Xoxoday Empuls operates as a cloud-hosted SaaS platform that processes only the data your organisation sends through agreed integration points, with all personnel access governed by strict role-based controls, least-privilege principles, and comprehensive audit logging.
Data Processed Within Xoxoday Empuls
The data Xoxoday Empuls processes falls into three well-defined categories. First, transactional data required for reward workflows, reconciliation, and calculation — such as transaction identifiers, dates, amounts, and scheme codes. Second, master and reference data such as department hierarchies, role configurations, and programme rules. Third, user access data — employee names, business email addresses, and permission roles needed to authenticate and authorise platform users. Xoxoday Empuls does not require payment card data or highly sensitive personal identifiers to operate. These categories of data are out of scope for normal platform workflows.Integration With Enterprise Systems
Connections between Xoxoday Empuls and your enterprise systems — such as SAP SuccessFactors, Workday, or Darwinbox for HR data, or SAP FI for financial reconciliation — are established through APIs, SFTP transfers, or middleware connectors. Xoxoday Empuls consumes and publishes data through these defined interfaces only. Xoxoday personnel do not hold or require interactive logins to your SAP environment, HRMS, or other core enterprise platforms for day-to-day operations.Exceptional and Elevated Access
In the rare event that elevated access becomes necessary — for example, troubleshooting in a non-production environment via a VPN connection — that access is explicitly requested, time-bound, scoped to the minimum privilege required, and fully logged. Database and log-level access within Xoxoday Empuls itself is restricted to designated engineering and DevOps personnel, used exclusively for maintenance and incident resolution, with all actions auditable and reviewable. A small, authorised operations and support group may access your organisation’s tenant within Xoxoday Empuls for configuration, support, and troubleshooting purposes. This group operates under strict RBAC policies and produces complete access logs.Your Organisation Stays in Control
Your organisation determines what data flows into and out of Xoxoday Empuls, which roles your users hold, and whether any elevated access is ever granted to Xoxoday personnel. All access arrangements are formalised through contracts and Data Processing Agreements (DPAs). Xoxoday Empuls aligns these controls with recognised security standards including ISO 27001 and SOC 2 Type II, ensuring independent verification of the controls governing data access. Xoxoday uses data received from your organisation solely to deliver and support the agreed services — no secondary use, no data sharing beyond what is required to operate the platform.Learn more: [Xoxoday Empuls Help Centre — 8. IT RISK ASSESSMENT](
Does Xoxoday Empuls encrypt data in transit and at rest?
Understand how Xoxoday Empuls encrypts data at rest and in transit, and the technical controls that protect your organisation’s information throughout the platform lifecycle.
What security certifications does Empuls comply with?
Learn which compliance frameworks Xoxoday Empuls is certified against — including ISO 27001 and SOC 2 Type II — and how these certifications support your vendor risk assessments.