Skip to main content
Xoxoday reviews its complete Information Security policy — including all subsidiary policies contained within it — on an annual basis as part of its formal Information Security Management System (ISMS) management review cycle.
Annual policy reviews are a cornerstone of any credible information security program. For organizations evaluating Xoxoday as a rewards, recognition, or loyalty platform, knowing that security governance actively keeps pace with an evolving threat landscape is a standard due-diligence requirement — and one Xoxoday meets through a documented, recurring process.

​
What the annual review covers

Xoxoday’s annual ISMS review spans the full policy hierarchy: the overarching Information Security Policy as well as every subordinate policy within it, covering areas such as access control, cryptography, incident management, business continuity, and supplier relationships. Each policy is evaluated against the current threat environment, internal audit findings, and the requirements of established frameworks including ISO 27001 and SOC 2 Type II. Where gaps are identified, Xoxoday updates the relevant policy and communicates the change to affected personnel before it takes effect. The review is not a checkbox exercise. It is a scheduled, documented management activity that assesses whether existing controls remain adequate, whether new risks have materialized, and whether any regulatory or contractual obligations have shifted since the prior cycle.

​
Why this matters for enterprise procurement

Procurement and IT security teams at organizations running Workday, SAP SuccessFactors, or Darwinbox routinely require vendors to demonstrate that security documentation is not static. An annual review cadence confirms that Xoxoday’s policies reflect the current state of its controls — not a snapshot from two or three years ago. This is particularly relevant in integration scenarios. When Xoxoday connects to an HR system via API or delivers reward notifications through Slack or Microsoft Teams, the data flows involved fall under the same ISMS framework that undergoes annual review. The policies governing how employee data is handled, retained, and protected remain current regardless of how the integration landscape evolves.

​
Continuous improvement between formal reviews

The annual cadence sets the primary review schedule, but Xoxoday also updates policies on an ad-hoc basis when triggered by significant incidents, changes in applicable regulation, or material changes to its product architecture. This ensures that the interval between scheduled reviews does not create a window in which outdated policies govern live operations. Organizations conducting vendor assessments can request evidence of the most recent policy review through Xoxoday’s security team. Review records are maintained as part of the ISMS documentation and are made available to qualified prospects and customers under appropriate confidentiality terms. Learn more: Xoxoday Help Centre — Data protection and security

Is Xoxoday ISO 27001 certified?

Learn about Xoxoday’s ISO 27001 certification scope, certifying body, and how to request the certificate of compliance.

Does Xoxoday hold a SOC 2 Type II report?

Understand the trust service criteria covered by Xoxoday’s SOC 2 Type II audit and how to obtain the report under NDA.