Paylocity Corporation

Security isn't a single yes/no, but Paylocity Corporation is SOC 2 Type II compliant and holds ISO 27001, SOC 2 Type II. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Paylocity Corporation hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@paylocity.com or via a /security page.

Paylocity Corporation's subprocessors aren't listed on SOC2C yet. The company can add them so buyers can assess fourth-party risk.

Paylocity Corporation's hosting and data-residency details aren't listed on SOC2C yet. The company can add where it hosts (AWS, GCP, Azure) and which data it handles.

Paylocity Corporation's trust center is at https://trust.paylocity.com;trustbmp.paylocity.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Paylocity is a private SaaS, cloud hosted provider that is internally managed and uses a multi-tenant architecture. Client data is logically separated with appropriate role-based access controls in place, and not physically segmented from other clients' data. The security framework relies on role-based access controls, with additional security measures such as IP restrictions and multi-factor authentication available. For an overview of our information security controls, please refer to following link to the Paylocity Information Security Controls Overview documentation under Resources.

Paylocity is ISO 27001:2022 certified and provides annual attestation reports for SOC 1 and SOC 2.

Data in transit is encrypted using TLS. Paylocity only accepts HTTPS connections to its web server and provide support for TLS 1.2. Data at rest is encrypted with AES 256-bit encryption.

Paylocity relies on a multi-tiered, redundant backup strategy to help ensure recovery of data, reliant on both on-premise datacenters, as well as cloud services. Backup procedures include daily snapshots of all critical client data to local storage media, as well as tiering backups to alternate locations. The snapshots are stored on redundant storage arrays and are retained for long term data retention compliance. Client data is also replicated between the primary and secondary data centers for business continuity. These data centers are geographically separated. Backups are tested regularly to ensure recovery reliability. Backups are encrypted using AES 256 and are retained for long term data retention compliance. Paylocity team members annually test restore capabilities. Automated software is set to alert in the event any backup process fails. Alerts are ticketed and investigated through resolution. The automated data backup software has a data retention field that is utilized to determine when storage media should be processed for destruction. For an overview, please refer to following link to the Paylocity Business Resilience Overview documentation under Resources.

Please refer to following link to the Paylocity Business Resilience Overview documentation under Resources. Testing results are classified as Confidential and are not released outside of the company.

All data is hosted in the US.

Paylocity provides direct SaaS solutions for all modules, which can be accessed via laptop, desktop, mobile or tablet. Paylocity has designed and built its network and system infrastructure in a highly redundant configuration. Its data centers are connected to multiple independent Internet service providers. Redundant hardware is in place throughout the network infrastructure to ensure network traffic delivery. The Paylocity application is protected from hardware failure by utilizing load balancing and clustering technologies. All of the data centers are tier 3 facilities with physical security personnel, proximity badge access, visitor logs, visitor escorts, video surveillance, FM-200 fire suppression, temperature sensors, moisture sensors, etc. The visitors must sign in and display a photo ID, be escorted by authorized personnel, are not permitted in the cages, are under video surveillance, etc.

Paylocity maintains an Incident Response Policy bolstered by our Incident Response Plan and corresponding procedures. Typically, notification occurs within 72 hours upon determination of a security breach, as determined by internal and external legal counsel. The overall Incident Response Plan covers: - Discovery - Notification - Initial Analysis and Assessment - Contain the damage and minimize the risk - Eradication - Recovery - Post Incident Review

Once the client is implemented within the application, the Company Administrator creates the user account and a temporary password, and has to ability to leverage other features around managing users and roles. Paylocity allows for customer-defined IDs and provide 2 options for passwords. The default requires passwords which consist of a minimum of eight alphanumeric characters which need to have at least three of the four following characteristics: - Contain upper case letters - Contain lower case letters - Contain at least one number (for example, 0-9). - Contain at least one special character The expiration is 180 days. If you would like to use enhanced password options based on NIST guidelines (8+ characters, no expiration, and check against the HaveIBeenPwned database), you can set that up as well for all users in your settings.

Paylocity enables clients to leverage Single Sign On, as long as the SSO provider supports SAML 2.x for user authentication.

Yes, Paylocity offers multi-factor authentication (MFA) for Company Administrators by default. For additional options, please work with your Paylocity Account Manager or sales team.

Once the client is implemented within the application, the Company Administrator creates the user account and a temporary password, and has to ability to leverage other features around managing users and roles.