Skip to main content
Empuls maintains a formally documented data breach and incident management procedure that governs the detection, containment, notification, and remediation of security incidents across its platform.
Xoxoday Empuls treats data security as a core operational responsibility, not a compliance checkbox. A formally documented incident management procedure is in place, covering the full lifecycle of a security event — from initial detection through containment, stakeholder notification, root cause analysis, and long-term remediation.

​
What the Procedure Covers

Empuls’s incident response procedure defines clear roles and responsibilities for security and engineering teams the moment an incident is flagged. The procedure distinguishes between severity levels and specifies escalation paths accordingly, ensuring that a low-severity anomaly is triaged differently from a confirmed data breach. Every stage of the response is recorded, creating an auditable trail from first detection to resolution. Detection mechanisms are integrated throughout the Empuls infrastructure. Automated monitoring continuously scans for unusual access patterns, unauthorized data exports, or authentication anomalies — whether the trigger originates within Empuls itself or through a connected integration such as Workday, SAP SuccessFactors, or Darwinbox. When an alert fires, the on-call security team is notified immediately and the investigation clock starts.

​
Notification and Transparency

When a confirmed breach occurs, Empuls follows structured notification timelines aligned with applicable data protection regulations. Affected customers and relevant authorities are informed within the timeframes required by law. This process is documented and rehearsed — not improvised under pressure. For organizations running Empuls alongside collaboration tools like Slack or Microsoft Teams, the incident procedure extends to access reviews for connected OAuth tokens and API integrations. This ensures that a breach in one linked system does not propagate silently across the employee engagement stack.

​
Alignment with Security Frameworks

Empuls’s incident management procedure is developed in alignment with ISO 27001 and SOC 2 Type II. SOC 2 Type II, in particular, requires that incident response be demonstrably operational — meaning Empuls’s procedures are tested and audited, not theoretical. If a privilege escalation event is detected in the Empuls admin panel, for example, the procedure triggers immediate account suspension, an internal investigation log, and — depending on severity — direct outreach to the affected organization’s IT or People Ops contact.

​
Why This Matters for HR and People Teams

HR systems hold some of the most sensitive employee data in any organization: compensation records, performance history, personal identification details, and benefits information. When this data lives in or flows through Empuls, customers reasonably expect a clear answer to what happens if something goes wrong. Empuls provides that answer through a formally documented, regularly tested incident management procedure — giving People teams and their security counterparts the confidence to deploy Empuls in enterprise environments without ambiguity about breach response. Learn more: Empuls Help Centre — General

Data Encryption and Security Standards on Empuls

Learn how Empuls encrypts data at rest and in transit, and which security certifications it holds including SOC 2 Type II and ISO 27001.

GDPR and Data Privacy Compliance in Empuls

Understand how Empuls handles personal employee data in line with GDPR and other regional privacy regulations.