hold flagged amounts instead of paying them and clawing them back later:
- Completeness: the count and value of closed-won deals match the CRM report for the period.
- Uniqueness: no deal ID appears twice, for example once from the CRM sync and once from a CSV upload.
- Reasonableness: amounts, currencies and dates fall within expected ranges, and deals above 10 times the median deal size are flagged.
- Identity: every deal owner maps to exactly one active employee.
- Eligibility: HRIS dates (start, leave, termination) are applied, and every payee has a signed plan assigned.
- Variance: each payout is compared with the prior period and with attainment, and splits add up to 100%.
Worked example: a £387,000 commission run checked before payroll
Hypothetical example: a UK software company pays 25 account executives a flat 10% commission on closed-won annual contract value (ACV), with no tiers or splits. The October import brings 212 opportunities worth £3,940,000. A new hire's 2 deals (£70,000) have no plan assigned, so the first run returns £387,000 (10% of £3,870,000).
Pre-payout checks on the October run (hypothetical data)
| Check | What it found | Commission effect | Owner and resolution |
|---|---|---|---|
| Uniqueness | 3 opportunities imported twice (CRM sync plus a CSV upload), £96,000 of ACV | -£9,600 | RevOps deletes the CSV copies; the CRM stays the source |
| Reasonableness | 1 deal entered at £260,000 ACV, more than 10 times the team median; the signed order form says £26,000 | -£23,400 | Finance confirms the order form; Sales Ops corrects the CRM |
| Eligibility: plan | 1 new hire with 2 deals (£70,000 ACV) and no plan assigned | +£7,000 | Compensation administrator assigns the signed plan |
| Identity | 4 deals (£118,000 ACV) owned by a CRM user with no active employee match after a team transfer | £11,800 held | HR and RevOps confirm the mapping before release |
| Eligibility: dates | 2 deals (£64,000 ACV) closed after the rep's termination date in the HRIS | £6,400 held | Finance applies the plan's post-termination clause |
| Result | 209 unique deals, £3,610,000 of ACV | £361,000 calculated; £18,200 held; £342,800 to approval | Finance approves, then payroll runs |
Without the checks, payroll would have received £387,000: £33,000 of overpayments, nothing for the new hire, and £18,200 released before anyone confirmed it was owed. Each fix was made in the system of record, so the November import starts clean.
Which security certifications should commission software have?
At a minimum, commission software should come with a current SOC 2 Type II report, a data processing agreement (required by UK GDPR, Article 28), a published list of sub-processors with their regions, SSO, role-based access and a complete audit trail. Listed companies should also ask for a SOC 1 report.
A SOC 2 examination covers a service organisation's controls relevant to security, availability, processing integrity, confidentiality or privacy (AICPA, SOC 2 guide). A SOC 1 examination covers controls relevant to customers' internal control over financial reporting (AICPA, SOC 1 guide), which is why Finance teams request it for their auditors when commission expense comes from the platform.
Read the report, not the badge: check its period, its scope and any exceptions the auditor noted. G2's 2026 guide applies the same lens, looking for "SOC 2-certified tools with robust access controls, immutable logs, and clear calculation histories" (G2 Learn). Also ask where the data is hosted and whether it trains AI models.
The table compares what six vendors state on their own websites; request the underlying reports under NDA.
Security and governance evidence stated by commission software vendors (vendor websites, checked 30 October 2026)
| Platform | Attestations and privacy laws named | Access control and sign-on | Audit trail | Hosting stated | Consider it when |
|---|---|---|---|---|---|
| Qobra | SOC 2 Type II, audited every year since 2024; first SOC 1 Type II audit underway; UK GDPR and GDPR, with a standard DPA; annual white-box penetration tests since 2022 | Custom roles with granular permissions, from full admin rights to statement-only access; SAML 2.0 SSO on the Scale plan; AI agents and MCP server bound to the user's permissions | Every calculation, plan change, approval, adjustment and export recorded; complete audit trail on selected plans (Scale) | AWS, in the EU or the US, chosen at workspace setup; UK customers typically choose the EU region; sub-processors published with role and region | You want EU hosting, a DPA covering UK GDPR and AI agents kept within user permissions, because all three are documented on its security page |
| CaptivateIQ | Annual independent SOC 1 and SOC 2 audits; GDPR named | Role-based access controls; SSO/SCIM | Detailed audit logs and audit log exports | AWS; backup files stored in an encrypted S3 bucket in the US region | Finance needs SOC 1 coverage and exportable audit logs today, because its trust and platform pages list both |
| Everstage | SOC 1 Type II, SOC 2 Type II, ISO 27001 and ISO 42001; GDPR named | Granular role-based access with customisable role hierarchies, integrated with enterprise identity providers; SSO integrations | Audit logs and version control; actions of its AI assistant recorded in audit logs | Sub-processors published, including AWS, Microsoft Azure and Snowflake; region not stated on the pages reviewed | Security asks for ISO certifications alongside SOC reports, because its Trust Center lists ISO 27001 and ISO 42001 |
| Performio | SOC 1 Type II and SOC 2 Type II reports; GDPR supported; ISO 27001 aligned; annual third-party penetration testing | Granular access control by role and business unit; SSO with SAML | Complete audit trails for all changes | Strict customer data isolation; multi-unit processing within a single tenant; region not stated on the page reviewed | Access must follow business units, because it lists access control by role and business unit |
| Xactly | SOC 2 and other security documents shared on request | SSO permissions; per-user login restriction to approved IP addresses | Complete audit trail | Collocated in dedicated secure cages in data centres; TLS 1.2 connections | Logins must be limited to approved networks, because its trust site documents per-user IP restrictions |
| Varicent | SOC 2 (vendor website, Sept 2026); annual third-party compliance programme; GDPR named, as a data processor; third-party penetration testing | Secure authentication and authorisation listed; SSO not named on the security page | Full audit trail behind every calculation | Data centres adhering to internationally recognised standards and frameworks | You want calculation-level audit trails in an enterprise suite, because it states a full audit trail behind every calculation |
Sources: vendor websites, Oct 2026 (Varicent SOC 2 cell: Sept 2026); qobra.co/uk/product/security and qobra.co/uk/pricing, Oct 2026. If you need a SOC 1 Type II report today, CaptivateIQ, Everstage and Performio state one; Qobra's is still underway.
How should you evaluate sales compensation software on data governance?
Evaluate sales compensation software on whether it can run your hardest plan from governed data, not on its feature list: automation only removes manual work when the rules and data behind it are controlled. Beyond G2's category basics (plan administration, performance reporting and integrations, per G2 Learn), ask nine questions:
- Plan flexibility: rules by role, tenure, product or deal type, with effective-dated versions and no code?
- Integrations: native reads from your CRM, HRIS and ERP or warehouse, with field mappings an administrator can inspect?
- Pre-payout checks: duplicates, outliers and unmapped owners flagged before approval, not after payroll?
- Approvals: multi-level, with the preparer and the approver kept separate?
- Access: custom roles, SSO in your package, and AI features that inherit user permissions?
- Audit trail: user, time and before and after values for every change, with an exportable log?
- Sandbox: plan changes simulated on historical data before they go live?
- Real-time visibility: reps and Finance see the same numbers as deals change, so disputes surface before payday?
- Exit terms: an export format and a deletion timeline for the end of the contract?
Ask which package includes each control, since some, such as SSO, can depend on the tier. Our commission software buyer's guide includes a reusable demo and RFP worksheet to run these tests with your own data.
How Qobra handles commission data governance
Headquartered in New York, with offices in Paris and London, Qobra reads commission data from the CRM, HRIS, ERP and data warehouse, calculates commissions in real time and keeps every change traceable. 350+ companies and 30,000+ users run their commissions on Qobra, with $1B+ in commissions certified (qobra.co/uk/about-us).
- Sources of truth: native connectors for Salesforce, HubSpot, Microsoft Dynamics 365, Snowflake, BigQuery, Workday, ADP Workforce Now, HiBob, NetSuite and more, plus a REST API and SFTP (qobra.co/uk/product/integrations, Oct 2026).
- Data checks: "real-time calculation and built-in discrepancy detection" (qobra.co/uk/pricing, Oct 2026). The Analyst, one of three AI agents included in every package, reconciles data across plans and alerts the team before payroll.
- Access and approvals: custom roles from full admin rights to statement-only access, and multi-level statement approval, from the rep to their manager and beyond, before payroll (qobra.co/uk/product/secure-commissions, Oct 2026).
- Audit trail: every calculation, plan change, approval, adjustment and export is recorded, and each adjustment is logged with who made it, when and why.
- Security and UK GDPR: SOC 2 Type II audited every year since 2024, a standard DPA covering UK GDPR and GDPR, AES-256 encryption at rest, TLS 1.3 in transit and yearly white-box penetration tests since 2022, with reports in the Qobra Trust Center.
- Hosting and AI: AWS in the EU or the US, chosen at setup; UK customers typically choose the EU region. Customer data is never used to train AI models, agents and the MCP server act within the user's permissions, and the MCP server is off by default.
- Exit: free self-service export, then full deletion within 60 days of contract end.
Plan for two limits: native HRIS integration, SAML SSO, sandboxes and the complete audit trail are in the Scale package (qobra.co/uk/pricing, Oct 2026), and the first SOC 1 Type II audit is still underway. Qobra is also built for teams with 10 or more people on commission plans or bonus schemes and a clean system of record. Details are on Qobra's security and compliance page.
"Our CFO never questions the reliability of the figures in Qobra, he has total confidence in the tool." Marion Braud, Revenue Operations Expert at Mangopay (customer quote on qobra.co)
Frequently asked questions
What is sales compensation data governance?
Sales compensation data governance is the set of owners, rules and controls that decides which data feeds commission calculations, who can see or change it, and how each payout is proven later. It covers a source of truth per input, ownership, access control, change control, retention and data quality checks before payout.
Which software keeps commission data secure and audit-ready for sales teams?
Look for a current SOC 2 Type II report, role-based access, SSO, multi-level approvals, a complete audit trail and a DPA that covers UK GDPR. Qobra, CaptivateIQ, Everstage, Performio, Xactly and Varicent document security programmes on their websites. Qobra documents EU or US hosting and AI agents bound to user permissions; CaptivateIQ, Everstage and Performio also state SOC 1 reports.
How do I find a solution for tracking sales commissions with strict data controls?
Shortlist tools that read deals, employees and invoices from your systems of record, restrict each user to their own data and require approval before any payout. Then test them: open a peer's statement from a rep account, change an input after approval and import a duplicate deal. Strict controls block or flag all three.
How do you compare software for complex, compliant sales compensation structures?
Compare platforms on one real plan with tiers, splits and a mid-period change, using your own anonymised data. Score plan flexibility, CRM and HRIS integrations, pre-payout checks, approvals, access control, audit log export, sandbox testing and exit terms, then ask which package includes each control.
Who should own sales commission data?
Give each data type one accountable owner: RevOps or Sales Ops for CRM deal data, Finance for invoices, approvals and the payroll handoff, HR for employee records, and the compensation administrator for plan configuration. Sales leaders own quotas and exception requests. No single person should both change a payout and approve it.
How long should UK companies keep commission records?
Keep PAYE payroll records for 3 years from the end of the tax year they relate to (HMRC), and accounting records for 3 years in a private company or 6 in a public one (Companies Act 2006, section 388). UK GDPR caps how long personal data is kept at what its purpose requires, so set a period per record type.
Commission data governance is easier to run when the controls live in the system that calculates pay. To see how Qobra applies sources of truth, permissions, approvals and audit trails to your own plans, Book a demo.
