How does Loyalife control IT staff access to customer data?

​

Backend Access Is Governed by the Principle of Least Privilege

Xoxoday Loyalife grants internal IT personnel only the minimum permissions required to perform their specific job function. Access to production systems is not a default entitlement — it is explicitly provisioned, time-bound where applicable, and revoked immediately upon role change or departure. Engineers working on infrastructure do not automatically receive access to application-layer customer data, and support staff with data visibility have no write access to configuration systems. This separation of concerns means that a compromise of any single credential or role cannot provide broad access across the environment.

​

Multi-Factor Authentication Is Mandatory for All Internal Access

Every member of the Xoxoday Loyalife IT team — including backend engineers, DevOps, and database administrators — must authenticate using multi-factor authentication before accessing any production system. This applies to VPN connections, cloud console access, and privileged management interfaces alike. Password-only authentication is not permitted for any backend environment entry point.

​

Customer Data Access Is Logged and Auditable

All access to environments containing customer data generates immutable audit logs. These logs capture the identity of the accessing party, the timestamp, the action taken, and the data scope involved. Xoxoday Loyalife retains these logs in a centralised, tamper-evident store separate from the application environment itself, ensuring logs cannot be altered by the same accounts being audited. For organisations that need to demonstrate compliance — for example, during a SOC 2 Type II audit or an ISO 27001 surveillance review — these logs are available to support your internal or third-party audit process.

​

Access Reviews and Joiner-Mover-Leaver Controls

Xoxoday Loyalife conducts periodic access reviews to validate that all active permissions remain appropriate. The joiner-mover-leaver process ensures that when an IT team member changes role or exits the organisation, their access is revoked within a defined SLA. Privileged access requests are subject to approval workflows, and standing access to production data is minimised in favour of just-in-time provisioning where operationally feasible.

​

Data Segregation Prevents Cross-Tenant Exposure

Customer data within Xoxoday Loyalife is logically segregated at the data layer. An IT team member with access to one customer’s environment cannot traverse to another organisation’s data. This is enforced programmatically, not solely by policy, so even elevated internal roles cannot bypass tenant boundaries inadvertently. This architecture directly supports enterprise buyers integrating Xoxoday Loyalife with systems such as Workday, SAP SuccessFactors, or Darwinbox, where employee data flowing into the loyalty platform must remain strictly scoped to your organisation. Learn more: Xoxoday Loyalife Help Centre — Security