Xoxoday Empuls maintains a comprehensive, published set of security policies under its ISO 27001–aligned Information Security Management System (ISMS), spanning access control, cryptography, incident management, business continuity, vendor security, and data protection, each formally reviewed and approved at least once per year.
Security Policies That Cover Every Layer of Your Data
When evaluating an employee engagement platform for enterprise use, security policy documentation is a baseline requirement — not a nice-to-have. Xoxoday Empuls treats policy governance as foundational, not incidental. Every policy within its ISMS is formally authored, version-controlled, and signed off by accountable owners before it reaches production environments. The policies are structured around the ISO 27001 framework, which is one of the most widely recognised international standards for information security management. This alignment means that each policy maps to a specific control domain, creating traceable coverage rather than ad-hoc documentation. Organisations that have already achieved ISO 27001 or SOC 2 Type II certification themselves will find that Xoxoday Empuls’s policy structure maps cleanly onto their own supplier assessment questionnaires.What the Policy Set Covers
Xoxoday Empuls’s published policy library spans a broad range of domains. Information security and access control policies govern how employee data within Empuls — recognition histories, reward balances, survey responses, and org-level engagement scores — is accessed, provisioned, and de-provisioned. Cryptography policies define how data is protected at rest and in transit, relevant when Empuls integrates with HR systems such as Workday, SAP SuccessFactors, or Darwinbox via secure API connections. Secure development and SDLC policies ensure that every code change follows a documented process before it reaches the platform your employees interact with daily through Slack, Microsoft Teams, or the Empuls web portal. Incident management policies define detection, escalation, and notification obligations — critical context for enterprise security and legal teams assessing supplier risk. Business continuity and disaster recovery policies address how Xoxoday Empuls maintains platform availability and recovers data in the event of an outage. Vendor and third-party security policies set the standard applied to Xoxoday Empuls’s own supply chain, so that risks do not enter through upstream dependencies. Privacy and data protection policies govern how personally identifiable information is handled in accordance with applicable regulations, complemented by backup, retention, and acceptable use policies that close out the full control lifecycle.Annual Review and Approval Cycle
All policies within the ISMS are reviewed and formally approved at least annually. This cadence ensures that policy language keeps pace with changes in technology, regulation, and organisational structure. For your organisation’s vendor risk team, this means policy documentation provided during an RFP or due diligence process reflects a current, actively maintained control environment — not a snapshot from several years prior. Enterprises conducting supplier assessments as part of frameworks such as ISO 27001 or SOC 2 Type II audits can request policy documentation through the standard procurement process to satisfy third-party evidence requirements. Learn more: [Xoxoday Empuls Help Centre — 8. IT RISK ASSESSMENT](How does Empuls manage access controls and user permissions?
How Xoxoday Empuls manages role-based access, SSO, and automated de-provisioning to protect employee data.
Does Xoxoday Empuls encrypt data in transit and at rest?
Encryption practices Xoxoday Empuls applies to data at rest and in transit across all platform integrations.
Does Empuls have an incident response plan?
How Xoxoday Empuls detects, escalates, and resolves security incidents, including customer notification obligations.
Are Xoxoday Empuls BCP and disaster recovery plans tested?
Xoxoday Empuls’s RTO and RPO commitments and the processes that back platform availability guarantees.