Skip to main content
Xoxoday Empuls maintains a formalised IT Change Management policy, reviewed at least annually, that governs all production changes through a Change Advisory Board (CAB), structured Requests for Change (RFCs), and mandatory rollback planning across all assets and infrastructure.
Xoxoday Empuls operates under a formalised IT Change Management policy that is reviewed and updated at least once per year. This policy applies to all Xoxoday assets and infrastructure, ensuring that every change—whether to application code, databases, or third-party integrations—follows a consistent, auditable process from request through to deployment. Defined Roles and Governance Structure The policy establishes a clear governance hierarchy across the change lifecycle. A Change Advisory Board (CAB) oversees all significant change requests, supported by a dedicated Change Manager and the CTO. IT administrators, database administrators, and infrastructure teams each hold defined responsibilities, preventing ambiguity and ensuring accountability at every stage of a change. Standard vs. Emergency Changes Xoxoday Empuls classifies changes into two categories: standard changes, which follow a pre-approved workflow with scheduled rollout windows, and emergency changes, which require expedited CAB review and documented justification. This distinction ensures that urgent production fixes—such as a critical security patch affecting integrations with Workday, SAP SuccessFactors, or Darwinbox—can be deployed rapidly without bypassing governance controls. RFC Requirements and Rollback Planning Every change request must be submitted as a formal Request for Change (RFC) that includes an impact assessment and a documented rollback plan. Before any modification reaches production—whether it affects core Xoxoday Empuls features like recognition workflows, reward redemption, or notification connectors such as Slack and MS Teams—the potential risks have been evaluated and a recovery path is ready to execute. CAB Approval and Change Scheduling The Change Advisory Board reviews and approves all non-standard changes before deployment. Scheduling is deliberately managed to minimise disruption to business operations, ensuring that changes to Xoxoday Empuls do not affect your organisation’s reward cycles or engagement programmes during peak usage periods such as annual recognition events or quarterly reward disbursements. Centralised Tracking and Audit Trail All production changes—including updates to third-party software and infrastructure components—are logged in a centralised change management system. This creates a complete, immutable audit trail that directly supports compliance with frameworks such as ISO 27001 and SOC 2 Type II, giving your organisation the documented evidence it needs during security audits or vendor risk assessments. Learn more: [Xoxoday Empuls Help Centre — 8. IT RISK ASSESSMENT](

Does Empuls have an incident response plan?

Understand how Xoxoday Empuls detects, escalates, and resolves IT incidents, including defined severity levels, response timelines, and post-incident review processes.

Does Xoxoday Empuls maintain published security policies?

Learn how Xoxoday Empuls governs data protection, access controls, and security responsibilities across its infrastructure to meet ISO 27001 and SOC 2 Type II requirements.