Xoxoday Empuls automatically disables user accounts inactive for more than 45 days and permanently de-provisions them when periodic access reviews confirm no ongoing business need exists.
Continuous Monitoring and Periodic Access Reviews
Xoxoday Empuls operates under an ISO 27001–aligned Information Security Management System (ISMS) that combines continuous monitoring of user account activity with structured, periodic access reviews. This dual-layer approach ensures access rights remain appropriate throughout the entire employee lifecycle — from onboarding through offboarding — without relying solely on manual audits or one-time checks. Automated controls flag inactivity in real time, reducing the window of exposure from stale or orphaned accounts before they become a risk.The 45-Day Inactivity Threshold
When a user account shows no activity for more than 45 consecutive days, Xoxoday Empuls disables it automatically. At this stage the account is suspended rather than permanently deleted, giving HR and IT administrators an opportunity to confirm whether the inactivity reflects a temporary leave of absence, an internal role change, or a genuine departure. A disabled account can only be re-enabled through a formal request and approval process. This control prevents unauthorised reinstatement and creates a documented record tied to a verified business justification — a requirement relevant to organisations demonstrating compliance with frameworks such as SOC 2 Type II.Permanent De-provisioning After Review
If a subsequent access review confirms that no ongoing business need exists, Xoxoday Empuls permanently de-provisions the account in accordance with its access control policy, HR offboarding procedures, and data retention requirements. For organisations running HRIS platforms such as Workday, SAP SuccessFactors, or Darwinbox, this de-provisioning step integrates naturally with existing offboarding workflows. When an employee is marked as terminated in the HRIS, their Xoxoday Empuls account activity is already being tracked, meaning dormancy controls apply from the moment active use ceases.Why This Matters for IT and Compliance Teams
Dormant accounts represent one of the most common access-control gaps cited in IT risk assessments. An account that remains active after an employee has left or changed roles creates an unnecessary attack surface and can produce findings during audits against ISO 27001 Annex A controls or SOC 2 Trust Service Criteria. Xoxoday Empuls addresses this directly. Automated disablement at 45 days provides a consistent, auditable trigger. The formal re-activation approval workflow produces a traceable paper trail. For teams using Slack or Microsoft Teams to coordinate HR workflows, access review outcomes can surface through integrated notifications, keeping stakeholders informed without additional manual reporting steps. Together, these controls give IT and HR teams confidence that every active account in Xoxoday Empuls reflects a current, verified business need. Learn more: [Xoxoday Empuls Help Centre — 8. IT RISK ASSESSMENT](Does Empuls review user access when employees change roles?
Learn how Xoxoday Empuls governs user access rights from onboarding through offboarding, including role-based controls and approval workflows.
Does HR notify IT when employees leave or change roles?
See how Xoxoday Empuls connects with HRIS platforms like Workday, SAP SuccessFactors, and Darwinbox to automate access revocation when employees leave.