Skip to main content
Xoxoday controls and monitors administrator access to customer data through the following measures: 1. Least-privilege access: Administrators are granted only the minimum permissions necessary for their role.
Xoxoday controls and monitors administrator access to customer data through the following measures: 1. Least-privilege access: Administrators are granted only the minimum permissions necessary for their role. 2. VPN and jump host: All infrastructure access requires VPN connectivity and a jump host, both protected by multi-factor authentication (MFA). 3. Role-based access control (RBAC): Administrative roles are clearly defined with granular permissions. 4. Audit logging: All administrative actions, including data access, configuration changes, and system modifications, are logged with user ID, timestamp, and action details. 5. Maker-checker workflows: Sensitive operations (e.g., manual point adjustments, rule changes, role updates) require multi-level approval. 6. Regular access reviews: Periodic reviews of administrative access privileges are conducted to ensure appropriateness. 7. Background checks: All employees undergo comprehensive background verification prior to onboarding. Learn more: Xoxoday Loyalife Help Centre

Cloud provider personnel should have no access to customer data. Describe

Xoxoday operates on AWS under the AWS Shared Responsibility Model, under which AWS datacenter personnel have no access to customer data (AWS…

Does the vendor allow security audits by the customer...

Xoxoday permits security audits by the customer or by the customer’s appointed audit firm, subject to a mutually agreed scope, schedule, and…