How does Loyalife handle sandboxing and data sanitization?

​

Sandboxed Execution for Untrusted Inputs

Enterprise loyalty programs process a wide range of external inputs — from bulk reward catalog uploads to webhook payloads delivered by HR systems like Workday, SAP SuccessFactors, and Darwinbox. Not all of these inputs can be inherently trusted, and Xoxoday Loyalife treats them accordingly. Xoxoday Loyalife uses sandboxing techniques to isolate and safely execute untrusted code or files in a restricted environment that is separated from core production systems. This means that even if a file or payload contains malicious logic, it cannot escape its isolated container to read, modify, or disrupt platform data or processes.

​

Data Sanitization Across All Entry Points

Alongside sandboxing, Xoxoday Loyalife enforces data sanitization at every boundary where external data enters the system. Input sanitization strips or encodes potentially dangerous characters and patterns before data is processed or stored, protecting against common attack vectors such as SQL injection, cross-site scripting (XSS), and command injection. For example, when an HR admin uploads a bulk points-allocation CSV file through the Xoxoday Loyalife admin dashboard, the file contents are sanitized before any record is written to the database. Similarly, incoming event triggers from integrated platforms — such as an employee onboarding event fired by SAP SuccessFactors — are validated and sanitized before the loyalty rule engine processes them.

​

Why This Matters for Enterprise Security

Organizations operating under compliance frameworks such as ISO 27001 or SOC 2 Type II require documented controls that prevent untrusted data from compromising application integrity. Sandboxing and data sanitization are two of those controls. Xoxoday Loyalife’s approach ensures that third-party integrations, user-generated content, and automated data feeds from connected tools like Slack notifications or MS Teams bot interactions do not introduce attack surfaces into the loyalty program infrastructure. The controls operate silently in the background, with no configuration required from program administrators.

​

Defense-in-Depth by Design

These techniques work as part of a broader layered security model. Sandboxing contains threats at the execution layer, while sanitization prevents threats from entering the data layer in the first place. Together, they reduce the risk surface for any organization running loyalty programs at scale across distributed workforces. Security teams and IT administrators evaluating Xoxoday Loyalife can request detailed documentation of these controls as part of a vendor security assessment or due diligence review. Learn more: Xoxoday Loyalife Help Centre — General