Open source HR software for public sector organizations

Most agencies connect the HR system to their existing directory so staff sign in with their normal credentials. In Frappe HR and ERPNext, the LDAP integration documentation covers directory-based sign-in, and social login keys cover federated sign-in through an external identity provider. The data moved is the user identity (username, email, group membership) from the directory into the HR system, and sometimes role mappings. The directory team owns the account source and group design, while the HR team owns which groups map to which HR roles. Confirm with the identity team which attribute is the login key, whether groups or only attributes are read, how disabled accounts are handled, and whether a service account with read-only rights is permitted under the agency's policy.

The HR system typically exports employee master data, pay-period attendance and leave, overtime, and pay element changes to the payroll provider, which calculates pay and tax. The payroll team owns the file layout, the cutoff dates and the reconciliation of totals, while the HR team owns the accuracy of source records. Many agencies still run payroll through a separate provider, so the export is often a scheduled CSV or a documented API call rather than a live link. Confirm the exact file specification with the payroll vendor, the cutoff calendar for each pay run, how corrections after cutoff are handled, who signs off on the reconciliation report, and whether the export must be retained as evidence of what was paid.

Payroll cost postings, position budgets and headcount figures usually flow from the HR or payroll output into the general ledger or the agency's financial management system. The data moved is summarized cost by fund, cost center, department and pay element, plus position and vacancy counts for budget reporting. The finance team owns the chart of accounts and posting rules, and the HR team owns the position and cost center assignments. Confirm with finance which account codes are used, whether postings are journal-level or summarized, how reversals and retroactive pay are posted, and who approves the batch before it reaches the ledger. If the agency uses an ERP such as Odoo or ERPNext in-house, check whether the HR and accounting modules are part of the same installation.

Mandatory training, licence renewals and professional certifications often need to be tied to an employee record so that compliance checks and role eligibility can be reviewed. The data moved is the course or certificate type, completion or expiry date, issuing body and the employee identifier. The HR or learning team owns the requirement list for each role, while the training provider or internal academy owns the completion evidence. Confirm whether records arrive by file import, by a provider API, or by manual entry, how expiry alerts reach managers, and how long completed training evidence must be kept under the agency's retention schedule. Ask whether certificates are stored as documents in the HR system or only referenced.

Agencies commonly produce headcount, vacancy, leave liability, workforce composition and pay-band reports for oversight bodies, legislatures and public transparency portals. The data moved is aggregated, and in some cases anonymized, extracts from the HR system. The HR analytics or reporting team owns the report definitions, while legal or information governance owns the decisions about what may be published and at what level of detail. Confirm the mandated report formats and deadlines, the small-cell suppression rules that prevent individuals from being identified, who can run exports, and whether each export is logged. Ask whether reports must be reproducible for a later audit, which affects how report definitions are versioned.

The HR system is usually the source of truth for who is employed and in which role, so joiners, movers and leavers can trigger account creation, access changes and removal in the identity governance layer. A typical pattern feeds HR records into an identity governance tool such as midPoint, which then provisions accounts in a directory such as Keycloak. The data moved is employee identifier, status, department, manager and role or position, with the effective date of each change. The HR team owns the employment events, the identity team owns the provisioning rules and the access entitlements. Confirm the event triggers and their timing, how a rehire is matched to a prior identity, how leave of absence is treated, and how access removal is evidenced for audit.

Start with the integrations that gate a pay run or an access decision, because errors there affect staff immediately. In practice this means the payroll export, the identity sign-in path and the joiner-mover-leaver feed, followed by the finance posting feed and then reporting and training links. Agencies should write down each interface with its owner, data fields, frequency, cutoff and evidence before build starts, since the scope is usually fixed in writing before work begins. Ask the implementation partner to document each interface in the agreed scope and to name who in the agency signs off on test results for each one.

Some agencies have in-house developers who can build simple file exports and directory sign-in, particularly on Frappe HR or ERPNext where LDAP and social login are documented features. The harder work is usually the payroll mapping, reconciliation, provisioning rules and testing against live pay runs, which need both HR and IT sign-off. Server scripts in Frappe are disabled by default from version 15 and must be enabled deliberately, which is a governance decision as well as a technical one. DeployOpen plans, implements, integrates and documents self-hosted open-source platforms inside the client's own infrastructure, and most engagements are fixed-scope with the scope agreed in writing before work starts. Confirm internally who will own each interface after handover.

The software licence is often the smallest line item, and for ERPNext the self-hosted software itself is free under GPL-3.0, according to the ERPNext pricing page. The cost is paid elsewhere: hosting inside your own cloud or data center, the payroll and localization work for your jurisdiction, integration with your existing payroll and identity systems, data migration, testing, training, and the staff time your HR and IT teams spend. Frappe Cloud shared site hosting starts at 5 US dollars per month, per the same pricing page, but a public sector hosting decision usually moves to your own infrastructure, so ask for that cost separately. One-time work (design, migration, cutover) differs from recurring work (hosting, patching, support, upgrades). Ask every bidder for a fixed-scope quote that lists these components separately.

The timeline is set by the number of employee record types, payroll rules, the number of integrations, and how much historical data must move. Payroll cutover is usually the fixed point the rest of the plan works around, so it should be chosen early and tested in parallel runs. Procurement, hosting approval, security review and accessibility testing of self-service pages often take longer than the software configuration itself. Ask each partner for a written schedule with milestones, the staff they need from you, and the assumptions behind each phase. Any duration you are given should trace back to the scope, not to a generic template.

Your team needs to supply decisions and data that only the agency can give. Typical inputs include:

• Approved leave policies, pay rules and collective agreement provisions for each employee group
• Employee master data extracts and a named data owner who signs off each mapping
• Access to the current payroll provider, identity directory and accounting system for integration testing
• Business owners for approvals, reporting and records retention decisions
• Staff for user acceptance testing and payroll parallel runs in the months before cutover

Delays usually come from slow sign-off on these inputs rather than from technical work. Confirm the list, the named people and the review turnaround in the statement of work before work starts.

Some teams can, but the answer depends on skills you already have in-house. Running ERPNext, for example, can be done through Docker Compose or the bench command line tool, and the frappe_docker repository provides production images, but production operation also needs database backups, patching, monitoring, and access controls that you must maintain yourself. Frappe's supported versions policy also says that warranty coverage from Frappe requires a listed version and a matching Frappe Cloud support plan. Many agencies keep day-to-day operation in-house and buy a partner for design, payroll localization, integration, hardening and upgrades. Ask any partner which parts you would own after handover and what documentation you receive.

Usually not on its own terms. FedRAMP's scope covers cloud products and services that create, collect, process, store or maintain federal information on behalf of an agency, and systems used only for a single agency's operations on cloud infrastructure, not offered as a shared service, are out of scope, according to FedRAMP's scope guidance under M-24-15. Your HR system may still face federal or state requirements if it handles federal grant, contract or criminal justice data, so confirm with your records officer and counsel. If your agency is a defense contractor storing controlled unclassified information, the CMMC rules apply to cloud service use. Ask your partner to map each data type to the rules that govern it before hosting is chosen.

Employee self-service pages for leave requests, payslips and timesheets are state or local government web content, so they fall under the ADA Title II rule. The rule requires WCAG 2.1 Level A and AA from 26 April 2027 for entities serving 50,000 or more people, and from 26 April 2028 for smaller entities and special districts, according to 28 CFR 35.200. This applies to content provided through contracts or licenses, so configuration and customizations from a partner count too. Ask for accessibility testing of each self-service form and document the results as part of the handover. Confirm the population threshold that applies to your entity with your legal team.

Start with the controls that match your records and access obligations. Role-based access for managers, HR staff and payroll staff, audit logs for changes to employee and pay records, multi-factor authentication for administrators, encryption in transit and at rest, and tested backups are the common baseline. If your state or agency follows NIST SP 800-53 through a state framework, map each control to its baseline (low, moderate or high) using the control catalog, which lists 149, 287 and 370 controls and enhancements for those baselines. Ask for penetration testing before go-live and for the evidence file that proves each control works.