Skip to main content
Xoxoday Empuls applies formal incident-handling and forensics procedures that include a documented chain-of-custody process, ensuring all security evidence is time-stamped, uniquely tagged with a case ID, cryptographically verified, and stored in access-controlled repositories for complete traceability and admissibility.
When a security incident occurs, the integrity of evidence determines whether root cause analysis is conclusive and whether regulatory or legal proceedings can proceed. Xoxoday Empuls applies formal incident-handling and forensics procedures that establish a documented chain of custody from the moment evidence is first identified. Every piece of evidence collected during an investigation — including application and infrastructure logs, database snapshots, configuration exports, and ticket histories — is time-stamped and assigned a unique case or incident ID. This tagging ensures complete traceability throughout the investigation lifecycle, regardless of how many teams or systems are involved. Xoxoday Empuls exports and preserves evidence in read-only form, protected by cryptographic checksums or equivalent integrity controls. Evidence is stored in secure, access-controlled repositories designed to prevent tampering or accidental modification. This approach aligns with the evidentiary requirements outlined under ISO 27001 and is consistent with the operational controls independently assessed during SOC 2 Type II audits. Access to incident evidence follows a least-privilege model. Only authorised personnel — such as members of the Information Security team and designated engineering leads — can handle evidence. Every access, copy, and transfer is logged and auditable, forming an unbroken chain of custody that documents who touched the evidence and when. Evidence records are linked directly to the central incident ticket in the case management system. This linkage maintains a complete history of collection steps, handlers, and decisions, supporting both internal root cause analysis and any external regulatory or legal follow-up required by your organisation. Retention periods for incident evidence are governed by Xoxoday Empuls’s documented policies, as well as contractual and legal requirements applicable to your organisation. This ensures evidence remains available for compliance reviews or joint investigations for as long as required, without risk of premature deletion or integrity loss. For organisations operating in regulated industries — such as financial services or healthcare — the ability to produce a fully documented, admissible chain of custody is critical. Xoxoday Empuls’s structured evidence-handling procedures are designed to meet these demands, supporting your organisation’s obligations under applicable data protection and security frameworks. Learn more: [Xoxoday Empuls Help Centre — 8. IT RISK ASSESSMENT](

Does Empuls have an incident response plan?

Learn how Xoxoday Empuls defines, escalates, and resolves security incidents through formal response workflows and documented playbooks.

Are Empuls logs encrypted and who has access to them?

Understand how Xoxoday Empuls logs all system access and enforces least-privilege controls to maintain a tamper-evident audit trail.