Xoxoday Empuls operates a formal third-party risk program aligned with ISO 27001 and SOC 2 Type II, covering pre-engagement due diligence, contractual security obligations, least-privilege access controls, and at-minimum annual reassessment of all critical vendors and subprocessors.
Third-Party Risk at a Glance
Xoxoday Empuls treats vendor security as an extension of its own security posture. Every third party that may access production environments, customer data, or critical services goes through a structured risk assessment before onboarding begins. This process is aligned with ISO 27001 controls and the trust service criteria required for SOC 2 Type II attestation.Pre-Engagement Due Diligence
Before any third party is approved, Xoxoday Empuls conducts a security review covering the vendor’s certifications (such as ISO 27001 or SOC 2 Type II reports), data residency practices, incident history, and technical and organisational controls in place. Vendors that store or process personal or confidential data — including cloud infrastructure providers, monitoring tools, and analytics platforms — receive the highest level of scrutiny. This ensures your organisation’s data is handled only by vendors that meet Xoxoday Empuls’s own baseline standards.Formal Approval Workflow
Xoxoday Empuls enforces an internal policy requiring InfoSec review and stakeholder sign-off before any new third party is approved to operate. Risk tier determines the depth of review: providers with access to confidential or personal data, such as those supporting integrations with tools like Workday or SAP SuccessFactors, are subject to additional due diligence steps. No vendor is onboarded without documented approval.Contractual and Data Protection Controls
Every third-party engagement includes security and confidentiality clauses covering acceptable use, minimum security controls, breach notification timelines, sub-processing restrictions, and audit rights. Where applicable — particularly for vendors processing personal data — a Data Processing Agreement (DPA) is executed in line with GDPR and other applicable privacy regulations. Xoxoday Empuls also retains the right to obtain or review independent assurance reports such as SOC 2 Type II attestations.Ongoing Monitoring and Reassessment
Xoxoday Empuls reassesses key vendors at least annually, or sooner if a material change occurs — such as a change in service scope, a reported security incident, or a lapsed certification. During each review cycle, certification validity is verified, updated SOC or ISO reports are reviewed, and the vendor’s overall risk posture is re-evaluated. This cadence ensures that third-party risk does not go stale after initial onboarding.Least-Privilege Access and Technical Controls
Third-party access to Xoxoday Empuls systems is restricted to the minimum necessary using role-based access control (RBAC) and environment segregation. All connectivity is secured over encrypted channels such as VPN or HTTPS. Activity logs for third-party sessions are captured and monitored to detect anomalous behaviour.Vendor Register and Change Management
Xoxoday Empuls maintains a documented register of all critical third parties and subprocessors involved in delivering its services. When providers are added, changed, or removed, the change management process triggers a fresh risk assessment and, where contractually or legally required, notifies your organisation of any new subprocessors. Learn more: [Xoxoday Empuls Help Centre — 8. IT RISK ASSESSMENT](What security certifications does Empuls comply with?
Understand the independent certifications and audit frameworks that underpin Xoxoday Empuls’s security programme, including scope, frequency, and report availability.
Does Empuls sign data privacy agreements with subprocessors?
Learn how Xoxoday Empuls handles personal data, executes Data Processing Agreements, and maintains compliance with GDPR and other global privacy regulations.