Are Xoxoday Physical and Logical Security Measures Adequate?

​

How Xoxoday Protects Client Data

Xoxoday enforces a defence-in-depth approach to data security, meaning no single control is relied upon in isolation. Physical infrastructure runs on enterprise-grade cloud environments with strict facility access controls, while logical security layers govern precisely how users and systems interact with data across the reward marketplace.

​

Role-Based Access Control (RBAC)

Xoxoday’s RBAC model ensures that every user — whether an HR administrator managing budgets in Workday or a finance approver reconciling spend in SAP SuccessFactors — accesses only the data and functions relevant to their role. Permissions are scoped by job function, department, and geography, preventing lateral movement within the system. When an employee departs or changes roles, access is revoked or adjusted immediately without manual intervention.

​

Multi-Factor Authentication (MFA)

All administrative and privileged accounts within Xoxoday require multi-factor authentication. Organisations that integrate Xoxoday with identity providers such as Okta, Azure AD, or Google Workspace can enforce MFA policies centrally, ensuring consistent authentication standards across every touchpoint in the reward workflow.

​

Encryption at Rest and in Transit

Data stored within Xoxoday is encrypted using AES-256, while all data transmitted between Xoxoday services, integrated platforms like Darwinbox, and end-user browsers is protected with TLS 1.2 or higher. This dual-layer encryption approach means that even in the unlikely event of a storage breach, data remains unreadable without the corresponding decryption keys.

​

Periodic Security Audits

Xoxoday undergoes regular third-party security assessments, including penetration testing and vulnerability scanning, as part of its compliance posture under ISO 27001 and SOC 2 Type II frameworks. Audit findings are tracked, remediated, and reviewed by Xoxoday’s internal security team on a defined cadence. Organisations can request audit summaries as part of their vendor due diligence process.

​

A Practical Example

Consider an organisation running Xoxoday alongside Microsoft Teams for employee recognition. An HR manager using the Teams integration can nominate and reward colleagues directly within Teams, but Xoxoday’s RBAC layer ensures that manager cannot access reward budgets or redemption records belonging to another department. MFA protects the HR manager’s admin account, and all reward transaction data flows between Teams and Xoxoday over an encrypted channel — with zero exposure of underlying personal records. Xoxoday’s layered security architecture is designed to meet the rigorous demands of enterprise clients operating in regulated industries, giving IT and compliance teams the assurance they need before and after deployment. Learn more: Xoxoday Help Centre — Security Requirement