This policy describes how Chronos Payroll detects, responds to, and reports security incidents affecting the payroll and tax data entrusted to us by our Vendors and their employees and contractors.

1. What Counts as a Security Incident

Any event that could put taxpayer or payroll data at risk, including: unauthorized access to an account or the database, a lost or stolen device with access to the platform, a suspected phishing or credential-theft attempt against a Chronos or Vendor login, or any vulnerability that could allow data exposure.

2. Detection

• Audit logging. Every login, multi-factor authentication event, and change to a sensitive record is written to a tamper-evident, cryptographically chained security log - each entry is linked to the one before it, so the log itself reveals if any entry is ever altered after the fact.
• Access review. Every login across every Vendor account is reviewable in one place, so access that should have been revoked (a departed employee, an inactive account) can be caught and removed.
• Failed-login and lockout tracking. Repeated failed multi-factor authentication attempts automatically lock the account and end the session, rather than allowing unlimited guesses.

3. Response Process

1. Identify & contain. Confirm the scope of the incident (which accounts, which data) and take immediate action to stop ongoing exposure - for example, forcing a password reset or disabling a compromised account.
2. Investigate. Review the audit log to reconstruct what happened and confirm the incident's full extent.
3. Notify. Affected Vendors are notified without unreasonable delay. Where taxpayer data (SSNs, tax filings) is involved, Chronos will also report the incident to the IRS through the local IRS Stakeholder Liaison, consistent with IRS Publication 4557 guidance for e-file providers, and to any state agency or affected individual where required by law.
4. Remediate. Close the underlying gap (patch, configuration fix, credential rotation) before considering the incident resolved.
5. Review. Document what happened and what changed afterward to prevent a repeat.

4. Reporting Timeline

Chronos aims to notify an affected Vendor within 72 hours of confirming an incident involving their data, and to begin the IRS/state notification process as soon as the scope of any taxpayer data exposure is confirmed.

5. How to Report a Suspected Incident

If you notice anything that looks like unauthorized access, a suspicious login, or unexpected changes to your account, contact us immediately at info@chronospayroll.com.

Back to Privacy Policy