Skip to main content
Xoxoday Empuls operates under a formalised cloud services agreement with Microsoft Azure, including Data Processing Agreements (DPAs) that establish binding obligations around security, availability, data residency, confidentiality, and regulatory compliance.
Xoxoday Empuls hosts its infrastructure on Microsoft Azure, one of the most widely adopted enterprise cloud platforms globally. To govern this relationship, Xoxoday maintains a formalised agreement with Microsoft that covers the full scope of cloud services used to deliver Empuls to your organisation. This agreement includes Microsoft’s standard cloud service terms and Data Processing Agreements (DPAs). These documents define contractual obligations around security controls, service availability, data residency, confidentiality, and compliance requirements — giving your IT and procurement teams a reliable reference point during vendor due diligence and risk assessment exercises. Data Residency and Confidentiality The agreement with Microsoft Azure specifies where your organisation’s data is stored and processed. Data residency provisions confirm that employee engagement data remains within agreed geographic boundaries and is not relocated outside those regions without clear justification. Confidentiality terms in the DPA ensure that Microsoft, acting as a sub-processor, handles data solely for the purposes defined in the agreement — a requirement commonly evaluated under frameworks such as ISO 27001 and regional data protection regulations. Security and Availability Commitments Microsoft Azure’s enterprise-grade infrastructure underpins Xoxoday Empuls’s security posture. The formalised agreement extends Azure’s security commitments — including encryption at rest and in transit, physical access controls, and incident response procedures — into Xoxoday’s own vendor and third-party risk management framework. Service availability terms define uptime expectations that HR and IT teams integrating Xoxoday Empuls with systems such as Workday, SAP SuccessFactors, or Darwinbox can rely on when assessing end-to-end platform resilience. Third-Party Risk Management The Microsoft Azure agreement sits within Xoxoday’s broader vendor and third-party risk management framework. During an IT risk assessment or procurement review, Xoxoday can confirm that this formal relationship is documented, including access to relevant sections of Microsoft’s DPA. This approach aligns directly with the audit expectations of SOC 2 Type II and ISO 27001 programmes, where demonstrating formalised, documented agreements with critical sub-processors is a standard control requirement. For organisations in regulated industries or running enterprise security questionnaires, this removes a common gap — confirming that Xoxoday Empuls does not rely on informal or implied arrangements with its cloud infrastructure provider. The agreement is maintained as a live part of Xoxoday’s compliance posture and is reviewed as part of ongoing vendor risk governance cycles. Learn more: [Xoxoday Empuls Help Centre — 8. IT RISK ASSESSMENT](

Where is Xoxoday Empuls cloud data hosted?

Understand where Xoxoday Empuls stores your organisation’s data and which Azure regions are used for processing and storage.

How does Empuls manage third-party vendor security risks?

Learn how Xoxoday Empuls manages sub-processor relationships and maintains a structured approach to vendor risk governance.