Infrastructure

High Availability

• Global coverage delivered through multiple cloud points of presence in the US, EMEA, and APAC regions.
• Each classified to the highest global standard for availability and security, including:
  • Infrastructure architecture exceeding Tier 3 accreditation standards.
  • Proven mission critical hosting.
  • At least N+1 capacity and redundancy provision of compute, network, storage,
    power, and HVAC.
  • 24*7*365 security operations.

Platform and Applications

Architecture

• Service-Oriented, multi-layered zone-based network security architecture that separates application role, application logic and data with principles of zero-trust.
• Network and application security gateways enforcing least privilege access.
• Distributed resilience though network load-balancing and message-based asynchronous processing.
• Dynamic cloud capacity.
• Providing a flexible, resilient, secure, and scalable infrastructure.
• Multi-tenant architecture for proven consistent performance and reliability.

Backups

• Backup cycles with regular transaction log backups, nightly incremental backups, and weekly full backups. Longer backup retention in non-GDPR/CCPA regions and regions with jurisdictional requirements.
• On-going verification/restoration testing procedures validate data integrity.
• Off-site backup replication.
• All backups replicated locally and to geographically remote cloud locations.
• All backups securely encrypted.

Disaster Recovery

•  In-region, geographically remote secondary cloud presence providing hot-site recovery capability and data protection.

Performance

• All systems are subject to continuous performance and health monitoring.
• All web and mobile systems are designed to provide fast response time by using modern user interface frameworks, small data transmission packets, and cached data when possible.

Management and Monitoring

• The platform and applications are monitored 365x24x7 by integrated monitoring tools.
• Global operations staff provides cover on 365x24x7 basis, ready to respond to an alert.

Service Response

• Formal Service Level Agreements categorise incidents by severity.
• Pre-defined targets for response and resolution time at P1 through P4 levels.

System Maintenance

• Where the planned maintenance period will affect the availability of systems, Fourth will make best efforts to notify key user contacts at least one week in advance.
• Emergency maintenance periods may be carried out immediately. Fourth will make best efforts to notify key user contacts in this situation.

Security

Physical Security

• Highly secure cloud facilities – CCTV, external barriers, and proximity access cards.
• Compartmentalised security zones.
• Servers held in locked cages.
• Gas, fire, heat, and flood detection as well as gaseous fire suppression systems.
• A complete building management system monitoring all elements.
• Guarded entry points.

Logical Security

• Access is granted on a need-to-know basis and in accordance with the principle of least access.
• Strict password policies are in place for all accounts.
• Application and network security gateways control access on all Internet access points.
• Remote access is only possible via a secure authenticated link.

Information Security

• Dedicated Senior Information Security Officer responsible for information security.
• Oversight by executive leadership team with quarterly security updates and reviews.
• Maintains continued compliance with local laws and regulations in conjunction with Legal.

Security Policies

• Information security policies communicated to all staff.
• Policies are reviewed at least annually.
• Policies covering:
  • Risk management
  • Information classification and handling
  • Change management
  • Patch management
  • Business continuity and disaster recovery
  • Access management
  • Sub Processor security
  • Incident response

Staff

• Information security training occurs annually.
• Subject to confidentiality agreements.
• Agree to adhere to company policies.

Laws and Regulations

• Dedicated Legal team maintaining Fourth’s continued compliance with all applicable local laws and regulations, in conjunction with security personnel and product owners.

Vulnerability Reporting Policy

• Keeping our customers’ data secure is our number-one priority and Fourth
  acknowledges the valuable role that independent security testing plays in Internet security.
• All security testing against our systems must be done in a responsible, non-disruptive and legal manner.

Compliance and Accreditation

Fourth

• ISAE 3402 Type II
• ISAE 3000 (SOC 2) Type II

Data Centres

• ISO 27001
• SOC 1/2/3
• Additional accreditations dependent on location.

Payroll Bureau (UK)

• PAYE Recognition
• Chartered Institute of Payroll Professionals
  • Payroll Assurance Scheme (PAS)
• Bacs Bureau Approved (BAB)

Payroll Bureau (USA)

• ISO 9001:2015
• Certified Professional Employer Organization (CPEO)