In March 2025, HR technology company Rippling filed a lawsuit alleging that a company employee in its Dublin office had used internal access to gather confidential information relevant to Deel (Rippling). According to court filings, the employee held a role in payroll operations for over a year, then shifted into months of unusual internal searches and data exfiltration targeting sales, competitive intelligence, and internal business records before being caught through a “honeypot” sting.
To be precise about what was and wasn’t alleged: the reported exfiltrated data centered on customer information, pricing, and competitive intelligence, not a confirmed mass leak of individual contractors’ personal records. But the case is still worth knowing about, because it demonstrates something structurally important: platforms like this hold enormous troves of sensitive contractor and employee data, an insider with legitimate access can operate for a long time before detection, and even a company valued in the billions isn’t immune to that risk (Midpage).
That’s the actual subject of this article. Working as a remote contractor through an Employer-of-Record (EOR) platform, or through a dedicated contractor-management system, is meaningfully different from a typical one-off freelance client relationship, not because it’s automatically more dangerous, but because the structure of the relationship concentrates your data differently and for longer.
Table of Contents
What Actually Makes “Contractor” Different From “Freelancer” Here
A lot of freelancer security advice treats “contractor” and “freelancer” as interchangeable, and for most purposes they are. But a specific arrangement is worth calling out separately: when you work through an Employer-of-Record platform (Deel, Remote, Rippling, and similar services) or a dedicated contractor-management system, a third party sits between you and your actual client, and that third party, not just the client, ends up holding a continuous, ongoing record of your personal and financial information (Remote).
| Problems | Typical Freelance Client Relationship | EOR / Contractor-Platform Arrangement |
| Who holds your data | The individual client, usually just for the duration of that project | A third-party platform, on an ongoing basis, often across multiple client relationships simultaneously |
| How much data is on file is retained continuously (Deel) | Whatever a W-9 or invoice requires | Often more extensive, banking details, tax documents, sometimes government-issued ID or other identity-verification information for compliance |
| How long it’s retained | Typically ends when the project does | Persists for as long as the platform relationship continues, and sometimes after |
| What tools you might be issued | Rarely anything beyond platform messaging | Sometimes client-side VPN access, dedicated devices, or platform-specific login credentials |
This is IdentityBastion’s practical distinction for contractor-specific arrangements, not a formal legal classification, but a way to flag that the caution appropriate for a single freelance client doesn’t fully cover what’s actually different about an ongoing, platform-mediated contractor relationship.
The Vectors Specific to Remote Contractor Arrangements
Data concentration at the EOR or platform level. Because an Employer-of-Record platform exists specifically to handle compliance, payroll, and tax administration on behalf of a client, it typically holds a more complete personal and financial profile on you than any single freelance client would, banking information, tax documents, and in cross-border arrangements, identification documents, all retained continuously rather than exchanged once per project.
This concentration is functionally necessary for the platform to do its job, but it also means a a single platform-level security incident could potentially affect records associated with multiple client relationships.
Insider threat within the platform itself. The Rippling-Deel case is a useful recent illustration of this risk category, even though the specific information alleged to have been taken was competitive business intelligence rather than contractor identity data.. What it demonstrates is that an employee with legitimate internal access, in this case, someone who’d previously worked in payroll operations, a role that would plausibly touch contractor and employee financial records, can operate inside these systems for an extended period without detection.
The mechanism that applies here generally: platforms holding large volumes of sensitive data are attractive targets for insider misuse, and payroll-adjacent roles are exactly the kind of internal access that could, in a different case, be pointed at contractor personal records instead of competitor intelligence.
Client-issued VPN or device access. Some contractor arrangements, particularly longer-term or more integrated ones, involve being issued a client’s VPN credentials or a company-managed device. This cuts both ways: it can improve security compared to using your own unmanaged home setup, but it also means your session data now depends partly on how well the client secures their own VPN infrastructure, a compromise on their end can expose your session even if your own habits are solid.
Platform breaches affecting many clients simultaneously. Because a contractor-management platform serves many companies at once, a breach at the platform level, whether from an external attacker or an insider, has the potential to expose contractor records across every client relying on that platform, not just one. This is structurally different from a single freelance client’s own systems being compromised, where the exposure is limited to that one relationship.
Ongoing data retention after the arrangement ends. Similar to the lingering-access issue covered in our hub article, but specific to the platform level here: Your financial and personal information may remain on file after a specific contractor engagement ends, depending on the platform’s retention policy and applicable legal requirements (Remote).
Matching This to Exposure Tiers
Per the IdentityBastion Exposure Framework, the data an EOR platform typically holds, banking details, tax identifiers, sometimes passport information for cross-border compliance, sits squarely in Tier 1, and the sheer duration and breadth of that retention is what distinguishes this risk from a single client’s more limited Tier 1 exposure. Any client-issued VPN or device credentials fall into Tier 2, with the added wrinkle that you don’t fully control the security practices on the other end of that access.
What Actually Helps, and What It Doesn’t
| Protection | Solves | Doesn’t Solve |
| Using unique credentials for any client- or platform-issued account, separate from your personal logins | Limits the damage if one set of credentials is compromised | Doesn’t protect against a breach or insider incident at the platform’s own infrastructure level |
| Asking what a platform’s data retention policy is once an engagement ends | Gives you a basis to request deletion where policy allows it | Depends entirely on the platform actually honoring its stated policy |
| Checking whether an EOR platform has independent security certifications (SOC 2, ISO 27001, or similar) | A reasonable signal of evidence that the organization has undergone a defined security assessment or certification process | Doesn’t guarantee that every insider, access-control, or human-error risk has been eliminated |
| Limiting what personal data you provide beyond what’s legally required for the specific engagement | Reduces the total exposure sitting with any one platform | Doesn’t help with data already required for compliance purposes, which isn’t optional |
| Treating client-issued VPN/device access with the same password hygiene as your own accounts | Reduces your own contribution to a compromised session | Doesn’t address vulnerabilities in the client’s own VPN infrastructure |
Common Mistakes With Contractor Arrangements
Assuming a well-funded, well-known platform is automatically more secure. A well-funded or established company is not automatically immune from insider threats. Effective controls depend on access restrictions, monitoring, and oversight, not company size alone (FTC).
Reusing personal passwords on client- or platform-issued accounts. This is the same mistake covered generally in our dedicated mistakes article, but it carries extra weight here because a compromised contractor-platform credential can expose data tied to multiple client relationships at once, not just one.
Never asking about data retention once an engagement ends. Most contractors simply assume their information gets deleted or becomes irrelevant once a project wraps up, without ever confirming that’s actually the platform’s policy.
Treating certifications like SOC 2 as a guarantee rather than a baseline signal. These certifications reflect a level of process maturity, not immunity from insider misuse or human error, useful information, but not a reason to stop asking other questions.
FAQs: Identity Theft Risks for Remote Contractors
Is Working Through an Employer-Of-Record Platform Less Safe Than Direct Freelance Clients?
Not inherently less safe, but structurally different, an EOR platform may hold more of your personal and financial information, and may retain it beyond an individual project, depending on the services provided and its retention policies.
What Happened in the Rippling-Deel Case, and Does It Mean Contractor Platforms Are Unsafe?
It was a corporate espionage case involving an employee accused of stealing competitive business data, not a confirmed mass leak of contractor personal information. It’s still a useful, real illustration that platforms holding large volumes of sensitive data are attractive insider-threat targets, regardless of company size or funding.
Should I Be Worried About Using a Client-Issued VPN or Device?
Not automatically, a properly managed company device or VPN can provide additional security controls, but it also means part of your security depends on the client’s infrastructure and configuration.. The main consideration is that your session security now partly depends on how well the client maintains their own infrastructure, which is outside your direct control.
How Do I Know What Happens to My Data After a Contractor Engagement Ends?
Ask directly, most contractors never do, and retention policies vary significantly by platform. If deletion is available and matters to you, it’s something you have to request rather than something that happens automatically.
Does a Platform Having Security Certifications Mean My Data Is Safe There?
It’s a reasonable positive signal, but certifications like SOC 2 primarily reflect process maturity rather than a guarantee against every risk, particularly insider threats, which formal audits don’t fully capture.
The Bottom Line: Identity Theft Risks for Remote Contractors
Remote contractor arrangements through an EOR or contractor-management platform aren’t inherently riskier than freelance work, but they do concentrate more of your data with a third party, for longer, than a typical single-client relationship does. The practical adjustments worth making: treat any platform- or client-issued credentials with the same care as your own, ask about data retention once an engagement ends instead of assuming it’s handled, and don’t let a platform’s size or valuation substitute for asking how it actually protects the data it holds.
What to Do Next
Contractor arrangements often involve self-employment tax obligations that carry their own separate identity theft risk, particularly around how income gets reported and where fraud can slip in during tax season. Our guide covers what’s specific to self-employed and contract workers.
Pingback: Digital Identity Theft Protection for Freelancers: A Guide