Payroll Trust & Security Center

We implement a robust defense system layered with advanced security measures. Here at Paper Trails, we keep all of our internal systems and firewalls up to date. We have significant email security software, including our secure email platform, that assists in preventing private data from being sent via unsecure email. Our firewalls also feature intrusion prevention and detection software to assist us in preventing a breach.

At Paper Trails, we implement stringent controls and continuous monitoring to safeguard sensitive client data. Our system utilizes role-based access protocols, ensuring that only authorized personnel can access specific sets of data. This approach is crucial in maintaining the confidentiality and integrity of client information. Further, dual controls are used for access to client funds and access to critical data systems. Our IT team constantly monitors access logs, enabling us to swiftly identify and respond to any instances of unauthorized access. This vigilant approach to access control plays a vital role in our comprehensive data security strategy.

To maintain and enhance our security posture, Paper Trails conducts periodic audits that serve as a critical component of our security strategy. These audits are instrumental in assessing the current state of our security systems and processes, allowing us to identify any potential weaknesses. Following each audit, we take proactive steps to implement necessary updates and enhancements. This systematic approach ensures that our security measures are not only up-to-date but also effective in countering emerging threats, thereby fortifying the overall protection of our client's data.

Direct deposit fraud is on the rise, and it’s impacting businesses of all sizes — including small employers right here in Maine. Hackers are targeting employee email accounts, gaining access to login credentials, and changing bank account information inside payroll systems, rerouting paychecks before anyone notices.

At Paper Trails, we take this threat seriously. We’ve responded with a series of preventative measures to help protect your business and employees from this type of fraud.

What We’re Doing:

• Removed email as an MFA method.
  Email-based authentication is no longer supported for isolved logins. Hackers frequently exploit email accounts to bypass MFA and change direct deposit settings. We now require stronger MFA options like SMS, authenticator apps, or passkeys.

• Staff education & alerts.
  Our internal team receives regular security training and real-time fraud updates to stay ahead of emerging threats.

• Client alerts and guidance.
  When fraud patterns are detected across our network, we notify clients and share immediate, actionable steps to reduce risk.

What You Can Do:

• Verify every direct deposit change face-to-face.
  Before processing a request, confirm it verbally or in person with the employee. Don’t rely solely on email.

• Encourage employees to watch for login and change notifications.
  If an employee receives a message about a password or MFA change, or direct deposit update they didn’t make, they should report it immediately.

• Use secure passwords and MFA.
  Remind your team not to reuse passwords between systems and to enable stronger authentication wherever possible, including email providers.

• Use direct deposit workflows.
  Ask us about setting up a direct deposit approval workflow where selected managers must approve any direct deposit changes before they go live.

• Report suspicious activity.
  If anything looks off, contact your Paper Trails payroll processor right away. We’re here to help investigate and secure your account.

isolved maintains a thorough and formal program dedicated to the security of client data. This program includes measures to protect against security threats and prevent unauthorized access to customer data. A significant aspect of this program is a continuous review process conducted by third-party auditors, ensuring ongoing compliance and effectiveness.

The security program of isolved, in collaboration with its cloud service provider Microsoft, is based on the Statement on Standards for Attestation Engagements (SSAE) 18, a standard set by the American Institute of Certified Public Accountants (AICPA). The completion of the SSAE 18 audit, including the annual SOC 1 Type 2 report, provides companies with confidence in isolved's products. This report covers various aspects of isolved's offerings, including the SaaS platform, payroll and tax filing services, and legacy Timeforce II SaaS solutions.

The isolved application features a multi-tenant SaaS architecture, ensuring data segregation and security at multiple levels. This includes role-based access controls down to the employee level and two-factor authentication for additional security. The logical access within the isolved platform and its data centers is stringently controlled, adhering to best practices in security.

To further enhance security, isolved has implemented automatic detection and response measures for compromised passwords:

• Automatic Detection: isolved continuously scans a third-party database of known breached passwords (often found on the dark web). If a user's password is detected in a breach, the system automatically flags it.
• Mandatory Password Change: Users with compromised passwords must update their credentials immediately upon their next login. isolved will guide them through a secure password reset process to protect their account.

By proactively detecting and mitigating security risks, isolved ensures your payroll data remains safe, private, and protected at all times.

We consistently conduct comprehensive training sessions to ensure that all staff members are well-versed in the latest security protocols and practices. These sessions are designed to keep our team abreast of the continually evolving landscape of security risks.

Our training covers a wide array of topics critical to data security, such as the newest phishing tactics, effective password management best practices, and the principles of maintaining data confidentiality. We test each employee with phishing and vishing attempts to keep them alert and aware. This diverse range of subjects helps in building a well-rounded understanding of cybersecurity among our staff.

To enhance practical understanding, our training sessions incorporate discussions on case studies and real-world scenarios. This approach not only bolsters our team's ability to identify potential security threats but also prepares them to respond promptly and effectively.