Xoxoday Empuls safeguards your organisation’s data through multi-tenant logical segregation, end-to-end encryption, role-based access control, and ISO 27001-aligned security controls that ensure complete isolation from all other customer environments.
Multi-Tenant Architecture with Strict Logical Segregation
Xoxoday Empuls runs on a multi-tenant architecture where every customer’s data is logically isolated using system-generated, company-specific identifiers. All transaction data for your organisation is stored in a dedicated schema within the shared database, preventing cross-tenant data access at both the application and database layers. No other customer can view, modify, or interact with your organisation’s records under any circumstances.Encryption at Rest and in Transit
All personally identifiable information (PII) stored in Xoxoday Empuls is encrypted using a system-generated, company-specific unique key. This cryptographic isolation ensures that even within a shared database environment, your organisation’s sensitive data remains indecipherable to any other tenant. All data in transit is protected using TLS 1.2+ (SHA-256 with RSA), covering every communication between your organisation’s users and Xoxoday Empuls.Secure Azure VPC and Network Architecture
Xoxoday Empuls is hosted entirely on Microsoft Azure within a Virtual Private Cloud (VPC), where all platform components are securely encapsulated. Inbound and outbound traffic flows exclusively through external load balancers, and every request must be authenticated before reaching internal microservices. Separate application instances run across availability zones, backed by master–slave databases with real-time synchronisation, ensuring high availability and minimising the risk of data loss for your organisation.Role-Based Access Control and Least Privilege
Access to your organisation’s tenant is governed by granular role-based access control (RBAC). Only authorised users within your organisation — along with a strictly limited set of Xoxoday support and engineering staff operating on a documented need-to-know basis — can view or manage your data. Privileged access is tightly controlled, fully logged, and subject to periodic review, consistent with SOC 2 Type II and ISO 27001 access management requirements.Audit Trails, Logging, and Monitoring
Xoxoday Empuls generates detailed event logs covering user activity, configuration changes, and all access to your organisation’s data. These logs are tamper-protected and regularly reviewed by the security team. Application-level audit trails capture who accessed what, when, and what changes were made, supporting your organisation’s compliance obligations and any forensic investigations that may arise.Backup, Continuity, and ISMS Governance
Regular backups of your organisation’s data, software, and system images are taken and tested against a formal backup policy. Development and test environments are logically separated from production, reducing the risk of inadvertent data exposure. All controls are governed by Xoxoday’s ISO 27001-aligned Information Security Management System (ISMS), which defines the policies, procedures, and change management processes that keep these safeguards effective over time. For organisations using HR integrations such as Workday, SAP SuccessFactors, or Darwinbox, data flowing into Xoxoday Empuls through those connectors is subject to the same segregation, encryption, and access control framework described above. Learn more: [Xoxoday Empuls Help Centre — 8. IT RISK ASSESSMENT](How does Xoxoday Empuls protect PII and is it SOC 2 compliant?
Understand how Xoxoday Empuls encrypts PII at rest and in transit, and how company-specific keys cryptographically isolate your organisation’s sensitive data.
Is Empuls ISO 27001 and SOC 2 certified?
Learn about Xoxoday Empuls’s ISO 27001 certification, SOC 2 Type II audit status, and how these frameworks govern platform-wide security controls.