Skip to main content
Plum is GDPR compliant. At Xoxoday, we ensure that the data is gathered, stored, and handled with respect to individual rights. We have raised awareness among our employees and other stakeholders on how to handle the data appropriately. Our employees understand the importance of GDPR and information security.
Xoxoday has an information security policy that is published and communicated to all suppliers and employees (including contractors and other relevant external parties).Xoxoday has ensured that the Information security policies have established the direction of the organization and align to best leading practices (e.g., ISO-27001, ISO-22307, CoBIT), regulatory, federal/state, and international laws where applicable.
Yes, at Xoxoday, we have a formal disciplinary or sanction policy established for employees who have violated security policies and controls. Employees are made aware of what action might be taken in the event of a violation and stated as such in the policies and controls. A detailed disciplinary process and policy are also in place.
At Xoxoday, we use JIRA for Project Management, and abiding by the Information security policy is mandatory and has been followed in all the projects.Every code change is reviewed by the tech lead or architect responsible for the project.During the review process, the reviewer is responsible for identifying possible security issues.
Yes, Xoxoday has a Mobile device policy. At Xoxoday, the mobile device policy takes into account the risks of working with mobile devices in unprotected environments and the controls to be implemented for preventing data transmitted/stored in the mobile device, and much more.
Yes at Xoxoday, we do have an ‘Information Security Policy’ in place.Information Classification is included in the organization’s processes, and be consistent and coherent across the organization. Results of classification indicate the value of assets depending on their sensitivity and criticality to the organization, e.g. in terms of confidentiality, integrity, and availability. Results of classification are updated in accordance with changes in their value, sensitivity, and criticality through their life-cycle.Formal procedures for the secure disposal of media are also established to minimize the risk of confidential information leakage to unauthorized persons. The procedures for the secure disposal of media containing confidential information are proportional to the sensitivity of that information.
Yes, we do have an ‘Information Security Policy’ in place and formal procedures for the secure disposal of media are established to minimize the risk of confidential information leakage to unauthorized persons. The procedures for the secure disposal of media containing confidential information are proportional to the sensitivity of that information.
Our application has role-based access controls and the menu’s screens are made accessible accordingly.
AES 256 bit encryption for PI data. SHA256 with unique salt for Hashing passwords.
Yes, Xoxoday does have tested Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP), the data would be stored at AWS Singapore.
During security audit/VAPT review, these incidents are identified.Yes, this process is widely communicated to all the employees and stakeholders.
Yes, on Xoxoday, we do conduct Quarterly VAPT.
Yes, at Xoxoday, we perform quarterly VAPT and have static code analysis via SonarQube
Policies, procedures, and standards have been established and maintained to protect information and physical media in transit, and are referenced in such transfer agreements.Also, there is a clause on securing business information and protection of confidential information in the NDA’s signed by the external parties.
As part of the ISO audit, IS Systems audit is also covered and yes the audit process ensures business disruption is minimized.
We have a quarterly VAPT performed on the entire application by a third-party security auditor.
At Xoxoday, we ensure that the data is gathered, stored, and handled with respect to individual rights. We have raised awareness among our employees and other stakeholders on how to handle the data appropriately. Our employees understand the importance of GDPR and information security. Our controls are placed based on the data protection impact assessment (DIPA). All personal data is encrypted on Xoxoday.We take data and security very seriously. We are ISO 27001, GDPR, and SOC compliant. More details about our security and privacy policy in the links aforementioned. You can also know more about our compliance here.
We may use the information we collect from you when you register, make a purchase, sign up for our newsletter, respond to a survey or marketing communication, surf the website, or use certain other site features in the following ways:
  • To personalize your experience and to allow us to deliver the type of content and product offerings in which you are most interested.
  • To improve our website in order to better serve you.
  • To allow us to better service you in responding to your customer service requests.
  • To ask for ratings and reviews of services or products.
  • To follow up with them after correspondence (live chat, email, or phone inquiries).
We take data and security very seriously. We are ISO 27001, GDPR and SOC compliant. More details about our security and privacy policy are here.
We ensure that ensure production data shall not be replicated or used in non-production environments. Physical segregation is done for production and non-production environments.
Yes. We are compliant with CPRA (California Privacy Rights Act), GDPR (General Data Protection Regulation) and HIPAA (Health Insurance Portability and Accountability Act)
In accordance with Data Protection Laws, we make available to Controller on request in a timely manner such information as is necessary to demonstrate compliance by Processor with its obligations under Data Protection Laws. Upon Controller’s written request and subject to the confidentiality obligations set forth in the Agreement, we will make available to Controller a copy of Nreach the most recent third-party audits or certifications, as applicable.
Yes, the policy, process, and procedure is implemented to ensure proper segregation of duties. our roles and job duties are segregated through role-based access to ensure maximum security of tenants’ databases
Attached the Xoxoday Privacy Policy. Please click here for the external privacy statement - https://www.xoxoday.com/privacy-policy.
Yes. We do maintain the records as per the Data privacy compliance requirements.
Yes. we maintain the list as per the Privacy laws and review it. We provide access only to authorised individual as per Role based access and access control policy.
Yes. we follow the privacy gidelines when collecting, storing, or processing Personal Data via electronic, audio, visual or print media. We are complied with this requirements.
We have review and monitor machanism to make sure that only the authorised individual have an access and the objectives of the privacy commitments are met.
Yes. we provide them a Information security and Privacy training. The frequency of the training is once in a year or as soon as they onboarded.
Yes. We have applicable data privacy clauses in the contracts.
We continuosly monitor the efficiency and effectiveness of implemented security controls frequently during the internal and external audits.