Xoxoday: Sensitive Data and Maintain Confidentiality

​

Data Protection at Every Layer

Xoxoday applies a defence-in-depth approach to data security, combining encryption, access governance, and continuous oversight to protect all sensitive information throughout its lifecycle. These controls apply uniformly across the platform, from stored records to live data exchanges between integrated systems.

​

Encryption at Rest and in Transit

All data stored within Xoxoday is encrypted at rest using client-specific cryptographic keys, ensuring that no two organisations share the same encryption boundary. Data exchanged between Xoxoday and connected HR systems — such as Workday, SAP SuccessFactors, or Darwinbox — is secured using TLS 1.2, preventing interception during transit. This dual-layer encryption model means sensitive employee and participant data remains protected whether it sits in storage or moves across networks.

​

Access Governed by Least Privilege

Xoxoday enforces role-based access control (RBAC), granting each internal user only the permissions required for their specific function. Administrators, HR teams, and engineers operate within clearly defined permission tiers, so no single role holds unnecessary access to customer data. All personnel who handle customer data must authenticate via two-factor authentication (2FA) and connect through a VPN, adding a mandatory verification layer before access is permitted.

​

Comprehensive Audit Logging and Access Reviews

Every access event, configuration change, and administrative action within Xoxoday is captured in a tamper-evident audit log. These records are available for review during internal audits, compliance assessments, or incident investigations. Xoxoday also conducts periodic access reviews to validate that existing permissions remain appropriate, identifying and correcting accounts or roles that may have accumulated excess access over time.

​

Confidentiality Built Into Workflows

When Xoxoday is integrated into recognition or loyalty workflows — for example, distributing reward points through a Microsoft Teams or Slack integration — workflow-level confidentiality controls prevent unauthorised viewing or sharing of participant data. Sensitive programme information is accessible only to users with an explicit operational need, not to every connected application or administrator by default.

​

GDPR Alignment

Xoxoday’s data handling practices are designed to align with GDPR requirements. Data minimisation, purpose limitation, and subject access controls are embedded into core product behaviour rather than offered as optional add-ons. Organisations operating in the EU or handling data belonging to EU residents can rely on Xoxoday’s controls as a component of their broader compliance obligations, including those verified under ISO 27001 and SOC 2 Type II frameworks.

---

Learn more: Xoxoday Help Centre — Data, Policy & Privacy