Vulnerability Disclosure Policy

Responsible Disclosure

Paylocity is dedicated to maintaining the security of Paylocity systems and the information they contain. We take information security risks very seriously; if you have information on an issue found while using https://www.paylocity.com or on Paylocity’s mobile application, we’d like you to let us know.

If you have a vulnerability to report to us, please follow the guidelines outlined below. There you will find additional details about the overall process.

Paylocity reserves all legal rights in the event of noncompliance.

Our Responsibilities
We will try to make this process as transparent as we can and will work with you to understand your submission.

• We’ll acknowledge receiving your submission.
• If we can’t reproduce the issue or see it as a false positive, we will let you know.
• If we validate your submission:
  • We'll tell you how high a priority it is for us
  • When we can, we'll send up updates on our progress remediating it
  • We’ll let you know when we’ve patched the vulnerability.

Your Responsibilities
To help us address our informational vulnerabilities in a timely manner, we need you to follow some guidelines:

• No matter the severity of vulnerabilities you may find, you agree not to compromise Paylocity information or its Information systems.
• When disclosing an issue you found, please use the Disclosure form found on this web page
• When scoring the issue, please use Bugcrowd’s Vulnerability Rating Taxonomy.
• Please include your contact information.
• Please respond promptly if we have a question about your submission.
• Please include all the information we will need to recreate the issue. Security researchers should include a detailed technical description of the issue they found.
• Examples of important technical details:
  • Proof-of-concept code along with the use of the exploit
  • Screen captures.
  • URL where the issue occurs.
  • The ID used to login.
  • The time and date when you noticed the issue.
  • Your IP (To find your IP, go to any major search engine and search “what is my IP”. What the search engine returns will look something like this: 255.255.255.255).
• Please include any plans for public disclosure

Scope
Out of scope vulnerabilities

The following are excluded from the Responsible Disclosure Policy (note that this list is not exhaustive):

• Vulnerabilities identified with automated tools (including web scanners) that do not include proof-of-concept or a demonstrated exploit.
• Third-party applications or services that integrate with Paylocity.
• Taking any action that may negatively affect Paylocity.
• Exfiltrating any personally identifiable information discovered, in any medium. Any personally identifiable information discovered cannot be saved or downloaded to your device or storage.
• Destruction or corruption of data, information or infrastructure, including any attempt to do so.
• Reconnaissance dependent on social engineering techniques of any kind (any verbal or written interaction with anyone affiliated with or working for Paylocity).
• Any exploitation actions, including accessing or attempting to access Paylocity’s data or information, beyond what is required for the initial “Proof of Vulnerability.” The actions to validate the Proof of Vulnerability must stop immediately after initial access to the data or a system.
• Denial of Service (DoS) attacks or Distributed Denial of Services (DDoS) attacks.
• Use of assets that you do not own or are not authorized or licensed to use when discovering a vulnerability.
• Knowingly posting, transmitting, uploading, linking to, or sending any viruses/malware.
• Pursuing vulnerabilities that send unsolicited bulk messages (spam) or unauthorized messages.
• Any vulnerability obtained through the compromise of Paylocity customer or employee accounts.
• UI and UX bugs and spelling mistakes.

In scope vulnerabilities
Services that Paylocity provides or any Paylocity product are in scope.