Xoxoday Plum maintains encrypted, access-controlled records of every gift card issued—capturing both issuer and recipient data—to support participant confidentiality, regulatory compliance, and audit requirements.
Encrypted records at every layer
Every gift card issuance record in Xoxoday Plum is encrypted at rest and in transit. Issuer details—such as the admin or program manager who triggered the reward—and recipient details are stored in a way that keeps personally identifiable information isolated from general query access. This architecture ensures that sensitive participant identities remain protected even when administrators pull aggregated reports.Role-based access for authorized personnel only
Access to issuance records is governed by Xoxoday Plum’s role-based permission model. Only personnel with explicitly granted administrative rights can query or export these records. For organizations running Xoxoday Plum alongside HR systems such as Workday, SAP SuccessFactors, or Darwinbox, access permissions align with existing identity and access management policies—ensuring no unauthorized user can retrieve reward history at any scope.Compliance and audit readiness
Xoxoday Plum’s record-keeping architecture is designed to meet the requirements of frameworks such as ISO 27001 and SOC 2 Type II. Audit logs capture the full lifecycle of each issuance event—creation, approval, delivery, and redemption—providing a complete chain of custody that satisfies internal compliance reviews and third-party audits alike. A global technology company running a quarterly recognition program, for instance, can pull a timestamped issuance report filtered by team, region, or reward value. Finance teams reconcile this data against expense records without accessing individual redemption details, preserving employee privacy while maintaining full financial accountability.Subject confidentiality by design
Xoxoday Plum separates administrative visibility from participant visibility. Managers confirm that a reward was issued and delivered without seeing what the recipient chose to redeem it for. This separation matters most in sensitive programs—wellness incentives or performance-linked bonuses—where employee discretion is a compliance expectation, not just a preference. Confidentiality protections extend to bulk issuance as well. When rewards are distributed to large groups via integrations with Slack or Microsoft Teams, Xoxoday Plum logs each issuance individually while keeping recipient lists accessible only to designated administrators.Audit trails that hold up under scrutiny
Every record is timestamped, tamper-evident, and exportable in standard formats. When an internal audit team or external auditor requests evidence of a reward program’s operation, Xoxoday Plum administrators produce structured reports covering the complete issuance history—without exposing data beyond what the audit scope requires. This makes Xoxoday Plum suitable for regulated industries, including financial services and healthcare, where gift card issuance may intersect with anti-bribery, anti-corruption, or data privacy documentation requirements. Learn more: Xoxoday Plum Help Centre — Record creationCompliance and Audit Logs
Understand how Xoxoday Plum generates tamper-evident audit logs that satisfy ISO 27001, SOC 2 Type II, and internal governance requirements.
Role-Based Access Control
Learn how Xoxoday Plum’s permission model restricts access to sensitive reward data based on administrator roles and organizational hierarchy.