Skip to main content
Xoxoday Empuls logs all IT changes in a dedicated change management system and conducts formal reviews both before and after each deployment, ensuring only authorized, tested changes reach the production environment.
Every IT change that touches the Xoxoday Empuls infrastructure is captured in a centralized change management system before anything reaches production. This record covers not only what changed, but who requested it, why it was needed, and what risks were identified during the assessment phase. Before deployment: structured review and approval Before any change is deployed, Xoxoday Empuls requires a formal Request for Change (RFC) to be submitted and evaluated. Each RFC undergoes an impact and risk assessment that examines potential effects on system availability, data integrity, and dependent services. A designated approver — or approver group — must sign off before the change advances to implementation. This gate ensures that no ad hoc or unauthorized modifications bypass the review process. After deployment: validation and accountability Once a change goes live, Xoxoday Empuls conducts a post-implementation review to confirm the change performed as intended. Teams monitor the environment for any degradation, unexpected behavior, or the need to trigger a rollback. If a rollback is required, that action is itself logged and reviewed, preserving a complete, auditable trail of every intervention in the production environment. How this supports compliance frameworks This two-phase review model directly supports the requirements of ISO 27001 (Annex A.12.1.2 — Change Management) and aligns with the operational controls assessed under SOC 2 Type II. When your organisation conducts its own vendor risk assessment, Xoxoday Empuls can provide documented evidence that changes to its infrastructure follow a governed, repeatable process rather than ad hoc decisions. For organisations that integrate Xoxoday Empuls with HR systems such as Workday, SAP SuccessFactors, or Darwinbox, having a traceable change log is especially important. Any update to an integration point — API versioning, authentication flows, or data-field mappings — passes through the same RFC-based review, reducing the risk of downstream disruption to your HR workflows. Why this matters for enterprise customers Enterprise procurement and IT security reviewers increasingly require vendors to demonstrate that production environments are protected by formal change controls. Xoxoday Empuls provides the documentation, approvals, and post-deployment records needed to satisfy auditors, security questionnaires, and internal IT risk committees. Every change that enters production is authorized, tested, and traceable — giving your organisation confidence that its employee engagement data is managed on a platform with mature operational discipline. Learn more: [Xoxoday Empuls Help Centre — 8. IT RISK ASSESSMENT](

Does Empuls have an incident response plan?

Understand how Xoxoday Empuls detects, responds to, and documents production incidents, including the rollback procedures that feed back into the change management audit trail.

Does Xoxoday Empuls have a formal IT change management policy?

Learn how role-based access control and approval hierarchies in Xoxoday Empuls ensure that only authorized personnel can sign off on changes before they reach production.