Summary
“Kansas HR” (a working name from the October 7 meeting; the final name is still to be decided) takes employee data out of the five provider portals HR types it into today. It also gives Fidelis one written answer to the question investors and auditors keep asking: who sees employee data. We propose Phases 0 and 1 now: discovery plus the new-hire workflow. That is about 294 development hours, with the new-hire workflow live at the end of week 6, counting from a week-0 kickoff. That matches the "one to two months" Don gave HR on October 7. There is no development fee. Fidelis pays $1,500 a month from signature, which covers the build, the provider connections, and ongoing support, with a six-month minimum and month to month after that. Phases 2 to 4 (benefits sync, offboarding, and reporting) remain optional and are decided after Phase 1.
What it does. Sends HR-written offer letters and compliance forms for e-signature and tracks them. Orders Checkr background checks after HR approval and assembles new-hire packets. Chases unsigned forms on HR's schedule. In the optional phases, it also pushes elections to carriers and Ascensus, runs offboarding, and keeps org charts and turnover reports current.
What it does not do. It never drafts, edits, or decides. Offer and termination letters, background-check decisions, and offboarding stay with HR.
Design. Paylocity stays the system of record and the hub. “Kansas HR” switches on Paylocity's existing Checkr and Ascensus integrations rather than rebuilding them. For e-signature, it uses Paylocity's onboarding e-signature if Fidelis's plan includes it, and otherwise connects to DocuSign. No connected product is rebuilt.
Hosting. “Kansas HR” runs on Railway, the same hosting Brian and Michael approved for the FIRMS replacement. The Railway project and the Cloudflare R2 document store are set up in Fidelis's own name. Sign-in is through Fidelis's Microsoft Entra, with MFA.
Ownership. Kaizen owns and licenses the software. Fidelis owns its data and documents, which sit in Railway and Cloudflare accounts in Fidelis's own name.
Full scope, for reference. Phases 0 to 4 total about 498 hours (range 436 to 596). Phases 2 to 4 are quoted separately if Fidelis wants them.
Software Fidelis keeps. Paylocity, Checkr, Ascensus, the carriers, and OneDrive all stay. DocuSign is the one product Fidelis may be able to cancel, if Paylocity's onboarding e-signature covers offers and compliance forms. Phase 0 checks Fidelis's other HR subscriptions for overlap (see What Fidelis keeps and what it can cancel).
Risks “Kansas HR” removes
The case for “Kansas HR” rests mainly on risk. The time savings are real but modest (see Pricing and cost case).
| Risk today | What can go wrong | How “Kansas HR” removes it | Phase |
|---|---|---|---|
| SSNs and personal data typed into about five provider portals | Each re-entry is another copy of an SSN to secure and another chance of a typo | Data entered once in Paylocity and read from there; SSNs masked; every view logged | 1 |
| No single answer to "who sees employee data" | Investor and audit questionnaires take time and may be answered inconsistently | Named access list, audit log, and the controls matrix in this PRD | 0, 1 |
| Lucy chasing unsigned compliance forms | Forms stay unsigned and her time goes to follow-ups | Signature campaigns with automatic reminders and escalation | 1 |
| Offer and onboarding steps tracked in email | A hire stalls and nobody notices | Per-hire timeline with same-day alerts on stuck steps | 1 |
| FCRA steps run by hand | A missed consent or adverse-action notice | Gates that will not let a check be ordered or acted on until each step is done | 1 |
| Missed enrollments and deductions that do not match elections | Employees without coverage, payroll errors | One HR-approved election updates the carrier, Paylocity deductions, and Ascensus | 2 |
| Premiums paid after someone leaves | Fidelis pays for coverage no one has | Coverage ended on the confirmed date; any carrier still showing coverage is flagged | 3 |
Pricing and cost case
Fidelis pays one monthly fee and no development fee. Kaizen carries the cost of the build and recovers it over the life of the subscription.
| Term | What it means |
|---|---|
| Monthly fee | $1,500 a month, billed from signature |
| What it covers | Phase 0 (discovery and design) and Phase 1 (the new-hire workflow, e-signature, Lucy's compliance-form campaigns, the HR console, and the security controls in this PRD); the connections to Paylocity, Checkr, Ascensus, and the e-signature provider; monitoring, bug fixes, security patches and scanning; and updates whenever a provider changes its connection |
| Term | Six-month minimum, then month to month |
| Not included | Phases 2 to 4 (benefits sync, offboarding, time-off checks, and reports), quoted separately if Fidelis wants them; new features outside this PRD; Railway and Cloudflare usage, billed to Fidelis's own accounts; and the independent penetration test (control 20) |
| Ownership | Kaizen owns the software and licenses it to Fidelis for the subscription. Fidelis owns all employee data and documents, held in its own Railway and Cloudflare accounts |
| If Fidelis cancels | Kaizen exports every record and document in standard formats, removes its access, and turns the software off; the data stays in Fidelis's accounts |
Cost case. The subscription is $18,000 a year with nothing paid up front. Neil estimates the manual work costs $60,000 to $80,000 a year, and HR expects about a 25% time reduction, so recovered time is about $15,000 to $20,000 a year. The rest of the case rests on the risks above and on any software Fidelis can stop paying for (next section). Off-the-shelf HR platforms run about $500 a month, so Phase 0 includes a written build-versus-buy check. Tom Hirokawa's October 28 model should be read alongside this section.
What Fidelis keeps and what it can cancel
Of the software in HR's current workflow, only DocuSign is a realistic candidate to cancel. Everything else is either the system of record or the provider itself, so this build removes the manual work between them rather than their fees. Phase 0's software and contract inventory checks every other HR subscription Fidelis pays for against what this build does.
| Product | What Fidelis pays for | After the build | Why |
|---|---|---|---|
| Paylocity | Payroll, HR, onboarding, time off | Keeps | System of record and the hub this build reads from. Phase 0 checks whether any Paylocity add-on module overlaps with this build and can be dropped. |
| DocuSign | E-signature seats | Can cancel, if Paylocity's onboarding e-signature covers offer letters and Lucy's compliance forms | Signing moves into Paylocity. The saving is modest: DocuSign's published plans run about $360 to $540 per user a year. |
| Checkr | Each background check | Keeps | A regulated consumer reporting agency billed per report, so there is no subscription to cut. |
| Ascensus | 401(k) recordkeeping | Keeps | Holds the plan accounts. |
| Cigna, Sun Life, Nippon Life | Premiums | Keeps | They are the insurers. Phase 3 stops premiums paid after someone leaves; it does not replace the carriers. |
| OneDrive | Part of Microsoft 365 | Keeps | Already licensed; it receives HR's document copies. |
| Other HR tools | To confirm: broker or benefits-administration portal, form or survey tools, spreadsheets | Confirmed in Phase 0 | Anything this build makes redundant is listed in the Phase 0 report with its annual cost. |
Background
Fidelis HR (Neil Carfagna and Kaitlyn Jashinski) re-keys each employee's details into Paylocity, three insurance carriers, the 401(k) provider, and the background-check vendor, and builds offer letters and benefits packets by hand. Every re-entry risks a missed enrollment, a deduction that does not match the election, or premiums paid after someone has left. HR met with Kaizen on October 7, 2026, sent the outline this PRD is built from, and asked for a projected cost on October 8.
| System | Role today | Role after this build |
|---|---|---|
| Paylocity | Payroll, time off, onboarding | Unchanged: system of record and hub |
| Checkr | Background checks | Ordered from Paylocity after HR approval |
| DocuSign | Named in the outline for offers | Can be cancelled if Paylocity's onboarding e-signature covers offer letters and compliance forms; otherwise connected for both |
| Ascensus | 401(k) | Receives eligibility, deferrals, and payroll each pay period |
| Cigna | Benefits | Receives elections and terminations |
| Sun Life | Benefits | Receives elections and terminations |
| Nippon Life | Dental, vision, and life | Receives elections and terminations |
| OneDrive | HR file storage | Receives copies of every document |
In the October 7 meeting, Neil said Kaitlyn is taking over more of his role and will be Kaizen's day-to-day contact, with Neil (a consultant) copied on everything. Neil described a similar system he built at Societe Generale that took two years: it created the offer letter, handled the compliance follow-up, and completed the provider forms. Today the same employee data (name, SSN, address, marital status, and more) is typed into about five provider portals. HR committed to send by October 21 high-level SOPs, its acronym and regulatory list, its access-role list, and recordings of a typical day. Those inputs drive Phase 0.
Goals, non-goals, and guardrails
The goal is one trigger, many updates: a hire, change, or termination entered once in Paylocity reaches every provider, with HR approving each step that affects someone's job, pay, or coverage.
Goals
Remove re-keying into Checkr, Ascensus, Cigna, Sun Life, and Nippon Life.
Send, track, and file every new-hire document without HR assembling packets by hand.
Keep a copy of every document sent and returned, downloadable by HR one at a time or in bulk, with a copy in OneDrive.
Alert HR the same day when any provider sync fails, with what failed and what to do.
Produce org charts and turnover reports from Paylocity data, always current.
Give Fidelis written answers on data access, storage, backup, and retention for audits and investor questionnaires.
Non-goals
Drafting, editing, or recommending offer or termination letters.
Making or recommending hiring, background-check, pay, or coverage decisions.
Replacing Paylocity or holding a second copy of payroll as a system of record.
Running payroll. Final paychecks are processed in Paylocity by HR and payroll. Also out of scope: AI-drafted replies to employee questions. Don offered this; Neil deprioritized it because HR's personal service to employees matters (he puts Fidelis turnover below 2% since inception).
Guardrails
HR approves before a background-check result is acted on and before any offboarding step runs.
Candidate consent and FCRA adverse-action steps stay in place and cannot be skipped.
Every change pushed to a provider is logged with what changed and who approved it.
The platform uses no AI to make or draft employment decisions. Any AI use (for example, reading a returned form) proposes a value that a person confirms. No SSNs, full names with middle names, or home addresses are sent to any AI model. This matches the PII rules for HR's use of Claude that Don and HR discussed on October 7.
Users, roles, and who can see employee data
Neil set the rule on October 7: only Kaitlyn, the managing members, Tom Hirokawa (CFO), and Neil himself may see SSNs and full employee records. Everyone else sees only what their step needs, and every read of sensitive data is logged. Today only Kaitlyn, Neil, Paylocity, and the providers see this data, and investors ask who sees it. Roles map to Entra groups that Fidelis administers, so adding or removing access is a Fidelis action, not a Kaizen one.
| Role | Who | Sees | Can do |
|---|---|---|---|
| HR Administrator | Kaitlyn Jashinski (primary), Neil Carfagna (consultant) | All employee records, SSNs, pay, elections, documents | Approve every gated step, upload letters and SPDs, export, manage templates |
| Executive viewer | Managing members (Brian Tortorella, Michael Tessitore), Tom Hirokawa (CFO) | All employee records, read-only | View and export; no workflow actions |
| Hiring Manager | Department heads | Their own candidate's offer status only, no PII | Review the offer letter draft before HR finalizes it |
| Compliance | Lucy Karongo | Her compliance-form campaigns: who has signed and who has not; the audit log. No SSNs, pay, or health data | Launch signature campaigns, set reminders, run access reviews |
| Accounting | Accounting team | Invoice notices and final-pay checklist only | Mark invoices received |
| IT / Access | Chris Mindrum | Exit tasks only (equipment, system access) | Close exit tasks |
| Employee / Candidate | External | Their own forms, through a single-use secure link to a personal email | Sign, complete, and return forms |
| Kaizen engineers | Kaizen dev team: Mykle, Jen, and developers being added | Masked or synthetic data during development. Production data only for named, US-based team members Fidelis approves, only when HR opens a support case, and every access logged | Fix and deploy; access removed when the subscription ends |
Restrictions that apply to every role
SSNs, bank details, and health elections are masked by default and revealed only to HR Administrators, with each reveal logged.
Health-related documents (elections, ADA accommodation records) sit in a separate restricted file area from the general personnel file, following the EEOC's confidential-medical-file rule.
Kaizen developers outside the United States work only with masked or synthetic data, as under SOW No. 1.
Fidelis and Unitas employees appear in the same system but can be split by entity if HR wants separate administrators.
Open question: Kaitlyn, Tom, and the managing members owe the final access-role list by October 21. It should confirm the executive-viewer role and whether Unitas HR needs its own administrator.
Proposed architecture
We recommend Paylocity as the hub rather than direct connections to each provider: it already holds the employee record, it already integrates with Checkr and Ascensus, and every update then traces back to one source.
“Kansas HR” listens to Paylocity's webhooks for hires, changes, and terminations, re-reads the employee from Paylocity's API, and acts only after HR approves. E-signature runs through Paylocity's onboarding e-signature if Fidelis's plan includes it, otherwise through DocuSign. OneDrive receives HR's copy of every document.
What stays. Paylocity payroll needs a licensed payroll provider. Checkr is a regulated consumer reporting agency billed per report, and Ascensus holds the 401(k) accounts. The carriers are the insurers themselves, and OneDrive is already part of Microsoft 365. “Kansas HR” replaces the manual work between these systems, not the systems themselves. DocuSign is the one product Fidelis may be able to cancel (see What Fidelis keeps and what it can cancel).
Hosting. “Kansas HR” runs on Railway in a US region, with a Railway project in Fidelis's own name and Kaizen added as members. Railway holds a SOC 2 Type II report and offers a HIPAA BAA as a paid add-on. Documents go to a Cloudflare R2 bucket in Fidelis's own Cloudflare account, created with R2's US jurisdiction so files stay in the United States. Cloudflare's SOC 2 Type II report covers R2. Health-related documents (benefit elections and accommodation records) stay out of R2 unless Cloudflare signs a BAA, which it generally offers only on Enterprise contracts. Otherwise they are stored in Railway under Railway's BAA. Secrets live in Railway variables limited to the project's administrators. Sign-in and MFA run through Fidelis's Microsoft Entra.
Phase 1: New hire
New hire goes first because it touches every provider; it is live when one real hire moves from verbal acceptance to completed onboarding with no re-keying.
Workflow (HR gates in bold)
Hiring manager's offer is approved. HR opens a hire record in the HR console.
Candidate gives verbal acceptance. HR approves ordering the background check. The platform orders it through Paylocity's Checkr integration, after confirming the candidate's stand-alone FCRA disclosure and authorization are on file.
The platform tracks Checkr status and alerts HR when a result arrives. HR reviews every result. If HR considers adverse action, the platform sends the pre-adverse-action notice with the report and the FCRA Summary of Rights, holds the file, and sends the final adverse-action notice only when HR confirms.
HR drafts the offer letter, the hiring manager reviews it, and HR marks it final. The platform never opens or edits the letter's content.
The platform sends HR's final letter for e-signature (Paylocity onboarding e-signature or DocuSign), tracks views and signature, and files the signed copy.
On signature, the platform triggers Paylocity onboarding for the new employee.
The platform fills in and sends the new-hire packet to the employee's personal email through a secure link: current-year benefits SPD, Ascensus 401(k) SPD, blank benefits and dental election forms, the employee's eligible plan options and costs, handbook, handbook acknowledgement, anti-harassment training, and any other compliance forms HR designates. A copy of each sent document is saved.
The platform tracks completion, sends reminders on a cadence HR sets (daily, every 3 days, or a custom interval), escalates to HR after a set number of reminders, saves every returned form, and flags anything stuck past a deadline HR sets.
The platform notifies Accounting of the related invoice (for example, the background-check charge).
HR sees each step on a per-hire timeline and is notified at each step.
Functional requirements
| ID | Requirement |
|---|---|
| NH-1 | Read new-hire, change, and termination events from Paylocity webhooks; re-read the employee from the API before acting. |
| NH-2 | Gate every outbound action behind the HR approval named in the workflow; no approval, no send. |
| NH-3 | Store letters only as uploaded by HR; no edit function exists for letter content. |
| NH-4 | Maintain a template library with plan-year versions; HR uploads new SPDs and forms each plan year, and the old version is retained, not overwritten. |
| NH-5 | Prefill forms only from fields HR entered or Paylocity holds; leave any unknown field blank for the employee. |
| NH-6 | Deliver packets to personal email by expiring secure link, never as unencrypted attachments containing SSNs. |
| NH-7 | Show a per-hire timeline: step, owner, status, age, and the next action. |
| NH-8 | Flag any step idle past its HR-set limit and email HR the same day. |
| NH-9 | Record each send, view, signature, and return with time and actor in the audit log. |
| NH-10 | Notify Accounting of hire-related invoices; no payment is made by the platform. |
| NH-11 | Configurable reminder cadence per document or campaign (daily, every 3 days, custom), with an escalation path and HR-approved exceptions (for example, an employee on leave). |
| NH-12 | Compliance-form campaigns for current employees: Lucy picks a form and a group of employees, the platform sends it for e-signature, reminds non-signers on her cadence, escalates to the employee's manager, and reports completion. |
Why NH-11 and NH-12 are in Phase 1. Neil raised this on October 7: Lucy spends much of her time chasing employees to sign compliance forms. New hires have an incentive to sign, because they are not hired until they do; current employees do not. The e-signature and reminder engine built for new hires serves both, so the campaign feature adds about 16 hours.
Phase order versus HR's stated order. HR listed the stages as offer letters, then provider feeds, then Paylocity onboarding, then offboarding. This PRD runs Paylocity onboarding in Phase 1, because onboarding starts the moment the offer is signed and every later phase reads from it. HR's other stages map to Phases 2 and 3.
E-signature. “Kansas HR” does not build its own signing. It sends documents through Paylocity's onboarding e-signature if Fidelis's plan includes it, otherwise through DocuSign. Signed copies, consent records, and certificates come back into “Kansas HR”. The signing provider remains responsible for the signature record itself. Form I-9 stays in Paylocity's onboarding, because federal rules for electronic I-9s carry their own audit and inspection requirements.
Phase 2: Benefits enrollment and payroll sync
Optional, decided after Phase 1. When an employee returns a completed election form, HR approves it once and the platform updates the carriers, Paylocity deductions, and Ascensus, so the deduction always matches the election.
| ID | Requirement |
|---|---|
| BE-1 | Save each returned election form to the employee's restricted file and place it in HR's review queue. |
| BE-2 | On HR approval, send each election to the right carrier: dental, vision, and life to Nippon Life; other coverage to Cigna or Sun Life per Fidelis's plan map. |
| BE-3 | On the same approval, set the matching employee deductions and employer contributions in Paylocity; show HR the before and after values first. |
| BE-4 | Send 401(k) eligibility, deferrals, and payroll data to Ascensus each pay period, using Paylocity's existing Ascensus integration. |
| BE-5 | Apply life events (new dependent, address change, salary change) everywhere at once after HR approval, with one change record listing every system updated. |
| BE-6 | After each push, compare what the carrier or Ascensus shows against the approved election where the provider makes that visible, and flag any mismatch. |
| BE-7 | If any push fails, alert HR the same day with the employee, the provider, the error, and the next step. |
How each carrier is reached depends on what exists. Paylocity's marketplace lists a Cigna integration described as covering FSA, HSA, and pre-tax accounts, which may not cover medical enrollment. We found no Paylocity marketplace listing for Sun Life or Nippon Life. Kaizen will use, in order of preference: an existing Paylocity or broker carrier feed; a carrier EDI 834 enrollment file Kaizen sets up; or, where a carrier offers neither, a prepared task with the filled carrier form for HR to submit through the carrier portal. Phase 0 confirms which applies to each carrier.
Phase 3: Offboarding
Optional, decided after Phase 1. Nothing in offboarding runs until HR confirms the termination in Paylocity and approves the offboarding run; HR writes and delivers the termination letter outside the platform.
| ID | Requirement |
|---|---|
| OF-1 | Detect a termination in Paylocity and open an offboarding record; take no action until HR approves it. |
| OF-2 | End coverage with each carrier effective on the date HR confirms, and stop 401(k) deferrals with Ascensus. |
| OF-3 | Send the standard exit and COBRA paperwork (not the termination letter) and save copies. |
| OF-4 | Create exit tasks to collect equipment and remove system access, assigned to IT, with due dates and status. |
| OF-5 | Track the final paycheck as a checklist item for payroll; the paycheck itself is processed in Paylocity. |
| OF-6 | Let HR upload a copy of the termination letter to the employee's file. |
| OF-7 | Flag any carrier that still shows active coverage after the end date, so premiums are not paid after departure. |
Phase 4: Time off and reporting
Optional, decided after Phase 1. Time off stays in Paylocity; the platform only checks it, and builds two reports from payroll data so they never go out of date.
| ID | Requirement |
|---|---|
| TR-1 | Before each payroll closes, flag negative time-off balances and balances that do not match payroll, and email HR the list. |
| TR-2 | Build company-wide and department org charts from the Paylocity supervisor field, updated on every hire, role change, and exit. |
| TR-3 | Flag missing or circular supervisor links, since the chart is only as accurate as that field. |
| TR-4 | Build turnover reports from hire and termination dates: by month, department, and length of service, split voluntary and involuntary. |
| TR-5 | Agree turnover definitions with HR before build (rate formula, headcount basis, treatment of rehires and transfers) so the numbers match how Fidelis reports today. |
| TR-6 | Export both reports to Excel and PDF on demand. |
Documents, retention, and OneDrive
Every document the platform sends is saved, every form an employee returns comes back to the platform, and HR can open or download any of it at any time.
Where HR finds documents. One file per employee in the HR console, split into a general personnel file and a restricted medical and benefits file. Each item shows what was sent, what came back, when, and by whom.
Downloads. One at a time or in bulk (per employee, per date range, or per document type) as a zip.
OneDrive copy. An automatic copy of each saved document to a Fidelis-designated OneDrive or SharePoint folder, mirroring the same two-part file structure. The platform copy remains the audit copy.
Storage and backup. Records sit in Fidelis's Railway project (US region). General documents go to Fidelis's R2 bucket under R2's US jurisdiction, and health-related documents are held in Railway under its BAA. “Kansas HR” encrypts SSNs, bank details, health fields, and every stored document itself, with keys in Railway variables, rather than relying only on the provider's storage encryption. Daily backups are retained 90 days and a restore is tested before go-live.
Retention. Set per document type with Fidelis's counsel and enforced by the platform, with a legal-hold flag that stops deletion. Starting points to confirm with counsel:
| Record | Federal starting point |
|---|---|
| Benefit plan records supporting required filings | At least 6 years from the filing date (ERISA §107) |
| Records showing how an employee's benefits were calculated | Until benefits are fully paid and audit periods close (ERISA §209) |
| Form I-9 | 3 years after hire or 1 year after employment ends, whichever is later |
| Background-check reports | Retained per counsel; disposed of securely when no longer needed (FTC disposal rule) |
| Payroll and time records | Kept in Paylocity as system of record; the platform keeps copies only of what it sent or received |
Fidelis's handbook covers employees in 15 states. State rules in each may extend these periods or require state-specific new-hire forms, so retention and packet contents are a counsel item.
Security, privacy, and compliance
The outline names HIPAA, ADA, IRCA, PII, and FCRA and asks who can read data, where it is stored, and how it is backed up. The answers below are written so HR can lift them into audit and investor questionnaires once confirmed. In the meeting Neil also listed "CR"; HR will send the full list by October 21. "CR" needs confirming; it may mean FCRA or a civil-rights framework. Tom Hirokawa and the managing members are preparing the investor-facing disclosure on data storage and access, which should draw on this table.
| Question | Answer |
|---|---|
| Who can read employee data? | Kaitlyn, Neil, the managing members, and Tom Hirokawa see full records. Other roles see only their own step (see Users, roles, and who can see employee data). Every view of SSNs, pay, or health data is logged with person and time. |
| Where is data stored? | In a Railway project and a Cloudflare R2 bucket, both in Fidelis's own name, both in the United States. This meets Neil's ask that "we house the software and all the proprietary information is just with us." No employee data is stored on Kaizen's own systems. |
| How is it backed up? | Daily backups, 90-day retention, restore tested before go-live. The recovery point is 24 hours and the recovery time is 8 hours, unless Fidelis sets tighter targets. |
| Who at Kaizen has access? | Named, US-based members of the Kaizen dev team whom Fidelis approves, only to resolve an HR-opened support case, with every access logged. Access ends when the subscription ends. |
| How is it encrypted? | TLS 1.2 or higher in transit. At rest, “Kansas HR” encrypts sensitive fields and documents itself. Keys and other secrets are held in Railway variables restricted to the project's administrators. |
| HIPAA and BAA | Kaizen will sign a BAA for health-election data. Whether Kaizen is a business associate of the group health plan or a vendor to the employer depends on the functions it performs for the plan; counsel to confirm, but the BAA covers either reading. Railway offers a BAA as a paid add-on above a spending threshold. Health-related documents stay out of R2 unless Cloudflare signs a BAA. |
| ADA | Medical and accommodation information is held in a separate, restricted file, apart from the personnel file. |
| IRCA (Form I-9) | I-9s stay in Paylocity's onboarding. Any copies “Kansas HR” holds sit in the restricted file, with retention set to the I-9 rule. |
| FCRA | A stand-alone disclosure and authorization is required before any order. Pre-adverse and adverse-action notices carry the required contents, and HR decides every step. |
| SOC 2 | Railway holds a SOC 2 Type II report, and Cloudflare's SOC 2 Type II report covers R2; Fidelis can request both under NDA. Kaizen's own SOC 2 evidence is still open. Proposed approach: rely on the hosting providers' reports for infrastructure, and provide Kaizen's completed security questionnaire and control descriptions. Decide with Fidelis whether Kaizen needs its own SOC 2 readiness effort before go-live. |
All of the above is subject to the security review Chris and Lucy are running for SOW No. 1; one set of answers should serve both engagements.
Security controls and compliance matrix
“Kansas HR” will run with 29 controls. Sixteen are described elsewhere in this PRD. The 13 marked "(new)" were added here and account for about 36 development hours, which are included in Timeline and hours. This table is the single list Fidelis can give to auditors and investors, subject to review by Fidelis's counsel and its cybersecurity provider.
| # | Control | What it does | Serves |
|---|---|---|---|
| 1 | Named security owners (new) | Kaizen names a security lead from its dev team; Fidelis names a privacy owner (proposed: Lucy Karongo) | HIPAA assigned security official; investor due diligence |
| 2 | Risk assessment (new) | Written risk assessment before go-live and every year after, with fixes tracked to closure | HIPAA Security Rule risk analysis |
| 3 | Written policies and incident-response plan (new) | Access, acceptable use, data handling, and incident-response procedures for “Kansas HR”, with annual training for HR users and the Kaizen dev team | HIPAA administrative safeguards; investor due diligence |
| 4 | Business associate and vendor agreements (new) | BAA between Kaizen and Fidelis's plan; Railway BAA add-on; Fidelis collects security reports and BAA or data-processing terms from Paylocity, Checkr, Ascensus, DocuSign (if used), Railway, Cloudflare, Microsoft, and the carriers | HIPAA business associate contracts; CCPA service-provider terms; investor due diligence |
| 5 | Role-based access | Access by Entra group; full records only for Kaitlyn, the managing members, Tom Hirokawa, and Neil | HIPAA access control; ADA; investor due diligence |
| 6 | Multi-factor sign-in (new) | Entra conditional access requires MFA on every sign-in, for staff and Kaizen alike | HIPAA person authentication |
| 7 | Automatic sign-out (new) | Idle sessions end after 15 minutes (proposed default; Fidelis may set it) | HIPAA automatic logoff |
| 8 | Access reviews and same-day removal (new) | Quarterly review of who has which role, signed by Kaitlyn and Lucy; departing users lose access the day they leave (offboarding exit task) | HIPAA workforce security; investor due diligence |
| 9 | Masking and logged reveal | SSNs, bank details, and health elections hidden by default; each reveal logged | HIPAA minimum necessary; ADA; investor due diligence |
| 10 | Restricted Kaizen access | Masked data in development. Production access only for named, US-based dev team members Fidelis approves, on an HR support case, time-limited and logged; removed when the subscription ends | HIPAA access control; investor due diligence |
| 11 | Encryption | TLS 1.2 or higher in transit; “Kansas HR” encrypts sensitive fields and documents at rest itself, with keys in Railway variables limited to administrators | HIPAA transmission security; HIPAA and New Jersey encryption safe harbors |
| 12 | Data minimization (new) | Store only fields a workflow needs; SSNs never in email bodies, file names, logs, or reports | CCPA proportionality; New Jersey breach law exposure |
| 13 | Secure delivery to employees | Expiring single-use links, never unencrypted attachments | HIPAA transmission security; New Jersey breach law |
| 14 | No PII to AI models | No SSNs, full names, or addresses sent to any AI model | Fidelis AI-use policy; investor due diligence |
| 15 | Separate medical file | Elections and accommodation records kept apart from the personnel file, and out of R2 unless Cloudflare signs a BAA | ADA confidential medical records; HIPAA |
| 16 | US-only storage in Fidelis's name | Railway project in a US region and R2 bucket under R2's US jurisdiction, both owned by Fidelis | Investor due diligence; Neil's "housed with us" requirement |
| 17 | Append-only audit log | Every read of sensitive data, change, send, signature, and approval, with person and time, kept at least 6 years | HIPAA audit controls; ERISA records; investor due diligence |
| 18 | Document integrity | Versioned documents, never overwritten; HR approval recorded on each provider update | HIPAA integrity; ERISA records |
| 19 | Unusual-activity alerts (new) | Alert Kaitlyn and Kaizen on bulk exports, repeated SSN reveals, or sign-ins from new locations | HIPAA security incident procedures |
| 20 | Vulnerability management (new) | Automated dependency and code scanning on every release, monthly patching, and an independent penetration test before go-live (test fee is Fidelis's, outside the monthly fee) | HIPAA periodic evaluation; investor due diligence |
| 21 | Secure development | Code review on every change, no secrets in code, separate development, test, and production environments | HIPAA integrity; investor due diligence |
| 22 | Backup and recovery | Daily backups kept 90 days, restore tested before go-live, 24-hour recovery point, 8-hour recovery time | HIPAA contingency plan |
| 23 | Incident notification (new) | Kaizen notifies Fidelis immediately on discovering a suspected breach, and in any case within 24 hours. Fidelis decides and sends notices: New Jersey State Police before affected employees, and HIPAA notice to the plan within 60 days at the latest | New Jersey breach law; HIPAA Breach Notification Rule; other states' breach laws |
| 24 | Retention and legal hold | Retention by document type, legal hold that blocks deletion, secure deletion at end of period | ERISA; IRCA; FCRA disposal |
| 25 | FCRA gates | Stand-alone disclosure and authorization before ordering; pre-adverse and adverse-action notices; HR decides each step | FCRA |
| 26 | I-9 handling | I-9s stay in Paylocity onboarding; any copies “Kansas HR” holds sit in the restricted file, kept 3 years from hire or 1 year after exit, whichever is later | IRCA |
| 27 | HR approval gates | No offer, check, election, or offboarding step runs without HR's approval | FCRA; ADA; investor due diligence |
| 28 | Employee data requests (new) | HR can export, correct, or delete one employee's data, subject to retention rules | CCPA, if Fidelis has California employees and meets its thresholds |
| 29 | Employee privacy notice (new, Fidelis action) | Fidelis updates its employee privacy notice to describe “Kansas HR”, what it holds, and who sees it | CCPA notice at collection, if applicable; investor due diligence |
Read by law
HIPAA (Security and Breach Notification Rules): 1 to 7, 9 to 11, 13, 15, 17 to 23.
ADA: 5, 9, 15, 27.
IRCA: 24, 26.
FCRA: 24, 25, 27.
ERISA records: 17, 18, 24.
New Jersey and other state breach laws: 11, 12, 13, 23.
CCPA (if it applies): 4, 12, 28, 29.
Investor and audit questionnaires: 1, 3, 4, 5, 8 to 10, 14, 16, 17, 20, 21.
"CR": to be mapped once HR defines it.
One conflict to resolve: SOW No. 1 promises incident notice within 72 hours of confirmed unauthorized access, while New Jersey law requires a vendor holding personal information for another entity to notify it immediately. Control 23 uses the stricter standard, and SOW No. 1 should be aligned to match.
Timeline and hours
The timeline is counted in weeks from signature, because the start date is Fidelis's to choose. Phases 0 and 1 take about 294 hours, and the new-hire workflow goes live at the end of week 6. Phases 2 to 4 add 204 hours and, if approved, run weeks 7 to 19. The full scope is about 498 hours across five phases (0 to 4).
Schedule assumptions.
Week 0 is signature and set-up: kickoff meeting, Fidelis creates the Railway and Cloudflare accounts in its own name, grants Paylocity API access, and approves the Entra app registration. HR's SOPs, lists, and recordings are in hand by then.
The Kaizen dev team (Mykle, Jen, and the developers being added) puts about 75 hours a week into Phase 1. On October 7 Don told HR the start depends on Kaizen's hiring. If the team is not in place, every date moves by the same amount.
If Phase 1 testing slips, go-live moves out by up to two weeks (end of week 8). Any weeks that fall in Fidelis's mid-December to early-January dark period are skipped; calendar dates are set at kickoff.
Production deployments follow SOW No. 1's freeze from the 14th to the 21st of each month.
Hours by work item
| Phase | Work item | Hours |
|---|---|---|
| 0 | Discovery: SOP mapping, HR software and contract inventory, provider connectivity checks, data-access matrix, security answers, turnover definitions | 24 |
| 0 | Build-versus-buy check against off-the-shelf HR platforms (about $500 a month) and Paylocity's own modules | 4 |
| 0 | Risk assessment, “Kansas HR” security policies, and incident-response plan (controls 1 to 3, 23) | 12 |
| 1 | Foundation on Railway in Fidelis's name: Entra sign-on with MFA, roles, session timeout, audit log, encrypted storage in Railway and R2, retention, OneDrive copy | 32 |
| 1 | Paylocity connection: webhooks, employee reads, onboarding trigger | 32 |
| 1 | Checkr through Paylocity: switch-on, status tracking, FCRA consent and adverse-action gates | 12 |
| 1 | E-signature connection: Paylocity onboarding e-signature or DocuSign; send, track, file signed copies | 20 |
| 1 | New-hire packet engine: templates, plan-year versions, prefill, secure send, reminders, returns | 40 |
| 1 | Compliance-form signature campaigns for Lucy: recurring sends, reminder cadence, escalation, completion report | 16 |
| 1 | HR console: per-hire timeline, approvals, stuck-step flags, document viewer, bulk download | 32 |
| 1 | Accounting invoice notice | 4 |
| 1 | Same-day failure alerts | 10 |
| 1 | Security build-out: unusual-activity alerts, quarterly access-review report, scanning and patching pipeline, employee data export, correction, and deletion (controls 8, 19, 20, 28) | 24 |
| 1 | Testing, UAT support, security review | 24 |
| 1 | Training and runbook | 8 |
| 2 | Election intake and HR review queue | 12 |
| 2 | Paylocity deductions and employer contributions | 16 |
| 2 | Carrier connections: Cigna, Sun Life, Nippon Life (range 16 to 64) | 32 |
| 2 | Ascensus per-pay-period switch-on and mismatch check | 10 |
| 2 | Life events across all systems | 14 |
| 2 | Testing and UAT | 12 |
| 3 | Termination trigger and HR confirmation gate | 6 |
| 3 | Carrier coverage end and 401(k) deferral stop | 10 |
| 3 | COBRA and exit packet | 10 |
| 3 | Exit tasks: equipment and access removal | 10 |
| 3 | Final-paycheck checklist | 4 |
| 3 | Testing | 8 |
| 4 | Pre-payroll time-off balance checks | 14 |
| 4 | Org charts, company and department | 18 |
| 4 | Turnover reports | 20 |
| 4 | Testing | 8 |
The hours show the work behind the monthly fee; they are not billed. The estimate's range is 436 to 596 hours for the full scope. Phases 0 and 1 carry less uncertainty: about 270 to 330 hours, driven mainly by how many forms and approval steps HR's SOPs add. The full-scope low end assumes Paylocity or the broker already feeds all three carriers. The high end assumes each carrier needs its own EDI 834 file. The independent penetration test (control 20) is a third-party cost to Fidelis, outside the monthly fee.
Acceptance criteria
Each phase is accepted by HR on evidence from real employees, not demonstrations alone.
| Phase | Accepted when | Signs |
|---|---|---|
| 0 Discovery | SOPs mapped to workflows; carrier connection method confirmed per carrier; data-access matrix and security answers approved; turnover definitions agreed | Neil, Kaitlyn, Chris, Lucy |
| 1 New hire | Two real hires completed end to end with no re-keying; every gate enforced; every document saved and copied to OneDrive; a forced sync failure alerts HR the same day; one compliance-form campaign for Lucy runs to completion, with reminders and escalation working | Neil, Kaitlyn |
| 2 Benefits | One month of elections and one life event pushed to every carrier, Paylocity, and Ascensus, each matching the approved election | Neil, Kaitlyn, Accounting |
| 3 Offboarding | Two real terminations completed: coverage ended, deferrals stopped, COBRA sent, exit tasks closed | Neil, Kaitlyn, Chris |
| 4 Reporting | Time-off check run before two payroll closes; org charts match Paylocity; turnover for the last 12 months matches HR's own figures | Neil, Kaitlyn |
Open questions, dependencies, and risks
The estimate holds if the items below resolve as assumed. Each one that does not is a reason the full-scope range runs to 596 hours.
Open questions for Fidelis HR
How do Cigna, Sun Life, and Nippon Life receive enrollments today (broker, Paylocity feed, portal, or paper), and who is the broker?
Is Paylocity's Checkr integration licensed and switched on, and does Fidelis already have a Checkr account?
Is Paylocity's Ascensus integration available on Fidelis's Paylocity plan, and is it switched on?
Does Fidelis hold Paylocity API (Weblink) access, and which Paylocity modules does it license (Onboarding, Benefits)?
Every HR-related subscription Fidelis pays for, with its annual cost (DocuSign, any broker or benefits-administration portal, Paylocity add-on modules, form or survey tools), so Phase 0 can confirm what this build lets Fidelis cancel.
Does Fidelis's Paylocity plan include onboarding e-signature, and can it send forms to current employees as well as new hires? If not, which DocuSign plan does HR use, and how many seats?
What does "send invoice to accounting" cover (background-check fees, recruiter fees, other)?
Which compliance forms belong in every packet, and do any differ by state or entity?
Plan-year start date and open-enrollment window, so Phase 2 (if approved) avoids going live mid-enrollment.
Turnover definitions HR uses today.
Is Unitas HR in scope with separate administrators?
Raised in the October 7 meeting
Offer letters: the meeting notes say "offer letter generation", but the outline says HR writes every letter. Should the platform fill an HR-approved template from entered fields, with no AI drafting, or only send letters HR uploads?
Lucy's compliance forms: which forms, how often, which employee groups, the reminder cadence, the escalation path, and allowed exceptions.
What does "CR" stand for in HR's regulatory list?
For Kaizen to confirm before quoting dates
Kaizen dev team capacity: whether the developers being added are in place at kickoff.
Which dev team members are US-based and may be approved for production access.
Railway's BAA add-on: spending threshold and cost to Fidelis.
Whether Fidelis wants a Cloudflare BAA (Enterprise) so health documents can also live in R2.
Dependencies
From Kaitlyn by October 21: SOPs, the acronym and regulatory list, the access-role list, and day-in-the-life recordings. From Tom Hirokawa by October 28: the cost baseline and build-versus-buy model.
Fidelis sets up the Railway project and the Cloudflare account and R2 bucket in its own name and adds Kaizen as members.
Paylocity, Checkr, Ascensus, DocuSign (if used), Railway, Cloudflare, and carrier accounts and fees are Fidelis's, outside Kaizen's monthly fee.
Risks
| Risk | Handling |
|---|---|
| The cost case looks thin on savings alone | No development fee; a six-month minimum, then month to month; Phase 0 lists any software Fidelis can cancel and includes a written build-versus-buy check |
| An off-the-shelf HR platform at about $500 a month covers enough | The Phase 0 build-versus-buy check says so plainly, as Don told HR on October 7 |
| A carrier offers no feed | Prepared portal task for HR; no change to the rest of the workflow |
| Paylocity marketplace integrations need Paylocity's involvement to switch on | Raised in Phase 0 week 1; HR requests through its Paylocity account team |
| Kaizen dev team not fully staffed by kickoff | Dates move day for day; Don flagged this to HR on October 7 |
| HR is a lower priority than the FIRMS replacement (Neil, October 7) | If SOW No. 1 needs the team, “Kansas HR” dates move |
| SOC 2 evidence gap | Settled in Phase 0 with Chris and Lucy before any production data is loaded |
| Fidelis's year-end dark period (mid-December to early January) | Weeks inside it are skipped; calendar dates set at kickoff account for it |
Sources
NC.JK Kaizen Meeting Outline (Fidelis HR, attached to Kaitlyn Jashinski's email of October 7, 2026)
Email thread "Kaizen + HR Meeting Follow-Up", October 7 to 8, 2026; Plaud recording, transcript, and notes, "10-07 Meeting: HR Automation Platform and PII Governance" (Don, Neil Carfagna, and Kaitlyn Jashinski, October 7, 2026)
Fidelis SOW No. 1, revised September 11, 2026 (backup, team, and incident-notice terms referenced here)
Morgan Lewis: CCPA employee exemption expires January 1, 2023
Federal Register: electronic signature and storage of Form I-9