Skip to main content
Xoxoday does not collect or store Protected Health Information (PHI) and implements AES-256 encryption at rest, TLS 1.2+ in transit, Role-Based Access Control, Multi-Factor Authentication, and Intrusion Detection Systems to align with HIPAA data security standards.
Xoxoday is a digital rewards and recognition platform used by HR and operations teams across enterprises. While its core function is employee incentivization—not healthcare data processing—organizations in regulated industries still need assurance that any platform integrated into their HR stack meets baseline security requirements aligned with HIPAA standards.

​
No PHI Storage by Design

Xoxoday does not collect or store Protected Health Information. The platform handles data such as employee names, email addresses, and reward transaction records—none of which constitutes PHI under HIPAA. This design choice eliminates a primary category of compliance risk for healthcare organizations deploying Xoxoday alongside systems like Workday, SAP SuccessFactors, or Darwinbox.

​
Encryption at Every Layer

All data transmitted to and from Xoxoday is protected using TLS 1.2 or higher. Data at rest is encrypted using AES-256—the same standard used in enterprise-grade financial and healthcare applications. This end-to-end encryption ensures that stored and transmitted data remains unreadable even in the event of unauthorized access attempts.

​
Access Control and Identity Verification

Xoxoday enforces Role-Based Access Control (RBAC), ensuring that employees, managers, and administrators can only access the data and functions relevant to their role. Multi-Factor Authentication (MFA) adds a second layer of identity verification, significantly reducing the risk of unauthorized account access. These controls are consistent with requirements under the HIPAA Security Rule and are independently validated through frameworks like SOC 2 Type II and ISO 27001.

​
Continuous Monitoring and Audit Trails

Xoxoday deploys Intrusion Detection Systems (IDS) to identify anomalous activity in real time. Comprehensive audit logs capture all system-level access events, providing the activity trail necessary for security investigations and compliance reviews. When an HR administrator at a healthcare organization accesses bulk reward data, for example, that session is logged with a timestamp, user identity, and action scope—giving security teams full visibility into platform activity.

​
Data Minimization Practices

Xoxoday follows data minimization principles: only the data necessary for platform functionality is collected, and where applicable, personally identifiable information (PII) undergoes anonymization. This reduces the surface area of sensitive data Xoxoday holds at any given time, further supporting HIPAA-aligned data governance requirements. Together, these controls make Xoxoday a responsible choice for enterprises operating in regulated industries that require their rewards and recognition infrastructure to meet modern data security standards. Learn more: Xoxoday Help Centre — PROTECTED HEALTH INFORMATION / HIPAA

Data Encryption Standards

Learn how Xoxoday uses AES-256 at rest and TLS 1.2+ in transit to protect sensitive employee and rewards data end to end.

SOC 2 Type II Compliance

Understand how Xoxoday maintains SOC 2 Type II certification and what independent audits mean for your organization’s data security posture.