Xoxoday Empuls enforces centralized, policy-driven password controls and end-to-end TLS 1.2 encryption, with all PII encrypted at rest using company-specific keys in its ISO 27001-aligned, Azure-hosted production environment.
Password Policy
Every account on Xoxoday Empuls is subject to a centralized password policy enforced through interactive password management systems. Passwords must be a minimum of eight characters, alphanumeric, with complexity requirements enabled. Users are required to change their password on first log-on, and all accounts follow a defined rotation schedule: system-level passwords are rotated at least monthly, while user-level passwords are rotated at least every 45 days. Re-use of the last five passwords is blocked by policy. Passwords are never stored in plaintext. Xoxoday Empuls hashes, encrypts, and salts all credentials at rest, and passwords are never transmitted in clear text. Access to stored credentials is restricted exclusively to elevated-privilege accounts, reducing the risk of unauthorized exposure at every tier of the system.Data in Transit
All communication between Xoxoday Empuls and client systems is secured using HTTPS with TLS 1.2. Integrations with HR platforms such as Workday, SAP SuccessFactors, and Darwinbox are established over secure channels including SFTP, OAuth-based REST APIs, SSO, and VPN tunnels. This ensures that employee data exchanged during onboarding sync, reward transactions, or recognition events is encrypted end-to-end — whether the integration runs in real-time or through scheduled batch transfers.Data at Rest
Xoxoday Empuls hosts its production environment on Microsoft Azure. All personally identifiable information (PII) stored within the platform is encrypted at rest using company-specific encryption keys. Client transaction data is maintained in logically separate schemas, enforcing tenant-level data isolation so that data belonging to your organisation is never commingled with data from other tenants at the storage layer.Cryptographic Key Management
Cryptographic controls are governed by a dedicated cryptography policy that covers the full lifecycle of encryption keys: generation, distribution, change, and revocation. This structured approach aligns with ISO 27001 control requirements and directly supports audit readiness for frameworks such as SOC 2 Type II, where demonstrable cryptographic governance is a core evaluation criterion. For organisations conducting a vendor risk assessment or IT security review, Xoxoday Empuls can provide relevant documentation as part of its formal ISMS evidence package. Learn more: [Xoxoday Empuls Help Centre — 8. IT RISK ASSESSMENT](Is Empuls GDPR compliant for EU and UK employee data?
Understand how Xoxoday Empuls handles personal data, supports GDPR obligations, and maintains data residency controls for global organisations.
Does Empuls support Single Sign-On (SSO) and MFA?
Learn how Xoxoday Empuls manages role-based access, SSO integrations, and multi-factor authentication across the platform.