Skip to main content
Xoxoday holds ISO/IEC 27001 and SOC 2 certifications for its information security management system, and its AWS-hosted infrastructure complies with PCI-DSS, HIPAA/HITECH, FedRAMP, GDPR, FIPS 140-2, and NIST 800-171.
Xoxoday operates under a layered security framework that aligns with globally recognized compliance standards. This framework covers both the application layer managed by Xoxoday and the underlying cloud infrastructure, ensuring end-to-end accountability for data protection and operational resilience across every environment where the platform runs.

​
ISO/IEC 27001 and SOC 2 Certifications

Xoxoday is certified under ISO/IEC 27001, the international standard for information security management systems (ISMS). This certification validates that Xoxoday has implemented a systematic, independently audited approach to identifying, managing, and mitigating information security risks. It is not a self-assessment — it requires third-party verification on a recurring basis. Xoxoday also holds SOC 2 certification, which confirms that its controls for security, availability, and confidentiality meet the Trust Services Criteria defined by the AICPA. Together, ISO/IEC 27001 and SOC 2 provide your organisation’s InfoSec and procurement teams with documented, auditable proof of governance at the application level.

​
AWS Infrastructure Compliance

The infrastructure underpinning Xoxoday runs on Amazon Web Services (AWS). AWS maintains compliance with PCI-DSS for payment data security, HIPAA/HITECH for healthcare information, FedRAMP for U.S. federal cloud services, GDPR for European data protection, FIPS 140-2 for validated cryptographic modules, and NIST 800-171 for protecting controlled unclassified information. Your organisation benefits from a hosting environment built to the highest regulatory standards without needing to independently validate each certification in a separate vendor review.

​
What This Means for Enterprise Integrations

For teams connecting Xoxoday with HR systems such as Workday, SAP SuccessFactors, or Darwinbox, these certifications translate directly into faster internal procurement approvals and smoother security reviews. When your IT team runs a vendor risk assessment, Xoxoday’s certification portfolio provides evidence across multiple compliance frameworks simultaneously, reducing back-and-forth with security questionnaires. Consider an organisation rolling out Xoxoday’s rewards and recognition platform across regions spanning both EU and U.S. operations. The combination of GDPR-compliant AWS infrastructure and Xoxoday’s own ISO/IEC 27001 ISMS means data residency requirements and information security governance expectations are met within a single vendor relationship, without needing separate arrangements for each jurisdiction.

​
Continuous Compliance

Xoxoday treats compliance as an ongoing operational discipline rather than a one-time certification milestone. Regular audits, vulnerability assessments, and policy reviews are embedded into the product and infrastructure lifecycle to ensure standards are maintained as both the platform and the regulatory landscape evolve. Learn more: Xoxoday Help Centre — IT

How does Xoxoday handle data security and encryption?

Learn about Xoxoday’s encryption standards, data-at-rest and in-transit protections, and access control practices.

How does Xoxoday comply with GDPR requirements?

Understand how Xoxoday manages data subject rights, consent, and cross-border data transfers under GDPR.