Skip to main content
Xoxoday Loyalife operates under a structured compliance program governed by internationally recognised security and data privacy standards, including ISO 27001 certification and SOC 2 Type II attestation.

​
Compliance Governance at Xoxoday Loyalife

Xoxoday Loyalife is built for enterprise environments where data protection and regulatory accountability are non-negotiable. The platform’s compliance posture is governed by a formal policy framework that spans information security, data privacy, access control, and vendor risk management. These policies are not static documents — they are reviewed, audited, and updated on a defined cadence to reflect changes in regulatory requirements and the evolving threat landscape. At the foundation, Xoxoday Loyalife holds ISO 27001 certification, the global standard for information security management systems. This certification means every aspect of how data is collected, stored, processed, and transmitted is subject to documented controls and independent third-party verification.

​
SOC 2 Type II Attestation

Xoxoday Loyalife undergoes annual SOC 2 Type II audits, which evaluate the platform’s security, availability, and confidentiality controls over an extended observation period — not just a point-in-time snapshot. For IT and procurement teams evaluating loyalty platform vendors, this attestation provides verifiable assurance that Xoxoday Loyalife’s operational security controls work consistently over time. Enterprise HR platforms such as Workday, SAP SuccessFactors, and Darwinbox routinely require vendor compliance documentation before enabling integrations. Xoxoday Loyalife’s compliance artefacts — audit reports, security questionnaires, and data processing agreements — are available to enterprise customers through a standard vendor assessment process.

​
Data Privacy and Access Policies

Xoxoday Loyalife enforces role-based access control (RBAC) policies that restrict data access to authorised personnel only. Administrative controls allow programme managers to define permission boundaries across departments, business units, and geographies. This is particularly relevant for organisations running multi-country loyalty programmes where regional data residency requirements apply. Data processing agreements (DPAs) are available for customers operating under GDPR, India’s DPDP Act, and equivalent regional privacy regulations. Xoxoday Loyalife’s privacy policies govern how personally identifiable information (PII) tied to employee or customer loyalty accounts is handled, retained, and deleted upon request.

​
Integration-Level Compliance

When Xoxoday Loyalife connects with communication tools such as Slack or Microsoft Teams for loyalty notifications, or with HRIS platforms like Darwinbox for employee data sync, all data exchanges occur over encrypted channels using TLS 1.2 or higher. API integrations follow OAuth 2.0 authentication standards, and no credentials are stored in plaintext at any layer of the integration stack. Compliance documentation can be requested through your Xoxoday Loyalife account team or through the vendor security review process. Learn more: Xoxoday Loyalife Help Centre — General

Data Security and Encryption Standards

Understand how Xoxoday Loyalife encrypts data at rest and in transit across all loyalty programme operations.

Role-Based Access Control in Loyalife

Learn how to configure administrator and manager permissions to match your organisation’s governance model.