Connect your Rippling account. Employee names, work emails, eligibility, and plan types flow into NudgeWell automatically — no CSV uploads, no broker ping-pong, no monthly reconciliation.
Read-only OAuth · Tokens encrypted at rest · HIPAA-adjacent data segregated
The Problem
HR re-exports a CSV from your HRIS once a quarter (or once a year). Every new hire falls through the cracks until the next export.
Without a live sync, terminated employees remain enrolled until the next census — generating nudges, draining engagement, and risking PHI exposure.
Eligibility data lives with the broker. Every question, update, or correction requires a thread of emails.
Day 1 FSA/HSA enrollment windows, preventive-care baselines, mental health EAP onboarding — all of it races the next scheduled sync.
The Solution
01
HR clicks Connect Rippling. A Rippling admin approves read-only OAuth. Then NudgeWell pulls the active roster and runs the first sync immediately.
02
The sync pulls work email, employment status, FSA/HSA eligibility, plan types, and carrier. Enough to drive every nudge category without manual CSV edits.
03
A daily 8:30 AM cron pulls the delta from Rippling. New hires get nudges the same morning. Terminated employees are deactivated, not deleted, preserving the audit trail.
04
Bulk-action a major change from the dashboard. Useful right after open enrollment, M&A events, or acquisitions.
05
Access + refresh tokens are encrypted at rest with AES-256-GCM. NudgeWell reads only workers, benefits, and company data — never compensation, reviews, or surveys.
06
Disconnect terminates the local connection immediately. Roster rows are preserved for the audit trail. No nudges are sent. No broker follow-up needed.
Yes — the OAuth consent screen requires a Rippling admin to grant NudgeWell read-only access to your roster. Once approved, anyone on your HR team can manage the connection from the NudgeWell portal.
Worker name, work email, employment status, department, manager email, home ZIP code, FSA/HSA eligibility, medical/dental/vision plan types, and insurance carrier. The sync does not read compensation, performance reviews, or any other sensitive Rippling data.
Once a day automatically, at 8:30 AM ET. You can also trigger an on-demand sync from the dashboard — useful after onboarding a new hire who needs nudges sooner.
Rippling flags a worker's employment status as 'terminated' or 'on_leave'. On the next sync, NudgeWell marks that employee's roster row as deactivated. Their record is preserved (required audit trail under HIPAA-adjacent retention rules), but no new nudges are sent and the row never appears in active-roster reports.
OAuth tokens are encrypted at rest (AES-256-GCM). The eligibility data we pull is not PHI under HIPAA — it's the same administrative data brokers already share on a census file. HR data is segregated from any member-level PHI and access is logged.
Yes — disconnect is one click in the portal. Rippling does not currently expose a public revocation endpoint, so we mark the connection as revoked locally. Existing roster rows are preserved for audit; new nudges stop immediately.
Rippling is the first adapter, but the underlying connector (services/hris/) is provider-agnostic — Gusto, BambooHR, and ADP Workforce Now are slotted into the same pattern. Each new adapter is a configuration, not a refactor.