Xoxoday Empuls enforces a formal offboarding and change-of-role process in which the HR team notifies security and access administration owners — across IT, DevOps, and InfoSec — of all terminations, resignations, and status changes, triggering prompt access revocation or adjustment across all internal systems.
How the HR Notification Process Works
Xoxoday’s HR team follows a defined procedure for terminations, resignations, and internal role changes. Upon triggering an offboarding or status-change event, HR formally notifies the relevant security and access administration owners — spanning IT, DevOps, and InfoSec — with the necessary details. This notification is not discretionary; it is a mandatory step in the process, ensuring that no access rights are overlooked regardless of how the employment event is categorised.Immediate Access Revocation and Adjustment
Once the notification is received, responsible teams act to disable or adjust the affected employee’s accounts across Xoxoday’s internal systems. Company-issued assets are simultaneously flagged for recovery. This prompt action aligns with least-privilege principles — a core control requirement under ISO 27001 and SOC 2 Type II — ensuring that no individual retains access beyond what their current role authorises.A Practical Example
Consider an employee moving from an engineering role to a customer success position. HR triggers a change-of-role notification that prompts IT and DevOps to revoke access to source-code repositories and CI/CD pipelines, while granting access to CRM and customer communication tools. The transition is logged and fully auditable, reducing insider-risk exposure during the handover period. For organisations running HRMS platforms such as Workday, SAP SuccessFactors, or Darwinbox, access lifecycle events can be coordinated to align with Xoxoday’s internal notification workflows, creating a consistent end-to-end audit trail from HR event to access change.Audit Readiness and Continuous Oversight
Access logs are available for review at any point, giving security teams the visibility to confirm that access removal or adjustment occurred as expected. This auditability is essential during compliance reviews and enables organisations to demonstrate due diligence when responding to external audits under SOC 2 Type II or ISO 27001. By connecting HR process events directly to security administration actions, Xoxoday Empuls closes the gap that most organisations leave open between people operations and access governance. Learn more: [Xoxoday Empuls Help Centre — 8. IT RISK ASSESSMENT](How is role-based access control (RBAC) implemented in Empuls?
Learn how Xoxoday Empuls enforces role-based access controls and least-privilege principles across all internal systems and environments.
Does Empuls revoke employee access within 24 hours?
Understand the full offboarding checklist Xoxoday Empuls follows to recover assets, revoke credentials, and protect sensitive data when employees exit.