Skip to main content
The platform logs key metadata for every significant action, including user ID, role, tenant, timestamp, source IP and device, the API endpoint or screen used, and the operation type (view, create, update, delete).
The platform logs key metadata for every significant action, including user ID, role, tenant, timestamp, source IP and device, the API endpoint or screen used, and the operation type (view, create, update, delete). Logs are written to a central, append-only logging backend and forwarded to SIEM where enabled, with retention aligned to Xoxoday’s security and compliance policies; audit trail data is maintained for over three years. Events captured include: all authentication events (successful and failed login and logout attempts, MFA challenges, SSO assertions and session timeouts, with reason codes); individual access to sensitive data; user creation and deactivation; role and access-profile changes; configuration changes; data exports and report generation; reward and budget approvals; support ‘login as user’ events with the reason recorded; and any log administration activity. This provides a tamper-evident trail covering access, search, retrieval, export, modification, transfer and deletion of personal data. Deletion actions are logged and deletion confirmations can be produced for compliance review. Administrators can retrieve audit reports from the platform, and additional log extracts can be provided by Xoxoday on request. Learn more: Empuls Help Centre

What is the retention period for audit logs?

Audit logs/trails are retained for a minimum of 3 years, with certain log types retained longer via backups (up to 7 years)…

Empuls' Privacy Breaches and Data Subject Requests

Empuls maintains formal processes to detect, respond to, and notify affected parties of privacy breaches and fulfil data subject rights under…