Client Security Assurance &
Due Diligence

Access follows role-based access control with predefined security groups and the principle of least privilege. Machine-to-machine access uses certificate-based authentication issued by an internal CA. Remote administrative access requires a Mercans-issued digital certificate plus two-factor authentication.

All access to Mercans systems — including privileged access — is granted strictly through a formal User Access Request (UAR) process. No access is provisioned until the request has been reviewed and approved by both the line manager and the application owner, in line with the principles of least privilege and need-to-know. Privileged access is subject to additional controls, including independent logging and review by the Security function. Access is revoked immediately on employee termination, role change or disciplinary action. Access rights are reviewed quarterly.

For client end-users within HR Blizz, roles are assigned by the client's own payroll/administrator team through the in-application onboarding process. Where SSO is integrated, a leaver's access is revoked through the client's domain removal, after which the user is removed from the authorized-user list.

Built-in and shared accounts are prohibited under Mercans' Access Control Policy. All privileged accounts are assigned to unique user identities, must not be shared, and are strictly limited in number to ensure individual traceability of all privileged activity. This restriction applies uniformly across production, test and development environments.

All user activity in HR Blizz is logged and time-stamped. Logged events include authentication attempts (successful and failed) and log-offs, system-administrator access, authorization events (granting/revoking access rights), and account-status and password changes — capturing what was changed, who made the change and the subject user or service account.

Mercans operates SIEM and IDS/IPS to detect anomalies, insider threats, privilege abuse, unusual network traffic and malware alerts. Security incidents and intrusion attempts are logged in the WAF and IPS, with alerts triggered to Technical IT Support against predefined thresholds. Monitoring is continuous.

System logs, administrator event logs and audit logs are retained for 180 days. A full-period audit trail is generated at each payroll period close.

• At rest — AES-256 across all storage; server-side storage only, no client data on local devices. Backups encrypted and password-protected.
• In transit — TLS v1.2+ enforced with 4096-bit / SHA-256 certificates; IPSec VPN between locations; confidential information moves only through secure exchange portals.

Cryptographic secrets are held in HashiCorp Vault, the private internal system of record. TLS certificate lifecycles are fully automated; other certificates follow the Mercans change-management process. Bank-file signing keys are generated and held on the Mercans encryption server, and private keys never leave it.

• Generation — keys are generated using strong, approved algorithms and key lengths, with separate algorithms for encryption and signing to ensure key diversification. Keys are rotated regularly.
• Storage & distribution — keys are securely stored and rotated using approved secret-management systems. Access is restricted through role-based controls and least privilege. Keys are securely backed up and archived only for as long as the associated encrypted data requires.
• Expiry — keys have defined lifetimes with clear activation and deactivation periods, and revocation mechanisms address key compromise or end-of-use.
• Archival, retrieval & destruction — lifecycle management covers secure distribution, activation, storage, rotation, recovery, replacement and secure destruction under standardized procedures. Recovery options exist for lost, expired or corrupted keys; keys are archived only as long as the associated data requires, after which they are securely destroyed.
• Certificate management — TLS 1.2+ / SSL protocols secure communication channels and data in transit, per the Mercans standard for handling sensitive data in service agreements.

Internal and external assets are scanned monthly using OWASP ZAP, with findings logged and tracked in the ITSec & Infra project in YouTrack. Supplemented by penetration testing, code reviews and security audits; the application is verified against OWASP ASVS.

Clients are notified without undue delay and within legally or contractually mandated timeframes. Where service delivery is impacted, the account manager notifies the client no later than 2 hours from the disruption becoming known.

Incidents can be reported by Freshdesk ticket to the QCRM team, by phone, or by email to sat@mercans.com and privacy@mercans.com. The Mercans Support Team provides Level 1 support, reviewing tickets and routing incidents to the Investigation Unit.

Infrastructure and services use redundant architecture with resources distributed across geographically dispersed data centres, and network connections between them support swift failover. Core systems are hosted on private cloud and remain accessible from primary or backup offices.

HR Blizz uses real-time mirroring with a promotable recovery site — the same replication machinery that runs continuously in normal operations, not a cold standby. On failover the mirror is promoted to a writable volume and the DR site becomes the production site. Disaster-recovery testing is conducted annually, with test plans and post-mortems. The Disaster Recovery Plans are published in the Compliance Hub.

Backups run daily (encrypted and password-protected) at every data-centre location, with delta snapshots twice daily. Local retention is 31 days, followed by one-year external archival. Retention criteria and periods can be determined by the client.

RTO and RPO targets are defined by disaster scenario in the Mercans Business Continuity Plan:

Records are retained in secure locations in Mercans' private cloud with access limited to authorized personnel. On expiry, records are reviewed, archived, or confidentially scrambled and destroyed per purpose and legal/regulatory requirements. Clients determine their own retention criteria and periods. Log retention is 180 days.

Access is blocked automatically through domain removal and the user is removed from the authorized-user list in HR Blizz. Employee payroll data is retained to meet country legal requirements — in many jurisdictions a minimum of ten years — rather than deleted immediately.

Mercans operates under GDPR and holds EEA-approved Binding Corporate Rules for Processors, backed by an ISO/IEC 27701 privacy information management system. Client data is stored server-side only, never on local devices, and confidential information is exchanged only through secure portals.

Governance is evidenced through documented policies, management oversight, an internal-audit function, QCRM involvement, the SAT and BCP teams, annual policy reviews, annual DR testing and ongoing compliance/audit activity. Supporting functions include Operations, Compliance, IT, Product, Technical Support, Internal Audit, Accounting and Human Resources.

The QCRM & Infosec team owns client security assessments, questionnaire responses and NDA-gated evidence. Primary contact: QCRM@mercans.com.

Issues follow Mercans' three-level support escalation. Any issue is first raised with L1 (Operations Support); if it is not resolved there it is escalated to L2, the BAU Director (Director of Global Operations, the Service-Delivery Responsible); if it still remains unresolved it is escalated to L3 — the CEO, or the CPO where the matter concerns privacy or data protection (per the Binding Corporate Rules).