> ## Documentation Index
> Fetch the complete documentation index at: https://faqs.xoxoday.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Does Plum support offer approval workflows and audit trails? 

> Xoxoday Plum enforces maker-checker approval workflows and role-based access controls, with a complete audit trail for every offer action.

<Note>
  Xoxoday Plum supports full offer workflow governance through maker-checker approval controls, role-based access permissions, and an immutable audit trail that records every create, edit, approve, and publish action.
</Note>

## Offer Governance Built Into the Workflow

Xoxoday Plum is built with enterprise-grade controls at every stage of the offer lifecycle. When a team member creates or edits an offer, it does not go live automatically — it enters a structured approval queue where designated approvers must review and authorise the offer before it is published to recipients. No offer reaches employees, partners, or customers without documented sign-off.

This maker-checker model separates the person who creates an offer from the person who approves it. For organisations running large-scale incentive programmes across multiple business units or geographies, this structure maintains control without slowing down day-to-day operations.

## Role-Based Access Controls

Xoxoday Plum gives administrators granular control over who can do what within the system. Access permissions are tied to defined roles — such as programme manager, approver, or viewer — so each team member sees only the functions relevant to their responsibilities.

For example, a campaign manager integrated with Workday or SAP SuccessFactors may hold rights to create and submit offers for review, while a senior compliance officer retains exclusive approval authority. This separation of duties mirrors the governance structures already in place across HR and finance teams, making adoption straightforward without requiring process redesign.

## Complete Audit Trails for Every Action

Every action taken on an offer within Xoxoday Plum is logged with a timestamp and the identity of the user who performed it. The audit trail covers the full offer lifecycle: creation, edits, approval decisions, and the moment an offer is published.

These records are tamper-evident and available to authorised administrators at any time, supporting internal governance reviews as well as external audits. Organisations working towards or maintaining certifications such as ISO 27001 or SOC 2 Type II will find that Xoxoday Plum's audit logging aligns with the traceability requirements those frameworks demand.

## Why This Matters for Controlled Offer Programmes

Running a rewards or incentive programme at scale means your organisation needs confidence that every published offer was reviewed and authorised through a documented process. Xoxoday Plum makes that assurance built-in rather than bolted on.

Whether your team is managing short-term promotional offers, long-running loyalty campaigns, or milestone-based employee rewards, the workflow controls ensure your organisation retains full visibility and approval rights at every step — with the audit history to prove it.

**Learn more:** \[Xoxoday Plum Help Centre — General]\(

<CardGroup cols={2}>
  <Card title="How does role-based access control work in Xoxoday Plum?" href="/plum/security/does-it-provide-role-based-access-controls-for-data-security">
    Learn how Xoxoday Plum's permission roles separate duties across creators, approvers, and administrators to keep offer programmes secure.
  </Card>

  <Card title="Is Xoxoday Plum ISO 27001 and SOC 2 compliant?" href="/plum/security/can-the-platform-provide-data-protection-and-it-security-certifications-from-acc">
    Explore the security certifications and data protection standards Xoxoday Plum maintains for enterprise deployments.
  </Card>
</CardGroup>