Xoxoday requires bidirectional internet connectivity — inbound for secure client and API access, outbound for integrations, email and SMS delivery, and payment processing — all governed by encryption in transit and continuous network monitoring.
Internet Connectivity Requirements
Xoxoday operates as a cloud-native, AI-enabled rewards and recognition platform that requires internet connectivity in both directions — inbound and outbound — to deliver a reliable, integrated experience for administrators, HR teams, and end users alike.Inbound Connectivity
Inbound connectivity refers to traffic flowing from the internet into Xoxoday’s infrastructure. Xoxoday exposes public-facing endpoints over HTTPS to allow authorised clients, users, and integrated applications to securely access the platform, its REST APIs, and webhook listeners. A practical example: when Workday or Darwinbox pushes employee lifecycle events — such as an onboarding trigger or a role change — to Xoxoday via a configured webhook, that communication arrives over an inbound connection. All inbound traffic passes through firewalls and a Web Application Firewall (WAF), and every request is authenticated before any processing occurs.Outbound Connectivity
Outbound connectivity refers to traffic that Xoxoday initiates toward approved third-party internet services. Xoxoday reaches out to transactional messaging providers to deliver email and SMS notifications — including reward alerts, redemption confirmations, and recognition updates sent to end users. When an employee in your organisation is recognised through a connected tool like Slack or MS Teams, Xoxoday initiates an outbound call to trigger that delivery in real time. Xoxoday also connects outbound to payment gateways and catalog partners to process reward redemptions, and to analytics services to power reporting dashboards and AI-driven engagement insights. All outbound destinations are defined on an approved allowlist, managed as part of Xoxoday’s network security controls.Security Across Both Directions
All inbound and outbound traffic on Xoxoday is protected by TLS encryption in transit, ensuring data confidentiality during every transmission. Firewalls, intrusion detection systems, and SIEM tooling provide layered protection across all network paths, enabling rapid identification and response to any anomalous activity. Xoxoday’s connectivity architecture aligns with ISO 27001 and SOC 2 Type II frameworks, both of which mandate controls around network access management, communication security, and continuous surveillance of data flows. This means your organisation can trust that every packet entering or leaving Xoxoday’s infrastructure is subject to documented, audited security policy. Learn more: Xoxoday Help Centre — Infrastructure Security (Protective Technology)Data Encryption in Transit and at Rest
Understand how Xoxoday protects data across all network connections using TLS and AES-256 encryption standards.
Third-Party Integrations and API Security
Learn how Xoxoday secures API endpoints and manages approved outbound connections to HRIS, messaging, and payment partners.