Xoxoday Empuls retains access request approvals as formal records in its ticketing and identity management systems for the complete duration of the user account and for a defined period after account closure, ensuring traceability for all access decisions in line with ISMS document retention and audit requirements.
Retention scope and timeline
Xoxoday Empuls treats access request approvals as formal records, not transient logs. Every approval — whether for initial provisioning, elevated privileges, or role changes — is stored in Xoxoday’s ticketing and identity management systems from the moment it is granted until the applicable retention period has fully elapsed. Approvals are never deleted while the associated access remains active. Once an account is deactivated or a role is revoked, the records enter a defined post-closure retention window aligned with Xoxoday’s Information Security Management System (ISMS) document retention policy and any relevant legal, regulatory, or contractual obligations.Why formal records matter for audit and compliance
Access approval records are a core audit artifact under frameworks such as ISO 27001 and SOC 2 Type II. Auditors reviewing Xoxoday Empuls deployments can trace every access decision back to a named approver, a timestamp, and the business justification captured at the time of the request. This is especially relevant for organisations using Xoxoday Empuls alongside HR systems such as Workday, SAP SuccessFactors, or Darwinbox, where joiners, movers, and leavers trigger automated provisioning or de-provisioning workflows. The approval records created during those lifecycle events are retained independently of the HR system, giving your security and compliance teams a durable audit trail even after an employee record is archived or anonymised upstream.Disposal only after retention periods elapse
Records are disposed of only after all applicable legal, regulatory, and contractual retention periods have passed. This prevents premature deletion that could create gaps in an organisation’s audit evidence, particularly during forensic investigations, internal reviews, or third-party assessments. For organisations subject to sector-specific regulations — such as data localisation requirements or financial services record-keeping rules — the retention window can be aligned with those obligations without exception processing or manual intervention.Practical example
Consider a scenario where your organisation onboards a new finance team lead via Workday. The provisioning request, approver identity, approval timestamp, and granted access scope are all captured as a formal record in Xoxoday’s identity management system. If an ISO 27001 surveillance audit or a SOC 2 Type II assessment occurs two years later, that record remains fully accessible and intact, regardless of whether the employee is still active. The record is only eligible for disposal once the organisation’s defined post-closure retention period — factoring in ISMS policy and any contractual commitments — has been met. This approach ensures that access traceability is never a gap finding in your compliance programme. Learn more: [Xoxoday Empuls Help Centre — 8. IT RISK ASSESSMENT](How often does Empuls review physical and logical access rights?
Understand how periodic access reviews are conducted to ensure least-privilege principles are enforced across user accounts.
How easy is it to access audit logs in Xoxoday Empuls?
Learn about the audit log types, retention periods, and export options available to compliance and security teams.