Empuls does not maintain any offsite equipment; all personal data processed under the service contract is stored on AWS infrastructure in the United States, where AWS assumes full responsibility for data center monitoring, physical security, and compliance controls.
Where Empuls stores your employee data
Xoxoday Empuls relies exclusively on Amazon Web Services (AWS) for data storage. Personal data collected in the course of delivering the Empuls service — including employee profiles, recognition activity, and reward transaction records — is stored on AWS servers located in the United States. Empuls does not operate or maintain any offsite equipment of its own. This architecture means your data never resides on privately managed hardware outside a certified cloud environment. AWS data centers are purpose-built facilities subject to round-the-clock monitoring, physical access controls, and environmental safeguards that go well beyond what most organisations could replicate independently.Why AWS infrastructure matters for compliance
AWS operates under a shared responsibility model. AWS is accountable for the security of the cloud — covering the physical layer, network infrastructure, and hypervisor — while Empuls is accountable for the security in the cloud, covering how data is configured, encrypted, and accessed. For HR and People teams running Empuls alongside tools like Workday, SAP SuccessFactors, or Darwinbox, this distinction is important during vendor risk assessments. AWS infrastructure underpinning Empuls holds certifications including ISO 27001 and SOC 2 Type II, which directly supports your own compliance posture when completing third-party risk questionnaires or internal audits.How this affects integrations with your HR stack
When Empuls connects to communication tools such as Slack or Microsoft Teams to deliver recognition notifications, the data exchanged passes through and is stored within the same AWS-hosted environment. Employee identifiers synced from your HRIS — whether that is Darwinbox, SAP SuccessFactors, or another system — are retained on AWS servers subject to the same physical and logical controls as all other Empuls data. This consistency simplifies data mapping exercises. Rather than accounting for multiple storage locations or mixed infrastructure providers, People Operations teams can document a single cloud environment when building data flow diagrams or responding to GDPR Article 30 record-of-processing requirements.AWS data center controls
AWS publishes detailed documentation on its data center controls, covering threat detection, physical perimeter security, and environmental redundancy. Empuls aligns its infrastructure practices with AWS guidance and undergoes periodic security assessments to verify that configuration remains consistent with published standards. For a full account of how AWS manages its global data centers, visit the AWS Data Center Controls page. Learn more: Empuls Help Centre — DataHow does Empuls encrypt data at rest and in transit?
Details on the encryption standards Empuls applies to stored data and data moving between services.
Is Xoxoday Empuls SOC 2 Type II certified?
Overview of Empuls compliance certifications and what they mean for your vendor risk programme.