Skip to main content
Xoxoday Empuls supports customer-initiated or customer-appointed third-party security scanning of its internet-facing supplier assets, subject to pre-approved rules of engagement covering scope, timing, and non-destructive tooling, and aligned with its change and incident management processes.
Security assurance is a shared responsibility between Xoxoday Empuls and the organisations it serves. When enterprise customers require direct confidence that external-facing infrastructure is hardened and well-managed, Xoxoday Empuls actively cooperates with structured security assessments rather than treating them as a compliance burden. Xoxoday Empuls supports customer-initiated or customer-appointed third-party security scans of internet-facing assets used to deliver its services. This applies across web application endpoints, authentication surfaces, APIs, and any externally reachable infrastructure within the agreed supplier boundary. These assessments are welcomed when conducted under a clearly defined, mutually agreed set of rules of engagement. Rules of Engagement Before any scan begins, Xoxoday Empuls requires written pre-approval covering three elements: the scope of assets to be tested, the window of time during which scanning will occur, and the specific tools and methodologies to be used. This protects platform stability and data integrity across all concurrent enterprise tenants. All scanning activity must be non-destructive. Techniques that risk service degradation — such as denial-of-service probes or unbounded automated fuzzing — fall outside permitted scope. Xoxoday Empuls routes these exercises through its formal change and incident management process so that any anomalous traffic signatures are correctly attributed and do not trigger unnecessary escalation or SLA breach calculations. VAPT Evidence as a Recognised Alternative For organisations that require security assurance without conducting their own live scans, Xoxoday Empuls provides results from its own third-party Vulnerability Assessment and Penetration Testing (VAPT) programme. These reports are produced by independent, qualified security vendors and include detailed remediation evidence against all identified findings. Sharing VAPT results frequently proves the more practical path. It delivers equivalent security confidence without introducing scheduling complexity or production risk, particularly for platforms serving many enterprise tenants simultaneously. Xoxoday Empuls maintains ISO 27001 certification and SOC 2 Type II attestation, both of which mandate continuous vulnerability management as part of their audit scope — VAPT reports are a recognised and auditable artefact under both frameworks. Practical Example Consider an organisation integrating Xoxoday Empuls with SAP SuccessFactors or Workday as part of a unified HR technology stack. The information security team may require evidence that the Empuls APIs and SSO endpoints involved in that integration are free of known exploitable vulnerabilities. Xoxoday Empuls can either share the relevant VAPT findings scoped to those endpoints or coordinate a targeted, time-boxed scan under an agreed rules-of-engagement document — whichever approach fits your organisation’s assurance process and risk appetite. Xoxoday Empuls treats external security assessments as an indicator of mature enterprise governance on both sides of the relationship. The objective is always to give your organisation the confidence it needs while preserving the availability and consistency that every tenant depends on. Learn more: [Xoxoday Empuls Help Centre — 8. IT RISK ASSESSMENT](

Does Empuls conduct penetration testing and security assessments?

Understand how Xoxoday Empuls conducts and shares third-party vulnerability assessment and penetration testing results as part of its security assurance programme.

Is Empuls ISO 27001 and SOC 2 certified?

Learn how Xoxoday Empuls maintains ISO 27001 and SOC 2 Type II certifications and what these frameworks mean for your organisation’s data security requirements.