Skip to main content
Xoxoday enforces separation of duties across security administration, system administration, and standard user functions through a Role-Based Access Control (RBAC) framework, granular permission scoping, and tamper-evident audit logging.
Xoxoday’s Role-Based Access Control (RBAC) framework is the foundation of its separation of duties model. Administrators can assign predefined or custom roles that are logically segregated to prevent overlap between critical functions. This design ensures that no single user can simultaneously hold security administration and system administration privileges within the same account. Security Administration vs. System Administration Security Admins in Xoxoday have authority over user provisioning, password policy configuration, multi-factor authentication (MFA) settings, and audit log access. System Admins manage platform configurations, third-party integrations, and operational workflows — but are explicitly restricted from altering security policies. This clear boundary reduces the risk of privilege abuse and directly supports compliance with frameworks such as SOC 2 Type II and ISO 27001. Standard User Access End users interact only with the features relevant to their day-to-day workflow — viewing reward balances, submitting peer nominations, or redeeming points. They have no visibility into administrative controls, integration settings, or security configurations. In environments where Xoxoday connects to Workday, SAP SuccessFactors, or Darwinbox for employee data synchronisation, this access boundary extends to HR data as well. Granular Permission Management Within the Xoxoday admin console, each role is configured with specific, scoped access rights. A manager approving nominations does not inherit any backend configuration privileges simply by virtue of their seniority or reporting line. Access is determined solely by role definition, not by organisational hierarchy, which prevents unintended privilege escalation. Audit Trails and Traceability Every administrative action in Xoxoday is logged with a role identifier and timestamp. Whether a Security Admin resets an MFA policy or a System Admin updates a notification integration — such as a Slack or Microsoft Teams webhook — the action is recorded in a tamper-evident audit trail. These logs are available for internal compliance reviews and can be exported to support external audits. Access Reviews and Least Privilege Xoxoday supports periodic access reviews through downloadable reports showing current role assignments and associated privileges across your organisation. This enables your security or compliance team to confirm that every user holds only the access they need — a core least-privilege principle that underpins SOC 2 Type II and ISO 27001 compliance programmes. Role validation can be scheduled as part of your organisation’s regular internal audit cycle. Learn more: Xoxoday Help Centre — Security Requirement

Role-Based Access Control

Learn how Xoxoday’s RBAC framework lets administrators define, assign, and manage roles with scoped privileges across the platform.

Audit Logs and Compliance Reporting

Understand how Xoxoday captures and exports administrative audit trails to support SOC 2 Type II and ISO 27001 compliance requirements.