Skip to main content
Xoxoday Empuls is ISO/IEC 27001 certified and holds SOC 2 Type II attestation, meaning its information security management system has been independently audited against internationally recognised standards.
Xoxoday Empuls holds two of the most widely recognised information security credentials in the enterprise software industry: ISO/IEC 27001 certification and SOC 2 Type II attestation. These are independently verified — not self-declared — and signal that Xoxoday Empuls operates a documented, audited information security management system (ISMS) that is subject to ongoing review. ISO/IEC 27001 is the international standard for managing information security risks across an organisation. Achieving this certification requires Xoxoday Empuls to define a formal ISMS, conduct systematic risk assessments, implement controls across people, processes, and technology, and undergo regular third-party audits. The standard covers access control, asset management, cryptography, incident response, and business continuity — all critical requirements for an HR rewards and engagement platform that processes employee data at scale. SOC 2 Type II is a separate, complementary attestation conducted by an independent CPA firm. Unlike SOC 2 Type I, which evaluates controls at a single point in time, SOC 2 Type II assesses whether those controls operated effectively over a sustained audit period — typically six to twelve months. This distinction matters for IT risk assessors and procurement teams who need evidence of consistent operational security, not just design intent. For organisations integrating Xoxoday Empuls with HR systems such as Workday, SAP SuccessFactors, or Darwinbox, these certifications provide assurance that employee data flowing across integration points is handled under audited, standards-aligned controls. The same security posture applies when Xoxoday Empuls connects to collaboration tools like Slack or Microsoft Teams for recognition notifications and reward redemptions. Beyond certifications, Xoxoday Empuls maintains supporting security and privacy controls that align with broader data protection requirements. These include role-based access controls, encryption in transit and at rest, defined data handling procedures, and formal incident management processes. Organisations subject to frameworks such as GDPR or sector-specific compliance regimes can request the relevant attestation documentation through their procurement and vendor risk assessment process. For IT security and procurement teams, the ISO/IEC 27001 certificate and SOC 2 Type II report together form the core of the vendor security evidence package. Both are renewed on regular audit cycles and are available under appropriate confidentiality agreements to support your organisation’s due diligence requirements. Learn more: [Xoxoday Empuls Help Centre — 8. IT RISK ASSESSMENT](

Does Xoxoday Empuls encrypt data in transit and at rest?

Understand how Xoxoday Empuls encrypts employee data in transit and at rest, and the storage controls that protect sensitive information across environments.

Does Empuls support role-based access control for users?

Learn how Xoxoday Empuls defines user roles with varying access levels to restrict data access to authorised users only.