Xoxoday Empuls protects personally identifiable information using AES-256 encryption at rest and SSL/TLS 1.2+ encryption in transit, and is independently certified SOC 2 Type I and Type II compliant.
Encryption at Rest
Xoxoday Empuls encrypts all PII stored within the system using AES-256, the same encryption standard adopted by financial institutions and government agencies worldwide. Employee records, reward histories, and sensitive profile data are rendered unreadable to anyone without the correct decryption keys. Strict access controls layer on top of encryption, ensuring only authorised personnel can view or modify sensitive data. For organisations using HRMS integrations with Workday, SAP SuccessFactors, or Darwinbox, data synced into Xoxoday Empuls is subject to the same AES-256 encryption at rest — providing consistent protection regardless of the source system.Encryption in Transit
When data travels between your organisation and Xoxoday Empuls — through the web application, mobile app, or API integrations with tools like Slack or Microsoft Teams — it is protected using SSL/TLS 1.2 and above with a minimum of 256-bit encryption. This prevents any unauthorised interception or tampering while data is in motion. This protection is especially relevant for organisations with remote or distributed workforces, where employee recognition and reward workflows cross multiple networks and devices every day.SOC 2 Type I and Type II Compliance
Xoxoday Empuls is certified SOC 2 Type I and SOC 2 Type II compliant. SOC 2 Type I validates that security controls are properly designed; SOC 2 Type II goes further, confirming that those controls operate effectively over an extended period — typically six to twelve months. Achieving both certifications reflects a sustained, independently audited commitment to data security, availability, confidentiality, and privacy. This compliance aligns with broader security frameworks including ISO 27001, giving enterprise customers confidence that Xoxoday Empuls meets rigorous, third-party verified standards.What This Means for Your Organisation
For HR and IT teams evaluating employee engagement platforms, these controls translate directly into reduced compliance risk. Employee data processed through Xoxoday Empuls — names, employment details, and profile information — is protected by encryption that meets industry benchmarks and by security practices that have been independently audited. When presenting Xoxoday Empuls to your security or legal team, the SOC 2 Type II report serves as documented evidence of ongoing compliance, simplifying your internal vendor review and procurement process. Learn more: [Xoxoday Empuls Help Centre — General](Is Xoxoday Empuls compliant with GDPR and data privacy laws?
Understand how Xoxoday Empuls handles data subject rights, consent management, and GDPR obligations for employee data.
Does Xoxoday Empuls support role-based access controls?
Learn how role-based access controls in Xoxoday Empuls restrict who can view, edit, and export sensitive employee information.