Skip to main content
Xoxoday enforces role-based access control (RBAC), the principle of least privilege, and multi-factor authentication across all internal and third-party access points, ensuring no unauthorized personnel can access sensitive institutional data including protected health information (PHI) or financial records.
Xoxoday prohibits unauthorized access to sensitive institutional data across its entire infrastructure. PHI, financial records, and any data classified as sensitive under global privacy regulations are not accessible by default—access must be explicitly granted based on a documented, role-specific business need. This applies equally to full-time employees, contractors, and third-party vendors.

​
How Access Is Governed

Access within Xoxoday follows the principle of least privilege combined with role-based access control. Every individual operating inside Xoxoday’s systems receives only the permissions required for their specific function—nothing beyond that scope. An operations team member processing reward fulfillment through the Xoxoday platform, for example, has no visibility into compliance records or financial account data belonging to separate business units or clients. Multi-factor authentication is required for every access session involving institutional data. Access events are captured in immutable audit trails that record who accessed what, when, and from where. Xoxoday’s security operations team monitors these logs continuously to detect anomalous behavior and enforce accountability across the organization.

​
Third-Party Vendor Controls

Third-party vendors integrated with Xoxoday’s infrastructure are bound by the same access governance policies as internal staff. Vendor agreements explicitly restrict data access to defined, time-limited scopes. Access entitlements are reviewed on a regular cadence and revoked immediately when a vendor’s engagement ends or their role changes. Xoxoday undergoes SOC 2 Type II audits, which independently verify that these vendor access controls are designed correctly and operating as intended. This gives enterprise clients in regulated industries an externally validated assurance—not just a policy document.

​
PHI and Financial Data on the Rewards Platform

For clients connecting Xoxoday to enterprise HR and finance systems such as Workday, SAP SuccessFactors, or Darwinbox, PHI and financial information are either not collected by Xoxoday or are fully segregated and encrypted at rest and in transit. Xoxoday’s architecture processes only the minimum data necessary to fulfill rewards and recognition transactions, structurally limiting the exposure of sensitive institutional data. Where financial identifiers such as bank account or payroll details are involved in incentive disbursements, those data elements are handled within encrypted, access-controlled environments that are isolated from Xoxoday’s general operational systems.

​
Compliance Alignment

These controls are aligned with HIPAA requirements for health information and GDPR requirements for personal data processed across the European Union and beyond. Xoxoday’s ISO 27001 certification and SOC 2 Type II attestation provide the documented, audited evidence that access governance practices meet the standards expected by healthcare organizations, financial institutions, and other regulated enterprises. Clients in sensitive industries can request Xoxoday’s security documentation, including access control policies and audit summaries, as part of their vendor assessment process. Learn more: Xoxoday Help Centre — Data, Policy & Privacy

How does Xoxoday control internal data access?

Learn how Xoxoday implements role-based access control and least privilege to restrict data access to authorized personnel only.

Is data encrypted at rest and in transit on Xoxoday?

Understand the encryption standards Xoxoday applies to sensitive data across storage, transmission, and third-party integrations.