Skip to main content
In an on-prem Empuls deployment, Xoxoday enforces the same encryption controls as in its SaaS environment: AES-256 for data at rest and TLS 1.3 for all data in transit, with keys managed via an HSM-equivalent KMS under your organisation’s control.
In an on-prem Empuls deployment, Xoxoday enforces the same encryption controls as in its SaaS environment: AES-256 for data at rest and TLS 1.3 for all data in transit, with keys managed via an HSM-equivalent KMS under your organisation’s control. At rest: Databases are encrypted using native TDE / volume-level encryption; all PII fields and backups are protected with AES-256, and keys stored and rotated in the customer’s KMS/HSM. In transit: TLS 1.3 is enforced on the Empuls web/API endpoints via the on-prem load balancer or Nginx ingress, with weak ciphers disabled; internal admin access (e.g., SSH, SMTPS) is likewise restricted to encrypted channels. Config screens in POC: During implementation/XoD, we walk through your organisation’s own LB/ingress configuration screens showing the TLS protocol version, certificates, and cipher suites in use, along with DB encryption/TDE settings, so your organisation can validate that all Empuls traffic and storage meet its on-prem security policies. Learn more: Empuls Help Centre

Does Xoxoday Empuls encrypt data in transit and at rest?

Xoxoday Empuls encrypts data in transit via TLS 1.3 and data at rest with AES-256, using AWS KMS for secure key management.

How does Xoxoday Empuls handle password and encryption requirements?

Xoxoday Empuls enforces ISO 27001-aligned password policies and TLS 1.2 encryption for all data in transit and at rest.