Summary
Kaizen will build "Kansas HR" (the name agreed on October 7), an HR workflow layer on top of Paylocity that takes a Fidelis or Unitas employee from offer to exit, so HR enters information once and every provider receives it. We estimate about 526 development hours (range 464 to 624), delivered in five phases over about 25 calendar weeks, with the new-hire workflow live in late January 2027 and all phases live by late April 2027.
What it does. Sends and tracks HR-written offer letters through its own built-in e-signature, orders Checkr background checks after HR approval, assembles and sends new-hire packets, pushes elections to carriers and Ascensus, runs offboarding, flags time-off problems before payroll closes, and keeps org charts and turnover reports current.
What it does not do. It never drafts, edits, or decides. Offer and termination letters, background-check decisions, and offboarding stay with HR.
Design. Paylocity stays the system of record and the hub. Kaizen turns on Paylocity's existing Checkr and Ascensus integrations rather than rebuilding them, and connects directly only where Paylocity has no connection. Kansas HR replaces DocuSign with its own e-signature; Paylocity, Checkr, Ascensus, and the carriers stay (see Replace or keep).
Hosting. Recommended: Fidelis's own Azure tenancy, behind Entra sign-on, reusing the platform foundation already being built under SOW No. 1. The final hosting decision rests with the managing members and Tom Hirokawa.
Indicative fee. About $103,200 at Kaizen's standard rates (about 486 technical hours at $200 and 40 implementation hours at $150), plus a small monthly maintenance fee, still to be priced, as Don told HR on October 7. A fixed fee would bill 50% at signature, 25% at the new-hire go-live, and 25% at final delivery.
The largest swing in the estimate is carrier connectivity for Cigna, Sun Life, and Nippon Life (16 to 64 hours), which we cannot size until Fidelis's broker and Paylocity confirm what feeds exist today.
Business case and timing. Neil estimates these manual tasks cost Fidelis and Unitas $60,000 to $80,000 a year in consulting fees and HR staff time, and expects automation to cut that time by about 25%. Tom Hirokawa is building the cost baseline and a build-versus-buy comparison by October 28. On October 7, Don said a build would take "one to two months" once SOPs are ready. That matches Phases 0 and 1 (offer through onboarding, about 322 hours). The full four-phase scope runs to late April 2027. Neil ranked this project below the FIRMS replacement, so operational work under SOW No. 1 comes first.
Background
Fidelis HR (Neil Carfagna and Kaitlyn Jashinski) re-keys each employee's details into Paylocity, three insurance carriers, the 401(k) provider, and the background-check vendor, and builds offer letters and benefits packets by hand. Every re-entry risks a missed enrollment, a deduction that does not match the election, or premiums paid after someone has left. HR met with Kaizen on October 7, 2026, sent the outline this PRD is built from, and asked for a projected cost on October 8.
| System | Role today | Role after this build |
|---|---|---|
| Paylocity | Payroll, time off, onboarding | Unchanged: system of record and hub |
| Checkr | Background checks | Ordered from Paylocity after HR approval |
| DocuSign | Named in the outline for offers | Replaced by Kansas HR's built-in e-signature; cancel if no other Fidelis team relies on it |
| Ascensus | 401(k) | Receives eligibility, deferrals, and payroll each pay period |
| Cigna | Benefits | Receives elections and terminations |
| Sun Life | Benefits | Receives elections and terminations |
| Nippon Life | Dental, vision, and life | Receives elections and terminations |
| OneDrive | HR file storage | Receives copies of every document |
In the October 7 meeting, Neil said Kaitlyn is taking over more of his role and will be Kaizen's day-to-day contact, with Neil (a consultant) copied on everything. Neil described a similar system he built at Societe Generale that took two years: it created the offer letter, handled the compliance follow-up, and completed the provider forms. Today the same employee data (name, SSN, address, marital status, and more) is typed into about five provider portals. HR committed to send by October 21 high-level SOPs, its acronym and regulatory list, its access-role list, and recordings of a typical day. Those inputs drive Phase 0.
Goals, non-goals, and guardrails
The goal is one trigger, many updates: a hire, change, or termination entered once in Paylocity reaches every provider, with HR approving each step that affects someone's job, pay, or coverage.
Goals
Remove re-keying into Checkr, Ascensus, Cigna, Sun Life, and Nippon Life.
Send, track, and file every new-hire document without HR assembling packets by hand.
Keep a copy of every document sent and returned, downloadable by HR one at a time or in bulk, with a copy in OneDrive.
Alert HR the same day when any provider sync fails, with what failed and what to do.
Produce org charts and turnover reports from Paylocity data, always current.
Give Fidelis written answers on data access, storage, backup, and retention for audits and investor questionnaires.
Non-goals
Drafting, editing, or recommending offer or termination letters.
Making or recommending hiring, background-check, pay, or coverage decisions.
Replacing Paylocity or holding a second copy of payroll as a system of record.
Running payroll. Final paychecks are processed in Paylocity by HR and payroll. Also out of scope: AI-drafted replies to employee questions. Don offered this; Neil deprioritized it because HR's personal service to employees matters (he puts Fidelis turnover below 2% since inception).
Guardrails
HR approves before a background-check result is acted on and before any offboarding step runs.
Candidate consent and FCRA adverse-action steps stay in place and cannot be skipped.
Every change pushed to a provider is logged with what changed and who approved it.
The platform uses no AI to make or draft employment decisions. Any AI use (for example, reading a returned form) proposes a value that a person confirms. No SSNs, full names with middle names, or home addresses are sent to any AI model. This matches the PII rules for HR's use of Claude that Don and HR discussed on October 7.
Users, roles, and who can see employee data
Neil set the rule on October 7: only Kaitlyn, the managing members, Tom Hirokawa (CFO), and Neil himself may see SSNs and full employee records. Everyone else sees only what their step needs, and every read of sensitive data is logged. Today only Kaitlyn, Neil, Paylocity, and the providers see this data, and investors ask who sees it. Roles map to Entra groups that Fidelis administers, so adding or removing access is a Fidelis action, not a Kaizen one.
| Role | Who | Sees | Can do |
|---|---|---|---|
| HR Administrator | Kaitlyn Jashinski (primary), Neil Carfagna (consultant) | All employee records, SSNs, pay, elections, documents | Approve every gated step, upload letters and SPDs, export, manage templates |
| Executive viewer | Managing members (Brian Tortorella, Michael Tessitore), Tom Hirokawa (CFO) | All employee records, read-only | View and export; no workflow actions |
| Hiring Manager | Department heads | Their own candidate's offer status only, no PII | Review the offer letter draft before HR finalizes it |
| Compliance | Lucy Karongo | Her compliance-form campaigns: who has signed and who has not; the audit log. No SSNs, pay, or health data | Launch signature campaigns, set reminders, run access reviews |
| Accounting | Accounting team | Invoice notices and final-pay checklist only | Mark invoices received |
| IT / Access | Chris Mindrum | Exit tasks only (equipment, system access) | Close exit tasks |
| Employee / Candidate | External | Their own forms, through a single-use secure link to a personal email | Sign, complete, and return forms |
| Kaizen engineers | Carson Vasquez, Ab DeWeese (US-based) | Masked or synthetic data during development; production data only when HR opens a support case, logged | Fix and deploy; access removed at hand-over |
Restrictions that apply to every role
SSNs, bank details, and health elections are masked by default and revealed only to HR Administrators, with each reveal logged.
Health-related documents (elections, ADA accommodation records) sit in a separate restricted file area from the general personnel file, following the EEOC's confidential-medical-file rule.
Kaizen's offshore developers work only with masked or synthetic data, as under SOW No. 1.
Fidelis and Unitas employees appear in the same system but can be split by entity if HR wants separate administrators.
Open question: Kaitlyn, Tom, and the managing members owe the final access-role list by October 21. It should confirm the executive-viewer role and whether Unitas HR needs its own administrator.
Proposed architecture
We recommend Paylocity as the hub rather than direct connections to each provider: it already holds the employee record, it already integrates with Checkr and Ascensus, and every update then traces back to one source.
Kaizen's layer listens to Paylocity's webhooks for hires, changes, and terminations, re-reads the employee from Paylocity's API, and acts only after HR approves. E-signature runs inside Kansas HR rather than through DocuSign (see Replace or keep). OneDrive connects to the Kaizen layer directly because Paylocity does not carry Fidelis's document copies.
Replace or keep: connected software
Only one connected product, DocuSign, is both easy to rebuild and a subscription Fidelis could cancel. Kansas HR will therefore build its own e-signature and drop DocuSign from the HR workflow. Every other connection is a regulated service, an insurer, or software Fidelis already pays for in a bundle, so rebuilding it would add risk without removing a bill.
| System | What Fidelis pays for | Difficulty to replicate | Decision | Why |
|---|---|---|---|---|
| DocuSign | Per-user e-signature subscription; list prices run about $30 (Standard) to $45 (Business Pro) per user per month | Easy | Replace in Phase 1 | Kansas HR already builds the sending, reminder, and tracking engine. Adding signing, signer verification, and a sealed record is about 48 hours. U.S. law (the ESIGN Act) gives an electronic signature the same effect as a written one when consent and record-keeping rules are met. Cancel only if no other Fidelis or Unitas team uses DocuSign. |
| Paylocity onboarding and document features | Usually bundled into Paylocity's per-employee price, not billed separately | Medium | Keep for now; review the contract | Kansas HR will do the document work, but cancelling a bundled module rarely lowers the bill. Worth pursuing only if Fidelis's contract itemizes these modules. |
| Paylocity payroll and HR core | Per-employee monthly subscription | Very hard | Keep | Payroll tax filing, wage payments, garnishments, and W-2s carry legal liability and need a licensed payroll provider. Paylocity also stays the system of record this PRD is built around. |
| Checkr | Per report ($29.99 to $94.99 list), with no platform fee | Very hard | Keep | Checkr is a consumer reporting agency under the FCRA, with court and database access Fidelis cannot reproduce. Fidelis pays only when it orders a report, so there is no subscription to eliminate. |
| Ascensus | 401(k) recordkeeping | Very hard | Keep | Ascensus holds participant accounts and runs regulated plan administration. That service cannot be replaced by software Fidelis owns. |
| Cigna, Sun Life, Nippon Life | Insurance premiums | Not software | Keep | These are the insurers themselves. Kansas HR replaces the manual re-keying into their portals, not the carriers. |
| OneDrive | Included in Fidelis's Microsoft 365 | Not a separate cost | Keep | Kansas HR stores its own copy of every document; OneDrive holds HR's backup copy at no extra cost. |
Still to check against HR's software list (due October 21). Any tool not named in the outline, such as a broker's benefits-enrollment platform, a training or handbook-acknowledgement tool, or a separate e-signature tool Lucy uses for compliance forms, gets the same test. Kansas HR replaces it only if it is easy to rebuild and Fidelis pays for it separately. Neil's $60,000 to $80,000 a year is mostly consulting fees and staff time, not software, so most of the savings come from automation rather than cancelled subscriptions.
Phase 1: New hire
New hire goes first because it touches every provider; it is live when one real hire moves from verbal acceptance to completed onboarding with no re-keying.
Workflow (HR gates in bold)
Hiring manager's offer is approved. HR opens a hire record in the HR console.
Candidate gives verbal acceptance. HR approves ordering the background check. The platform orders it through Paylocity's Checkr integration, after confirming the candidate's stand-alone FCRA disclosure and authorization are on file.
The platform tracks Checkr status and alerts HR when a result arrives. HR reviews every result. If HR considers adverse action, the platform sends the pre-adverse-action notice with the report and the FCRA Summary of Rights, holds the file, and sends the final adverse-action notice only when HR confirms.
HR drafts the offer letter, the hiring manager reviews it, and HR marks it final. The platform never opens or edits the letter's content.
The platform sends HR's final letter for signature through Kansas HR's built-in e-signature, tracks views and signature, and files the sealed signed copy.
On signature, the platform triggers Paylocity onboarding for the new employee.
The platform fills in and sends the new-hire packet to the employee's personal email through a secure link: current-year benefits SPD, Ascensus 401(k) SPD, blank benefits and dental election forms, the employee's eligible plan options and costs, handbook, handbook acknowledgement, anti-harassment training, and any other compliance forms HR designates. A copy of each sent document is saved.
The platform tracks completion, sends reminders on a cadence HR sets (daily, every 3 days, or a custom interval), escalates to HR after a set number of reminders, saves every returned form, and flags anything stuck past a deadline HR sets.
The platform notifies Accounting of the related invoice (for example, the background-check charge).
HR sees each step on a per-hire timeline and is notified at each step.
Functional requirements
| ID | Requirement |
|---|---|
| NH-1 | Read new-hire, change, and termination events from Paylocity webhooks; re-read the employee from the API before acting. |
| NH-2 | Gate every outbound action behind the HR approval named in the workflow; no approval, no send. |
| NH-3 | Store letters only as uploaded by HR; no edit function exists for letter content. |
| NH-4 | Maintain a template library with plan-year versions; HR uploads new SPDs and forms each plan year, and the old version is retained, not overwritten. |
| NH-5 | Prefill forms only from fields HR entered or Paylocity holds; leave any unknown field blank for the employee. |
| NH-6 | Deliver packets to personal email by expiring secure link, never as unencrypted attachments containing SSNs. |
| NH-7 | Show a per-hire timeline: step, owner, status, age, and the next action. |
| NH-8 | Flag any step idle past its HR-set limit and email HR the same day. |
| NH-9 | Record each send, view, signature, and return with time and actor in the audit log. |
| NH-10 | Notify Accounting of hire-related invoices; no payment is made by the platform. |
| NH-11 | Configurable reminder cadence per document or campaign (daily, every 3 days, custom), with an escalation path and HR-approved exceptions (for example, an employee on leave). |
| NH-12 | Compliance-form campaigns for current employees: Lucy picks a form and a group of employees, the platform sends it for e-signature, reminds non-signers on her cadence, escalates to the employee's manager, and reports completion. |
Why NH-11 and NH-12 are in Phase 1. Neil raised this on October 7: Lucy spends much of her time chasing employees to sign compliance forms. New hires have an incentive to sign, because they are not hired until they do; current employees do not. The e-signature and reminder engine built for new hires serves both, so the campaign feature adds about 16 hours.
Phase order versus HR's stated order. HR listed the stages as offer letters, then provider feeds, then Paylocity onboarding, then offboarding. This PRD runs Paylocity onboarding in Phase 1, because onboarding starts the moment the offer is signed and every later phase reads from it. HR's other stages map to Phases 2 and 3.
Built-in e-signature (replaces DocuSign). Kansas HR signs documents itself, to these requirements:
ESIGN consent. Before a first signature, the employee or candidate sees the federal consent disclosure: the right to paper copies, how to withdraw consent, and what device and software they need. They confirm electronically, which shows they can open the format.
Intent and attribution. A clear "Sign" action, with the signer's name and the time recorded. The single-use email link is backed by a one-time code sent to the signer.
Sealed record. On completion, the platform flattens the PDF, records a fingerprint of the file so any later change is detectable, and attaches a completion certificate. The certificate lists who signed, when, from which IP address, and every view and reminder.
Retention and reproduction. Signed records stay accurate, accessible to authorized HR users for the full retention period, and printable, as the ESIGN Act requires.
Form I-9 stays in Paylocity onboarding. Federal rules for electronic I-9s add audit-trail, indexing, and inspection requirements of their own. Kansas HR will not sign I-9s unless counsel approves the design after Phase 0.
Phase 2: Benefits enrollment and payroll sync
When an employee returns a completed election form, HR approves it once and the platform updates the carriers, Paylocity deductions, and Ascensus, so the deduction always matches the election.
| ID | Requirement |
|---|---|
| BE-1 | Save each returned election form to the employee's restricted file and place it in HR's review queue. |
| BE-2 | On HR approval, send each election to the right carrier: dental, vision, and life to Nippon Life; other coverage to Cigna or Sun Life per Fidelis's plan map. |
| BE-3 | On the same approval, set the matching employee deductions and employer contributions in Paylocity; show HR the before and after values first. |
| BE-4 | Send 401(k) eligibility, deferrals, and payroll data to Ascensus each pay period, using Paylocity's existing Ascensus integration. |
| BE-5 | Apply life events (new dependent, address change, salary change) everywhere at once after HR approval, with one change record listing every system updated. |
| BE-6 | After each push, compare what the carrier or Ascensus shows against the approved election where the provider makes that visible, and flag any mismatch. |
| BE-7 | If any push fails, alert HR the same day with the employee, the provider, the error, and the next step. |
How each carrier is reached depends on what exists. Paylocity's marketplace lists a Cigna integration described as covering FSA, HSA, and pre-tax accounts, which may not cover medical enrollment. We found no Paylocity marketplace listing for Sun Life or Nippon Life. Kaizen will use, in order of preference: an existing Paylocity or broker carrier feed; a carrier EDI 834 enrollment file Kaizen sets up; or, where a carrier offers neither, a prepared task with the filled carrier form for HR to submit through the carrier portal. Phase 0 confirms which applies to each carrier.
Phase 3: Offboarding
Nothing in offboarding runs until HR confirms the termination in Paylocity and approves the offboarding run; HR writes and delivers the termination letter outside the platform.
| ID | Requirement |
|---|---|
| OF-1 | Detect a termination in Paylocity and open an offboarding record; take no action until HR approves it. |
| OF-2 | End coverage with each carrier effective on the date HR confirms, and stop 401(k) deferrals with Ascensus. |
| OF-3 | Send the standard exit and COBRA paperwork (not the termination letter) and save copies. |
| OF-4 | Create exit tasks to collect equipment and remove system access, assigned to IT, with due dates and status. |
| OF-5 | Track the final paycheck as a checklist item for payroll; the paycheck itself is processed in Paylocity. |
| OF-6 | Let HR upload a copy of the termination letter to the employee's file. |
| OF-7 | Flag any carrier that still shows active coverage after the end date, so premiums are not paid after departure. |
Phase 4: Time off and reporting
Time off stays in Paylocity; the platform only checks it, and builds two reports from payroll data so they never go out of date.
| ID | Requirement |
|---|---|
| TR-1 | Before each payroll closes, flag negative time-off balances and balances that do not match payroll, and email HR the list. |
| TR-2 | Build company-wide and department org charts from the Paylocity supervisor field, updated on every hire, role change, and exit. |
| TR-3 | Flag missing or circular supervisor links, since the chart is only as accurate as that field. |
| TR-4 | Build turnover reports from hire and termination dates: by month, department, and length of service, split voluntary and involuntary. |
| TR-5 | Agree turnover definitions with HR before build (rate formula, headcount basis, treatment of rehires and transfers) so the numbers match how Fidelis reports today. |
| TR-6 | Export both reports to Excel and PDF on demand. |
Documents, retention, and OneDrive
Every document the platform sends is saved, every form an employee returns comes back to the platform, and HR can open or download any of it at any time.
Where HR finds documents. One file per employee in the HR console, split into a general personnel file and a restricted medical and benefits file. Each item shows what was sent, what came back, when, and by whom.
Downloads. One at a time or in bulk (per employee, per date range, or per document type) as a zip.
OneDrive copy. An automatic copy of each saved document to a Fidelis-designated OneDrive or SharePoint folder, mirroring the same two-part file structure. The platform copy remains the audit copy.
Storage and backup. Documents and records sit in Fidelis's Azure tenancy (United States regions), encrypted at rest and in transit, with daily backups retained 90 days and a restore tested before go-live, matching SOW No. 1.
Retention. Set per document type with Fidelis's counsel and enforced by the platform, with a legal-hold flag that stops deletion. Starting points to confirm with counsel:
| Record | Federal starting point |
|---|---|
| Benefit plan records supporting required filings | At least 6 years from the filing date (ERISA §107) |
| Records showing how an employee's benefits were calculated | Until benefits are fully paid and audit periods close (ERISA §209) |
| Form I-9 | 3 years after hire or 1 year after employment ends, whichever is later |
| Background-check reports | Retained per counsel; disposed of securely when no longer needed (FTC disposal rule) |
| Payroll and time records | Kept in Paylocity as system of record; the platform keeps copies only of what it sent or received |
Fidelis's handbook covers employees in 15 states. State rules in each may extend these periods or require state-specific new-hire forms, so retention and packet contents are a counsel item.
Security, privacy, and compliance
The outline names HIPAA, ADA, IRCA, PII, and FCRA and asks who can read data, where it is stored, and how it is backed up; the answers below are written so HR can lift them into audit and investor questionnaires once confirmed. In the meeting Neil listed HIPAA, ADA, IRCA, and "CR". HR will send the full list by October 21, and "CR" needs confirming; it may mean FCRA or a civil-rights framework. Tom Hirokawa and the managing members are preparing the investor-facing disclosure on data storage and access, which should draw on this table.
| Question | Answer |
|---|---|
| Who can read employee data? | Named HR Administrators see full records; other roles see only their step (see Users, roles, and who can see employee data). Every read of SSNs, pay, or health data is logged with person and time. |
| Where is data stored? | Recommended: Fidelis's own Azure tenancy, United States regions only, with no employee data on Kaizen systems. This matches SOW No. 1 and Neil's ask that "we house the software and all the proprietary information is just with us." Not yet decided: in the meeting Don offered either a Kaizen-hosted private server or Fidelis-owned servers with maintenance access for Kaizen. The managing members and Tom Hirokawa are deciding. |
| How is it backed up? | Daily backups, 90-day retention, restore tested before go-live; recovery point 24 hours, recovery time 8 hours unless Fidelis sets tighter targets. |
| Who at Kaizen has access? | Two named US-based engineers, only to resolve an HR-opened support case, logged; removed at hand-over. |
| How is it encrypted? | TLS 1.2 or higher in transit; Azure-managed or Fidelis-held keys at rest; secrets in Key Vault under Fidelis control. |
| HIPAA and BAA | Kaizen will sign a BAA for health-election data. Whether Kaizen is a business associate of the group health plan or a vendor to the employer depends on what functions it performs for the plan; counsel to confirm, but signing the BAA covers either reading. |
| ADA | Medical and accommodation information is held in a separate, restricted file, apart from the personnel file. |
| IRCA (Form I-9) | I-9s and supporting documents are stored in the restricted file with retention set to the I-9 rule. |
| FCRA | Stand-alone disclosure and authorization required before an order; pre-adverse and adverse-action notices with required contents; HR decides every step. |
| SOC 2 | Open. Kaizen has not confirmed what SOC 2 evidence it holds today. Proposed approach if there is no Kaizen report: deploy only in Fidelis's tenancy so Microsoft's Azure SOC reports cover the infrastructure, provide Kaizen's completed security questionnaire and control descriptions, and decide with Fidelis whether a Kaizen SOC 2 readiness effort is required before go-live. Don and Carson to confirm what Kaizen can evidence today. |
All of the above is subject to the security review Chris and Lucy are running for SOW No. 1; one set of answers should serve both engagements.
Security controls and compliance matrix
Kansas HR will run with 29 controls. Sixteen are described elsewhere in this PRD; the 13 marked "(new)" were added here and add about 36 development hours, which are included in Timeline and hours. The table is the single list Fidelis can hand to auditors and investors, subject to review by Fidelis's counsel and its cybersecurity provider.
| # | Control | What it does | Serves |
|---|---|---|---|
| 1 | Named security owners (new) | Kaizen names a security lead (Carson Vasquez); Fidelis names a privacy owner (proposed: Lucy Karongo) | HIPAA assigned security official; investor due diligence |
| 2 | Risk assessment (new) | Written risk assessment before go-live and every year after, with fixes tracked to closure | HIPAA Security Rule risk analysis |
| 3 | Written policies and incident-response plan (new) | Access, acceptable use, data handling, and incident-response procedures for Kansas HR, with annual training for HR users and Kaizen engineers | HIPAA administrative safeguards; investor due diligence |
| 4 | Business associate and vendor agreements (new) | BAA between Kaizen and Fidelis's plan; Fidelis collects security reports and BAA or data-processing terms from Paylocity, Checkr, Ascensus, Microsoft, and the carriers | HIPAA business associate contracts; CCPA service-provider terms; investor due diligence |
| 5 | Role-based access | Access by Entra group; full records only for Kaitlyn, the managing members, Tom Hirokawa, and Neil | HIPAA access control; ADA; investor due diligence |
| 6 | Multi-factor sign-in (new) | Entra conditional access requires MFA on every sign-in, for staff and Kaizen alike | HIPAA person authentication |
| 7 | Automatic sign-out (new) | Idle sessions end after 15 minutes (proposed default; Fidelis may set it) | HIPAA automatic logoff |
| 8 | Access reviews and same-day removal (new) | Quarterly review of who has which role, signed by Kaitlyn and Lucy; departing users lose access the day they leave (offboarding exit task) | HIPAA workforce security; investor due diligence |
| 9 | Masking and logged reveal | SSNs, bank details, and health elections hidden by default; each reveal logged | HIPAA minimum necessary; ADA; investor due diligence |
| 10 | Restricted Kaizen access | Masked data in development; production access only on an HR support case, time-limited, logged, and removed at hand-over | HIPAA access control; investor due diligence |
| 11 | Encryption | TLS 1.2 or higher in transit; encryption at rest with keys in Fidelis's Key Vault | HIPAA transmission security; HIPAA and New Jersey encryption safe harbors |
| 12 | Data minimization (new) | Store only fields a workflow needs; SSNs never in email bodies, file names, logs, or reports | CCPA proportionality; New Jersey breach law exposure |
| 13 | Secure delivery to employees | Expiring single-use links, never unencrypted attachments | HIPAA transmission security; New Jersey breach law |
| 14 | No PII to AI models | No SSNs, full names, or addresses sent to any AI model | Fidelis AI-use policy; investor due diligence |
| 15 | Separate medical file | Elections and accommodation records kept apart from the personnel file | ADA confidential medical records; HIPAA |
| 16 | US-only storage | All data and backups in US Azure regions, in Fidelis's tenancy (hosting decision pending) | Investor due diligence |
| 17 | Append-only audit log | Every read of sensitive data, change, send, signature, and approval, with person and time, kept at least 6 years | HIPAA audit controls; ERISA records; investor due diligence |
| 18 | Document integrity | Versioned documents, never overwritten; HR approval recorded on each provider update | HIPAA integrity; ERISA records |
| 19 | Unusual-activity alerts (new) | Alert Kaitlyn and Kaizen on bulk exports, repeated SSN reveals, or sign-ins from new locations | HIPAA security incident procedures |
| 20 | Vulnerability management (new) | Automated dependency and code scanning on every release, monthly patching, and an independent penetration test before go-live (test fee is Fidelis's, outside the build fee) | HIPAA periodic evaluation; investor due diligence |
| 21 | Secure development | Code review on every change, no secrets in code, separate development, test, and production environments | HIPAA integrity; investor due diligence |
| 22 | Backup and recovery | Daily backups kept 90 days, restore tested before go-live, 24-hour recovery point, 8-hour recovery time | HIPAA contingency plan |
| 23 | Incident notification (new) | Kaizen notifies Fidelis immediately on discovering a suspected breach, and in any case within 24 hours. Fidelis decides and sends notices: New Jersey State Police before affected employees, and HIPAA notice to the plan within 60 days at the latest | New Jersey breach law; HIPAA Breach Notification Rule; other states' breach laws |
| 24 | Retention and legal hold | Retention by document type, legal hold that blocks deletion, secure deletion at end of period | ERISA; IRCA; FCRA disposal |
| 25 | FCRA gates | Stand-alone disclosure and authorization before ordering; pre-adverse and adverse-action notices; HR decides each step | FCRA |
| 26 | I-9 handling | I-9s and supporting documents in the restricted file, kept 3 years from hire or 1 year after exit, whichever is later | IRCA |
| 27 | HR approval gates | No offer, check, election, or offboarding step runs without HR's approval | FCRA; ADA; investor due diligence |
| 28 | Employee data requests (new) | HR can export, correct, or delete one employee's data, subject to retention rules | CCPA, if Fidelis has California employees and meets its thresholds |
| 29 | Employee privacy notice (new, Fidelis action) | Fidelis updates its employee privacy notice to describe Kansas HR, what it holds, and who sees it | CCPA notice at collection, if applicable; investor due diligence |
Read by law
HIPAA (Security and Breach Notification Rules): 1 to 7, 9 to 11, 13, 15, 17 to 23.
ADA: 5, 9, 15, 27.
IRCA: 24, 26.
FCRA: 24, 25, 27.
ERISA records: 17, 18, 24.
New Jersey and other state breach laws: 11, 12, 13, 23.
CCPA (if it applies): 4, 12, 28, 29.
Investor and audit questionnaires: 1, 3, 4, 5, 8 to 10, 14, 16, 17, 20, 21.
"CR": to be mapped once HR defines it.
One conflict to resolve: SOW No. 1 promises incident notice within 72 hours of confirmed unauthorized access, while New Jersey law requires a vendor holding personal information for another entity to notify it immediately. Control 23 uses the stricter standard; SOW No. 1 should be aligned to match.
Timeline and hours
The build totals about 526 development hours over about 25 calendar weeks; Phase 1 carries nearly half the hours because it stands up the shared pieces every later phase reuses.
Dates are estimates that move day for day with a later start, late HR inputs, or Kaizen team commitments to the SOW No. 1 parallel closes in January and February. Production deployments follow SOW No. 1's freeze from the 14th to the 21st of each month. Each phase gets 30 days of fixes after go-live. On October 7 Don told HR "one to two months" once SOPs are ready, and said the start depends on Kaizen's current hiring: a couple of weeks to a month if developers are in place, a month or two later if not. Neil's "one month or less" is realistic for Phases 0 and 1. The later phases should be presented to HR as follow-on releases, not part of that window.
Hours by work item
| Phase | Work item | Hours |
|---|---|---|
| 0 | Discovery: SOP mapping, HR software and contract inventory, provider connectivity checks, data-access matrix, security answers, turnover definitions | 24 |
| 0 | Build-versus-buy check against off-the-shelf HR platforms (about $500 a month) and Paylocity's own modules, as Don offered HR | 4 |
| 0 | Risk assessment, Kansas HR security policies, and incident-response plan (controls 1 to 3, 23) | 12 |
| 1 | Shared foundation in Fidelis Azure: sign-on with MFA, roles, session timeout, audit log, document store, retention, OneDrive copy | 32 |
| 1 | Paylocity connection: webhooks, employee reads, onboarding trigger | 32 |
| 1 | Checkr through Paylocity: switch-on, status tracking, FCRA consent and adverse-action gates | 12 |
| 1 | Built-in e-signature replacing DocuSign: ESIGN consent, one-time-code signer check, signature placement, sealed PDF with completion certificate | 48 |
| 1 | New-hire packet engine: templates, plan-year versions, prefill, secure send, reminders, returns | 40 |
| 1 | Compliance-form signature campaigns for Lucy: recurring sends, reminder cadence, escalation, completion report | 16 |
| 1 | HR console: per-hire timeline, approvals, stuck-step flags, document viewer, bulk download | 32 |
| 1 | Accounting invoice notice | 4 |
| 1 | Same-day failure alerts | 10 |
| 1 | Security build-out: unusual-activity alerts, quarterly access-review report, scanning and patching pipeline, employee data export, correction, and deletion (controls 8, 19, 20, 28) | 24 |
| 1 | Testing, UAT support, security review | 24 |
| 1 | Training and runbook | 8 |
| 2 | Election intake and HR review queue | 12 |
| 2 | Paylocity deductions and employer contributions | 16 |
| 2 | Carrier connections: Cigna, Sun Life, Nippon Life (range 16 to 64) | 32 |
| 2 | Ascensus per-pay-period switch-on and mismatch check | 10 |
| 2 | Life events across all systems | 14 |
| 2 | Testing and UAT | 12 |
| 3 | Termination trigger and HR confirmation gate | 6 |
| 3 | Carrier coverage end and 401(k) deferral stop | 10 |
| 3 | COBRA and exit packet | 10 |
| 3 | Exit tasks: equipment and access removal | 10 |
| 3 | Final-paycheck checklist | 4 |
| 3 | Testing | 8 |
| 4 | Pre-payroll time-off balance checks | 14 |
| 4 | Org charts, company and department | 18 |
| 4 | Turnover reports | 20 |
| 4 | Testing | 8 |
Of the 526 hours, about 40 are implementation support (discovery workshops, UAT coordination, training) at $150 and about 486 are technical at $200, for an indicative $103,200 before the monthly maintenance fee. Building e-signature in place of a DocuSign integration adds a net 28 hours, about $5,600, and lets Fidelis cancel DocuSign if HR is its only user. At list prices, that pays back within about a year for 15 or more seats; HR's software list will confirm Fidelis's actual seat count and cost. The independent penetration test (control 20) is a third-party cost to Fidelis, outside this fee. The low end (464 hours) assumes Paylocity or the broker already feeds all three carriers. The high end (624 hours) assumes each carrier needs its own EDI 834 file and HR's SOPs add forms or approval steps beyond the outline. Tom Hirokawa's October 28 model will show the payback period against Neil's estimate of $60,000 to $80,000 a year in current cost.
Acceptance criteria
Each phase is accepted by HR on evidence from real employees, not demonstrations alone.
| Phase | Accepted when | Signs |
|---|---|---|
| 0 Discovery | SOPs mapped to workflows; carrier connection method confirmed per carrier; data-access matrix and security answers approved; turnover definitions agreed | Neil, Kaitlyn, Chris, Lucy |
| 1 New hire | Two real hires completed end to end with no re-keying; every gate enforced; every document saved and copied to OneDrive; a forced sync failure alerts HR the same day; one compliance-form campaign for Lucy runs to completion, with reminders and escalation working | Neil, Kaitlyn |
| 2 Benefits | One month of elections and one life event pushed to every carrier, Paylocity, and Ascensus, each matching the approved election | Neil, Kaitlyn, Accounting |
| 3 Offboarding | Two real terminations completed: coverage ended, deferrals stopped, COBRA sent, exit tasks closed | Neil, Kaitlyn, Chris |
| 4 Reporting | Time-off check run before two payroll closes; org charts match Paylocity; turnover for the last 12 months matches HR's own figures | Neil, Kaitlyn |
Open questions, dependencies, and risks
The estimate holds if the items below resolve as assumed; each unresolved one is a reason the range runs to 540 hours.
Open questions for Fidelis HR
How do Cigna, Sun Life, and Nippon Life receive enrollments today (broker, Paylocity feed, portal, or paper), and who is the broker?
Is Paylocity's Checkr integration licensed and switched on, and does Fidelis already have a Checkr account?
Is Paylocity's Ascensus integration available on Fidelis's Paylocity plan, and is it switched on?
Does Fidelis hold Paylocity API (Weblink) access, and which Paylocity modules does it license (Onboarding, Benefits)?
Who else at Fidelis and Unitas uses DocuSign (for example, loan closings or investor documents), how many seats, and when does the contract renew? DocuSign can be cancelled only if HR is its only user.
What does "send invoice to accounting" cover (background-check fees, recruiter fees, other)?
Which compliance forms belong in every packet, and do any differ by state or entity?
Plan-year start date and open-enrollment window, so Phase 2 avoids going live mid-enrollment.
Turnover definitions HR uses today.
Is Unitas HR in scope with separate administrators?
Raised in the October 7 meeting
Hosting: Fidelis Azure (recommended, matches SOW No. 1) or a Kaizen-hosted private server? Decision from the managing members and Tom Hirokawa.
Offer letters: the meeting notes say "offer letter generation", but the outline says HR writes every letter. Should the platform fill an HR-approved template from entered fields, with no AI drafting, or only send letters HR uploads?
Lucy's compliance forms: which forms, how often, which employee groups, the reminder cadence, the escalation path, and allowed exceptions.
What does "CR" stand for in HR's regulatory list?
Monthly maintenance fee: Don mentioned a small fee covering hosting usage and upkeep; it still needs pricing.
Kaizen start date: depends on current developer hiring; confirm before quoting dates to Neil.
Dependencies
From Kaitlyn by October 21: SOPs, the acronym and regulatory list, the access-role list, and day-in-the-life recordings. From Tom Hirokawa by October 28: the cost baseline and build-versus-buy model.
Shared platform foundation (Azure, Entra, audit log) from SOW No. 1; if this build starts first, it carries about 24 extra hours to stand that up.
Paylocity, Checkr, Ascensus, and carrier accounts and fees are Fidelis's, outside Kaizen's fee.
Risks
| Risk | Handling |
|---|---|
| A carrier offers no feed | Prepared portal task for HR; no change to the rest of the workflow |
| Paylocity marketplace integrations need Paylocity's involvement to switch on | Raised in Phase 0 week 1; HR requests through its Paylocity account team |
| Kaizen team shared with SOW No. 1 during the January and February parallel closes | Phase 2 scheduled after the first close; dates move day for day if SOW No. 1 needs the team |
| SOC 2 evidence gap | Settled in Phase 0 with Chris and Lucy before any production data is loaded |
| Holiday dark period, Dec 15 to Jan 5 | Kaizen builds through it; UAT resumes January 5 |
Two more risks from the meeting. An off-the-shelf HR platform at about $500 a month may cover enough of this; Don told HR that Kaizen would say so, and the Phase 0 build-versus-buy check answers it. Neil also ranked this project below FIRMS, so if SOW No. 1 needs the team, the dates move.
Sources
NC.JK Kaizen Meeting Outline (Fidelis HR, attached to Kaitlyn Jashinski's email of October 7, 2026)
Email thread "Kaizen + HR Meeting Follow-Up", October 7 to 8, 2026; Plaud recording, transcript, and notes, "10-07 Meeting: HR Automation Platform and PII Governance" (Don, Neil Carfagna, and Kaitlyn Jashinski, October 7, 2026)
Fidelis SOW No. 1, revised September 11, 2026 (platform, hosting, backup, and team terms reused here)