What third-party security audits does Xoxoday Empuls undergo?

​

Third-Party Security Audit Framework

Xoxoday Empuls subjects its security controls to recurring independent audits that validate both the design and operating effectiveness of controls across its application, infrastructure, and organisational processes. These are not one-time exercises — they follow structured annual cycles aligned with globally recognised frameworks, ensuring continuous assurance rather than point-in-time snapshots.

​

Formal Certifications and Attestations

Xoxoday Empuls holds ISO/IEC 27001:2022 certification for its Information Security Management System (ISMS), covering organisational, application, and infrastructure security controls. This is complemented by SOC 2 Type I and SOC 2 Type II attestations, with the Type II report spanning a 12-month reporting period and renewed annually by an independent audit firm assessing security, availability, and confidentiality trust service criteria. For payment and cardholder data handling, Xoxoday Empuls follows PCI-DSS compliant processes. Privacy obligations are addressed through GDPR, CCPA/CPRA, and HIPAA compliance frameworks. Xoxoday Empuls also holds CSA STAR Level 1 registration, demonstrating alignment with the Cloud Security Alliance’s comprehensive controls catalogue.

​

Scope of Independent Audits

Third-party audit scope covers organisational security governance, logical and physical access controls, change management, incident response, encryption, backup and disaster recovery, and secure software development practices. The production environment — hosted on Microsoft Azure — forms the primary scope for application and infrastructure control reviews. Microsoft Azure data centres are independently audited for ISO 27001, SOC 2, and PCI-DSS, among other frameworks. Xoxoday Empuls leverages these Azure-level attestations as part of its layered compliance posture, giving your organisation visibility into controls at both the application and infrastructure tiers.

​

Vulnerability Assessment and Penetration Testing

Xoxoday Empuls conducts annual external VAPT on production applications, APIs, and infrastructure, carried out by specialist third-party cybersecurity firms. Internal automated vulnerability scans complement these external assessments throughout the year. All vulnerabilities identified during VAPT are remediated and then rescanned to confirm closure before the final VAPT certificate is issued — no findings are left open at certification time.

​

Audit Timing and Findings

Xoxoday Empuls runs recurring annual cycles for ISO 27001 surveillance audits, SOC 2 Type II attestations, and external VAPT, all performed by accredited, independent audit firms and specialist cybersecurity providers. No material or unremediated high-risk findings remain open; any vulnerabilities identified are remediated and verified through follow-up scans before certification is finalised. Organisations using Xoxoday Empuls alongside HR systems such as Workday, SAP SuccessFactors, or Darwinbox for people-data synchronisation can request the most recent SOC 2 Type II report or ISO 27001 certificate under a non-disclosure agreement to support their own vendor risk assessments. Learn more: [Xoxoday Empuls Help Centre — 8. IT RISK ASSESSMENT](