Skip to main content
Xoxoday records every login attempt, access denial, and privilege change with full audit trails — logs are retained per GDPR policy, encrypted at rest, and made available to customers through their account manager upon verified request.
Xoxoday’s rewards, incentives, and payout platform applies enterprise-grade logging and monitoring across all user and administrator activity. Every interaction that touches access control, authentication, or authorization is recorded with enough context to support compliance reviews, security investigations, and operational audits.

​
Event Logging and Audit Trails

Xoxoday records every login attempt — successful or failed — capturing the IP address, user-agent string, timestamp, and role of the actor, whether that is an administrator or an end user. Access denials, privilege escalations, and accepted authorization changes are logged in the same audit trail. This level of granularity means security teams can reconstruct the exact sequence of events during an incident — a capability that directly supports SOC 2 Type II and ISO 27001 audit requirements.

​
SIEM Integration and Real-Time Monitoring

Event data flows into Xoxoday’s internal logging infrastructure and is simultaneously pushed to a Security Information and Event Management (SIEM) system for continuous analysis. Security teams can identify anomalies, flag suspicious login patterns, and respond to potential threats in real time. For organizations running enterprise HR stacks such as Workday or SAP SuccessFactors, this centralized monitoring layer adds a consistent security signal across workforce and reward activity without requiring custom integrations.

​
Log Retention and Protection

Xoxoday retains audit logs for the duration necessary to meet compliance and operational objectives, consistent with its GDPR Data Retention Policy. Logs are encrypted at rest and monitored continuously for unauthorized access attempts. Direct access to raw logs is intentionally restricted — this design prevents tampering and preserves the integrity of the audit record.

​
Customer Access to Logs

Customers do not have self-serve access to raw logs, but Xoxoday provides detailed log extracts on request. If your organization needs log data for a security review, a compliance audit under frameworks such as SOC 2 Type II, or an active incident investigation, your assigned account manager or customer success representative can fulfill the request after identity verification. All log access requests go through defined authorization protocols to protect the confidentiality of recorded events. As a practical example: if your IT security team detects an anomaly in your identity provider and needs to correlate it against Xoxoday login events, your account manager can pull a timestamped extract covering the relevant window — complete with IP addresses, user roles, and authentication outcomes. Learn more: Xoxoday Help Centre — System requirement

Data Encryption and Security at Rest

Understand how Xoxoday encrypts stored data and protects it from unauthorized access.

GDPR Compliance and Data Retention

Learn how Xoxoday handles personal data retention and deletion in line with GDPR requirements.

Role-Based Access Control

See how Xoxoday enforces least-privilege access across administrator and end-user roles.

Single Sign-On and Authentication

Explore how Xoxoday integrates with your identity provider for secure, centralized authentication.