Xoxoday Empuls protects personal information in transit using TLS 1.2, SFTP, VPN tunnels, and OAuth-secured APIs, and encrypts data at rest with customer-specific keys in its Azure environment, with access governed by role-based access control, SSO integration, and least-privilege permissions.
Data in Transit
Every connection to and from Xoxoday Empuls is protected by HTTPS with TLS 1.2 as the minimum enforced protocol, preventing interception or tampering in transit. File-based data exchanges use SFTP, and all API connections — including integrations with HRIS platforms such as Workday, SAP SuccessFactors, and Darwinbox — are secured via OAuth. VPN tunnels are applied where direct network-level protection is required for sensitive data flows.Data at Rest
Personal data stored within Xoxoday Empuls is encrypted at rest using strong cryptographic standards within its Microsoft Azure environment. Encryption is applied using customer-specific keys, meaning your organisation’s data is logically and cryptographically separated from other tenants. Even in the event of underlying infrastructure exposure, the data remains inaccessible without the correct decryption keys.Access Control and Audit Logging
Xoxoday Empuls enforces role-based access control (RBAC) combined with a least-privilege model, so administrators and users are granted only the permissions their function requires — nothing more. Xoxoday Empuls integrates with enterprise identity providers via SSO, supporting systems such as Okta and Azure Active Directory, which means access provisioning and revocation stay in sync with your organisation’s HR workflows. Every administrative action and sensitive data access generates a log entry, creating a full audit trail available for compliance reviews and incident investigations.Cross-Border Transfer Governance
When personal data crosses jurisdictions, Xoxoday Empuls applies appropriate contractual safeguards including Data Processing Agreements (DPAs) and, where applicable, Standard Contractual Clauses (SCCs). These transfers are governed by Xoxoday’s Privacy Policy and the Privacy-by-Design principles embedded in its Information Security Management System (ISMS). Subprocessors are vetted against defined security and data protection requirements before any personal data is shared with them.Independent Validation
These controls are externally audited as part of Xoxoday Empuls’s ISO 27001 certification and SOC 2 Type II attestation. This means your organisation’s security and procurement teams can rely on independently verified evidence rather than self-attested claims when completing IT risk assessments or vendor due diligence questionnaires. Learn more: [Xoxoday Empuls Help Centre — 8. IT RISK ASSESSMENT](Does Xoxoday Empuls support role-based access control (RBAC)?
Learn how Xoxoday Empuls enforces role-based access control, least-privilege permissions, and SSO integration to protect sensitive employee data.
Is Empuls ISO 27001 and SOC 2 certified?
Understand the independent security certifications that validate Xoxoday Empuls’s data protection and information security controls.