Skip to main content
Limited third-party access exists for operational purposes only: (a) AWS (cloud infrastructure provider) - hosts the encrypted data; AWS does not independently access or process customer data; (b) Cloudflare (CDN/WAF) - processes web traffic metadata (IP addresses, request headers) for security filtering; no customer…
Limited third-party access exists for operational purposes only: (a) AWS (cloud infrastructure provider) - hosts the encrypted data; AWS does not independently access or process customer data; (b) Cloudflare (CDN/WAF) - processes web traffic metadata (IP addresses, request headers) for security filtering; no customer PII is stored by Cloudflare; (c) Reward fulfillment vendors - receive only the minimum data necessary for order fulfillment (e.g., delivery name, address, phone number for merchandise orders). For digital gift card/voucher redemption, fulfillment is typically anonymous. All third parties operate under contractual data protection obligations. Learn more: Xoxoday Loyalife Help Centre

Does Xoxoday Loyalife conduct regular third-party pen tests? Share summary?

Xoxoday conducts regular third-party penetration tests (at least annually, with additional tests after significant changes)…

Does Loyalife have a vulnerability management process?

Xoxoday Loyalife maintains a formal Threat and Vulnerability Management policy to identify, assess, and remediate security vulnerabilities across its…