Skip to main content
Xoxoday secures all API endpoints for enterprise integrations using OAuth 2.0 and JWT-based authentication, TLS 1.2/1.3 encrypted HTTPS communication, and built-in rate limiting to defend against misuse and DDoS attacks.
When enterprise teams connect Xoxoday to HR platforms like Workday, SAP SuccessFactors, or Darwinbox, the integrity of that data exchange is non-negotiable. Xoxoday’s API infrastructure is built with layered security controls that protect every request from authentication through transmission.

​
Authentication and Authorization

Xoxoday implements OAuth 2.0 and JWT (JSON Web Token)-based authentication across all API endpoints. OAuth 2.0 ensures that only authorized applications can obtain access tokens, while JWT provides a tamper-proof, time-bound credential that accompanies each API call. This combination eliminates the need to share long-lived credentials and significantly reduces the attack surface for unauthorized access. When a system like Workday or SAP SuccessFactors initiates a data sync with Xoxoday, the integration follows a token exchange flow where access is granted only after identity is verified and scoped permissions are confirmed. Tokens expire automatically, forcing re-authentication and limiting exposure if a credential is ever compromised.

​
Encrypted Data in Transit

All data transmitted through Xoxoday’s APIs travels over HTTPS, enforced with TLS 1.2 and TLS 1.3. Information moving between Xoxoday and enterprise systems—whether employee records, reward transactions, or recognition events—is fully encrypted and protected against interception. Older, weaker protocol versions are not supported, ensuring connections always meet current security standards. For organizations connecting Xoxoday to Slack or Microsoft Teams, the same encryption applies to every API call that delivers notifications, approval requests, or redemption links. There are no unencrypted communication paths in any supported integration scenario.

​
Rate Limiting and DDoS Protection

Xoxoday enforces API rate limiting and throttling to protect against both accidental overuse and deliberate abuse. If an integration sends an unusually high volume of requests in a short window—whether from a misconfigured script or a volumetric attack—Xoxoday automatically throttles or blocks that traffic before it affects platform availability. IT and DevOps teams integrating Xoxoday can reference rate limit headers included in API responses to build graceful retry logic within their own applications, making integrations more resilient without additional configuration on Xoxoday’s side.

​
Compliance and Auditability

Xoxoday’s API security practices align with its broader compliance posture, which includes ISO 27001 certification and SOC 2 Type II attestation. API access logs are maintained for audit purposes, giving enterprise security teams visibility into which systems accessed which endpoints and when. This supports internal compliance reviews, regulatory requirements, and incident response workflows without requiring additional tooling from the customer. Learn more: Xoxoday Help Centre — Security Requirement

Data Encryption at Rest and in Transit

Learn how Xoxoday protects stored and transmitted data using AES-256 encryption and enforced TLS across all environments.

SSO and SAML Authentication for Enterprise

Understand how Xoxoday supports Single Sign-On via SAML 2.0 to centralize identity management across enterprise directories.