Does Xoxoday Empuls support role-based access controls?

​

Role-Based Access Controls Across Every System Layer

Role-based access control is not a feature toggle in Xoxoday Empuls — it is enforced uniformly across the user interface, programmatic API access, and the reporting layer. Administrators, managers, and employees each operate within a clearly defined permission boundary, regardless of how they interact with the system.

​

User Interface Controls

Within the Xoxoday Empuls interface, access is governed by roles such as Super Admin, HR Admin, Manager, and Employee. A manager logging in sees only the team members within their reporting hierarchy. Sensitive administrative settings — reward budgets, approval workflows, and integration configurations — are visible exclusively to users holding the appropriate admin role. An employee cannot access compensation data or organisational-level analytics, even if they navigate directly to those pages.

​

API-Level Enforcement

Every API call made to Xoxoday Empuls is subject to the same role-based permission model as the UI. When your organisation integrates Empuls with an HRIS like Workday, SAP SuccessFactors, or Darwinbox, the API tokens or service accounts used carry role-specific scopes. A read-only sync service cannot trigger reward transactions; an HR Admin token cannot modify platform-level security settings. This design prevents privilege escalation through programmatic access. For example, a Darwinbox integration configured to sync employee records into Xoxoday Empuls operates under a restricted API role that permits employee data updates but blocks access to reward redemption history or financial reporting. The same principle applies to custom integrations built against the Empuls API.

​

Reporting and Analytics Controls

Analytics in Xoxoday Empuls are scoped by role at the data level, not just at the navigation level. A department head reviewing engagement scores sees data only for their own department. Cross-departmental or organisation-wide reports are accessible exclusively to HR Admins and Super Admins. No user can export data beyond their authorised scope, even through the reporting interface or scheduled report emails.

​

Compliance Alignment

This layered RBAC architecture directly supports Xoxoday Empuls’s compliance posture under ISO 27001 and SOC 2 Type II. Auditors can verify that access controls are enforced consistently across every interaction channel — not merely declared in policy. Whether your teams access Xoxoday Empuls through a browser, through a Slack or Microsoft Teams bot integration, or through a direct API call, the role-based controls remain uniformly in effect. Learn more: [Xoxoday Empuls Help Centre — 6. SHARED CAPABILITIES](