Skip to main content
Xoxoday maintains a comprehensive information security policy aligned with globally recognised frameworks — including ISO 27001:2013, SOC 2, GDPR, and HIPAA — and conducts periodic Vulnerability Assessment and Penetration Testing to address emerging risks.
Xoxoday establishes and enforces a formal information security policy built on industry-standard best practices. This policy governs how Xoxoday protects the confidentiality, integrity, and availability of data across its rewards, recognition, and loyalty platforms. Every product — from Empuls (employee engagement) to Plum (rewards catalogue) and Compass (sales incentives) — operates within this unified security framework.

​
Certifications and Compliance

Xoxoday holds active certifications across four major compliance frameworks. ISO 27001:2013 provides the international standard for Information Security Management Systems, ensuring Xoxoday’s controls are systematically managed and continuously improved. SOC 2 Type 1 attests that Xoxoday’s system design meets the Trust Service Criteria for security, availability, and confidentiality. GDPR compliance ensures that personal data belonging to employees and end users in the European Union is processed lawfully and with appropriate safeguards. HIPAA certification demonstrates Xoxoday’s capability to handle protected health information, which is relevant for organisations in healthcare, insurance, and related sectors. For organisations that integrate Xoxoday with enterprise HR systems such as Workday, SAP SuccessFactors, or Darwinbox, this compliance posture ensures that data exchanged across system boundaries meets the same security standards expected of the primary HR platform.

​
Security Incident Management

Xoxoday maintains a documented Security Incident Reporting and Response Procedure that covers the full lifecycle of a security event — identification, assessment, recording, containment, response, and post-incident learning. When an incident is detected, defined response workflows activate immediately to limit impact and prevent recurrence. Organisations connecting Xoxoday to communication tools such as Slack or Microsoft Teams can be confident that incident detection extends across these integration touchpoints, not just the core platform.

​
Ongoing Vulnerability Management

Xoxoday conducts periodic Vulnerability Assessment and Penetration Testing (VAPT) to proactively surface and remediate security weaknesses before they can be exploited. VAPT exercises simulate real-world attack scenarios against Xoxoday’s infrastructure, APIs, and application layers. Findings feed directly into Xoxoday’s risk management cycle, ensuring the security posture keeps pace with an expanding integration surface and evolving threat landscape.

​
Security as a Continuous Practice

Xoxoday’s information security policy is not a static document. It is reviewed and updated in response to changes in the regulatory environment, emerging threats, and product evolution. Whether your organisation operates under ISO 27001 audit cycles, faces GDPR data subject access requests, or must demonstrate HIPAA-readiness to enterprise customers, Xoxoday’s controls are designed to support those requirements without placing additional compliance burden on your team. Learn more: Xoxoday Help Centre — Technical requirement

How does Xoxoday handle data encryption?

Learn how Xoxoday encrypts data in transit and at rest to protect sensitive employee and end-user information.

What is Xoxoday's approach to penetration testing?

Understand how Xoxoday conducts VAPT exercises to identify and remediate vulnerabilities across its platforms and APIs.