# Payments and Wallet
Source: https://help-plum.xoxoday.com/account-administration/reporting/payments

See how to view and track payment records for your Plum account, including wallet top-ups and reward-related transactions.

*Plum's reports offer detailed insights into Reward transactions, enabling admins to manage organizational activities effectively.*

Plum keeps track of all the transactions of Reward Points, Reward Codes, Reward Links, Perks History, and Plum GiftCard API. Reports allow you to check the status of your transactions along with details like invoice date, amount, invoice note, balance, and comments. You can also view the redemption history of the recipients.

Plum diligently keeps track of all transactions involving Reward Points, Reward Codes, Reward Links, Perks History, and interactions via the Plum GiftCard API. Through detailed reports, users gain insight into the status of their transactions, including crucial details such as invoice dates, transaction amounts, invoice notes, current balance, and any accompanying comments. Additionally, users have the ability to delve into the redemption history of recipients, providing a comprehensive understanding of reward utilization.

***

## Accessing Reports as an Admin

To access the plethora of reports available as a Super Admin, users simply need to navigate to the designated "Reports" section within the admin dashboard's navigation menu. Super Admins are granted access to a wide array of reports encompassing various transactional activities within the organization.

<Frame>
  <img alt="" />
</Frame>

<Info>
  **Note:** Admins view only their sent rewards, while Super Admins access all reports.
</Info>

It's important to note that while regular Admins are limited to viewing reports related to rewards they've issued, Super Admins have the privilege of accessing all types of reports, providing a more holistic view of organizational activities.

Navigate to the "Reports" section in the admin dashboard's navigation menu as a Super Admin.

* Access various reports covering organizational transactions.
* Review scheduled future rewards and cancel them if needed.
* Download reports via the "Download" button in the top right corner.

In addition to viewing transactional reports, users can also manage scheduled future rewards, with the ability to cancel them if necessary, offering flexibility and control over reward disbursements.

Furthermore, users can easily download reports by simply clicking on the "Download" button located in the top right corner of the page, facilitating seamless access to comprehensive transactional data.

***

## Exploring Payment Details

### Checking Payments

<Frame>
  <img alt="Download From Mintlify" />
</Frame>

<Frame>
  <img alt="" />
</Frame>

* Click on 'Wallet icon on the nav menu
* Click on 'Transaction history'
* Customize payment reports using filters.
* Explore payment details including invoice, amount, recharge, date, and status.
* Export Excel reports to your email.

Upon accessing the "Reports" section, users will encounter a screen similar to the one depicted in the provided image. To delve into payment details, users can simply click on the "View Report" option under the "Wallet History" section, initiating a deeper exploration into payment-related activities.

<Info>
  **Pro tip:** Once within the payment report interface, users have the flexibility to customize their view by utilizing various filters to cater to specific requirements. This customization empowers users to extract pertinent information efficiently.
</Info>

Within the payment section, users can review detailed payment information, including invoice details, transaction amounts, the entity responsible for the recharge, transaction dates, and current payment statuses. This comprehensive overview enables users to gain valuable insights into financial activities within the organization.

Furthermore, users can seamlessly export payment details in Excel format to their designated email addresses, facilitating easy access and further analysis of transactional data.

By leveraging these robust reporting capabilities, users can effectively monitor and manage transactional activities within the Xoxoday Plum application, ensuring transparency, accountability, and informed decision-making.


# Plum Gift Cards API Report
Source: https://help-plum.xoxoday.com/account-administration/reporting/plum-gift-cards-api-report

Learn how to access and read the Plum gift cards API report, used to track gift card transactions sent through the API.

*Access detailed Gift Card reports for insights on product usage and recipient details.*

***

## Accessing Gift Card Reports

Follow these steps to view detailed reports for Gift Card Reports:

<Steps>
  <Step title="Navigate to Reports">
    Go to dashboard and click "**Reports**".
  </Step>

  <Step title="Select Gift Cards">
    Within the "**Reports**" section, click on "**Gift Card**". You can select the sent date by clicking in the box "**Sent Date UTC**".
  </Step>

  <Step title="View Detailed Information">
    Here you'll find detailed reports containing the following information fields:

    * Order ID
    * Product Name
    * Product ID
    * Recipient Email
    * Currency
    * Denominations
    * Date with Timestamp
    * Amount Charged
    * Status
    * Actions

    <Frame>
      <img alt="" />
    </Frame>
  </Step>
</Steps>

By following these steps, you can easily access and review reports specific to gift cards, providing valuable insights into product usage and recipient details.

***

## Filter the Report

Click on the filter icon to filter the report by:

* Order ID
* Recipient Email
* Sent Date
* Delivered Date
* Status
* PO Number
* Tag

<Frame>
  <img alt="" />
</Frame>

***

## Manage Columns

Click on ||| Columns Icon to manage the columns you wish to show in the report. Simply check or uncheck the boxes based on your requirement.

<Frame>
  <img alt="" />
</Frame>

The reports can be downloaded using the "Download" button on the top right.

Feedback or Questions: Reach out to us at [cs@xoxoday.com](mailto:cs@xoxoday.com)


# Reports
Source: https://help-plum.xoxoday.com/account-administration/reporting/reporting-faqs

Find answers to frequently asked questions about generating, reading, and troubleshooting reward reports in Plum.

***

## Can your reporting tools provide both a unified and department/program-specific breakdown so we can track performance and metrics across teams?

Absolutely. The Xoxoday reward marketplace platform includes advanced reporting tools that offer both holistic and granular insights. Admins can view cross-team performance data or generate custom reports for specific departments or programs, helping stakeholders monitor redemption trends, participant engagement, and ROI.

***

### Is monthly reporting on points requests, including accepted and rejected transactions, supported?

Yes, the Xoxoday survey rewards platform offers detailed monthly reports covering all redemption activities, including accepted and rejected requests. Admins can access, export, and schedule these reports to maintain full transparency and auditability across all rewards-related transactions.

*FAQ on Notification and Cancellation*

***

## How do I receive notifications if scheduled rewards are not sent?

In the event that scheduled rewards are canceled due to low balance or exceeding threshold limits, both admins and Super Admins will receive notifications. These notifications will provide detailed information about the canceled rewards, allowing swift corrective action to maintain a seamless rewarding experience for all users.

***

## Can I cancel rewards in bulk?

Yes, users now have the ability to cancel rewards in bulk. Simply select all the users for whom you wish to cancel rewards and click on the "Cancel reward" button, as illustrated below:

<Frame>
  <img alt="" />
</Frame>


# Overview
Source: https://help-plum.xoxoday.com/account-administration/reporting/reporting-overview

Get an overview of Plum's reporting tools, covering how to track reward distribution, spend, and redemption activity across your account.

*Explore insights into various reports within Plum*

This article provides an overview of the reports available within Plum, a platform for managing rewards, incentives, and payments efficiently. Below are the different report types offered:

* **Rewards API Report** — This report provides detailed insights regarding the usage of the Rewards API within Plum. Users can track API usage, performance metrics, and any issues encountered during API transactions.

* **Reward Code Report** — The Reward Code report offers a comprehensive overview of all reward codes generated and redeemed within the platform. Users can monitor the distribution of reward codes, redemption rates, and any associated trends or patterns.

* **Reward Link Report** — Users can leverage the Reward Link report to analyze the effectiveness of reward links distributed through Plum. This report provides insights on link clicks, conversions, and overall engagement with the reward links.

* **Integration Report** — The Integration report provides insights into Xoxoday Plum's integration with external systems. Users can monitor integration status, track data synchronization, and troubleshoot any related issues.

* **Payment and Wallet Report** — This report focuses on providing users with a detailed overview of payment transactions and wallet activities within Plum. Users can track payments, withdrawals, account balances, and any financial transactions processed through the platform.

Through these reports, users can effectively monitor, analyze, and optimize their reward, incentive, and payment strategies within Plum. Whether it's tracking API performance, analyzing reward distribution, or monitoring financial transactions, these reports offer valuable insights to drive informed decision-making and enhance overall platform performance.

<Frame>
  <img alt="" />
</Frame>

Feedback or Questions: Reach out to us at [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Reward Code Report
Source: https://help-plum.xoxoday.com/account-administration/reporting/reward-code-report

See how to generate and interpret the reward code report in Plum, covering distribution status and redemption activity.

*Discover how to access detailed transaction reports for Reward Code*

To view transaction reports for Reward Code, navigate to the Reports and then to the "Reward Code" tab. The reports provide detailed information such as recipient name, recipient email, date of delivery, campaign details, status, and more.

***

## How to Access Reward Code Reports

<Steps>
  <Step title="Click on Reports">
    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Navigate to Reward Code section">
    To view the report for Reward Code, simply navigate to the "**Reward Code**" section.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="View transaction details">
    In this section, you'll find comprehensive transaction details, including "**Unique ID**", "**Payment Reference ID**", "**Recipient Name**", and "**Recipient Email**", along with other relevant information.
  </Step>

  <Step title="Download the report">
    To download the report, click on "**Download**" at the top right corner of the page.

    <Frame>
      <img alt="" />
    </Frame>

    <Info>
      Select your desired time frame for viewing reports by clicking Send Date UTC.
    </Info>
  </Step>
</Steps>

***

## Tracking Email and SMS Activity in Rewards Code Report

You can easily track Email and SMS activity in the Rewards Code report, enabling you to monitor and analyze the communication activities related to rewards distribution.

<Steps>
  <Step title="Navigate to Reports > Reward Code">
    Navigate to **Admin Dashboard > Reports > Reward Code.** Click the **'three dots icon'** to move ahead.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="View Activity Timeline">
    Click **'View Details'** and, using the dropdown menu, view **'Activity Timeline'.**

    <Frame>
      <img alt="" />
    </Frame>
  </Step>
</Steps>

***

## Filter the Report

Click on the filter icon to filter the report by the options given.

<Frame>
  <img alt="" />
</Frame>

***

## Manage Columns

Click on ||| Columns Icon to manage the columns you wish to show in the report. Simply check or uncheck the boxes based on your requirement.

<Frame>
  <img alt="" />
</Frame>

Feedback or Questions - Reach out to us at [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Reward Link Report
Source: https://help-plum.xoxoday.com/account-administration/reporting/reward-link-report

See how to generate and interpret the reward link report in Plum, covering distribution status and redemption activity.

*Discover how to access and navigate detailed Reward Link reports with filtering options.*

To view transaction reports for Reward Links, navigate to **Reports > Reward Link.**

The reports provide detailed information such as recipient name, recipient email, date of delivery, campaign details, status, and more.

***

## How to Access Reward Links Reports

* Click on **Reports >> Reward Link**
* Explore detailed reports for Reward Links, including **recipient name, recipient email, date of delivery, campaign details, status**, and more.

<Frame>
  <img alt="" />
</Frame>

* Utilize the filter options provided to obtain specific reports based on criteria such as **recipient name, recipient email, batch ID, phone number, generation date range,** and more.

<Frame>
  <img alt="" />
</Frame>

* Download the report using the top **download button.**
* Select your desired time frame by clicking on **Sent Date (UTC)** and choosing the range.

***

## Filter the Report

Click on the filter icon to filter the report by:

* Unique ID
* Payment Reference ID
* Recipient Name
* Recipient Phone
* Sent Date (UTC)
* Redemption Date (UTC)
* Status
* Campaign
* Batch ID

<Frame>
  <img alt="" />
</Frame>

***

## Manage Columns

Click on ||| Columns Icon to manage the columns you wish to show in the report. Simply check or uncheck the boxes based on your requirement.

<Frame>
  <img alt="" />
</Frame>

Feedback or Questions - Reach out to us at [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Reward Points Reports
Source: https://help-plum.xoxoday.com/account-administration/reporting/reward-points-reports

Learn how to generate and interpret reward points reports in Plum, covering points issued, redeemed, and outstanding balances.

*Easily view and download Reward Points transaction reports.*

To view transaction reports for Reward Point, navigate to **Reports > Wallet History > Reward Point** tab. The reports provide detailed information such as recipient name, recipient email, date of delivery, campaign details, status, and more.

***

## How to Access Reward Points Reports

* Navigate to **Reports.**

<Frame>
  <img alt="" />
</Frame>

* Click on **Reward Points.**

<Frame>
  <img alt="" />
</Frame>

* Utilize the filter options to obtain specific reports based on criteria such as recipient name, recipient email, batch ID, phone number, generation date range, and more.
* Download the report using the top **download button.**
* You can also select your desired time frame by clicking on Sent Date (UTC) and choosing the range.

<Frame>
  <img alt="" />
</Frame>

Select your desired time frame by clicking on **Sent Date (UTC)** and choosing the range.

<Frame>
  <img alt="" />
</Frame>

***

## Tracking Email and SMS Activity in Rewards Reports

You can easily track Email and SMS activity in the Rewards Points report, enabling you to monitor and analyze the communication activities related to rewards distribution.

<Steps>
  <Step title="Navigate to Reports > Reward Points">
    Navigate to **Admin Dashboard > Reports > Wallet History > Reward Points.** Click the **'three dots icon'** to move ahead.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="View Activity Timeline">
    Click **'Take Action'** and the using dropdown view **'Activity Timeline'.**

    <Frame>
      <img alt="" />
    </Frame>
  </Step>
</Steps>

***

## Filter the Report

Click on the filter icon to filter the report.

<Frame>
  <img alt="" />
</Frame>

***

## Manage Columns

Click on ||| Columns Icon to manage the columns you wish to show in the report. Simply check or uncheck the boxes based on your requirement.

<Frame>
  <img alt="" />
</Frame>

Feedback or Questions: Reach out to us at [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Manage Admins
Source: https://help-plum.xoxoday.com/account-administration/user-management/add-admin-user

Learn how to add a new admin user to your Plum account, including how to set their access level and permissions during setup.

The **All Admins** page enables Super Admins to manage users who have access to the Plum Admin Dashboard. Super Admins can add Admins,  assign or modify roles, configure rewarding thresholds, or delete Admin.

To access the **All Admins** page, navigate to **Settings > Admin > All Admins**.

<Frame>
  <img alt="Screenshot 2026 08 30 At 8 52 25 PM" />
</Frame>

## Add an Admin

To add a new Admin:

1. On the **All Admins** page, click **Add New**.
2. In the **Add Admin** form, enter the user's **Name** and **Email Address**.
3. Select the appropriate role:
   * **Admin:** Provides access to the Plum Admin Dashboard with the permissions assigned to the Admin role, including the configured rewarding threshold.
   * **Super Admin:** Provides full access to the account and Super Admin features.
4. Click **Save**.

The new user can sign in to the Plum Admin Dashboard with the permissions assigned to their role.

<Frame>
  <img alt="" />
</Frame>

## Edit Admin

Super Admins can change an Admin's role at any time.

To change an Admin's role:

1. Locate the user in the **All Admins** list.
2. Click the **three-dot menu** under the **Actions** column.
3. Select **Edit Admin**.
4. Change the **Role** to **Admin** or **Super Admin**.
5. Click **Save**.

<Frame>
  <img alt="Screenshot 2026 08 30 At 8 52 50 PM" />
</Frame>

The user's permissions are updated automatically based on the newly assigned role.

* Changing an **Admin** to a **Super Admin** grants access to Super Admin features.
* Changing a **Super Admin** to an **Admin** removes access to Super Admin-only features.

The updated settings take effect immediately.

## Change to Report View

Super Admins can change an Admin's access to **Report View**, where applicable. Report View provides access to relevant reporting information without providing the administrative permissions available to an Admin or Super Admin.

To change an Admin to Report View:

1. Locate the Admin in the **All Admins** list.
2. Click the **three-dot menu** under the **Actions** column.
3. Select **Edit Admin**.
4. Change the access or role to **Report View**.
5. Click **Save**.

<Frame>
  <img alt="Screenshot 2026 08 30 At 8 53 47 PM" />
</Frame>

The user's access is updated based on the permissions associated with **Report View**. Administrative actions that are not included in Report View are no longer available to the user.

## Delete an Admin

Super Admins can delete an Admin to revoke their access to the Plum Admin Dashboard.

To delete an Admin:

1. Locate the Admin in the **All Admins** list.
2. Click the **three-dot menu** under the **Actions** column.
3. Select **Delete Admin**.
4. Confirm the action.

<Frame>
  <img alt="Screenshot 2026 08 30 At 8 54 27 PM" />
</Frame>

Once deleted, the user can no longer sign in to the Plum Admin Dashboard. Historical activity associated with the user is retained for audit purposes.


# Manage Thresholds
Source: https://help-plum.xoxoday.com/account-administration/user-management/managing-threshold

See how to configure approval thresholds for admin users in Plum, controlling how much they can send without additional sign-off.

## Edit Rewarding Threshold

Super Admins can configure or modify the **rewarding threshold** for an Admin. The rewarding threshold defines the maximum amount that the Admin is permitted to reward, based on the limits configured for the account.

To edit the rewarding threshold:

1. Locate the Admin in the **All Admins** list.
2. Click the **three-dot menu** under the **Actions** column.
   <Frame>
     <img alt="Screenshot 2026 08 30 At 8 53 47 PM 2" />
   </Frame>
3. Select **Edit Admin**.
4. Update the **Rewarding Threshold** as required.
   <Frame>
     <img alt="Screenshot 2026 08 30 At 8 53 14 PM" />
   </Frame>
5. Click **Save**.

The updated rewarding threshold takes effect immediately and applies to subsequent rewards initiated by the Admin.

## Reset Amount Spent

Super Admins can reset the **Amount Spent** for an Admin from the **All Admins** page. This resets the amount accumulated against the Admin's rewarding threshold without changing the threshold itself.

To reset the amount spent:

1. Navigate to **Settings > Admin > All Admins**.
2. Locate the required Admin.
3. Click the **three-dot menu** under the **Actions** column.
4. Select **Edit**.
5. Click on Reset and Update

Once the action is confirmed:

* The **Amount Spent** is reset to **0**.
* The **Rewarding Threshold** remains unchanged.
* The Admin's available balance is restored based on the existing threshold.
* Previous reward transactions remain unchanged.

**Example:** If an Admin has a rewarding threshold of **USD 1,000** and has spent **USD 800**, resetting the amount spent changes the amount spent to **USD 0** and restores the available balance to **USD 1,000**.

<Note>
  **Note:** Resetting the amount spent only resets the spending counter. It does not change the Admin's rewarding threshold or delete historical reward transactions.
</Note>


# Switching Account
Source: https://help-plum.xoxoday.com/account-administration/user-management/switching-account

See how to switch between multiple Plum accounts as an admin, useful if you manage rewards across more than one organization.

The **Switch Account** feature allows you to switch between multiple Xoxoday Plum accounts associated with your login credentials.

To switch between accounts:

<Steps>
  <Step title="Click the **Profile** icon in the top-right corner of the Plum Admin Dashboard.">
    <Frame>
      <img alt="Screenshot 2026 09 05 At 10 51 35 PM 1" title="Screenshot 2026 09 05 At 10 51 35 PM 1" />
    </Frame>
  </Step>

  <Step title="Select **Switch Account**." />

  <Step title="Select the required account from the list of associated accounts">
    <Frame>
      <img alt="Screenshot 2026 08 31 At 12 27 31 AM" />
    </Frame>
  </Step>
</Steps>

You are redirected to the selected account and can access it based on the permissions assigned to your user profile.

If the required account is not available in the list, ensure that your user profile has been added to that account.

Feedback or Questions: Reach out to us at [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Manage Profile and Password
Source: https://help-plum.xoxoday.com/account-administration/user-management/updating-profile-password



The **Profile** section allows administrators to manage their account information and update their password from the Plum Admin Dashboard.

<Info>
  You can only change/update Name and Password. Please reach out to [cs@xoxoday.com](mailto:cs@xoxoday.com).
</Info>

## Update Profile Information

To update your profile information:

1. Sign in to the **Plum Admin Dashboard**.
2. Click the **Profile** icon in the top-right corner.
   <Frame>
     <img alt="Screenshot 2026 09 05 At 10 51 35 PM" title="Screenshot 2026 09 05 At 10 51 35 PM" />
   </Frame>
3. Select the option to edit your profile.
4. Update the required information, such as your **Name** or **Password**.
   <Frame>
     <img alt="Screenshot 2026 09 05 At 10 57 35 PM" title="Screenshot 2026 09 05 At 10 57 35 PM" />
   </Frame>
5. Save the changes.

The updated information is applied to your Plum account.

Feedback or Questions: Reach out to us at [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Overview
Source: https://help-plum.xoxoday.com/account-administration/user-management/user-management

Get an overview of user management in Plum, covering how to add, remove, and control access for admin users on your account.

Plum supports two administrative roles: **Super Admin** and **Admin**. These roles determine the level of access a user has within the Plum Admin Dashboard.

<Info>
  By default, the user who creates a Plum account is assigned the Super Admin role.
</Info>

## Super Admin

A Super Admin has full access to the Plum Admin Dashboard and can manage users, company settings, campaigns, reports, and wallet operations.

## Admin

An Admin has access to operational features required to send rewards and manage day-to-day activities. Access to administrative settings and account-level configurations is restricted.

## Permissions Comparison

| Feature                                                    | Super Admin                         | Admin                                                             |
| :--------------------------------------------------------- | :---------------------------------- | :---------------------------------------------------------------- |
| Recharge Company Wallet                                    | ✓                                   | ✗                                                                 |
| Reward Spending Limit                                      | Unlimited                           | Restricted by the assigned spending threshold                     |
| View Reports                                               | Access to all reports               | Access to self-reports only; company-level reports are restricted |
| Maker–Checker Capabilities                                 | Can be assigned as Maker or Checker | Can be assigned as Maker or Checker                               |
| Add, Edit, or Deactivate Admins                            | ✓                                   | ✗                                                                 |
| Set Admin Spending Thresholds                              | ✓                                   | ✗                                                                 |
| View All Admins and Spending Thresholds                    | ✓                                   | ✗                                                                 |
| Self-Approval                                              | Not allowed                         | Not allowed                                                       |
| Send Rewards (Xoxo Points, Reward Codes, and Reward Links) | ✓                                   | ✓                                                                 |
| Campaigns                                                  | Create, modify, and use campaigns   | Use existing campaigns only; cannot create new campaigns          |
| Access to Plum Pro                                         | Full access                         | Can distribute brand vouchers                                     |
| Edit Company Details                                       | ✓                                   | ✗                                                                 |

<Note>
  If Maker–Checker workflows are enabled for your organization, users can be assigned as either a Maker or a Checker. However, users cannot approve their own requests, even if they are assigned both roles.
</Note>

Feedback or Questions: Reach out to [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Admin Settings
Source: https://help-plum.xoxoday.com/account-settings/admin/admin-settings



The **Admin Settings** page allows Super Admins to control the features and capabilities available to other Admins across the organisation. These settings help manage information visibility, reporting access, and approval workflows.

To access **Admin Settings**, navigate to **Settings > Admin > Admin Settings**.

<Frame>
  <img alt="Screenshot 2026 08 30 At 9 54 57 PM" />
</Frame>

All settings on this page are **toggle-based**. Super Admins can enable or disable each setting based on the organisation's requirements.

## Show Wallet Balance to Admins

Allows Admins to view the organisation's available wallet balance during the reward flow.

When enabled, Admins can view the available wallet balance while sending rewards. This helps Admins track the available balance and avoid initiating rewards when sufficient funds are not available.

## Show Redemption Data to Admins

Allows Admins to view redemption data while creating or managing campaigns.

When enabled, Admins can access redemption information to understand how rewards are being used and make informed decisions when managing campaigns.

## Enable Custom Reports

Allows Super Admins to create and share custom reports with designated **Report Viewers**.

When enabled, Super Admins can grant or revoke access to custom reports. Users with access can view the reports and dashboards shared with them.

## Enable Workflow Requests

Enables an approval workflow for supported Admin actions.

When enabled, selected actions performed by Admins are submitted as requests and require approval from a designated approver before they take effect. This provides additional control over administrative changes and helps organisations maintain appropriate governance over platform activities.


# Report Settings
Source: https://help-plum.xoxoday.com/account-settings/admin/report-setting



The **Report Settings** page allows Super Admins to create and manage **Custom Reports** for their organization. Super Admins can configure the data included in each report and control which users have access to view the reports.

To access **Report Settings**, navigate to **Settings > Admin > Report Settings**.

<Frame>
  <img alt="Screenshot 2026 08 30 At 10 15 47 PM" />
</Frame>

## Create a Custom Report

Super Admins can create custom reports based on the organisation's reporting requirements.

When creating a custom report, you can:

* Enter a **Report Name**.
* Select the **Columns** to include in the report.
* Assign the report to one or more users.

Each report can be configured independently based on the requirements of different teams or users.

<Frame>
  <img alt="Screenshot 2026 08 30 At 10 20 35 PM" />
</Frame>

## Share a Custom Report

Super Admins can provide selected users with access to a custom report.

Once a report is assigned to a user, the user can access it from the **Reports** section of the Plum Admin Dashboard. A user can be assigned to multiple custom reports based on their responsibilities.

<Frame>
  <img alt="Screenshot 2026 08 30 At 10 14 01 PM" />
</Frame>

## Edit a Report Configuration

Super Admins can update an existing custom report at any time.

You can:

* Change the **Report Name**.
* Add or remove **Report Columns**.
* Add or remove users who have access to the report.

Any changes to the report configuration are reflected the next time the user accesses the report.

## Revoke Report Access

Super Admins can remove a user's access to a custom report at any time.

If a user is no longer assigned to any custom reports, their **Report Viewer** access is automatically removed.

## Example

Custom reports can be configured for different teams based on the information they require.

For example:

* A **Finance Report** can include fields such as order value, cost, and markup.
* A **Customer Support Report** can include fields such as customer name, product, and delivery status.

This allows each user to access only the reports and information relevant to their responsibilities.


# Configure IP Whitelisting
Source: https://help-plum.xoxoday.com/account-settings/api/ip-whitelisting



IP Whitelisting is a security feature that restricts access to the Rewards API to approved IP addresses. Once enabled, only API requests originating from whitelisted IP addresses are accepted. Requests from any other IP address are rejected.

This feature helps organizations secure their API integrations and ensure that only trusted servers can communicate with the Rewards API.

## Benefits of IP Whitelisting

IP Whitelisting can help organizations:

* Secure access to the Rewards API.
* Restrict API requests to trusted servers or networks.
* Prevent unauthorized access to API credentials.
* Meet internal security and compliance requirements.

## How It Works

After one or more IP addresses are whitelisted:

* API requests from approved IP addresses are processed normally.
* API requests from any other IP address are rejected.
* Changes to the IP allowlist take effect immediately.

If a request is made from an IP address that is not on the allowlist, the API returns an error indicating that the request originated from a non-whitelisted IP address.

<Note>
  Example: If your organization whitelists the public IP addresses of its office network or application servers, only requests originating from those IP addresses can access the Rewards API. Requests from any other location are blocked.
</Note>

## Add a Whitelisted IP Address

To add an IP address to the allowlist:

<Steps>
  <Step title="Navigate to Settings > API > Rewards API" />

  <Step title="Scroll to the IP Whitelisting section" />

  <Step title="Enter the IPv4 address to be whitelisted" />

  <Step title="Click Add" />
</Steps>

The IP address is added to the allowlist and can immediately be used to access the Rewards API.

## Manage Whitelisted IP Addresses

Organizations can whitelist multiple IP addresses to support different servers or environments.

To remove an IP address:

<Steps>
  <Step title="Navigate to the IP Whitelisting section" />

  <Step title="Locate the IP address in the list" />

  <Step title="Click Delete" />
</Steps>

Once removed, requests originating from that IP address are no longer authorized to access the Rewards API.


# Overview
Source: https://help-plum.xoxoday.com/account-settings/email-domain-auth/email-domain-authentication-overview

Get an overview of email domain authentication in Plum and how it improves the deliverability of your reward emails.

*Using your brands custom domain in Xoxoday*

Domain authentication serves as a proactive step to boost the delivery, security, and trustworthiness of your reward emails. This, in turn, aids in the effectiveness of your email marketing endeavors and cultivates favorable connections with recipients.

### Why you should consider Authenticating your Domain:

Check out below

***

## Improved Email Deliverability

Authenticating your domain increases the likelihood that your reward emails will be delivered successfully to recipients' inboxes. Email service providers often prioritize authenticated domains, reducing the chances of emails being marked as spam or bouncing.

## Enhanced Security

Domain authentication helps prevent unauthorized use of your domain for sending emails. By confirming ownership of your domain, you reduce the risk of phishing attacks and other fraudulent activities that could damage your organization's reputation.

## Credibility and Trust

Authenticated domains convey credibility and trustworthiness to recipients. When recipients see emails coming from an authenticated domain, they are more likely to trust the content and take desired actions, such as opening the email and engaging with its contents.

## Brand Recognition

By authenticating your domain, you reinforce your brand identity in recipients' minds. Consistently sending emails from a verified domain helps recipients recognize and remember your brand, leading to increased brand loyalty and engagement.

## Compliance with Email Standards

Domain authentication aligns with industry standards and best practices for email communication. It demonstrates your commitment to adhering to email authentication protocols, such as SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting, and Conformance).

## Reduced Risk of Spam Filtering

Authenticated domains are less likely to trigger spam filters, ensuring that your reward emails reach recipients' primary inboxes instead of being diverted to spam or junk folders. This maximizes the visibility and effectiveness of your email campaigns.

Feedback or Questions: Reach out to us at [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Email Whitelisting
Source: https://help-plum.xoxoday.com/account-settings/email-domain-auth/email-whitelisting

Learn how to whitelist Plum's sending domain with your email provider so reward emails don't get filtered as spam.

*Learn how to whitelist your email.*

For emails to not land in spam and properly open images in email services like Microsoft Outlook and Gmail, follow the steps below.

***

## Microsoft Outlook Email Whitelisting Process

### Option 1: For Individual Email Addresses to be whitelisted from inside email message

In an open message that was sent from a particular email address or domain, right-click on a blocked item.

Do one of the following:

* Click Add Sender to Safe Senders List.
* Click Add the Domain \[@domain] to Safe Senders List.

***

### Option 2: For Email Address to be whitelisted from settings

<Steps>
  <Step title="Click on the File option in the header">
    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Select Options on the left side menu">
    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Select Trust Centre again from the left Panel">
    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Click on the Trust Center Setting">
    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Untick the option which says Don't download pictures automatically">
    Untick the option which says "Don't download pictures automatically in HTML email messages or RSS items."

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Refresh and Restart Outlook Again">
    <Frame>
      <img alt="" />
    </Frame>
  </Step>
</Steps>

***

### Option 3: For Email Address to be whitelisted from Microsoft Admin

Step by Step Instructions (Admin Side)

* Login to [https://portal.microsoftonlie.com](https://portal.microsoftonlie.com/)
* Go to **Admin > Exchange > Mail Flow**

Mail Flow enables you to set rules on the server before the email is delivered to Outlook.

* This is similar to setting rules using Outlook's built in rules.
* New rule details in Office 365. Click to view larger.
* Click the + and select Bypass Spam Filtering
* Apply this rule if… > The sender… > domain is

Enter the domain name (example: rolet.com)

* Under specify domain, be sure to click the + to add the domain to the list.

You can come back to this rule and add domain names for each domain you want to whitelist. There is no need to create additional global rules in Mail Flow for each domain.

* Click ok
* Check Stop processing more rules
* Click save

<Frame>
  <img alt="" />
</Frame>

***

## Google Email Whitelisting Process

* In the Admin console Go to **Apps > G Suite Gmail > Advanced settings.**
* Scroll to the Spam section, hover over the setting, and click **"Configure".**
* Enter a unique name for the setting.
* Check the Bypass spam filters for messages received from addresses or domains within this approved senders lists box.
* Click **"Use existing or Create a new one"**, enter a new list name, and click **"Create".**
* Hover over the list name, click **"Edit"**, and then click **"Add".**
* Enter domain name 'abc.com'
* **Save**

***

## DMARC Quarantine Issue

Error Message:

DMARC Message from domain xoxoday.com, DMARC fail, (SPF aligned False, DKIM aligned False) DMARC policy is quarantine, applied policy is quarantine.

For the above Error, please do the whitelisting process for your respective email services.

Feedback or Questions: Reach out to us [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Authenticate Domain
Source: https://help-plum.xoxoday.com/account-settings/email-domain-auth/step-by-step-guide-to-authenticate-your-domain

Follow this step-by-step guide to authenticate your email domain so reward communications from Plum reach recipients reliably.

The **Domain Authentication** feature allows organisations to use their own custom domain to send reward communications from Plum.

Authenticating your domain verifies that the organisation owns the domain and helps ensure that emails sent from the domain are recognised as legitimate. This can improve the credibility and deliverability of reward communication and prevent the sender address from displaying **“via [notifications@xoxoday.com](mailto:notifications@xoxoday.com)”** to recipients.

Check out this for entire list of benefits and why you should consider authenticating your domain [Email Domain Authentication](/account-settings/email-domain-auth/email-domain-authentication-overview)

***

## Prerequisites

Before authenticating your domain, ensure that:

* **KYB (Know Your Business)** verification has been approved.
* You have **Super Admin** access to the Plum Admin Dashboard.
* You have access to your organisation's **DNS Manager** or hosting provider.
* If you do not have DNS access, coordinate with your organisation's IT or DNS administrator to add the required records.

<Tip>
  **Tip:** If you do not have access to the DNS Manager, you can use the email option in Plum to send the required DNS records to your IT or DNS administrator.
</Tip>

***

## Step by step guide to Authenticate Your Domain

<Info>
  Ensure you are logged in as Super Admin with approved KYB. If not done already, head over to: Submitting Verification Details
</Info>

<Steps>
  <Step title="Add Your Domain Name">
    Navigate to **Settings > Notifications.** Click on **'Authenticate your Domain'.**

    <Frame>
      <img alt="" />
    </Frame>

    Now click on **'Save and Proceed'.**
  </Step>

  <Step title="Add DNS Records to Your DNS Manager">
    The following DNS records need to be added in your DNS Settings. Access your DNS provider portal and input these records. Note that all records are CNAME.

    <Frame>
      <img alt="" />
    </Frame>

    **Send DNS Records to IT Admin**

    If you lack access to the DNS Manager Portal, forward these DNS records to your IT Admin or DNS Manager. The records will be sent via email along with a CSV file.

    <Info>
      **Pro tip:** Coordinate with your company's IT Admin responsible for DNS management. You can use the inbuilt emailing tool to send the DNS records to your IT Admin colleague.
    </Info>

    We will send DNS records in email along with CSV to your IT Admin.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Verify Domain">
    After the IT Admin has added the records:

    * Check the box 'Please verify that your records have been added'.
    * Once selected, the Verify button will activate. Click on **'Verify'.**

    <Frame>
      <img alt="" />
    </Frame>

    If your DNS records are added correctly and given sufficient time to take DNS changes to take place, on verification your domain is now authenticated.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>
</Steps>

Feedback or Questions: Reach out to us at [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Troubleshoot
Source: https://help-plum.xoxoday.com/account-settings/email-domain-auth/troubleshoot-domain-authentication

Troubleshoot the most common issues that come up while setting up email domain authentication for your Plum account.

After you've connected your domain or **email-sending domain, it can take up to 24 hours for the DNS changes to propagate and reflect in Xoxoday. If your domain** isn't connecting as expected after 24 hours, follow the steps below to troubleshoot your domain.

***

## Check the status of your Domain Authentication

Verify that the DNS records have been updated in Xoxoday and in your domain host.

* In your Xoxoday Plum account, go to **Settings > Notifications.**
* In the left sidebar menu, navigate to **Website > Domains & URLs.**

If your domain has **pending**, then acknowledge that Records are added and click Verify to authenticate domain.

* If your domain connection failed, you need to **Verify** again.
* If Xoxoday cannot connect your domain. There are three error types:

**Typo:** the record added to your domain host is different from what's in Xoxoday.

**Missing record:** Xoxoday is unable to identify the record in your domain host.

**Conflicting record:** there is a conflicting DNS record in your domain host.

To resolve these errors, ensure that the records in your domain host match what's in Xoxoday.

You should also check the status of your DNS records in your domain host.

* Log in to your DNS host.
* Confirm that the CNAME records match the Host(name) and Values provided by Xoxoday during the connection process.
* If you've confirmed that your DNS records have been updated correctly, you can click either Refresh or **check them again** in the domain setup within Xoxoday to confirm your records have been updated and your domain can be connected. **If this does not work, you can try copying and pasting the provided values again, or review the following common DNS record issues.**

***

## Common DNS issues

If you are unable to connect your domains, here are some common DNS issues that you can check for in your DNS host.

### Duplicated Domain

Some domain hosts will add a root domain to your CNAME records by default. For example, when entering xox\*\*.\_domainkey.example.com\*\*, an additional domain will be added. The records would then propagate as xox\*.\_domainkey.example.com.example.com\*.

You can use external tools to check for a duplicated root domain. For example, you can use [Dig](https://toolbox.googleapps.com/apps/dig/) to check your email sending domains or [Whatsmydns](https://www.whatsmydns.net/) for your site domains.

If your domain name was duplicated in your CNAME record:

* Keep the domain manager tool open in your browser.
* In a new tab or window, log in to your DNS provider and navigate to your DNS Zone File (sometimes appears as Domain Files, Manage DNS).
* Enter your **host(name) values** without the domain. This will look different for domains and email-sending domains. For example:

Domain: you can enter info. rather than [info.example.com](http://info.example.com/).

Email sending domain: you can enter xox.\_domainkey rather than xox\*\*.\_domainkey.example.com\*\*.

### Records invalidated by domain host

If your domain name was not duplicated in your CNAME record, but you're seeing a record invalid error in your domain manager, the updated records may have been invalidated by your domain host.

Your DNS provider may have invalidated your CNAME record because of certain characters, such as an underscore ("\_") or a hyphen ("--"). You should contact your provider's support team for further assistance.

The CNAME records that appears in your Xoxoday email sending domain setup strictly adheres to the DKIM protocol and are supported by most major DNS providers.

***

## Use Whatsmydns to troubleshoot site domains

Whatsmydns is a tool used to check DNS records and DNS propagation for your site domains.

You can use Whatsmydns to confirm that your DNS records have been correctly updated and are propagating successfully.

<Steps>
  <Step title="Navigate to Whatsmydns.net">
    Navigate to [Whatsmydns.net](https://www.whatsmydns.net/)
  </Step>

  <Step title="Enter your domain">
    In the top left, enter the **domain** you're trying to connect to in Xoxoday.
  </Step>

  <Step title="Select CNAME">
    Click the dropdown menu and select **CNAME.**
  </Step>

  <Step title="Click Search">
    Click **Search.**

    If your DNS update was successful, the results should correspond to the values provided in Xoxoday.
  </Step>
</Steps>

If the Whatsmydns results do not match the value provided in Xoxoda, this means that the DNS record may have been incorrectly updated or is not propagating correctly. You can try updating your DNS record again, or reach out to your domain provider to troubleshoot further.

If you're still seeing problems after completing the troubleshooting steps above, you can reach out to [cs@giift.com](mailto:cs@giift.com)


# Email Settings
Source: https://help-plum.xoxoday.com/account-settings/notification/email-setting



The **Email Settings** page allows Admins to customise the emails sent to reward recipients. Admins can configure the email footer, sender details, and PDF gift certificate settings.

To access **Email Settings**, navigate to **Settings > Notifications**.

<Frame>
  <img alt="Screenshot 2026 08 30 At 11 35 24 PM" />
</Frame>

## Customize the Email Footer

The **Custom Footer** setting allows Admins to add custom text to the footer of reward emails.

You can use the footer to include:

* Company contact information
* Support details
* Legal disclaimers
* Other relevant information that should appear in reward emails

The configured footer is included in reward emails sent to recipients.

## Configure the Sender Name

The **Sender Name** determines the name displayed in the **From** field of reward emails.

By default, **Xoxoday** is displayed as the sender. Admins can replace this with a custom sender name, such as **Acme Rewards** or **HR Team**, to provide a branded email experience.

## Configure the Sender Email Address

The **Sender Email** determines the email address displayed in the **From** field of reward emails.

By default, reward emails are sent from [**notifications@xoxoday.com**](mailto:notifications@xoxoday.com). Organiszations can configure a custom sender email address, such as [**rewards@company.com**](mailto:rewards@company.com), to align reward communications with their corporate domain.

<Note>
  A custom sender email address requires **domain authentication** using SPF, DKIM, and DMARC DNS records. Without domain authentication, emails may be delivered to spam folders or rejected by recipient mail servers.
</Note>

## Enable PDF Generation

The **Enable PDF Generation** setting allows reward emails to include a **PDF gift certificate** as an attachment.

The PDF contains the relevant reward or gift card details and can be downloaded or printed by the recipient.

This setting is available for:

* **Reward Codes (Xoxo Codes)**
* **Gift Cards (Plum Pro)**


# Reminders
Source: https://help-plum.xoxoday.com/account-settings/notification/low-balance-alerts



# **Low Balance Alert**

The **Low Balance Alert** feature helps organizations monitor their Plum wallet balance and avoid interruptions to their reward programs. Super Admins can configure a minimum wallet balance and receive email notifications when the wallet balance falls below the specified threshold.

These alerts allow administrators to add funds to the wallet in advance and help prevent failed rewards, bookings, or order cancellations due to insufficient balance.

## Set Up Low Balance Alerts

To enable Low Balance Alerts:

1. Navigate to **Settings > Notifications**.
2. Locate the **Low Balance Notification** section.
3. Turn on the notification toggle.
4. Enter the **wallet balance threshold** at which the notification should be triggered.
5. Click **Save Changes**.

<Frame>
  <img alt="Screenshot 2026 08 30 At 10 49 07 PM" />
</Frame>

## How Low Balance Alerts Work

When the wallet balance falls below the configured threshold, Plum sends an email notification to the **Super Admin**.

The notification includes:

* The current wallet balance.
* An **Add Funds to Wallet** button that redirects to the wallet recharge page.

If the wallet balance remains below the configured threshold, the platform sends up to **two reminder emails**.

Once the wallet is recharged, the reminder counter is automatically reset. Future notifications will be triggered again when the wallet balance falls below the configured threshold.

# Emails for Redemption

The **Reminder Emails for Redemption** feature allows organizations to automatically notify recipients about rewards that have not yet been redeemed. These reminders help recipients redeem their rewards before they expire.

## Reminder Types

You can configure the following types of redemption reminders:

### Scheduled Reminders

Scheduled reminders are sent at regular intervals until the reward is redeemed or expires. This option is useful for rewards with longer validity periods.

The available frequencies are:

* **Monthly**
* **Quaterly**

### Pre-Expiry Reminders

Pre-expiry reminders are sent once before the reward expires. These reminders encourage recipients to redeem their rewards before the expiry date.

The available reminder intervals are:

* **30 days before expiry**
* **15 days before expiry**
* **7 days before expiry**

## Configure Reminder Emails

To configure Reminder Emails for Redemption:

1. Navigate to **Settings > Notifications**.
2. Locate the **Reminder Emails** section.
3. Select the required reminder type and frequency.
4. Click **Save Changes**.

<Frame>
  <img alt="Screenshot 2026 08 30 At 11 26 39 PM" />
</Frame>

Once configured, the platform automatically sends reminder emails according to the selected schedule. Scheduled reminders continue until the reward is redeemed or expires, while pre-expiry reminders are sent once before the reward expires.


# Branding
Source: https://help-plum.xoxoday.com/account-settings/storefront/branding



The **Storefront** page allows Admins to customise the Plum storefront and manage the rewards available to users. You can configure the storefront URL, company logo, favicon, theme colour, and global reward catalog.

To access these settings, navigate to **Settings > Storefront**.

## Redemption Marketplace URL

The Storefront URL (also referred to as the Marketplace URL or Domain) is the unique web address for your Plum storefront, for example:

`https://stores.xoxoday.com/{company-name}`

The storefront URL is generated automatically during account setup based on your company name and can be configured only once.

<Note>
  Once your account is created, the storefront URL cannot be changed from the Plum Admin Dashboard. If you need to update your storefront URL, please contact the Xoxoday Plum Support team.
</Note>

<Frame>
  <img alt="Screenshot 2026 08 30 At 11 39 56 PM" />
</Frame>

***

## Company Logo

You can also upload a custom logo. Navigate to **Settings > Storefront > Company Logo** and click on **"Change".**

<Frame>
  <img alt="" />
</Frame>

* Choose a transparent logo file (maximum size: 240 x 80 px).
* Upload it to the platform and click **"Save".**

Your brand logo will prominently appear in the upper left corner of your website and in all email communications. Switch to the storefront to preview its placement and appearance.

<Frame>
  <img alt="" />
</Frame>

***

## Update the Favicon

The favicon is the small icon displayed in the browser tab when users open your storefront.

Navigate to **Settings > Storefront > Branding** and click **Change** under Favicon.

Choose the favicon image and upload it to the platform. Click **Save**.

The uploaded favicon replaces the default Xoxoday icon and is displayed in the browser tab whenever users visit your storefront.

***

## Storefront Theme

The theme color controls the primary color used across your storefront.

Navigate to **Settings > Storefront > Branding** and select or enter your preferred theme color (Hex code). Click **Save**.

The selected color is applied across the storefront, including buttons, the navigation bar, category highlights, and call-to-action (CTA) links, giving your storefront a consistent branded appearance.

<Frame>
  <img alt="Screenshot 2026 08 30 At 11 42 39 PM" />
</Frame>

***

## Hero Banner

The **Hero Banners** feature allows you to add promotional banners to the homepage of your Plum storefront. You can use banners to highlight campaigns, offers, announcements, or other relevant information.

Banners are displayed vertically on the storefront homepage in the order configured by the Admin.

## Add a Hero Banner

To add a banner:

1. Navigate to **Settings > Storefront**.
2. Locate the **Hero Banner** section.
3. Click **Add Banner**.
4. Upload the **Banner Image**.
   * The image must be in **PNG or JPG** format.
   * The maximum file size is **2 MB**.
5. Enter a **Banner Name**.
6. Enter the **Redirect URL**. This is the URL that opens when a user clicks the banner.
7. Click **Save Banner**.

<Frame>
  <img alt="Screenshot 2026 08 30 At 11 44 13 PM" />
</Frame>

## Manage Promotional Banners

You can manage the banners displayed on your storefront homepage.

* Banners are displayed **vertically** on the homepage.
* Banners do not rotate automatically.
* Banners cannot be scheduled for specific dates or times.
* You can **drag and drop** banners to change their display order.

The updated banner order is reflected on the storefront homepage.

***

## Global Reward Catalog

This feature allow to customise the reward catalog shown in our marketplace. You can enable or disable categories like Gift Cards, Merchandise, Experience and Perks along with control of restricting some catalog for different countries.

<Steps>
  <Step title="Navigate to Global Reward Catalog">
    Navigate to **Settings > Storefront > Global Reward Catalog** and click on **"Customize".**

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Set Denomination Range">
    Define the value range by entering a minimum and maximum denomination.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Select Geography">
    Filter your results by selecting the specific countries or geographic regions you wish to include.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Customise categories">
    You can choose to view and customise the global reward catalog of 1000+ brand vouchers. You can see a list of categories which includes:

    * Gift Card
    * Merchandise
    * Lounge
    * Charity
    * Experience
    * Perks
    * Flights
    * Hotels
    * Miles
    * Mobile Top-ups

    <Frame>
      <img alt="" />
    </Frame>

    <Frame>
      <img alt="" />
    </Frame>

    Click on "**Customise**" next to the catalog item.

    You will a list of items here. Simply check and uncheck the box to include or exclude the item on storefront.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>
</Steps>

Feedback or Questions: Reach out to us at [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Customization
Source: https://help-plum.xoxoday.com/account-settings/storefront/customization



The Customization section allows Admins to configure various settings for the Plum storefront. You can customise the points terminology, payment options, redemption requirements, storefront footer, and delivery address settings.

To access these settings, navigate to **Settings > Storefront > Customization**.

<Frame>
  <img alt="Screenshot 2026 08 30 At 11 53 52 PM" />
</Frame>

## Change Point Name

You can customise the name used to refer to points on the Plum storefront. This allows organisations to use terminology that is consistent with their internal rewards program.

For example, an organisation may refer to points as **Ace Points**, **Coins**, or **Credits**.

To change the point name:

1. Navigate to **Settings > Storefront > Customise**.
2. Click **Change Point Name**.
3. Enter the preferred point name.
4. Save the changes.

The updated point name is displayed across the storefront wherever points are referenced.

<Frame>
  <img alt="Screenshot 2026 08 30 At 11 56 16 PM" />
</Frame>

## Change Points Icon

The **Change Points Icon** setting allows you to customise the icon displayed next to the points balance in the storefront header. You can upload a custom icon to replace the default coin icon.

To change the points icon:

1. Navigate to **Settings > Storefront > Customise**.
2. Locate **Change Points Icon**.
3. Upload the required icon.
4. Save the changes.

The uploaded icon is displayed next to the points balance in the storefront header.

<Frame>
  <img alt="Screenshot 2026 08 30 At 11 56 16 PM 2" />
</Frame>

**See where it appears**: Open the storefront to view the updated points icon.

## Allow Digital Payments

The **Allow Digital Payments to Users** setting allows users to make partial payments using a personal credit or debit card or bank account when their available points or codes do not cover the full purchase amount.

This option is enabled by default.

To enable or disable digital payments:

1. Navigate to **Settings > Storefront > Customise**.
2. Locate **Allow Digital Payments to Users**.
3. Turn the toggle **on** or **off** based on your requirements.

When disabled, users cannot use a personal payment method to pay the remaining amount after applying their available points or codes.

<Frame>
  <img alt="Screenshot 2026 08 30 At 11 56 16 PM 1" />
</Frame>

## Set a Minimum Value for Points Redemption

The **Set a Minimum Value for Reward Points Redemption** setting allows you to define the minimum number of points a user must accumulate before they can redeem rewards.

To configure the minimum redemption value:

1. Navigate to **Settings > Storefront > Customise**.
2. Turn on **Set a Minimum Value for Reward Points Redemption**.
3. Enter the required minimum points value.
4. Save the changes.

Users can redeem rewards only after their available points meet the configured minimum value.

<Frame>
  <img alt="Screenshot 2026 08 30 At 11 56 16 PM 3" />
</Frame>

## Enable Storefront Footer

The **Enable Storefront Footer** setting allows you to display a footer at the bottom of your Plum storefront.

To enable or disable the storefront footer:

1. Navigate to **Settings > Storefront > Customise**.
2. Locate **Enable Storefront Footer**.
3. Turn the toggle **on** or **off**.
4. Save the changes.

When enabled, the footer is displayed to users on the storefront.

<Frame>
  <img alt="Screenshot 2026 08 31 At 12 00 18 AM" />
</Frame>

## Manage Delivery Addresses

The **Saved Addresses** feature allows Admins to save delivery addresses for physical rewards, such as merchandise and physical gift cards. Saved addresses can be reused across eligible reward campaigns, reducing the need to enter the same delivery details for each order.

<Frame>
  <img alt="Screenshot 2026 08 31 At 12 02 44 AM" />
</Frame>

### Add a Delivery Address

To add a delivery address:

1. Navigate to **Settings > Storefront > Customise**.
2. Click **Add New Address**.
3. Enter the required delivery details.
4. Click **Save**.

### Edit or Delete a Delivery Address

To manage an existing delivery address:

1. Navigate to **Settings > Storefront > Customise**.
2. Select the saved address.
3. Choose **Edit** or **Delete**.
4. Make the required changes or confirm the deletion.

Saved addresses can be used across eligible reward campaigns unless **Lock Delivery Address** is enabled.

<Frame>
  <img alt="Screenshot 2026 08 31 At 12 02 00 AM" />
</Frame>

## Lock Delivery Address

The **Lock Delivery Address** setting allows organisations to restrict deliveries to a specific verified or approved address.

When this setting is enabled:

* The delivery address is pre-filled during checkout.
* Users cannot edit, delete, or replace the locked address.
* Users cannot add a new delivery address during checkout.

Users must use the locked delivery address to complete the order. If the address is incorrect, contact the organisation or program administrator for assistance.


# Admin Activity
Source: https://help-plum.xoxoday.com/admin/admin-activity



The **Admin Activity** page provides an audit trail of threshold changes made for administrators within an organisation. It enables Super Admins to track threshold updates, monitor amount-spent resets, and identify the Super Admin who performed each action.

<Note>
  The **Admin Activity** page is available only to Super Admins.
</Note>

To access the page, navigate to **Settings > Admins > Admin Activity**.

<Frame>
  <img alt="Screenshot 2026 08 30 At 9 35 38 PM" />
</Frame>

## Activity Details

Each activity record includes the following information:

| Field                  | Description                                                                                                                               |
| :--------------------- | :---------------------------------------------------------------------------------------------------------------------------------------- |
| **Date**               | The date on which the action was performed.                                                                                               |
| **Action**             | The type of update performed, such as **Threshold Increased**, **Threshold Decreased**, **Threshold Updated**, or **Amount Spent Reset**. |
| **Account Affected**   | The administrator whose threshold or spending details were updated.                                                                       |
| **Existing Threshold** | The threshold value before the change.                                                                                                    |
| **New Threshold**      | The updated threshold value after the change.                                                                                             |
| **Amount Spent**       | The amount spent by the administrator when the activity was recorded.                                                                     |
| **Admin Balance**      | The remaining available balance after the update.                                                                                         |
| **Action Taken By**    | The Super Admin who performed the action.                                                                                                 |

## Filter Activity

Use the available filters to find specific activity records.

* **Date Range:** Filter activities by a specific date range. By default, the page displays activity from the last **30 days**.
* **Account Affected:** View activities for a specific administrator.
* **Action Taken By:** View activities performed by a specific Super Admin.
* **Action:** Filter activities by the type of action performed:
  * **Threshold Increased**
  * **Threshold Decreased**
  * **Threshold Updated**
  * **Amount Spent Reset**

## Customize the Table

The **Columns** option allows Super Admins to select the information displayed in the activity table.

The **Date** and **Action** columns are always displayed and cannot be hidden.

## Download Activity

Click **Download** to export the activity log as a CSV file.

The exported file includes the activity details available in the log and can be used for reporting, auditing, or record-keeping purposes.


# Delete or Disable Campaign
Source: https://help-plum.xoxoday.com/campaigns/campaign-management/delete-or-disable-a-reward-campaign

See how to permanently delete a reward campaign, or disable it temporarily without losing its configuration, in Plum.

*Learn how to delete or disable a campaign*

***

## Reward Code Campaign

<Steps>
  <Step title="Disable the Campaign">
    Whilst it is not possible to delete your Reward Code Campaign, you can disable it by clicking the "**Disable" button under the "Actions**" tab.
  </Step>

  <Step title="Confirm Disable">
    Now click on the "**Disable**" button on the screen above.
  </Step>

  <Step title="Re-enable if Needed">
    You can also choose to "**Enable**" it later if you ever change your mind.
  </Step>
</Steps>

***

## Reward Link Campaign

<Steps>
  <Step title="Navigate to Reward Link Campaign">
    Click on the "Reward Link Campaign" section.
  </Step>

  <Step title="Disable the Campaign">
    You can now choose to disable a Reward Link Campaign, by clicking on the "Disable" button under the "**Actions**" tab.
  </Step>
</Steps>


# Edit Campaign
Source: https://help-plum.xoxoday.com/campaigns/campaign-management/edit-a-reward-campaign

Learn how to edit an existing reward campaign in Plum, including updating its budget, recipients, and reward details after launch.

*Learn how to edit your reward link or reward code campaigns*

***

## Editing the Reward Campaigns

<Steps>
  <Step title="Go to the Campaign Section">
    Go to the **"Campaign**" section in the Admin Dashboard.
  </Step>

  <Step title="Choose Edit">
    Now, under the "Actions", choose to **"Edit"** the Campaign.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Update Campaign Name">
    You can now change the name of the campaign and update the campaign accordingly.
  </Step>

  <Step title="Select Categories">
    You can choose to select/deselect the categories and subcategories to include in the campaign.
  </Step>

  <Step title="Customize the Mailer">
    You can also choose the customize the mailer.
  </Step>

  <Step title="Done">
    Congratulations! You have successfully updated your campaign.
  </Step>
</Steps>

***

Feedback or Questions: Email [cs@xoxoday.com](mailto:cs@xoxoday.com)


# Overview
Source: https://help-plum.xoxoday.com/campaigns/campaigns-overview

Get an overview of reward campaigns in Plum, including how to distribute gift cards, reward links, and reward codes to groups at scale.

*Learn how to create and manage customized campaigns in Xoxoday Plum.*

***

## Campaigns

Xoxoday Plum enables Super Admins and Admins to create and manage bespoke campaigns, enriching the rewarding experience for end-users by offering customizable storefronts and personalized rewards, thereby boosting engagement and satisfaction levels.

Within Plum, you can seamlessly create two types of campaigns:

* **Reward Code Campaign**
* **Reward Link Campaign**

Each campaign type offers unique features and benefits, catering to diverse requirements. Whether it's an employee recognition program, customer loyalty initiative, or any other rewarding campaign, Plum provides comprehensive solutions.

In the following section, we'll guide you through the step-by-step process of creating, editing, and disabling your Plum campaigns. You'll learn everything from naming your campaign to customizing email and SMS content, ensuring unforgettable reward experiences for your audience.

***

<Info>
  **Pro Tip**

  Maximize engagement by periodically refreshing your campaign content and rewards to keep your audience excited and motivated. Experiment with different customization options and monitor performance metrics to optimize your campaigns for maximum impact.
</Info>

***

Feedback or Questions: Email [cs@xoxoday.com](mailto:cs@xoxoday.com)


# Create Reward Code Campaign
Source: https://help-plum.xoxoday.com/campaigns/create-a-reward-code-campaign

Learn how to create a reward code campaign in Plum so you can distribute reward codes to a large group of recipients in bulk.

*Learn how to create a Reward Code Campaign*

Plum lets you customize Reward Code Campaigns with tailored storefronts and custom landing pages for enhanced user engagement and redemption experiences.

***

## Creating a Reward Code Campaign

<img alt="Customize Catalog" />

<img alt="" />

<img alt="" />

**Customize Catalog**

Customize the email subject and content to align with your campaign goals.

<img alt="" />

<img />- You can also edit the logo by clicking on "Edit Logo" and uploading a new logo.

* You can also edit the logo by clicking on "Edit Logo" and uploading a new logo.

<img alt="" />

<img alt="" />

* Xoxoday Plum allows for editing or removing the banner. Click on "**Edit/Remove Banner**" and follow the steps.

<img />- Click on "Edit Message" to make changes to the message.

<img />#

<img alt="" />

* Click on "Edit Message" to make changes to the message.

<img alt="" />

* **Configure Message Details** Toggle the recipient's name on or off and choose from our library of greetings (or create a custom one). Define your message by entering a title and body text, then adjust the content alignment to your preference.

<img alt="" />

## \*\*​Step 6: Setting Up the Campaign

<img />## **​Step 6: Setting Up the Campaign Once all configurations are complete, click "Create**" to launch your Reward Code Campaign. Once all configurations are complete, click "Create\*\*" to launch your Reward Code Campaign.

<img alt="" />

<Steps>
  <Step title="Navigation">
    Navigate to Settings > Campaigns, select Reward Code and click "**Create Reward Code Campaign**."

    <Frame>
      <img alt="Customize Catalog" />
    </Frame>
  </Step>

  <Step title="Naming the Campaign">
    Start by giving your campaign a name. You can then choose the specific categories you wish to include or exclude.

    <Frame>
      <img alt="Customize Catalog" />
    </Frame>
  </Step>

  <Step title="Customizing the Storefront">
    Utilize the campaign to tailor the storefront for your end-users. This customization encompasses options such as country, brand, and categories. Once adjustments are made, remember to save the changes.

    <Frame>
      <img alt="" />
    </Frame>

    <Frame>
      <img alt="" />
    </Frame>

    Customize Catalog
  </Step>

  <Step title="Adding a Custom Landing Page">
    Enhance personalization by incorporating a custom landing page. When recipients receive the reward code, they will first encounter this landing page before being directed to the storefront for redemption.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Add the Email Subject and Content">
    <Frame>
      <img alt="Customize Catalog" />
    </Frame>

    <Frame>
      <img alt="" />
    </Frame>

    <Frame>
      <img alt="" />
    </Frame>

    Customize Catalog

    Customize the email subject and content to align with your campaign goals.

    <Frame>
      <img alt="" />
    </Frame>

    <Frame>
      <img alt="" />
    </Frame>

    * You can also edit the logo by clicking on "Edit Logo" and uploading a new logo.
    * You can also edit the logo by clicking on "Edit Logo" and uploading a new logo.

    <Frame>
      <img alt="" />
    </Frame>

    <Frame>
      <img alt="" />
    </Frame>

    * Xoxoday Plum allows for editing or removing the banner. Click on "**Edit/Remove Banner**" and follow the steps.

    <Frame>
      <img alt="" />
    </Frame>

    * Click on "Edit Message" to make changes to the message.

    <Frame>
      <img alt="" />
    </Frame>

    <Frame>
      <img alt="" />
    </Frame>

    * Click on "Edit Message" to make changes to the message.

    <Frame>
      <img alt="" />
    </Frame>

    * **Configure Message Details** Toggle the recipient's name on or off and choose from our library of greetings (or create a custom one). Define your message by entering a title and body text, then adjust the content alignment to your preference.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Setting Up the Campaign">
    <Frame>
      <img alt="" />
    </Frame>

    Once all configurations are complete, click "**Create**" to launch your Reward Code Campaign. Once all configurations are complete, click "**Create**" to launch your Reward Code Campaign.

    <Frame>
      <img alt="" />
    </Frame>

    <Frame>
      <img alt="" />
    </Frame>

    Congratulations! You have successfully created a Reward Code Campaign. For any feedback or questions reach out to us at [cs@xoxoday.com](mailto:cs@xoxoday.com). Congratulations! You have successfully created a Reward Code Campaign. For any feedback or questions reach out to us at [cs@xoxoday.com](mailto:cs@xoxoday.com).
  </Step>
</Steps>


# Create Reward Link Campaign
Source: https://help-plum.xoxoday.com/campaigns/create-a-reward-link-campaign

Learn how to create a reward link campaign in Plum so you can distribute reward links to a large group of recipients in bulk.

*Learn to create campaigns with Reward Links tailored to your audience's preferences.*

***

## Creating a Reward Link Campaign

Step-by-step guide to creating Reward Link Campaign:

<Steps>
  <Step title="Navigation">
    Navigate to **Settings > Campaign, select the tab Reward Link and click "Create Reward Link Campaign**".

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Choose a Name">
    Choose a descriptive and memorable name for your campaign so that it is easy to identify later. Consider including the campaign objective or target audience in the name.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Customize the Catalog">
    Tailor the reward amount and country selection based on your target audience's preferences. You can choose either gift cards or merchandise as the reward type. Click "**Customise"** to adjust the amount and currency.

    <Frame>
      <img alt="" />
    </Frame>

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Add the Currency type and Voucher value. Once done, click on &#x22;Save and Proceed&#x22;.">
    <Frame>
      <img alt="Image" />
    </Frame>
  </Step>

  <Step title="Voucher Selection">
    Carefully select vouchers that align with your audience's interests and preferences.

    <Frame>
      <img alt="" />
    </Frame>

    <Info>
      **Pro tip**

      Consider offering a variety of options to cater to diverse tastes and maximize redemption rates.
    </Info>
  </Step>

  <Step title="Personalized Communication">
    Customize your email and SMS campaigns to resonate with your audience by using personalization tokens to address recipients by name and segmenting your messaging based on demographics or past interactions.

    <Frame>
      <img alt="" />
    </Frame>

    <Frame>
      <img alt="" />
    </Frame>

    <Info>
      **Pro tip**

      You can customize communication at the time of sending reward links as well. Learn more here: [Customize Reward Communication](/send-rewards/reward-links/reward-link-customize-reward-communication)
    </Info>
  </Step>

  <Step title="Preview">
    Always preview your campaign setup before finalizing it. Check for any errors or inconsistencies in the content and ensure that the campaign flows smoothly from start to finish. Once previewed, click **"Create**" to proceed.
  </Step>
</Steps>

***

Feedback or Questions: Email [cs@xoxoday.com](mailto:cs@xoxoday.com)


# Manage Campaigns
Source: https://help-plum.xoxoday.com/campaigns/duplicate-or-disable-a-campaign

See how to duplicate an existing reward campaign to reuse its settings, or disable a campaign that is no longer needed in Plum.

The Campaign Duplication feature helps you save time by creating new campaigns based on existing ones. Whether you're working with Reward Codes or Reward Links, you can duplicate any campaign in just a few clicks.

***

## What is Campaign Duplication?

Instead of starting from scratch every time you want to run a similar campaign, you can **duplicate** an existing one. This copies all the settings and configurations of the original campaign, allowing you to make only the necessary changes.

## Where to Find This Feature

You can access the duplication feature from the Campaigns section under **Settings**.

***

## How to Duplicate a Campaign

<Steps>
  <Step title="Navigate to Settings > Campaigns" />

  <Step title="Choose campaign type">
    Choose between:

    * **Reward Codes Campaigns**
    * Reward Links Campaigns
  </Step>

  <Step title="Open the three-dot menu">
    Each campaign is listed with a **three-dot menu (⋮)** on the right. Click on the three dots to open more options.
  </Step>

  <Step title="Click Duplicate Campaign">
    Click **"Duplicate Campaign"** from the menu.
  </Step>

  <Step title="Update the campaign name if needed">
    * Default name: `Copy of #"Original Campaign Name"}`
    * You can rename it or keep the default.
  </Step>

  <Step title="Customize and Create">
    Click "Customize Your Communications" to proceed. Customize the email template as needed, then click **"Create"**.
  </Step>
</Steps>

### What Gets Duplicated?

When you duplicate a campaign, the following elements are copied:

* Campaign settings
* Rules and configurations
* Templates and assets (if applicable)

<Note>
  The new campaign is created in a **draft/inactive** state so you can review and activate it when ready.
</Note>

### Tips and Best Practices

* Use duplication to run recurring campaigns with similar setups.
* Rename duplicated campaigns clearly to avoid confusion.
* Review and adjust expiry dates, reward quantities, and other variables before activating.

***

## Disable a Campaign

<Steps>
  <Step title="Go to Campaigns">
    Go to Campaigns and click on the Reward Code or Reward Link tab.
  </Step>

  <Step title="Find the campaign you want to pause" />

  <Step title="Click the three-dot menu">
    Click the **three-dot menu (⋮)** next to it.
  </Step>

  <Step title="Select Disable" />

  <Step title="Confirm">
    In the confirmation pop-up, click **Yes, Disable**.

    <Check>
      Done — the campaign is now paused.
    </Check>
  </Step>
</Steps>

***

For any queries or feedback, reach out to [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Admin and Business
Source: https://help-plum.xoxoday.com/faq/security-compliance/adminbusiness

Find answers to frequently asked questions about Plum's administrative controls and business continuity practices.

*Access Admin and Business security policy documents.*

<AccordionGroup>
  <Accordion title="Business Continuity Management Procedure">
    [Open document](https://drive.google.com/file/d/1LyE7ogFTxdbUiaSLBOYaMbFxsvXbuI3v/view)
  </Accordion>

  <Accordion title="Business Continuity Management Procedure">
    [Open document](https://drive.google.com/file/d/1jNgN1Rc9hMM8xcVPcB6Rd32NKHqvHdyo/view?usp=sharing)
  </Accordion>

  <Accordion title="Bring Your Own Device Policy">
    [Open document](https://drive.google.com/file/d/10sWqTxSQqSdfdPi4q4lwIjHtoJhrn5UQ/view?usp=sharing)
  </Accordion>

  <Accordion title="Supplier Management Procedure">
    [Open document](https://drive.google.com/file/d/16c7bYIdwy8ei58QnYydnA5qT07UD_meb/view?usp=sharing)
  </Accordion>

  <Accordion title="Asset Management Procedure">
    [Open document](https://drive.google.com/file/d/1WJL_C6MLX9PCDfTisFUokTzoLK5qdoiw/view?usp=sharing)
  </Accordion>

  <Accordion title="Logging and Monitoring Procedure">
    [Open document](https://drive.google.com/file/d/1ZDDnbuxb8X39t39QP-riP2wwQjl9crhc/view?usp=sharing)
  </Accordion>

  <Accordion title="Change Management Procedure">
    [Open document](https://drive.google.com/file/d/1NjQR15_VDeHqKB1OHHBFOIv_1n3igI48/view?usp=sharing)
  </Accordion>

  <Accordion title="SDLC Procedure">
    [Open document](https://drive.google.com/file/d/1xr3hhkLmYu6c5tpR8aG3iF2NyQ2ormZa/view?usp=sharing)
  </Accordion>
</AccordionGroup>


# Application, Dev and Security
Source: https://help-plum.xoxoday.com/faq/security-compliance/application-dev-and-security

Find answers to frequently asked questions about Plum's application development lifecycle and secure coding practices.

***

## Infrastructure & Compliance

<AccordionGroup>
  <Accordion title="How do you continuously monitor and report the compliance of your infrastructure in accordance to industry best practices (OWASP, SANS, SOC, ISO 27001)?">
    We take steps to securely develop and test against security threats to ensure the safety of our customer data. We maintain a Secure Development Lifecycle, in which training our developers and performing design and code reviews takes a primary role. In addition, Xoxoday employs third-party security experts to perform detailed penetration tests on different applications. In addition to the security components provided by our top-level cloud providers AWS, Xoxoday maintains its own dedicated controls by following the industry best practices. These controls cover DDoS attacks, DB protection and a dedicated web application firewall, as well as network firewall fine-grained rules configured using the highest industry standards.
  </Accordion>

  <Accordion title="Are Cloud Hosting services (IaaS) provided?">
    We provide Software as a Service (SaaS).
  </Accordion>

  <Accordion title="What is the service delivery model? (IaaS/PaaS/SaaS)">
    SaaS.
  </Accordion>

  <Accordion title="Is there an Internet-accessible self-service portal available that allows clients to configure security settings and view access logs, security events and alerts?">
    Admins can control the application and will have access to alerts and security events.
  </Accordion>

  <Accordion title="What Services/products are being/will be provided to the customer?">
    Xoxoday application is an API-driven digital rewards platform that automates rewards, incentives and gifting. The storefront has a global catalogue of 20,000+ options with 5,000+ experiences, 2,000+ gift cards and 10,000+ perks. The platform offers reward distribution modes like sending bulk vouchers via emails and generation of bulk voucher codes.
  </Accordion>

  <Accordion title="Do you offer an on-premise solution?">
    No. We are cloud hosted only.
  </Accordion>

  <Accordion title="Describe in detail your product's architecture.">
    We will share this as an attachment upon request.
  </Accordion>

  <Accordion title="Describe the key differentiators of your technical architecture.">
    Cloud hosted, microservice-based, highly scalable, High Availability.
  </Accordion>

  <Accordion title="Describe the minimum and recommended system requirements for your solution.">
    NA — We are cloud hosted.
  </Accordion>

  <Accordion title="Describe your solution's networking requirements and capabilities.">
    NA — We are cloud hosted. Users need to have internet access.
  </Accordion>

  <Accordion title="Is your solution available in a seamless manner to access as an app on different mobile devices and as web app on different desktop devices?">
    Yes. The solution is available as part of SAP SuccessFactors solution on web, as well as the SuccessFactors native mobile app for both iOS and Android.
  </Accordion>

  <Accordion title="Mobile Device Availability? (Android and iOS)">
    It's accessible in a mobile browser and can be accessed via an Android or iOS device.
  </Accordion>

  <Accordion title="Tablet Device Availability? (Android and iOS)">
    Our applications are compatible with desktops, tablets, and mobiles. No additional components are required.
  </Accordion>

  <Accordion title="Browser compatibility? (MS Edge, Chrome, Safari, IE)">
    Our applications are compatible with desktops, tablets, and mobiles. No additional components are required.
  </Accordion>

  <Accordion title="Technology Stack? (Infrastructure / Frontend / Backend / Database)">
    AWS / Kubernetes — React — Node/GraphQL — MySQL/MongoDB.
  </Accordion>

  <Accordion title="What technology languages/platforms/stacks/components are utilized in the scope of the application?">
    We have deployed our application on Amazon Web Services (AWS) cloud platform. We are using MySQL, Salt stack, Node.js and MongoDB technology.
  </Accordion>

  <Accordion title="Is the application developed on the latest language framework?">
    Yes. We are using the latest language frameworks like MySQL, JavaScript, Node.js and MongoDB.
  </Accordion>

  <Accordion title="Is the application developed using secure libraries?">
    Yes. These are approved during the code review process wherein the reviewer checks the utility and security of the libraries.
  </Accordion>

  <Accordion title="Where is the primary data center? Backup data center?">
    We have deployed our application on AWS Cloud virtual platform. The backup data center is in Singapore.
  </Accordion>

  <Accordion title="Describe the network topology.">
    The data centers are hosted completely in isolation so that access is limited and controlled. Load balancer allows shifting incremental load and can auto scale based on data load. Each instance (EC2) under a fortified VPC network is a conglomeration of Docker Container Web Services and APIs and application layer running on top. Amazon CloudWatch is implemented to enable monitoring. The data is encrypted using 256-encryption-based SSL certificate. Xoxoday plans a quarterly VAPT-based security audit.
  </Accordion>

  <Accordion title="Describe your network configuration and how your sensitive data system is protected.">
    Plum by Xoxoday is a cloud-based SaaS platform hosted on VPC infrastructure of AWS. The data centers are hosted in complete isolation. The architecture allows adding more location-specific data centers for latency and data security. Load balancers allow auto-scaling. Each EC2 instance under fortified VPC network is a conglomeration of Docker Container Web Services and APIs. Amazon CloudWatch is implemented for monitoring. Data is encrypted using TLS 1.3 in transit and AES-256 at rest.
  </Accordion>
</AccordionGroup>

***

## Backup, Recovery & Business Continuity

<AccordionGroup>
  <Accordion title="Have you implemented backup or recovery mechanisms to ensure compliance with regulatory, statutory, contractual or business requirements?">
    Data backups are done daily and in a secured way in AWS.
  </Accordion>

  <Accordion title="If using virtual infrastructure, does your cloud solution include independent hardware restore and recovery capabilities?">
    We use AWS Virtual platform cloud. We have created an Amazon CloudWatch alarm that monitors Amazon EC2 instances and automatically recovers them if impaired. EBS Snapshot functionality allows us to capture and restore virtual machine images at any time.
  </Accordion>

  <Accordion title="Does your infrastructure environment solution include software/provider independent restore and recovery capabilities?">
    Yes, the infrastructure environment solution includes software/provider independent restore and recovery capabilities.
  </Accordion>

  <Accordion title="Do you test your backup or redundancy mechanisms at least annually?">
    Yes. Data backups are automated and done daily in a secured way on AWS. We test the backup or redundancy mechanisms at least annually.
  </Accordion>

  <Accordion title="Does the RTO and RPO of CSP's contingency plan meet with vendor's customer requirements?">
    Our RTO and RPO is 60 minutes.
  </Accordion>

  <Accordion title="Has Supplier implemented data backup and recovery procedures to prevent data loss, unwanted overwrite and/or destruction?">
    Yes. Data backups are done daily and in a secured way in AWS.
  </Accordion>

  <Accordion title="Does the organisation store backups offsite?">
    Data backups are done on a daily basis and in a secured way on AWS.
  </Accordion>

  <Accordion title="Are all systems, assets and information backed up based on a BIA which establishes RPO/RTO?">
    We take automated backups on a regular basis.
  </Accordion>

  <Accordion title="Shall a backup be taken before and after any major changes to hardware, OS, application or configuration?">
    Yes. We take a backup of all data before making any major changes to hardware and software.
  </Accordion>

  <Accordion title="There shall be a detailed backup procedure based on the established RPO and RTO.">
    We have implemented the Backup Recovery Procedure.
  </Accordion>

  <Accordion title="What backup and disaster recovery plans are in place to avoid data loss/service loss in the time of contingency?">
    We have Business Continuity Policy and Business Continuity Management Procedure in place, tested periodically. Our policies are reviewed and audited annually. We test the BCP every 12 months, reviewed as part of internal and external audits.
  </Accordion>

  <Accordion title="Have you applied a data backup mechanism? What is the frequency of backup?">
    Yes. Data backups are done on a daily basis in a secured way in AWS.
  </Accordion>

  <Accordion title="Is your backup mechanism tested at least annually?">
    Yes. It is tested annually.
  </Accordion>

  <Accordion title="All backup data should be encrypted and adequately protected against unauthorized access.">
    Yes. All data backup is encrypted.
  </Accordion>

  <Accordion title="Are you able to restore user data upon loss through disk recovery mechanisms or stored backups?">
    Yes. It can be recovered.
  </Accordion>

  <Accordion title="Do you possess ISO 22301 for Business Continuity?">
    We have implemented the Business Continuity Management Policy and test the BCM plan annually. The BCM policy is attached for reference.
  </Accordion>

  <Accordion title="What type of DR options do you provide for my data within your offering?">
    We have implemented policies and procedures with regard to DR. Since we have deployed our application on AWS cloud, they provide DR services.
  </Accordion>

  <Accordion title="Please share the logical diagram with DR in place.">
    The application network architecture diagram is attached upon request.
  </Accordion>
</AccordionGroup>

***

## Application Development & SDLC

<AccordionGroup>
  <Accordion title="Do you test your applications before they are promoted into the Production environment? What types of testing do you perform?">
    We have an SDLC Policy as per ISMS requirements and follow General Coding Practice. We conduct data validation on a trusted system, use cryptographic functions to protect secrets, and perform code reviews, vulnerability assessments, and penetration testing. We follow a blue-green deployment strategy that introduces new changes without downtime and provides rollback capability.
  </Accordion>

  <Accordion title="Do you have a defined quality change control and testing process in place?">
    Yes. Changes to the production environment are documented, tested, and approved prior to implementation. Production software and hardware changes may include applications, systems, databases, and network devices requiring patches, service packs, and other updates.
  </Accordion>

  <Accordion title="Do you have controls in place to ensure that standards of quality are being met for all software development?">
    We have implemented the SDLC Procedure and standards of quality are met for all software development.
  </Accordion>

  <Accordion title="What controls do you have in place to detect source code security defects for any outsourced software development activities?">
    We have not outsourced software development activities. Our code reviews and analysis run through stringent automated technologies as well as manual source code overviews to cover any security loopholes prior to the production phase.
  </Accordion>

  <Accordion title="Are mechanisms in place to ensure that all debugging and test code elements are removed from released software versions?">
    Yes. All debugging and test code elements are removed from released software versions.
  </Accordion>

  <Accordion title="Do you use an automated source code analysis tool to detect security defects in code prior to production?">
    Yes. We use an automated source code analysis tool.
  </Accordion>

  <Accordion title="Privacy by Design is incorporated into all your developments and services.">
    We are proactively embedding privacy into the design and operation of IT systems, networked infrastructure, and business practices.
  </Accordion>

  <Accordion title="Does the software development lifecycle in the organisation specifically focus on security?">
    We focus on security while producing software. SDLC procedures are attached for reference.
  </Accordion>

  <Accordion title="Are development, test and production environments separate?">
    Yes. All environments are separate.
  </Accordion>

  <Accordion title="Is production data ever used in a test environment?">
    No. We do not use production data in test environments.
  </Accordion>

  <Accordion title="Is testing of applications done on a separate testing facility and not on production data?">
    Yes. Both are kept separate.
  </Accordion>

  <Accordion title="Are patches tested in a UAT instance before deployment on the production server?">
    Yes.
  </Accordion>

  <Accordion title="Are applications and operating system software implemented after extensive and successful security testing?">
    Any applications and software are implemented after security testing by our IT team. All logs are monitored. We maintain an approved software/application register, audited during internal and external audits. Users are disallowed from installing software on their workstations.
  </Accordion>

  <Accordion title="Do you do static code analysis?">
    Yes. We have static code analysis.
  </Accordion>

  <Accordion title="How do you ensure code is being developed securely?">
    We have an SDLC Policy per ISMS requirements and follow General Coding Practice including data validation on a trusted system, cryptographic functions to protect secrets, and least privilege — restricting users to only the functionality, data, and system information required for their tasks.
  </Accordion>

  <Accordion title="What percentage of your production code is covered by automated tests?">
    More than 50% of our production code is covered by automated tests.
  </Accordion>

  <Accordion title="Is a staging/pre-production system used to validate build artifacts before promotion to production?">
    We do not use staging for building artifacts.
  </Accordion>

  <Accordion title="How is application security testing performed? Internal, third parties, or both? How often is it tested?">
    We conduct application security testing with the help of industry-approved third-party vendors every six months. Any observations found are addressed by our team. The primary objective is to identify and eliminate problems that could lead to a breach of confidentiality, availability, or integrity of Xoxoday data resources.
  </Accordion>

  <Accordion title="Any product pre-release security threat modeling, secure coding practice, security architecture review and penetration testing?">
    Yes. Our code reviews run through stringent automated technologies and manual source code overviews. Vulnerability scanning gives deep insight for quick identification of non-compliant systems. Xoxoday also employs third-party security experts to perform VAPT.
  </Accordion>

  <Accordion title="Is application development following secure coding standards such as OWASP?">
    Yes. Code reviews and analysis run through stringent automated technologies as well as manual source code review. Multiple security checks including code reviews, web vulnerability reviews, and advanced security tests are performed in every build.
  </Accordion>

  <Accordion title="Is the code reviewed by peer or externally?">
    Yes. Code is reviewed both internally and externally. We engage third-party vendors for security testing every six months.
  </Accordion>

  <Accordion title="Please provide further information about your handling of security requirements during development.">
    All software development procedures are supervised and monitored by Xoxoday to include: security requirements, independent security review of the environment, code reviews, quality monitoring, evaluation, and acceptance criteria for information systems.
  </Accordion>

  <Accordion title="Describe the management system in place to fix vulnerabilities identified during control activities.">
    Our QA department reviews and tests our code base. Dedicated application security engineers identify, test, and triage security vulnerabilities. We also conduct code reviews and VAPT with the help of a third-party vendor. VAPT Certificate is attached.
  </Accordion>

  <Accordion title="Do you have a managed process for approving new 3rd Party Libraries?">
    Yes. This is part of the code review process wherein the reviewer checks the utility and security of the 3rd party library.
  </Accordion>

  <Accordion title="Develop applications based on secure coding guidelines.">
    Compliant. The application is developed based on secure coding guidelines and code reviews are conducted per compliance requirements.
  </Accordion>

  <Accordion title="Implement controls to obfuscate application code prior to compilation.">
    Compliant.
  </Accordion>

  <Accordion title="Configures web services in accordance with OWASP.">
    Compliant. Yes, we follow all technical guidelines for development that come under the Open Web Application Security Project.
  </Accordion>

  <Accordion title="Configure web services to prevent sensitive information leakage in response headers.">
    Compliant. We have implemented DLP techniques and there are no possibilities of data leakage or loss.
  </Accordion>

  <Accordion title="Configure web services to use secure HTTP headers.">
    Compliant. The application uses HTTPS.
  </Accordion>

  <Accordion title="Implement strict HTTP transport security headers to protect websites against protocol downgrade attacks and cookie hijacking.">
    Compliant. We use strict HTTP transport security.
  </Accordion>

  <Accordion title="Impose file upload frequency restrictions in applications to prevent abuse or attack.">
    We cannot impose file upload frequency restrictions. However, the application has technical and organizational measures to prevent attacks through WAF, log monitoring, AWS GuardDuty, Amazon CloudWatch, IDS/IPS, etc.
  </Accordion>
</AccordionGroup>

***

## Access Control & Authentication

<AccordionGroup>
  <Accordion title="Do you have an identity management system (enabling classification of data for a customer) in place to enable both role-based and context-based entitlement to data?">
    We have a role-based access system to make sure that only authorized individuals have access to the required information.
  </Accordion>

  <Accordion title="Do you provide customers with strong (multifactor) authentication options (e.g., digital certs, tokens, biometrics)?">
    We don't provide multi-factor authentication as a default. As of now, there's OAuth 2.0 and SAML-based tokens. JSON-based token is available for maximum security direct-email logins.
  </Accordion>

  <Accordion title="Does the SaaS support MFA such as OTP, security tokens, or biometrics?">
    No, we don't provide multi-factor authentication as a default. As of now, there's OAuth 2.0 and SAML-based tokens. JSON-based token is available for maximum security direct-email logins.
  </Accordion>

  <Accordion title="Do you allow customers to define password and account lockout policies for their accounts?">
    It can be configured with Active Directory.
  </Accordion>

  <Accordion title="Do you restrict personnel access to all management functions or administrative access based on the principle of least privilege?">
    Access to data and systems is based on the principles of least privilege. All information systems and data are classified and segregated to support role-based access requirements. We use MFA, Firewall, VPN, Active Directory, etc. for maximum security.
  </Accordion>

  <Accordion title="How do you verify password strength?">
    The password needs to be a minimum of 8 characters long and contain at least one capital letter, special characters among '# \$ % \* &' and 1 digit. These are reviewed monthly.
  </Accordion>

  <Accordion title="How are passwords stored (encrypted, hashed, algorithm or hashing methodology)?">
    We store passwords hashed. We have SHA-512 hash with unique salt for every password.
  </Accordion>

  <Accordion title="How are passwords hashed?">
    We store passwords hashed. We have SHA-512 hash with unique salt for every password.
  </Accordion>

  <Accordion title="Does your solution follow any particular internationally accepted best practices or standards for password management?">
    Yes. Our password requirements comply with all factors to ensure strong passwords: minimum length, special characters, capitalized letters, and alpha-numeric combinations. Passwords are stored after encryption.
  </Accordion>

  <Accordion title="Does the solution force the new user to change the password for their first logon and on expiry?">
    Yes.
  </Accordion>

  <Accordion title="Can passwords be changed by the user at anytime?">
    Yes.
  </Accordion>

  <Accordion title="Can the solution alert the security administrator to delete a UserID if it has not been used for predefined days?">
    The solution does not allow login using credentials that have not been used. Admins can create and delete user accounts.
  </Accordion>

  <Accordion title="Can users be prevented from logging into multiple terminals simultaneously?">
    It's a SaaS solution. Users can log in from multiple locations.
  </Accordion>

  <Accordion title="Does the solution have other options of logon inputs besides user ID and password?">
    No. Users need to login with user ID and password. However, we have integrations with Zoho CRM, HubSpot, DarwinBox, SurveyMonkey, Freshdesk, etc.
  </Accordion>

  <Accordion title="What is the idle session timeout and session expiration?">
    Since it's a SaaS product, session timeout can be set with the help of Active Directory. For example — 15 min or 20 mins as per requirements.
  </Accordion>

  <Accordion title="Is there account lockout functionality? What is the maximum number of failed login attempts before the account gets locked out?">
    The account will get automatically locked after 5 unsuccessful login attempts.
  </Accordion>

  <Accordion title="What is the account unlock process?">
    Users will get a reset password link and can unlock their account through that.
  </Accordion>

  <Accordion title="Share the User ID lifecycle process, from creation till termination of a user ID/account.">
    User accounts will be created by the admin and linked with the email ID of the users. Please refer to the admin guide: [https://xoxoday.gitbook.io/plum/user-guide/for-admins-1](https://xoxoday.gitbook.io/plum/user-guide/for-admins-1)
  </Accordion>

  <Accordion title="Does access provided to users and administrators follow Need to Know basis?">
    Yes.
  </Accordion>

  <Accordion title="Is two-factor authentication enabled for end users and Administrators?">
    Yes. Two-factor authentication is enabled. MFA devices like Google Authenticator are available for OTP/Codes/Passwords.
  </Accordion>

  <Accordion title="Does MFA apply while accessing cloud environment/applications remotely (VPN, VDI)?">
    Yes.
  </Accordion>

  <Accordion title="How is Segregation of Duties (SoD) implemented for various user access roles?">
    We have procedures for Roles, Responsibilities & Authorities at Xoxoday. Per the access control policy, access to data is provided only to authorized and appropriate individuals.
  </Accordion>

  <Accordion title="Detail out the organization password policy.">
    Password policy: Must contain at least 8 characters, numbers and letters, uppercase (A-Z), lowercase (a-z), digits (0-9), and non-alphabetic characters (e.g., !, \$, #, %). Password must be changed every 90 days. Passwords are shared through secure, encrypted channels.
  </Accordion>

  <Accordion title="Supplier has internal processes for identity and access management.">
    Yes. Policies and procedures enforce two-factor authentication for privileged account management while accessing tenant data/systems. An IAM solution manages user access through role-based access profiles based on the need-to-know principle and segregation of duties.
  </Accordion>

  <Accordion title="Control panel or administration console to the service is properly protected from abuse. Segregation of duties is implemented for privileged users.">
    By default, Xoxoday will not have access to service data. Access control is managed by the admin from the customer end. If we require access for troubleshooting, we request temporary access, and the customer decides. Access to our production environment is allowed only via the Xoxoday corporate network to authorized individuals.
  </Accordion>

  <Accordion title="What kind of identity and access management services are provided?">
    Please refer to the admin guide on SSO Logins: [https://xoxoday.gitbook.io/plum/user-guide/for-admins-1/getting-started](https://xoxoday.gitbook.io/plum/user-guide/for-admins-1/getting-started)
  </Accordion>

  <Accordion title="Are access to utility programs used to manage virtualized partitions appropriately restricted and monitored?">
    Yes. Access has been restricted and monitored for security reasons.
  </Accordion>

  <Accordion title="Do you have complexity or length requirements for passwords?">
    Yes. We have complexity and length requirements for passwords.
  </Accordion>

  <Accordion title="Do you review user access and rights at least annually?">
    We review user access on a periodical basis, validated during internal and external audits.
  </Accordion>
</AccordionGroup>

***

## Network Security & Firewall

<AccordionGroup>
  <Accordion title="Do your network architecture diagrams clearly identify high-risk environments and data flows?">
    Yes. We have captured this information in our architecture and data flow diagrams.
  </Accordion>

  <Accordion title="Are all non-internet facing systems placed behind a firewall?">
    Yes, we have a firewall.
  </Accordion>

  <Accordion title="Does the vendor have a comprehensive network architecture diagram covering infrastructure used for customer operations?">
    Yes, we have the network architecture diagram.
  </Accordion>

  <Accordion title="Is the internet access secure through a proxy/firewall?">
    Yes, we have configured secure internet access.
  </Accordion>

  <Accordion title="Are roles and responsibilities defined for Firewall configuration?">
    Yes, we have configured these.
  </Accordion>

  <Accordion title="Is there a proactive mechanism to monitor unauthorised network access attempts?">
    Yes. We have IDS and IPS implemented and receive alerts for unauthorised network access.
  </Accordion>

  <Accordion title="Is the firewall rule base reviewed at regular intervals?">
    Yes. It's reviewed on a monthly basis.
  </Accordion>

  <Accordion title="Does the firewall have real-time logging and alerting capability?">
    Yes.
  </Accordion>

  <Accordion title="Are prior management approvals obtained and communication provided to the customer in case of any external connections to parties other than the customer?">
    Yes.
  </Accordion>

  <Accordion title="Are all servers, end user devices configured according to security standards as part of the build process?">
    Yes. All are configured according to security standards as part of the build process.
  </Accordion>

  <Accordion title="Are Intrusion Detection Systems (IDS) or Intrusion Prevention Systems (IPS) used by your organisation?">
    We have implemented IDS/IPS to facilitate timely detection, investigation by root cause analysis, and response to incidents.
  </Accordion>

  <Accordion title="Is wireless access allowed in your organisation?">
    Wireless access is allowed and handled with high-quality routers, password protection and restriction on internet usage.
  </Accordion>

  <Accordion title="Are network boundaries protected by firewalls?">
    Yes. We have installed firewalls for maximum security and configured them to restrict unauthorised traffic.
  </Accordion>

  <Accordion title="Is data import, data export, and service management conducted over secure, industry-accepted standardized network protocols?">
    All data is collected only through the Xoxoday Platform.
  </Accordion>

  <Accordion title="What type/model of Firewall is implemented to segregate security zones and protect the infrastructure from external attacks?">
    We use a Web Application Firewall (WAF).
  </Accordion>

  <Accordion title="How are operating systems hardened to provide only the necessary ports, protocols and services to meet business needs?">
    We harden the operating systems and restrict access to all ports, applications, and software, monitored on a regular basis.
  </Accordion>

  <Accordion title="Describe how you protect your wireless network environment from unauthorized access.">
    We have implemented policies and mechanisms to protect the wireless network environment. We use a cloud-hosted VPN with strict access controls to allow our employees to access the official network. This VPN is managed by our IT team and linked with SSO/Active Directory.
  </Accordion>

  <Accordion title="Is the network used for providing service to the customer logically and physically segregated? Is the server placed on a separate LAN?">
    Yes. It's logically and physically segregated. We have deployed our application on AWS Cloud platform.
  </Accordion>

  <Accordion title="Are external access (e.g., remote, wireless, third party) to the network only permitted after a user has been identified and authenticated?">
    We do not provide external access.
  </Accordion>

  <Accordion title="Whether Firewall, IPS/IDS, DLP, Anti APT, SIEM, AntiSpoofing and other security solutions have been implemented?">
    We have implemented IDS/IPS, Endpoint security, Firewall, DLP, Antispoofing, VPN, Active Directory and other security solutions for maximum security.
  </Accordion>

  <Accordion title="Are internal and external networks separated by firewalls with access policies and rules?">
    Yes. With multiple layered firewalls configured with deny-all mode allowing only specific rules required for business, network traffic is regulated. We have implemented intrusion detection and prevention system tools for timely detection and investigation.
  </Accordion>

  <Accordion title="Is there a standard approach for protecting network devices to prevent unauthorised access/network related attacks and data theft?">
    With multiple layered firewalls in deny-all mode, network traffic is regulated. We use tools that analyze various traffic patterns and correlate network events. Early warning signals trigger alerts to our team. We are equipped to detect and mitigate threats, DDoS attacks, session hijacks, login spoofs, or any other data extraction strategies.
  </Accordion>

  <Accordion title="Any host-based IPS for critical systems? Any next generation firewall, IPS and web application firewall?">
    Yes. As part of WAF, rate limiters are installed to block multiple requests from specific IPs to prevent DDoS-type attacks. These are powered by intelligent daemons that detect other identifiers like URLs accessed or other client properties to automatically blacklist possible threats.
  </Accordion>

  <Accordion title="Are network components and computers password protected?">
    All our network components and computers are password protected to ensure compliance with integrity, availability, and confidentiality principles of Information Security.
  </Accordion>

  <Accordion title="Is the production network segmented into different zones based on security levels?">
    Yes.
  </Accordion>

  <Accordion title="What is the process for making changes to network configuration?">
    We have Network Access Control and Security Procedure in place. Network resources must be on a need-to-know basis and authorizations must be obtained from appropriate authorities. Networks are logically or physically divided based on the criticality of the information stored.
  </Accordion>

  <Accordion title="Describe how you protect against attacks that target virtual infrastructure directly (shimming, Blue Pill, Hyper jumping, etc.)">
    We have WAF, IDS/IPS, AWS GuardDuty, Cloudflare, and data encryption. We conduct code reviews and VAPT annually with a third-party vendor. We are equipped to detect and mitigate DDoS attacks, session hijacks, login spoofs, or any other data extraction strategies.
  </Accordion>

  <Accordion title="Is application deployed behind the firewall and IDS/IPS?">
    We use Cloudflare Web Application Firewall (WAF) and IDS/IPS for maximum security.
  </Accordion>

  <Accordion title="Does WAF protect from application attacks?">
    Yes. We have implemented the Web Application Firewall (WAF).
  </Accordion>

  <Accordion title="Service Provider should have solid application security controls such as WAF and RASP to detect and block web-based attacks such as XSS, SQL Injection, and CSRF.">
    We have a web application firewall, IDS/IPS, SQL injection protection. We use Cloudflare for the same.
  </Accordion>

  <Accordion title="What cryptographic frameworks are used to secure data in transit over public networks?">
    Yes. Our network communication is encrypted with highly restricted protocols to ensure maximum security. We use TLS 1.2 encryption for data in transit.
  </Accordion>

  <Accordion title="Describe the network protocols used to communicate between components of the system (e.g., HTTPs, LDAP, SSL).">
    We use HTTPS and our network communication is encrypted with highly restricted protocols to ensure maximum security.
  </Accordion>

  <Accordion title="I cannot find anywhere in their documentation that they support IP address range restriction for the application API, could we get confirmation?">
    We do not provide support for IP address range restriction. Our restrictions/security are based on our OAuth process and do not restrict to specific IPs.
  </Accordion>
</AccordionGroup>

***

## Logging, Monitoring & Audit

<AccordionGroup>
  <Accordion title="Do you monitor and log privileged access (e.g., administrator level) to information security management systems?">
    Yes. We monitor the logs. Application and infrastructure logs are centrally collected and backed up in a secure manner for internal development and audit-related concerns.
  </Accordion>

  <Accordion title="Does the organisation maintain audit logs of user activities, exceptions, and security events on all systems that store or process sensitive data?">
    Yes. We maintain the records.
  </Accordion>

  <Accordion title="Do these audit logs contain details regarding the User ID, timestamp, and what actions were performed?">
    Yes. Since we record Services and Server logs at the level of virtual machine, and Audit and Access logs at the level of AWS, all these are covered.
  </Accordion>

  <Accordion title="At what frequency are these logs reviewed?">
    Monthly.
  </Accordion>

  <Accordion title="Is the ability to delete event logs restricted to only superadmin or host admin?">
    Yes. Only authorised individuals can do this.
  </Accordion>

  <Accordion title="Are changes made to virtual machines or moving of an image made immediately available to customers through electronic methods?">
    Audit logs are reviewed and recorded on a regular basis automatically. These logs are integrated with security operations/SIEM solutions. We provide logs to the customer on a need and approval basis.
  </Accordion>

  <Accordion title="Are system administrator and system operator activities monitored and logged?">
    We maintain logs and monitor for security and audit purposes.
  </Accordion>

  <Accordion title="Are the system clocks of all information processing systems synchronized with an agreed accurate time source?">
    Yes. System clocks of all relevant information processing systems are synchronized to facilitate tracing and reconstitution of activity timelines.
  </Accordion>

  <Accordion title="Do you use a synchronized time-service protocol (e.g., NTP) to ensure all systems have a common time reference?">
    Yes.
  </Accordion>

  <Accordion title="What is the log retention policy? Who has access to logs in your organization?">
    We maintain logs for at least 180 days. Only the CTO and Production Head will have access to these logs. There will be no modification to these logs.
  </Accordion>

  <Accordion title="Who has access to Security logs?">
    Only authorised individuals have access to the security logs — e.g., CTO, DevOps Head, Production Head.
  </Accordion>

  <Accordion title="How long are security logs maintained by the provider?">
    At least 180 days.
  </Accordion>

  <Accordion title="IS logging enabled for all components, such as network devices, servers, DBs, IAM, Cloud Services?">
    Yes. Only authorised individuals have access.
  </Accordion>

  <Accordion title="Do you have a SIEM for monitoring and maintaining logs over security incidents?">
    Yes. We have a SIEM in place for monitoring and maintaining logs over security incidents from various components.
  </Accordion>

  <Accordion title="Provide the scope of data sources merged in your SIEM and confirm if configured for granular analysis and real-time alerting.">
    Yes, SIEM has been implemented. Our event management systems merge data sources to maintain log data within the SIEM. This helps in proper analysis and driving out alerts in case of contingency. Audit logs are reviewed and recorded automatically. These logs are integrated with security operations/SIEM solutions.
  </Accordion>

  <Accordion title="Is a SOC implemented to monitor the software solution? Can the customer gain access to the SOC alert and response reporting?">
    We have implemented the Security Operations Center to monitor, prevent, detect, investigate, and respond to cyber threats around the clock.
  </Accordion>

  <Accordion title="Does the Company run a Security Operations Center (or equivalent) which allows detection and response to Cyber Security Incidents?">
    Cyber security incidents are analyzed with network intrusion detection (IDS) tools. The incident response team is immediately notified for counter-actions and defense mechanisms. We have a Security incident management process to classify and handle incidents and security breaches.
  </Accordion>

  <Accordion title="Are all security events (authentication events, SSH session commands, privilege elevations) in production logged?">
    Yes.
  </Accordion>

  <Accordion title="Can logs be integrated into a SIEM system?">
    No. Logs are automatically audited but are not integrated with tenant's security ops. In case the tenant requests logs, they can be shared when asked by the clients.
  </Accordion>

  <Accordion title="Is a service available for APIs to push the logs of our company's administrators' operations on the Vendor platform in real time?">
    No. We do not have such a service. The key admin actions are present in the application reports. Our support team can help with a deep dive into a specific incident with the help of audit logs.
  </Accordion>

  <Accordion title="Is there a support for operation logs on the admin console? What operations do the audit logs monitor?">
    Yes. Audit logs are reviewed and recorded on a regular basis automatically. These logs are integrated with security operations/SIEM solutions.
  </Accordion>

  <Accordion title="Logging and monitoring is in place for analysing activities of privileged users as well as for inspecting and analysing network traffic.">
    All infrastructure logs are collected using the AWS Audit Trail, meanwhile application related logs are collected in our Elastic Search server and retained in long-term cloud storage. The audit logs are reviewed and recorded automatically. These logs are integrated with security operations/SIEM solutions.
  </Accordion>

  <Accordion title="Logs are reviewed in a continuous manner to improve performance as well as detect potential security issues.">
    Yes. Our event management systems merge data sources to maintain log data within the SIEM. This helps in proper analysis and driving out alerts if needed.
  </Accordion>

  <Accordion title="Do you monitor and log user, system and administrative access?">
    We monitor logs on a regular basis. Infrastructure logs are collected using AWS Audit Trail. Application related logs are collected in our Elastic Search server and retained in long-term cloud storage.
  </Accordion>

  <Accordion title="What logging and monitoring capabilities are in place to detect unauthorised access to data or hacking attempts?">
    We use a cloud-hosted VPN with strict access controls. We have implemented intrusion detection tools for timely detection and investigation. File integrity and network intrusion detection (IDS) tools are implemented. We also have Endpoint security software for all computers.
  </Accordion>

  <Accordion title="Are independent IT security testing programs, assurance, audit and/or assessments performed? How frequently?">
    We perform internal and external audits annually. We also conduct security assessments and testing like VAPT every six months. We communicate these assessment results to clients on a yearly basis.
  </Accordion>

  <Accordion title="Does your internal security group carry out audits on your Information Security Management System?">
    Yes. We conduct audits on our Information Security Management System. The last audit date was 16th June 2021.
  </Accordion>

  <Accordion title="Will event logging/audit mechanisms be turned on at all times for the system?">
    Yes.
  </Accordion>

  <Accordion title="Will logs be regularly reviewed?">
    Yes. Administrative logs are part of the Cloud Dashboard and are regularly reviewed.
  </Accordion>

  <Accordion title="Are systems and networks monitored for security events?">
    We use Bitdefender Endpoint security software to prevent malware and protect data. Additionally, we have AWS GuardDuty threat detection service that continuously monitors for malicious activity and unauthorised behaviour. We use Amazon CloudWatch and Grafana which monitor instances and alert us through emails.
  </Accordion>

  <Accordion title="Do you have any monitoring tool in place to get timely alerts on when a device is going down, restarted, or resources are over utilized?">
    We have an intrusion detection/monitoring application that alerts on unauthorized access. We use Amazon CloudWatch and Grafana which monitor instances and alert us through emails.
  </Accordion>

  <Accordion title="How do you monitor system integrity, logs, intrusion detection, and system access?">
    Infrastructure logs are collected using AWS Audit Trail. Application related logs are collected in our Elastic Search server and retained in long-term cloud storage.
  </Accordion>

  <Accordion title="Are audit logs maintained that record user activities, exceptions, success and failure logons, policy changes, and information security events?">
    Yes. All audit logs are monitored as a best practice.
  </Accordion>

  <Accordion title="Are servers configured to capture who accessed a system and what changes were made?">
    Yes. Infrastructure logs are collected using the AWS Audit Trail, meanwhile application related logs are collected in our Elastic Search server and retained in long-term cloud storage.
  </Accordion>

  <Accordion title="Detail out the process for security event logging and monitoring (including applicable correlation rules). Detail the log retention period and protection mechanisms to prevent log tampering.">
    Yes. Our event management systems merge the data sources to maintain a log data within the SIEM. This helps in proper analysis and driving out alerts if needed in case of contingency.
  </Accordion>

  <Accordion title="What alerts can be set in the system?">
    At Xoxoday, the following are recorded in audit logs: 1. Infrastructure logs — collected using AWS Audit Trail. 2. Application related logs — collected in our Elastic Search server and retained in long-term cloud storage.
  </Accordion>
</AccordionGroup>

***

## Data Protection & Encryption

<AccordionGroup>
  <Accordion title="Are you capable of supporting litigation holds (freeze of data from a specific point in time) for a specific customer without freezing other customer data?">
    Yes. We can freeze data from a specific time without freezing other data if needed.
  </Accordion>

  <Accordion title="Do you have the capability to recover data for a specific customer in the case of a failure or data loss?">
    We have a data loss prevention solution in place and data will not be lost.
  </Accordion>

  <Accordion title="What is the purpose for processing the Personal Data?">
    Personal data will be processed only for rewards and redemption purposes.
  </Accordion>

  <Accordion title="Can Supplier provide a data map which includes all country locations where Personal Data would traverse, be stored or processed?">
    Yes. We can provide the data flow diagram.
  </Accordion>

  <Accordion title="Have you implemented measures for prevention of loss of PII data? (e.g., DLP, restricted access controls, log recording, encryption)">
    We use technologies like DLP, Data encryption, access control, and log monitoring.
  </Accordion>

  <Accordion title="Is data import, data export, and service management conducted over secure industry-accepted standardized network protocols?">
    All data is collected only through the Xoxoday Platform.
  </Accordion>

  <Accordion title="Describe how you make sure the customer's data is properly segregated from other customers' in multi-tenant solutions.">
    Yes. The data is segregated with a client-specific key for proper handling and representation. Physical segregation is done for production and non-production environments.
  </Accordion>

  <Accordion title="Would you support encryption keys generated by our own PKI that would be used to encrypt data?">
    We use a split key mechanism to ensure that every client's key is unique. It's generated automatically from our end.
  </Accordion>

  <Accordion title="What type of mechanisms do you implement to make sure Data Integrity is protected against errors, corruption or misuse?">
    We have WAF, IDS/IPS, AWS GuardDuty, Cloudflare, and encrypted data. We conduct code reviews per compliance requirements and VAPT annually with a third-party vendor. We are equipped to detect and mitigate threats, DDoS attacks, session hijacks, login spoofs, or any other data extraction strategies.
  </Accordion>

  <Accordion title="Describe how you make sure the application is properly protected against exploitation of CVE vulnerabilities prior to allowing it to go to production.">
    Yes. We do testing before deploying in the production environment.
  </Accordion>

  <Accordion title="Is data import and export conducted over secure, industry-accepted standardized network protocols?">
    All data is collected only through the Xoxoday Platform.
  </Accordion>

  <Accordion title="Is sensitive information transferred to external recipients? If so, are controls in place to protect it?">
    We do not transfer any data externally. However, we have implemented encryption, VPN, Firewall, IDS/IPS, and monitoring systems.
  </Accordion>

  <Accordion title="Do procedures exist to protect documents and computer media from unauthorized disclosure, modification, removal, and destruction?">
    We have disabled all ports and users do not have access to USB, CD-ROM, Disks, tapes, or Hard drives. All data including backups has been encrypted. We use TLS 1.2 for data in transit and AES-256 for data at rest.
  </Accordion>

  <Accordion title="Are there security procedures for the decommissioning of IT equipment and storage devices which contain sensitive information?">
    All customer data including backup data is stored on AWS virtual platform cloud and does not store anything locally. We use TLS 1.2 for data in transit and AES-256 for data at rest. We have also implemented the Media handling procedure.
  </Accordion>

  <Accordion title="Is the data classified top secret/confidential/PII stored separately from public data or data of other organizations residing on the same cloud?">
    Yes.
  </Accordion>

  <Accordion title="How is data loss prevented and how is high availability ensured?">
    Our web application, email records, and endpoints are sealed with data loss prevention techniques. We have the capability to respond immediately.
  </Accordion>

  <Accordion title="If other tenants' information/data is compromised, how is the vendor making sure that the customer organization's data is not impacted?">
    We logically segment or encrypt customer data such that data may be produced for a single tenant only, without inadvertently accessing another tenant's data.
  </Accordion>

  <Accordion title="What security measures are implemented by the Application Service Provider for guarding against data leakage/data corruption/data breach?">
    All security mechanisms and policies are established to prevent data leaks in transit as well as at rest. Exhaustive VAPT has been conducted along with business logic testing based on the OWASP framework, which incorporates 120+ test cases.
  </Accordion>

  <Accordion title="Is the data for multiple customers co-mingled in the same database or schema?">
    No. We use logical data isolation with the help of company-specific encryption keys.
  </Accordion>

  <Accordion title="Is any DLP solution in place? What is implemented to prevent data leaks?">
    Yes. We have implemented Data Loss Prevention techniques on AWS.
  </Accordion>

  <Accordion title="Are rules pertaining to remote access monitoring configured on DLP solution?">
    We have implemented data loss prevention techniques to make sure that the data is not lost permanently.
  </Accordion>

  <Accordion title="Are policies configured to monitor and detect data leakage over different file types?">
    It's a part of our data loss prevention techniques.
  </Accordion>

  <Accordion title="Is the current DLP solution capable of enforcing policies even when the endpoint is disconnected from the corporate network?">
    Our web assets, email records, and endpoints are sealed with data loss prevention techniques even when the endpoint is disconnected from the corporate network.
  </Accordion>

  <Accordion title="How the encryption keys used are secured and protected from unauthorized access?">
    Each tenant's data is uniquely encrypted using a client-specific key. We use AES-256 bit encryption for data at rest. Our network communication is encrypted with highly restricted protocols. The cryptographic keys, including data encryption and SSL certificates, are managed by Xoxoday for optimal security.
  </Accordion>

  <Accordion title="Any centralized crypto materials and key management infrastructure in place?">
    We use a split key mechanism to ensure that every client's key is unique. We perform annual key rotation. Keys are generated using KMS service whenever needed. We store keys in KMS.
  </Accordion>

  <Accordion title="Please describe your Key Management controls including key rotation, key generation, key storage.">
    We use a split key mechanism to ensure that every client's key is unique. We perform annual key rotation. Keys are generated using KMS service whenever needed. We store keys in KMS.
  </Accordion>

  <Accordion title="Does your system support dynamic key for encryption? How to store the key?">
    We use logical data isolation with the help of company-specific encryption keys.
  </Accordion>

  <Accordion title="Authentication mechanisms must not allow passwords to be sent in clear text, using a minimum of TLS 1.2, and an encryption algorithm and strength of AES-256.">
    Password can be reset by employees. We do not send the password in plain text. We use TLS 1.2 for data in transit and AES-256 for data at rest.
  </Accordion>

  <Accordion title="Passwords must be Hashed while stored using a salted non-reversible hash.">
    We store passwords hashed. We have SHA-512 hash with unique salt for every password.
  </Accordion>

  <Accordion title="Which groups of staff have access to personal and sensitive data?">
    Only our product engineering team members have access as per their job functions and role-based logical access. We do not provide access to any third parties and all development and testing is done by internal employees.
  </Accordion>

  <Accordion title="Is sensitive data encrypted when stored on laptops, desktops, and server hard drives?">
    Yes. We use TLS 1.2 for data in transit and AES-256 for data at rest. All data including backups is encrypted.
  </Accordion>

  <Accordion title="Does the provider retain rights to the customer data even if data is removed from the provider?">
    Our data cleaning process goes through an organized purge. Once the data is purged, it's purged from all places.
  </Accordion>

  <Accordion title="CLOUD SERVICE PROVIDER must be able to ensure any data and/or system disposal in case of service termination and in case of data and/or system end of life.">
    Yes. Per our policies and procedures, we ensure secure disposal and removal of data from every storage media. The data cannot be recovered by any computer forensic means. We assure secure data disposal when storage is decommissioned or when the contract comes to an end.
  </Accordion>

  <Accordion title="Will the application collect and/or host any User Generated Content (UGC)?">
    The only user data stored within the system is personal information — names, emails, and contact numbers. This data is not put to any use by Xoxoday and resides within the system. The data can be deleted upon the tenant's request.
  </Accordion>

  <Accordion title="Entities shall be responsible for defining and updating the information/data retention policy and procedure.">
    We have implemented the Data Retention and Disposal Policy.
  </Accordion>

  <Accordion title="Retain audit logs in accordance with retention requirements: 90 days for non-PHI activities and one year for PHI related activities.">
    We retain logs for a minimum of 180 days and in accordance with the Company's records retention guidelines. We do not process any e-PHI.
  </Accordion>
</AccordionGroup>

***

## Patch Management

<AccordionGroup>
  <Accordion title="Are system and security patches applied to workstations on a routine basis?">
    We update patches on a routine basis.
  </Accordion>

  <Accordion title="Are system and security patches applied to servers on a routine basis?">
    We update patches on a routine basis for servers as well.
  </Accordion>

  <Accordion title="Are system and security patches tested prior to implementation in the production environment?">
    We test patches before implementation in the production environment.
  </Accordion>

  <Accordion title="Are all systems and applications patched regularly?">
    Patches are updated regularly.
  </Accordion>

  <Accordion title="How are security patches rated?">
    Security patches are rated as Critical, High, Medium, and Low.
  </Accordion>

  <Accordion title="Describe the patch management process including frequency and process to apply patches, and how rapidly you can patch vulnerabilities across all components of the solution.">
    Critical patches will be deployed immediately. High patches will be deployed within 5 days. Medium patches within 15 days. Low within 25 days. Patch Management Procedure is attached.
  </Accordion>

  <Accordion title="Does the vendor have a patch management process for the operating systems and software on their PCs, servers and network infrastructure?">
    Yes. We update patches periodically for our operating systems, software, servers, and network infrastructure.
  </Accordion>

  <Accordion title="Are all security patches tested before they are deployed? How is this accomplished?">
    Yes. We test the patches on the testing environment and deploy to production upon validation.
  </Accordion>

  <Accordion title="Are security patches regularly reviewed and applied to network and security devices?">
    Yes. Security patches are regularly monitored and applied to the network security devices. All critical patches will be deployed immediately.
  </Accordion>

  <Accordion title="Please outline your planned approach to security patching of operating systems and applications.">
    We update patches periodically. See Patch Management Procedure attached.
  </Accordion>

  <Accordion title="Is there a process in place for tracking patch compliance in terms of patches successfully applied, unapplied patch ratio, and latency in rollout?">
    Yes. We regularly update our instance and make sure we follow security best practices. There is a process in place for regularly updating the servers and monitoring for latest updates across the entire stack.
  </Accordion>

  <Accordion title="Documented patch management procedures shall be developed, implemented and maintained.">
    We have implemented the Patch Management Procedure.
  </Accordion>

  <Accordion title="In the event a patch is not approved for use by the system vendor, a reason and risk mitigating controls for that patch shall be documented.">
    We follow the Change Management process to implement the compensatory control.
  </Accordion>

  <Accordion title="In the event a patch cannot be implemented due to current operations, an official exception shall be raised.">
    We follow the Change Management process.
  </Accordion>

  <Accordion title="All supporting systems used to develop or integrate systems shall be appropriately and timely patched.">
    Patches are updated on time.
  </Accordion>

  <Accordion title="Establish a dedicated patch management process for components.">
    Critical patches will be deployed immediately. High patches within 5 days. Medium patches within 15 days. Low within 25 days. Patch Management Procedure is attached.
  </Accordion>

  <Accordion title="Test patches and updates prior to deploying software in production environments.">
    Yes. We test patches before deploying in the production environment.
  </Accordion>
</AccordionGroup>

***

## Change Management

<AccordionGroup>
  <Accordion title="Does the organisation have a formal change control process for IT changes?">
    We have implemented the Change Management Procedure. All IT changes take place as per the Change Management Procedure.
  </Accordion>

  <Accordion title="Do you have technical measures in place to ensure that changes in production environments are registered, authorized and in adherence with existing SLAs?">
    Yes. Changes to the production environment are documented, tested, and approved prior to implementation. Production software and hardware changes may include applications, systems, databases, and network devices requiring patches, service packs, and other updates.
  </Accordion>

  <Accordion title="Are the vendor's change control procedures compliant with ISO 27002?">
    Yes. Change management procedures are attached. We are compliant.
  </Accordion>

  <Accordion title="Do formal change management procedures exist for networks, systems, desktops, software releases, deployments, and software vulnerability patching activities?">
    Yes. We have implemented the change management procedures, and this applies to all Xoxoday assets, infrastructure, processes, software, and third-party activities. The procedure also applies to employees, vendors, and all other individuals who have access to, or are responsible for Xoxoday information processing facilities.
  </Accordion>

  <Accordion title="Are changes to the production environment reviewed by at least two engineers/operations staff?">
    Yes. Our production team and QA team test all new releases or changes made to the existing product.
  </Accordion>

  <Accordion title="Does the requirement discussed and agreed that CSP notify vendor for major changes of infrastructure/security configuration in cloud environment?">
    Yes. We will notify the customer if there are any major changes.
  </Accordion>

  <Accordion title="Is a communication channel established between Vendor and the customer to notify the customer on the scheduled downtime and in case of any data security breach?">
    Yes. Our customer support team will communicate.
  </Accordion>
</AccordionGroup>

***

## Antivirus & Endpoint Security

<AccordionGroup>
  <Accordion title="Is antivirus software installed on workstations?">
    We have installed antivirus on all workstations and servers.
  </Accordion>

  <Accordion title="Are controls in place to prevent administrators and other staff from downloading customer data to removable storage (USB memory sticks, CD ROM, etc.)?">
    Yes. We have the controls in place. We have blocked connecting Hard disk, USB, CD-ROM, etc. to computers and all devices are centrally managed.
  </Accordion>

  <Accordion title="What processes does the vendor have to detect and prevent viruses and other malicious software?">
    We use Bitdefender Endpoint security software to prevent malware and protect data. Additionally, we have AWS GuardDuty that continuously monitors for malicious activity and unauthorised behaviour. We use a cloud-hosted VPN with strict access controls linked with SSO/Active Directory.
  </Accordion>

  <Accordion title="Please outline any anti-malware (antivirus, etc.) tools that will be used to protect the system.">
    We use endpoint security for prevention.
  </Accordion>

  <Accordion title="In case of any exceptions due to which anti-malware activities fail, are alternative controls implemented to reduce the exposure on remote endpoints?">
    We have an alerting system in place and we perform scanning immediately to reduce the risk.
  </Accordion>

  <Accordion title="How are endpoint devices that are connected to the corporate network managed and secured?">
    We have all required security controls for protecting endpoints — VPN, Firewall, IDS/IPS, Anti-Virus software, Audit log monitoring, Active Directory, etc.
  </Accordion>

  <Accordion title="Ensure that all anti-malicious code protection is up-to-date based on entity-defined maintenance schedules.">
    We maintain up-to-date endpoint security to safeguard from attack scripts, viruses, worms, Trojan horses, backdoors, and malicious active content.
  </Accordion>

  <Accordion title="Detail Out the mechanism for Antivirus installation, monitoring and signature updates of infrastructure.">
    We are using Linux operating systems and following security best practices. We are monitoring using Prometheus/Grafana.
  </Accordion>

  <Accordion title="What are the procedures for configuration management, patch installation and malware prevention for all servers and PCs?">
    We have installed endpoint security in servers and PCs of all our employees as per compliance requirements.
  </Accordion>

  <Accordion title="Do you ensure that endpoints (laptops, desktops, etc.) have the latest available security-related patches installed?">
    Yes. We update patches periodically and ensure that all endpoints have the latest available security-related patches.
  </Accordion>

  <Accordion title="How are endpoint devices that are connected to the corporate network managed and secured?">
    We have all required security controls for protecting endpoints — VPN, Firewall, IDS/IPS, Anti-Virus software, Audit log monitoring, Active Directory, etc. We use a cloud-hosted VPN with strict access controls linked with SSO/Active Directory.
  </Accordion>
</AccordionGroup>

***

## SSO, Authentication & Integration

<AccordionGroup>
  <Accordion title="Mandatory Active Directory (SSO) Integration preferably through ADFS.">
    Yes. Our partnerships with a wide array of integration partners ensure existing customer-based SSO capability for all users to seamlessly use Xoxoday's products. With an easy DIY setup, your SSO solution would be plugged in and ready to go. Please refer to our list of integrations: [https://xoxoday.gitbook.io/plum/developer-resources/integrations](https://xoxoday.gitbook.io/plum/developer-resources/integrations)
  </Accordion>

  <Accordion title="Can your solution link to our Identity Federation Tool in order to authenticate users and retrieve their user profile using SAML or OAuth?">
    Yes. The application has robust authentication methods. We have integrated SAML 2.0 with SAP SuccessFactors and also support OAuth 2.0 for seamless authentication.
  </Accordion>

  <Accordion title="Are there interactions between the proposed solution and third-party applications/middleware?">
    API Documentation: [https://xoxoday.gitbook.io/plum/user-guide/for-admins-1/xoxo-links/xoxo-link-apis](https://xoxoday.gitbook.io/plum/user-guide/for-admins-1/xoxo-links/xoxo-link-apis)
  </Accordion>

  <Accordion title="Is API integration available?">
    Please click here to know more about API integration: [https://www.empuls.io/integrations](https://www.empuls.io/integrations)
  </Accordion>

  <Accordion title="Does the application have APIs available for user provisioning and deprovisioning?">
    The application enables user account management through API-based integration with the customer's HR management system. These APIs are used to access employee data to ensure users' accounts are created, updated, and disabled securely.
  </Accordion>

  <Accordion title="Does the application support any APIs? How are they consumed internally and externally?">
    Please click here for API Documentation: [https://xoxoday.gitbook.io/plum/user-guide/for-admins-1/xoxo-links/xoxo-link-apis](https://xoxoday.gitbook.io/plum/user-guide/for-admins-1/xoxo-links/xoxo-link-apis)
  </Accordion>

  <Accordion title="How the security of the exposed APIs is managed?">
    We have implemented WAF, IDS/IPS, and Amazon GuardDuty for maximum security. OAuth 2.0 is used to authorize all API requests. We also conduct code reviews to make sure that the APIs are secure.
  </Accordion>

  <Accordion title="Does the platform support typical Single Sign-On paradigms (e.g., Active Directory)?">
    Yes. It supports SSO.
  </Accordion>

  <Accordion title="Explain how the system supports single sign-on and an external roles-based access control system.">
    Our partnerships with a wide array of integration partners ensure existing customer-based SSO capability for all users to seamlessly use Xoxoday's products. With an easy DIY setup, your SSO solution would be plugged in and ready to go.
  </Accordion>

  <Accordion title="How to Authentication/Single Sign On (SSO): products should support the SAML2 standard?">
    Application Integrations: [https://www.application.io/integrations?tab=tab-collaborations](https://www.application.io/integrations?tab=tab-collaborations)
  </Accordion>

  <Accordion title="Products should support the secure VPN standard.">
    It's a web and mobile application.
  </Accordion>

  <Accordion title="Describe your SSO and Federated Identity Enablement integration options.">
    Our partnerships ensure existing customer-based SSO capability for all users. Our identity federation standards include SAML 2.0, SPML, WS-Federation, and more as means of authenticating and authorizing users with airtight security protocol. Please visit: xoxoday.com/integrations
  </Accordion>

  <Accordion title="Does your solution support modern authentication methods, e.g., SAML and OAuth/OIDC against Azure AD?">
    Yes. The application has robust authentication methods. We have integrated SAML 2.0 with SAP SuccessFactors and support OAuth 2.0 and Azure AD for seamless authentication.
  </Accordion>

  <Accordion title="Will the service/solution require integration with other customer solutions/data, either on-premise or in the cloud?">
    We have an option to integrate with SSO and HRMS. For more info, please visit the link: [https://www.application.io/integrations](https://www.application.io/integrations)
  </Accordion>

  <Accordion title="Does your service include Standard Reporting and Analytics Functionalities?">
    Two standard reports are available for admins on SuccessFactors at the program level — Budget and Spot Award Nomination. Using People Analytics, customers can create their own reports and dashboards combining Spot Awards data from Recognition with data from across SuccessFactors. Admins can also access similar data via a Xoxoday logon.
  </Accordion>

  <Accordion title="Can your service, via standard or custom interfaces/APIs, integrate with third party analytics?">
    Yes. Customers can extract data from SuccessFactors via Integration Center and integrate it with other third parties.
  </Accordion>

  <Accordion title="Do you support a Pub Sub architecture model for data transfer?">
    Somewhat. We have a Spot Award Approved event available via Intelligent Service Center on SuccessFactors which customers can use to build custom extensions.
  </Accordion>

  <Accordion title="Please describe user provisioning, on-boarding and off-boarding of end users to the platform.">
    User provisioning for SAP SuccessFactors — Reward and Recognition is handled the same way as the rest of SuccessFactors. For employees redeeming points via Xoxoday, user provisioning is done on the fly at the time of redeeming the awards.
  </Accordion>
</AccordionGroup>

***

## Third Party & Vendor Management

<AccordionGroup>
  <Accordion title="Do contracts with third party vendors that access or host your organization's information assets contain security requirements commensurate with your organization's security standards?">
    We make sure that they have adequate controls in place and meet the security standard.
  </Accordion>

  <Accordion title="Are you managing the offer from end to end or do you rely on suppliers and/or subcontractors?">
    We are managing the platform end to end.
  </Accordion>

  <Accordion title="Are incident reporting obligations passed on to all 3rd parties who are subcontracted by you?">
    Yes. Incident reporting obligations are passed on to all 3rd parties as well. All contracts and agreements are reviewed by the Legal Department.
  </Accordion>

  <Accordion title="Are third party connections to your network monitored and reviewed to confirm only authorized access and appropriate usage?">
    We use Amazon CloudWatch and Grafana which monitor instances and alert us through emails. Infrastructure logs are collected using the AWS Audit Trail, meanwhile application related logs are collected in our Elastic Search server and retained in long-term cloud storage. Administrative logs are part of the Cloud Dashboard and are regularly reviewed.
  </Accordion>
</AccordionGroup>

***

## Service, Support & Upgrades

<AccordionGroup>
  <Accordion title="Is application of patches and upgrades under the provider's responsibility or the customer's?">
    It will be the responsibility of Xoxoday.
  </Accordion>

  <Accordion title="How is the customer informed of application upgrades impacting the end user's client?">
    The process for upgrades is automated using Continuous Integration and Deployment. Since our services are delivered via the web, upgrades and updates are seamless and usually do not involve any actions from end-users.
  </Accordion>

  <Accordion title="Can customers control the timing of software upgrades? What support do you provide during the upgrade process?">
    Xoxoday's architecture goes through constant upliftment and experiences no downtime during upgrades and maintenance windows.
  </Accordion>

  <Accordion title="How often is the platform scheduled for software patches and updates?">
    The process for upgrades is automated using CI/CD. We try to release product hotfixes once every week and major features once every month.
  </Accordion>

  <Accordion title="What is the process for upgrades? How often are new versions released?">
    The process for upgrades is automated using CI/CD. Upgrades and updates are seamless. We try to release hotfixes once every week and major features once every month.
  </Accordion>

  <Accordion title="Support requirement (version updates, future enhancement etc.)">
    Product updates and feature enhancements are done periodically by the application team. These updates are available to all customers by default. The customer need not do anything from their end to update the product version as the application is hosted on AWS Cloud.
  </Accordion>

  <Accordion title="What SLAs apply to the product/service?">
    The time of support ranges between two to forty-eight hours. This depends on the level of service and the gravity of incidents.
  </Accordion>

  <Accordion title="What support methods are available?">
    We have Email Support and an application help center for helping users.
  </Accordion>

  <Accordion title="How would you service and support Union Pacific as a customer?">
    We will be providing training for the admin and the end user and also provide extensive support through our customer support team.
  </Accordion>

  <Accordion title="Is there an individual or group with responsibility for security within the organization?">
    Yes. We have an Information security team and group of people with responsibility for security within the organization.
  </Accordion>

  <Accordion title="If your customer later finds and reports a security hole/issue in the solution, will you provide the patch/fix at no cost?">
    Yes. We fix the issues found at no cost. We understand that consumer data protection is a high priority. We have implemented a Bug Bounty Program and encourage the reporting of security issues. If any outsiders or customers report security-related issues, we fix them free of cost.
  </Accordion>

  <Accordion title="Confirm with CSP which technologies and processes are used to ensure high levels of performance, reliability and availability.">
    We have deployed our application on Amazon Web Services (AWS) cloud platform. We are using MySQL, Salt stack, Node.js, and MongoDB technology.
  </Accordion>

  <Accordion title="Please provide a high-level diagram of your Continuous Integration and Continuous Deployment (CI/CD) pipeline.">
    See the application high-level diagram of CI/CD attached.
  </Accordion>

  <Accordion title="What are the digital infrastructure secure configuration, vulnerability management and patch management policies, procedures and processes?">
    See the following policies attached — Infrastructure Change Control Procedure, Patch Management Procedure, Information System Acquisition Development and Maintenance Procedure, SDLC Procedure, Threat and Vulnerability Management.
  </Accordion>

  <Accordion title="Do you provide customers with security administrative guides that detail configurable security settings, their interpretation and how to implement them?">
    Please click here for more details: [https://help.empuls.io/](https://help.empuls.io/)
  </Accordion>

  <Accordion title="It seems they support credit card processing for adding funds, what is their PCI DSS compliance exposure and level achieved?">
    Payments are redirected to PayU gateway or PayPal websites to complete purchases securely. We are also implementing PCI DSS compliance controls and will provide the certification as soon as possible.
  </Accordion>

  <Accordion title="Estimate implementation duration from project start to go live in first market.">
    Approximately 2 weeks.
  </Accordion>

  <Accordion title="Please describe the typical installation time and resources required for your solution.">
    No installation. We are an out-of-the-box SaaS solution.
  </Accordion>

  <Accordion title="What are any prerequisites recommended to use or access the solution/services effectively?">
    No recommendations as such. The application is a SaaS product supported by a comprehensive web application that can be accessed via desktop and mobile browsers on all compatible devices, including Android and iOS.
  </Accordion>

  <Accordion title="How do you limit data exfiltration from production endpoint devices?">
    We have a multi-layered network architecture with role-based access control. All confidential/PII data is encrypted at rest with a split key mechanism to ensure that every client's key is unique. Additionally, we have an intrusion detection/monitoring application that alerts on unauthorized access.
  </Accordion>

  <Accordion title="Do you have breach detection systems and/or anomaly detection with alerting?">
    Yes.
  </Accordion>

  <Accordion title="Are the hosts where the service is running uniformly configured?">
    Yes.
  </Accordion>

  <Accordion title="If hosted on public cloud (Amazon, Google, Azure etc.) — security configurations are aligned with public cloud vendor security requirements?">
    Yes. We have deployed our application on AWS Virtual platform cloud. We use WAF, IDS/IPS, AWS Audit Trail, Amazon GuardDuty, etc.
  </Accordion>

  <Accordion title="Is there a service that will be a separate test environment? Will this include the use of dummy or live data?">
    Yes. Segregation is done for production and non-production environments.
  </Accordion>

  <Accordion title="Which all locations is the vendor working from or are their offices located?">
    The production center location will be Bangalore.
  </Accordion>
</AccordionGroup>

***

## Compliance Statements

<AccordionGroup>
  <Accordion title="Mandatory Business ownership to be mapped for all applications on-boarded.">
    Xoxoday would act as liaison partner between customer and merchants. We process the budgets which are approved by the customer. Xoxoday application is a SaaS Product.
  </Accordion>

  <Accordion title="Logs should be sent to the customer SIEM for continuous monitoring of security events from the application.">
    The logs are automatically audited, but are not integrated with tenant's security ops. In case the tenant requests logs, they can be shared when asked by the clients.
  </Accordion>

  <Accordion title="When infrastructure is shared, the tenant environments are properly segregated and isolated.">
    It's a multi-tenant system. We use logical data isolation with the help of company-specific encryption keys and it is isolated from other customers' data.
  </Accordion>

  <Accordion title="Vendor has network forensics capabilities in place, and when required, the customer is assisted by the Vendor in performing any investigations on suspicious activities.">
    Infrastructure logs are collected using the AWS Audit Trail, meanwhile application related logs are collected in our Elastic Search server and retained in long-term cloud storage. We provide these logs on a need and approval basis for forensic investigation. We can freeze data from a specific time without freezing other data if needed.
  </Accordion>

  <Accordion title="The concept of least privilege should be employed for specific duties to adequately mitigate risk.">
    We are compliant. We have implemented the password management policy and follow the concept of least privilege. Only a limited number of approved users have privileged access. All access will be provided on a need and approval basis. We maintain a ticketing system to make sure that the appropriate process is followed.
  </Accordion>

  <Accordion title="Passwords shall be implemented on sensitive components to prevent unauthorised access and all default passwords shall be changed.">
    We have implemented the Password Management Policy for maximum security of data.
  </Accordion>

  <Accordion title="Passwords shall be changed at an agreed upon interval.">
    We are compliant. The password will be changed every 90 days.
  </Accordion>

  <Accordion title="Implement network-based technical controls that monitor communications with external systems and with key internal systems for suspicious traffic.">
    These are integrated with security operations/SIEM solutions.
  </Accordion>

  <Accordion title="Secure log-on procedures shall be in place (warning banners, protection against brute force, logging of authentication events, etc.).">
    We have a secure log-on process and are compliant with these requirements.
  </Accordion>

  <Accordion title="Secure log-off procedures shall be followed (maximum session times, termination of inactive sessions).">
    We have a secure log-off process and are compliant with these requirements.
  </Accordion>

  <Accordion title="System logging and auditing features are enabled and configured.">
    Audit logs are reviewed and recorded on a regular basis automatically. These logs are integrated with security operations/SIEM solutions.
  </Accordion>

  <Accordion title="System architecture/interconnection diagrams showing data flows, and physical and logical segmentation shall be reviewed and updated at least quarterly.">
    We review architecture diagrams and data flow diagrams on a periodical basis. This is also validated during our internal and external independent audits.
  </Accordion>

  <Accordion title="Segregation, physically and/or logically, shall be implemented ensuring that the required levels of control for data flows and users are met.">
    We logically segregate the tenant's data, and it is segregated with a client-specific key for proper handling and security reasons.
  </Accordion>

  <Accordion title="Unsecured protocols or protocols with known vulnerabilities shall not be used.">
    We do not use any unsecured protocols.
  </Accordion>

  <Accordion title="All critical applications shall be reviewed and tested after operating system changes or other major changes.">
    All critical applications are reviewed and tested before deployment.
  </Accordion>

  <Accordion title="Development, test and production environments shall be segregated.">
    We have a separate test and production environment.
  </Accordion>

  <Accordion title="Performance and capacity monitoring, such as system and network utilisation, shall be practiced.">
    We monitor systems and network utilization.
  </Accordion>

  <Accordion title="Network IDS may be provided where necessary.">
    We have implemented file integrity (host) and network intrusion detection (IDS) tools to help facilitate timely detection and investigation.
  </Accordion>

  <Accordion title="Performance improvement plans shall be outlined based on successive progression of security controls maturity and based on identified nonconformities.">
    We make sure that we follow industry best practices, the PDCA cycle, and standards in order to safeguard the Information Security System.
  </Accordion>

  <Accordion title="Service Provider shall have strict patching practice to ensure security patches are applied rapidly.">
    All critical patches are applied rapidly.
  </Accordion>

  <Accordion title="Service Provider should have capabilities to integrate security systems with the customer's Security monitoring solution (SIEM).">
    We are a multi-tenant SaaS system and all our logs will contain data of all customers. We will have our own log monitoring and security analysis.
  </Accordion>

  <Accordion title="CLOUD SERVICE PROVIDER (CSP) must ensure CLIENT that its infrastructure is always using up-to-date systems.">
    Yes. All critical patches will be deployed immediately. We ensure that our infrastructure is always using up-to-date systems.
  </Accordion>

  <Accordion title="In multi-tenancy cloud environment, CLOUD SERVICE PROVIDER must ensure the CLIENT environment is segregated from other tenants' environment.">
    We have the ability to logically segment or encrypt customer data such that data may be produced for a single tenant only, without inadvertently accessing another tenant's data.
  </Accordion>

  <Accordion title="The solution is to be deployed and operationalized in a configuration where application and data storage components will reside and operate on separate physical or virtual servers.">
    Compliant. We have deployed our application and database on separate servers.
  </Accordion>

  <Accordion title="Configure REST/Web services to explicitly validate content types.">
    Since the application is a SaaS Platform, this would not be applicable.
  </Accordion>

  <Accordion title="Applications must be designed in such a way that it captures evidence of any action taken by the user to protect itself from denying authenticity of the activity.">
    Infrastructure logs are collected using the AWS Audit Trail, meanwhile application related logs are collected in our Elastic Search server and retained in long-term cloud storage. Administrative logs are part of the Cloud Dashboard and are regularly reviewed.
  </Accordion>

  <Accordion title="The hosted application's architecture must be configured in such a way that data stores containing confidential or regulated information are logically located in a secure network segment.">
    Yes. We logically segregate the tenant's data and the application.
  </Accordion>

  <Accordion title="The hosted web application's architecture is to be deployed and configured with a web application firewall to protect the application.">
    WAF and rate limiters are installed to block multiple requests from specific IPs to prevent DDoS-type attacks.
  </Accordion>

  <Accordion title="All application created sessions, windows, forms, pages, and pop-ups that display highly confidential information must be terminated or closed after the user logs out.">
    Once the user logs out from the application, all pages, forms, and pop-ups will get closed.
  </Accordion>

  <Accordion title="Implement controls to log TLS connection failures.">
    We maintain logs and monitor on a regular basis for security reasons.
  </Accordion>

  <Accordion title="Implement processes to measure the availability, quality, and adequate capacity of resources to deliver the required system performance.">
    Compliant. We have resources to meet these requirements.
  </Accordion>
</AccordionGroup>

***

## Infrastructure & Compliance

<AccordionGroup>
  <Accordion title="How do you continuously monitor and report the compliance of your infrastructure in accordance to industry best practices (OWASP, SANS, SOC, ISO 27001)?">
    We take steps to securely develop and test against security threats to ensure the safety of our customer data. We maintain a Secure Development Lifecycle, in which training our developers and performing design and code reviews takes a primary role. In addition, Xoxoday employs third-party security experts to perform detailed penetration tests on different applications. In addition to the security components provided by our top-level cloud providers AWS, Xoxoday maintains its own dedicated controls by following the industry best practices. These controls cover DDoS attacks, DB protection and a dedicated web application firewall, as well as network firewall fine-grained rules configured using the highest industry standards.
  </Accordion>

  <Accordion title="Are Cloud Hosting services (IaaS) provided?">
    We provide Software as a Service (SaaS).
  </Accordion>

  <Accordion title="What is the service delivery model? (IaaS/PaaS/SaaS)">
    SaaS.
  </Accordion>

  <Accordion title="Is there an Internet-accessible self-service portal available that allows clients to configure security settings and view access logs, security events and alerts?">
    Admins can control the application and will have access to alerts and security events.
  </Accordion>

  <Accordion title="What Services/products are being/will be provided to the customer?">
    Xoxoday application is an API-driven digital rewards platform that automates rewards, incentives and gifting. The storefront has a global catalogue of 20,000+ options with 5,000+ experiences, 2,000+ gift cards and 10,000+ perks. The platform offers reward distribution modes like sending bulk vouchers via emails and generation of bulk voucher codes.
  </Accordion>

  <Accordion title="Do you offer an on-premise solution?">
    No. We are cloud hosted only.
  </Accordion>

  <Accordion title="Describe in detail your product's architecture.">
    We will share this as an attachment upon request.
  </Accordion>

  <Accordion title="Describe the key differentiators of your technical architecture.">
    Cloud hosted, microservice-based, highly scalable, High Availability.
  </Accordion>

  <Accordion title="Describe the minimum and recommended system requirements for your solution.">
    NA — We are cloud hosted.
  </Accordion>

  <Accordion title="Describe your solution's networking requirements and capabilities.">
    NA — We are cloud hosted. Users need to have internet access.
  </Accordion>

  <Accordion title="Is your solution available in a seamless manner to access as an app on different mobile devices and as web app on different desktop devices?">
    Yes. The solution is available as part of SAP SuccessFactors solution on web, as well as the SuccessFactors native mobile app for both iOS and Android.
  </Accordion>

  <Accordion title="Mobile Device Availability? (Android and iOS)">
    It's accessible in a mobile browser and can be accessed via an Android or iOS device.
  </Accordion>

  <Accordion title="Tablet Device Availability? (Android and iOS)">
    Our applications are compatible with desktops, tablets, and mobiles. No additional components are required.
  </Accordion>

  <Accordion title="Browser compatibility? (MS Edge, Chrome, Safari, IE)">
    Our applications are compatible with desktops, tablets, and mobiles. No additional components are required.
  </Accordion>

  <Accordion title="Technology Stack? (Infrastructure / Frontend / Backend / Database)">
    AWS / Kubernetes — React — Node/GraphQL — MySQL/MongoDB.
  </Accordion>

  <Accordion title="What technology languages/platforms/stacks/components are utilized in the scope of the application?">
    We have deployed our application on Amazon Web Services (AWS) cloud platform. We are using MySQL, Salt stack, Node.js and MongoDB technology.
  </Accordion>

  <Accordion title="Is the application developed on the latest language framework?">
    Yes. We are using the latest language frameworks like MySQL, JavaScript, Node.js and MongoDB.
  </Accordion>

  <Accordion title="Is the application developed using secure libraries?">
    Yes. These are approved during the code review process wherein the reviewer checks the utility and security of the libraries.
  </Accordion>

  <Accordion title="Where is the primary data center? Backup data center?">
    We have deployed our application on AWS Cloud virtual platform. The backup data center is in Singapore.
  </Accordion>

  <Accordion title="Describe the network topology.">
    The data centers are hosted completely in isolation so that access is limited and controlled. Load balancer allows shifting incremental load and can auto scale based on data load. Each instance (EC2) under a fortified VPC network is a conglomeration of Docker Container Web Services and APIs and application layer running on top. Amazon CloudWatch is implemented to enable monitoring. The data is encrypted using 256-encryption-based SSL certificate. Xoxoday plans a quarterly VAPT-based security audit.
  </Accordion>

  <Accordion title="Describe your network configuration and how your sensitive data system is protected.">
    Plum by Xoxoday is a cloud-based SaaS platform hosted on VPC infrastructure of AWS. The data centers are hosted in complete isolation. The architecture allows adding more location-specific data centers for latency and data security. Load balancers allow auto-scaling. Each EC2 instance under fortified VPC network is a conglomeration of Docker Container Web Services and APIs. Amazon CloudWatch is implemented for monitoring. Data is encrypted using TLS 1.3 in transit and AES-256 at rest.
  </Accordion>
</AccordionGroup>

***

## Backup, Recovery & Business Continuity

<AccordionGroup>
  <Accordion title="Have you implemented backup or recovery mechanisms to ensure compliance with regulatory, statutory, contractual or business requirements?">
    Data backups are done daily and in a secured way in AWS.
  </Accordion>

  <Accordion title="If using virtual infrastructure, does your cloud solution include independent hardware restore and recovery capabilities?">
    We use AWS Virtual platform cloud. We have created an Amazon CloudWatch alarm that monitors Amazon EC2 instances and automatically recovers them if impaired. EBS Snapshot functionality allows us to capture and restore virtual machine images at any time.
  </Accordion>

  <Accordion title="Does your infrastructure environment solution include software/provider independent restore and recovery capabilities?">
    Yes, the infrastructure environment solution includes software/provider independent restore and recovery capabilities.
  </Accordion>

  <Accordion title="Do you test your backup or redundancy mechanisms at least annually?">
    Yes. Data backups are automated and done daily in a secured way on AWS. We test the backup or redundancy mechanisms at least annually.
  </Accordion>

  <Accordion title="Does the RTO and RPO of CSP's contingency plan meet with vendor's customer requirements?">
    Our RTO and RPO is 60 minutes.
  </Accordion>

  <Accordion title="Has Supplier implemented data backup and recovery procedures to prevent data loss, unwanted overwrite and/or destruction?">
    Yes. Data backups are done daily and in a secured way in AWS.
  </Accordion>

  <Accordion title="Does the organisation store backups offsite?">
    Data backups are done on a daily basis and in a secured way on AWS.
  </Accordion>

  <Accordion title="Are all systems, assets and information backed up based on a BIA which establishes RPO/RTO?">
    We take automated backups on a regular basis.
  </Accordion>

  <Accordion title="Shall a backup be taken before and after any major changes to hardware, OS, application or configuration?">
    Yes. We take a backup of all data before making any major changes to hardware and software.
  </Accordion>

  <Accordion title="There shall be a detailed backup procedure based on the established RPO and RTO.">
    We have implemented the Backup Recovery Procedure.
  </Accordion>

  <Accordion title="What backup and disaster recovery plans are in place to avoid data loss/service loss in the time of contingency?">
    We have Business Continuity Policy and Business Continuity Management Procedure in place, tested periodically. Our policies are reviewed and audited annually. We test the BCP every 12 months, reviewed as part of internal and external audits.
  </Accordion>

  <Accordion title="Have you applied a data backup mechanism? What is the frequency of backup?">
    Yes. Data backups are done on a daily basis in a secured way in AWS.
  </Accordion>

  <Accordion title="Is your backup mechanism tested at least annually?">
    Yes. It is tested annually.
  </Accordion>

  <Accordion title="All backup data should be encrypted and adequately protected against unauthorized access.">
    Yes. All data backup is encrypted.
  </Accordion>

  <Accordion title="Are you able to restore user data upon loss through disk recovery mechanisms or stored backups?">
    Yes. It can be recovered.
  </Accordion>

  <Accordion title="Do you possess ISO 22301 for Business Continuity?">
    We have implemented the Business Continuity Management Policy and test the BCM plan annually. The BCM policy is attached for reference.
  </Accordion>

  <Accordion title="What type of DR options do you provide for my data within your offering?">
    We have implemented policies and procedures with regard to DR. Since we have deployed our application on AWS cloud, they provide DR services.
  </Accordion>

  <Accordion title="Please share the logical diagram with DR in place.">
    The application network architecture diagram is attached upon request.
  </Accordion>
</AccordionGroup>

***

## Application Development & SDLC

<AccordionGroup>
  <Accordion title="Do you test your applications before they are promoted into the Production environment? What types of testing do you perform?">
    We have an SDLC Policy as per ISMS requirements and follow General Coding Practice. We conduct data validation on a trusted system, use cryptographic functions to protect secrets, and perform code reviews, vulnerability assessments, and penetration testing. We follow a blue-green deployment strategy that introduces new changes without downtime and provides rollback capability.
  </Accordion>

  <Accordion title="Do you have a defined quality change control and testing process in place?">
    Yes. Changes to the production environment are documented, tested, and approved prior to implementation. Production software and hardware changes may include applications, systems, databases, and network devices requiring patches, service packs, and other updates.
  </Accordion>

  <Accordion title="Do you have controls in place to ensure that standards of quality are being met for all software development?">
    We have implemented the SDLC Procedure and standards of quality are met for all software development.
  </Accordion>

  <Accordion title="What controls do you have in place to detect source code security defects for any outsourced software development activities?">
    We have not outsourced software development activities. Our code reviews and analysis run through stringent automated technologies as well as manual source code overviews to cover any security loopholes prior to the production phase.
  </Accordion>

  <Accordion title="Are mechanisms in place to ensure that all debugging and test code elements are removed from released software versions?">
    Yes. All debugging and test code elements are removed from released software versions.
  </Accordion>

  <Accordion title="Do you use an automated source code analysis tool to detect security defects in code prior to production?">
    Yes. We use an automated source code analysis tool.
  </Accordion>

  <Accordion title="Privacy by Design is incorporated into all your developments and services.">
    We are proactively embedding privacy into the design and operation of IT systems, networked infrastructure, and business practices.
  </Accordion>

  <Accordion title="Does the software development lifecycle in the organisation specifically focus on security?">
    We focus on security while producing software. SDLC procedures are attached for reference.
  </Accordion>

  <Accordion title="Are development, test and production environments separate?">
    Yes. All environments are separate.
  </Accordion>

  <Accordion title="Is production data ever used in a test environment?">
    No. We do not use production data in test environments.
  </Accordion>

  <Accordion title="Is testing of applications done on a separate testing facility and not on production data?">
    Yes. Both are kept separate.
  </Accordion>

  <Accordion title="Are patches tested in a UAT instance before deployment on the production server?">
    Yes.
  </Accordion>

  <Accordion title="Are applications and operating system software implemented after extensive and successful security testing?">
    Any applications and software are implemented after security testing by our IT team. All logs are monitored. We maintain an approved software/application register, audited during internal and external audits. Users are disallowed from installing software on their workstations.
  </Accordion>

  <Accordion title="Do you do static code analysis?">
    Yes. We have static code analysis.
  </Accordion>

  <Accordion title="How do you ensure code is being developed securely?">
    We have an SDLC Policy per ISMS requirements and follow General Coding Practice including data validation on a trusted system, cryptographic functions to protect secrets, and least privilege — restricting users to only the functionality, data, and system information required for their tasks.
  </Accordion>

  <Accordion title="What percentage of your production code is covered by automated tests?">
    More than 50% of our production code is covered by automated tests.
  </Accordion>

  <Accordion title="Is a staging/pre-production system used to validate build artifacts before promotion to production?">
    We do not use staging for building artifacts.
  </Accordion>

  <Accordion title="How is application security testing performed? Internal, third parties, or both? How often is it tested?">
    We conduct application security testing with the help of industry-approved third-party vendors every six months. Any observations found are addressed by our team. The primary objective is to identify and eliminate problems that could lead to a breach of confidentiality, availability, or integrity of Xoxoday data resources.
  </Accordion>

  <Accordion title="Any product pre-release security threat modeling, secure coding practice, security architecture review and penetration testing?">
    Yes. Our code reviews run through stringent automated technologies and manual source code overviews. Vulnerability scanning gives deep insight for quick identification of non-compliant systems. Xoxoday also employs third-party security experts to perform VAPT.
  </Accordion>

  <Accordion title="Is application development following secure coding standards such as OWASP?">
    Yes. Code reviews and analysis run through stringent automated technologies as well as manual source code review. Multiple security checks including code reviews, web vulnerability reviews, and advanced security tests are performed in every build.
  </Accordion>

  <Accordion title="Is the code reviewed by peer or externally?">
    Yes. Code is reviewed both internally and externally. We engage third-party vendors for security testing every six months.
  </Accordion>

  <Accordion title="Please provide further information about your handling of security requirements during development.">
    All software development procedures are supervised and monitored by Xoxoday to include: security requirements, independent security review of the environment, code reviews, quality monitoring, evaluation, and acceptance criteria for information systems.
  </Accordion>

  <Accordion title="Describe the management system in place to fix vulnerabilities identified during control activities.">
    Our QA department reviews and tests our code base. Dedicated application security engineers identify, test, and triage security vulnerabilities. We also conduct code reviews and VAPT with the help of a third-party vendor. VAPT Certificate is attached.
  </Accordion>

  <Accordion title="Do you have a managed process for approving new 3rd Party Libraries?">
    Yes. This is part of the code review process wherein the reviewer checks the utility and security of the 3rd party library.
  </Accordion>

  <Accordion title="Develop applications based on secure coding guidelines.">
    Compliant. The application is developed based on secure coding guidelines and code reviews are conducted per compliance requirements.
  </Accordion>

  <Accordion title="Implement controls to obfuscate application code prior to compilation.">
    Compliant.
  </Accordion>

  <Accordion title="Configures web services in accordance with OWASP.">
    Compliant. Yes, we follow all technical guidelines for development that come under the Open Web Application Security Project.
  </Accordion>

  <Accordion title="Configure web services to prevent sensitive information leakage in response headers.">
    Compliant. We have implemented DLP techniques and there are no possibilities of data leakage or loss.
  </Accordion>

  <Accordion title="Configure web services to use secure HTTP headers.">
    Compliant. The application uses HTTPS.
  </Accordion>

  <Accordion title="Implement strict HTTP transport security headers to protect websites against protocol downgrade attacks and cookie hijacking.">
    Compliant. We use strict HTTP transport security.
  </Accordion>

  <Accordion title="Impose file upload frequency restrictions in applications to prevent abuse or attack.">
    We cannot impose file upload frequency restrictions. However, the application has technical and organizational measures to prevent attacks through WAF, log monitoring, AWS GuardDuty, Amazon CloudWatch, IDS/IPS, etc.
  </Accordion>
</AccordionGroup>

***

## Access Control & Authentication

<AccordionGroup>
  <Accordion title="Do you have an identity management system (enabling classification of data for a customer) in place to enable both role-based and context-based entitlement to data?">
    We have a role-based access system to make sure that only authorized individuals have access to the required information.
  </Accordion>

  <Accordion title="Do you provide customers with strong (multifactor) authentication options (e.g., digital certs, tokens, biometrics)?">
    We don't provide multi-factor authentication as a default. As of now, there's OAuth 2.0 and SAML-based tokens. JSON-based token is available for maximum security direct-email logins.
  </Accordion>

  <Accordion title="Does the SaaS support MFA such as OTP, security tokens, or biometrics?">
    No, we don't provide multi-factor authentication as a default. As of now, there's OAuth 2.0 and SAML-based tokens. JSON-based token is available for maximum security direct-email logins.
  </Accordion>

  <Accordion title="Do you allow customers to define password and account lockout policies for their accounts?">
    It can be configured with Active Directory.
  </Accordion>

  <Accordion title="Do you restrict personnel access to all management functions or administrative access based on the principle of least privilege?">
    Access to data and systems is based on the principles of least privilege. All information systems and data are classified and segregated to support role-based access requirements. We use MFA, Firewall, VPN, Active Directory, etc. for maximum security.
  </Accordion>

  <Accordion title="How do you verify password strength?">
    The password needs to be a minimum of 8 characters long and contain at least one capital letter, special characters among '# \$ % \* &' and 1 digit. These are reviewed monthly.
  </Accordion>

  <Accordion title="How are passwords stored (encrypted, hashed, algorithm or hashing methodology)?">
    We store passwords hashed. We have SHA-512 hash with unique salt for every password.
  </Accordion>

  <Accordion title="How are passwords hashed?">
    We store passwords hashed. We have SHA-512 hash with unique salt for every password.
  </Accordion>

  <Accordion title="Does your solution follow any particular internationally accepted best practices or standards for password management?">
    Yes. Our password requirements comply with all factors to ensure strong passwords: minimum length, special characters, capitalized letters, and alpha-numeric combinations. Passwords are stored after encryption.
  </Accordion>

  <Accordion title="Does the solution force the new user to change the password for their first logon and on expiry?">
    Yes.
  </Accordion>

  <Accordion title="Can passwords be changed by the user at anytime?">
    Yes.
  </Accordion>

  <Accordion title="Can the solution alert the security administrator to delete a UserID if it has not been used for predefined days?">
    The solution does not allow login using credentials that have not been used. Admins can create and delete user accounts.
  </Accordion>

  <Accordion title="Can users be prevented from logging into multiple terminals simultaneously?">
    It's a SaaS solution. Users can log in from multiple locations.
  </Accordion>

  <Accordion title="Does the solution have other options of logon inputs besides user ID and password?">
    No. Users need to login with user ID and password. However, we have integrations with Zoho CRM, HubSpot, DarwinBox, SurveyMonkey, Freshdesk, etc.
  </Accordion>

  <Accordion title="What is the idle session timeout and session expiration?">
    Since it's a SaaS product, session timeout can be set with the help of Active Directory. For example — 15 min or 20 mins as per requirements.
  </Accordion>

  <Accordion title="Is there account lockout functionality? What is the maximum number of failed login attempts before the account gets locked out?">
    The account will get automatically locked after 5 unsuccessful login attempts.
  </Accordion>

  <Accordion title="What is the account unlock process?">
    Users will get a reset password link and can unlock their account through that.
  </Accordion>

  <Accordion title="Share the User ID lifecycle process, from creation till termination of a user ID/account.">
    User accounts will be created by the admin and linked with the email ID of the users. Please refer to the admin guide: [https://xoxoday.gitbook.io/plum/user-guide/for-admins-1](https://xoxoday.gitbook.io/plum/user-guide/for-admins-1)
  </Accordion>

  <Accordion title="Does access provided to users and administrators follow Need to Know basis?">
    Yes.
  </Accordion>

  <Accordion title="Is two-factor authentication enabled for end users and Administrators?">
    Yes. Two-factor authentication is enabled. MFA devices like Google Authenticator are available for OTP/Codes/Passwords.
  </Accordion>

  <Accordion title="Does MFA apply while accessing cloud environment/applications remotely (VPN, VDI)?">
    Yes.
  </Accordion>

  <Accordion title="How is Segregation of Duties (SoD) implemented for various user access roles?">
    We have procedures for Roles, Responsibilities & Authorities at Xoxoday. Per the access control policy, access to data is provided only to authorized and appropriate individuals.
  </Accordion>

  <Accordion title="Detail out the organization password policy.">
    Password policy: Must contain at least 8 characters, numbers and letters, uppercase (A-Z), lowercase (a-z), digits (0-9), and non-alphabetic characters (e.g., !, \$, #, %). Password must be changed every 90 days. Passwords are shared through secure, encrypted channels.
  </Accordion>

  <Accordion title="Supplier has internal processes for identity and access management.">
    Yes. Policies and procedures enforce two-factor authentication for privileged account management while accessing tenant data/systems. An IAM solution manages user access through role-based access profiles based on the need-to-know principle and segregation of duties.
  </Accordion>

  <Accordion title="Control panel or administration console to the service is properly protected from abuse. Segregation of duties is implemented for privileged users.">
    By default, Xoxoday will not have access to service data. Access control is managed by the admin from the customer end. If we require access for troubleshooting, we request temporary access, and the customer decides. Access to our production environment is allowed only via the Xoxoday corporate network to authorized individuals.
  </Accordion>

  <Accordion title="What kind of identity and access management services are provided?">
    Please refer to the admin guide on SSO Logins: [https://xoxoday.gitbook.io/plum/user-guide/for-admins-1/getting-started](https://xoxoday.gitbook.io/plum/user-guide/for-admins-1/getting-started)
  </Accordion>

  <Accordion title="Are access to utility programs used to manage virtualized partitions appropriately restricted and monitored?">
    Yes. Access has been restricted and monitored for security reasons.
  </Accordion>

  <Accordion title="Do you have complexity or length requirements for passwords?">
    Yes. We have complexity and length requirements for passwords.
  </Accordion>

  <Accordion title="Do you review user access and rights at least annually?">
    We review user access on a periodical basis, validated during internal and external audits.
  </Accordion>
</AccordionGroup>

***

## Network Security & Firewall

<AccordionGroup>
  <Accordion title="Do your network architecture diagrams clearly identify high-risk environments and data flows?">
    Yes. We have captured this information in our architecture and data flow diagrams.
  </Accordion>

  <Accordion title="Are all non-internet facing systems placed behind a firewall?">
    Yes, we have a firewall.
  </Accordion>

  <Accordion title="Does the vendor have a comprehensive network architecture diagram covering infrastructure used for customer operations?">
    Yes, we have the network architecture diagram.
  </Accordion>

  <Accordion title="Is the internet access secure through a proxy/firewall?">
    Yes, we have configured secure internet access.
  </Accordion>

  <Accordion title="Are roles and responsibilities defined for Firewall configuration?">
    Yes, we have configured these.
  </Accordion>

  <Accordion title="Is there a proactive mechanism to monitor unauthorised network access attempts?">
    Yes. We have IDS and IPS implemented and receive alerts for unauthorised network access.
  </Accordion>

  <Accordion title="Is the firewall rule base reviewed at regular intervals?">
    Yes. It's reviewed on a monthly basis.
  </Accordion>

  <Accordion title="Does the firewall have real-time logging and alerting capability?">
    Yes.
  </Accordion>

  <Accordion title="Are prior management approvals obtained and communication provided to the customer in case of any external connections to parties other than the customer?">
    Yes.
  </Accordion>

  <Accordion title="Are all servers, end user devices configured according to security standards as part of the build process?">
    Yes. All are configured according to security standards as part of the build process.
  </Accordion>

  <Accordion title="Are Intrusion Detection Systems (IDS) or Intrusion Prevention Systems (IPS) used by your organisation?">
    We have implemented IDS/IPS to facilitate timely detection, investigation by root cause analysis, and response to incidents.
  </Accordion>

  <Accordion title="Is wireless access allowed in your organisation?">
    Wireless access is allowed and handled with high-quality routers, password protection and restriction on internet usage.
  </Accordion>

  <Accordion title="Are network boundaries protected by firewalls?">
    Yes. We have installed firewalls for maximum security and configured them to restrict unauthorised traffic.
  </Accordion>

  <Accordion title="Is data import, data export, and service management conducted over secure, industry-accepted standardized network protocols?">
    All data is collected only through the Xoxoday Platform.
  </Accordion>

  <Accordion title="What type/model of Firewall is implemented to segregate security zones and protect the infrastructure from external attacks?">
    We use a Web Application Firewall (WAF).
  </Accordion>

  <Accordion title="How are operating systems hardened to provide only the necessary ports, protocols and services to meet business needs?">
    We harden the operating systems and restrict access to all ports, applications, and software, monitored on a regular basis.
  </Accordion>

  <Accordion title="Describe how you protect your wireless network environment from unauthorized access.">
    We have implemented policies and mechanisms to protect the wireless network environment. We use a cloud-hosted VPN with strict access controls to allow our employees to access the official network. This VPN is managed by our IT team and linked with SSO/Active Directory.
  </Accordion>

  <Accordion title="Is the network used for providing service to the customer logically and physically segregated? Is the server placed on a separate LAN?">
    Yes. It's logically and physically segregated. We have deployed our application on AWS Cloud platform.
  </Accordion>

  <Accordion title="Are external access (e.g., remote, wireless, third party) to the network only permitted after a user has been identified and authenticated?">
    We do not provide external access.
  </Accordion>

  <Accordion title="Whether Firewall, IPS/IDS, DLP, Anti APT, SIEM, AntiSpoofing and other security solutions have been implemented?">
    We have implemented IDS/IPS, Endpoint security, Firewall, DLP, Antispoofing, VPN, Active Directory and other security solutions for maximum security.
  </Accordion>

  <Accordion title="Are internal and external networks separated by firewalls with access policies and rules?">
    Yes. With multiple layered firewalls configured with deny-all mode allowing only specific rules required for business, network traffic is regulated. We have implemented intrusion detection and prevention system tools for timely detection and investigation.
  </Accordion>

  <Accordion title="Is there a standard approach for protecting network devices to prevent unauthorised access/network related attacks and data theft?">
    With multiple layered firewalls in deny-all mode, network traffic is regulated. We use tools that analyze various traffic patterns and correlate network events. Early warning signals trigger alerts to our team. We are equipped to detect and mitigate threats, DDoS attacks, session hijacks, login spoofs, or any other data extraction strategies.
  </Accordion>

  <Accordion title="Any host-based IPS for critical systems? Any next generation firewall, IPS and web application firewall?">
    Yes. As part of WAF, rate limiters are installed to block multiple requests from specific IPs to prevent DDoS-type attacks. These are powered by intelligent daemons that detect other identifiers like URLs accessed or other client properties to automatically blacklist possible threats.
  </Accordion>

  <Accordion title="Are network components and computers password protected?">
    All our network components and computers are password protected to ensure compliance with integrity, availability, and confidentiality principles of Information Security.
  </Accordion>

  <Accordion title="Is the production network segmented into different zones based on security levels?">
    Yes.
  </Accordion>

  <Accordion title="What is the process for making changes to network configuration?">
    We have Network Access Control and Security Procedure in place. Network resources must be on a need-to-know basis and authorizations must be obtained from appropriate authorities. Networks are logically or physically divided based on the criticality of the information stored.
  </Accordion>

  <Accordion title="Describe how you protect against attacks that target virtual infrastructure directly (shimming, Blue Pill, Hyper jumping, etc.)">
    We have WAF, IDS/IPS, AWS GuardDuty, Cloudflare, and data encryption. We conduct code reviews and VAPT annually with a third-party vendor. We are equipped to detect and mitigate DDoS attacks, session hijacks, login spoofs, or any other data extraction strategies.
  </Accordion>

  <Accordion title="Is application deployed behind the firewall and IDS/IPS?">
    We use Cloudflare Web Application Firewall (WAF) and IDS/IPS for maximum security.
  </Accordion>

  <Accordion title="Does WAF protect from application attacks?">
    Yes. We have implemented the Web Application Firewall (WAF).
  </Accordion>

  <Accordion title="Service Provider should have solid application security controls such as WAF and RASP to detect and block web-based attacks such as XSS, SQL Injection, and CSRF.">
    We have a web application firewall, IDS/IPS, SQL injection protection. We use Cloudflare for the same.
  </Accordion>

  <Accordion title="What cryptographic frameworks are used to secure data in transit over public networks?">
    Yes. Our network communication is encrypted with highly restricted protocols to ensure maximum security. We use TLS 1.2 encryption for data in transit.
  </Accordion>

  <Accordion title="Describe the network protocols used to communicate between components of the system (e.g., HTTPs, LDAP, SSL).">
    We use HTTPS and our network communication is encrypted with highly restricted protocols to ensure maximum security.
  </Accordion>

  <Accordion title="I cannot find anywhere in their documentation that they support IP address range restriction for the application API, could we get confirmation?">
    We do not provide support for IP address range restriction. Our restrictions/security are based on our OAuth process and do not restrict to specific IPs.
  </Accordion>
</AccordionGroup>

***

## Logging, Monitoring & Audit

<AccordionGroup>
  <Accordion title="Do you monitor and log privileged access (e.g., administrator level) to information security management systems?">
    Yes. We monitor the logs. Application and infrastructure logs are centrally collected and backed up in a secure manner for internal development and audit-related concerns.
  </Accordion>

  <Accordion title="Does the organisation maintain audit logs of user activities, exceptions, and security events on all systems that store or process sensitive data?">
    Yes. We maintain the records.
  </Accordion>

  <Accordion title="Do these audit logs contain details regarding the User ID, timestamp, and what actions were performed?">
    Yes. Since we record Services and Server logs at the level of virtual machine, and Audit and Access logs at the level of AWS, all these are covered.
  </Accordion>

  <Accordion title="At what frequency are these logs reviewed?">
    Monthly.
  </Accordion>

  <Accordion title="Is the ability to delete event logs restricted to only superadmin or host admin?">
    Yes. Only authorised individuals can do this.
  </Accordion>

  <Accordion title="Are changes made to virtual machines or moving of an image made immediately available to customers through electronic methods?">
    Audit logs are reviewed and recorded on a regular basis automatically. These logs are integrated with security operations/SIEM solutions. We provide logs to the customer on a need and approval basis.
  </Accordion>

  <Accordion title="Are system administrator and system operator activities monitored and logged?">
    We maintain logs and monitor for security and audit purposes.
  </Accordion>

  <Accordion title="Are the system clocks of all information processing systems synchronized with an agreed accurate time source?">
    Yes. System clocks of all relevant information processing systems are synchronized to facilitate tracing and reconstitution of activity timelines.
  </Accordion>

  <Accordion title="Do you use a synchronized time-service protocol (e.g., NTP) to ensure all systems have a common time reference?">
    Yes.
  </Accordion>

  <Accordion title="What is the log retention policy? Who has access to logs in your organization?">
    We maintain logs for at least 180 days. Only the CTO and Production Head will have access to these logs. There will be no modification to these logs.
  </Accordion>

  <Accordion title="Who has access to Security logs?">
    Only authorised individuals have access to the security logs — e.g., CTO, DevOps Head, Production Head.
  </Accordion>

  <Accordion title="How long are security logs maintained by the provider?">
    At least 180 days.
  </Accordion>

  <Accordion title="IS logging enabled for all components, such as network devices, servers, DBs, IAM, Cloud Services?">
    Yes. Only authorised individuals have access.
  </Accordion>

  <Accordion title="Do you have a SIEM for monitoring and maintaining logs over security incidents?">
    Yes. We have a SIEM in place for monitoring and maintaining logs over security incidents from various components.
  </Accordion>

  <Accordion title="Provide the scope of data sources merged in your SIEM and confirm if configured for granular analysis and real-time alerting.">
    Yes, SIEM has been implemented. Our event management systems merge data sources to maintain log data within the SIEM. This helps in proper analysis and driving out alerts in case of contingency. Audit logs are reviewed and recorded automatically. These logs are integrated with security operations/SIEM solutions.
  </Accordion>

  <Accordion title="Is a SOC implemented to monitor the software solution? Can the customer gain access to the SOC alert and response reporting?">
    We have implemented the Security Operations Center to monitor, prevent, detect, investigate, and respond to cyber threats around the clock.
  </Accordion>

  <Accordion title="Does the Company run a Security Operations Center (or equivalent) which allows detection and response to Cyber Security Incidents?">
    Cyber security incidents are analyzed with network intrusion detection (IDS) tools. The incident response team is immediately notified for counter-actions and defense mechanisms. We have a Security incident management process to classify and handle incidents and security breaches.
  </Accordion>

  <Accordion title="Are all security events (authentication events, SSH session commands, privilege elevations) in production logged?">
    Yes.
  </Accordion>

  <Accordion title="Can logs be integrated into a SIEM system?">
    No. Logs are automatically audited but are not integrated with tenant's security ops. In case the tenant requests logs, they can be shared when asked by the clients.
  </Accordion>

  <Accordion title="Is a service available for APIs to push the logs of our company's administrators' operations on the Vendor platform in real time?">
    No. We do not have such a service. The key admin actions are present in the application reports. Our support team can help with a deep dive into a specific incident with the help of audit logs.
  </Accordion>

  <Accordion title="Is there a support for operation logs on the admin console? What operations do the audit logs monitor?">
    Yes. Audit logs are reviewed and recorded on a regular basis automatically. These logs are integrated with security operations/SIEM solutions.
  </Accordion>

  <Accordion title="Logging and monitoring is in place for analysing activities of privileged users as well as for inspecting and analysing network traffic.">
    All infrastructure logs are collected using the AWS Audit Trail, meanwhile application related logs are collected in our Elastic Search server and retained in long-term cloud storage. The audit logs are reviewed and recorded automatically. These logs are integrated with security operations/SIEM solutions.
  </Accordion>

  <Accordion title="Logs are reviewed in a continuous manner to improve performance as well as detect potential security issues.">
    Yes. Our event management systems merge data sources to maintain log data within the SIEM. This helps in proper analysis and driving out alerts if needed.
  </Accordion>

  <Accordion title="Do you monitor and log user, system and administrative access?">
    We monitor logs on a regular basis. Infrastructure logs are collected using AWS Audit Trail. Application related logs are collected in our Elastic Search server and retained in long-term cloud storage.
  </Accordion>

  <Accordion title="What logging and monitoring capabilities are in place to detect unauthorised access to data or hacking attempts?">
    We use a cloud-hosted VPN with strict access controls. We have implemented intrusion detection tools for timely detection and investigation. File integrity and network intrusion detection (IDS) tools are implemented. We also have Endpoint security software for all computers.
  </Accordion>

  <Accordion title="Are independent IT security testing programs, assurance, audit and/or assessments performed? How frequently?">
    We perform internal and external audits annually. We also conduct security assessments and testing like VAPT every six months. We communicate these assessment results to clients on a yearly basis.
  </Accordion>

  <Accordion title="Does your internal security group carry out audits on your Information Security Management System?">
    Yes. We conduct audits on our Information Security Management System. The last audit date was 16th June 2021.
  </Accordion>

  <Accordion title="Will event logging/audit mechanisms be turned on at all times for the system?">
    Yes.
  </Accordion>

  <Accordion title="Will logs be regularly reviewed?">
    Yes. Administrative logs are part of the Cloud Dashboard and are regularly reviewed.
  </Accordion>

  <Accordion title="Are systems and networks monitored for security events?">
    We use Bitdefender Endpoint security software to prevent malware and protect data. Additionally, we have AWS GuardDuty threat detection service that continuously monitors for malicious activity and unauthorised behaviour. We use Amazon CloudWatch and Grafana which monitor instances and alert us through emails.
  </Accordion>

  <Accordion title="Do you have any monitoring tool in place to get timely alerts on when a device is going down, restarted, or resources are over utilized?">
    We have an intrusion detection/monitoring application that alerts on unauthorized access. We use Amazon CloudWatch and Grafana which monitor instances and alert us through emails.
  </Accordion>

  <Accordion title="How do you monitor system integrity, logs, intrusion detection, and system access?">
    Infrastructure logs are collected using AWS Audit Trail. Application related logs are collected in our Elastic Search server and retained in long-term cloud storage.
  </Accordion>

  <Accordion title="Are audit logs maintained that record user activities, exceptions, success and failure logons, policy changes, and information security events?">
    Yes. All audit logs are monitored as a best practice.
  </Accordion>

  <Accordion title="Are servers configured to capture who accessed a system and what changes were made?">
    Yes. Infrastructure logs are collected using the AWS Audit Trail, meanwhile application related logs are collected in our Elastic Search server and retained in long-term cloud storage.
  </Accordion>

  <Accordion title="Detail out the process for security event logging and monitoring (including applicable correlation rules). Detail the log retention period and protection mechanisms to prevent log tampering.">
    Yes. Our event management systems merge the data sources to maintain a log data within the SIEM. This helps in proper analysis and driving out alerts if needed in case of contingency.
  </Accordion>

  <Accordion title="What alerts can be set in the system?">
    At Xoxoday, the following are recorded in audit logs: 1. Infrastructure logs — collected using AWS Audit Trail. 2. Application related logs — collected in our Elastic Search server and retained in long-term cloud storage.
  </Accordion>
</AccordionGroup>

***

## Data Protection & Encryption

<AccordionGroup>
  <Accordion title="Are you capable of supporting litigation holds (freeze of data from a specific point in time) for a specific customer without freezing other customer data?">
    Yes. We can freeze data from a specific time without freezing other data if needed.
  </Accordion>

  <Accordion title="Do you have the capability to recover data for a specific customer in the case of a failure or data loss?">
    We have a data loss prevention solution in place and data will not be lost.
  </Accordion>

  <Accordion title="What is the purpose for processing the Personal Data?">
    Personal data will be processed only for rewards and redemption purposes.
  </Accordion>

  <Accordion title="Can Supplier provide a data map which includes all country locations where Personal Data would traverse, be stored or processed?">
    Yes. We can provide the data flow diagram.
  </Accordion>

  <Accordion title="Have you implemented measures for prevention of loss of PII data? (e.g., DLP, restricted access controls, log recording, encryption)">
    We use technologies like DLP, Data encryption, access control, and log monitoring.
  </Accordion>

  <Accordion title="Is data import, data export, and service management conducted over secure industry-accepted standardized network protocols?">
    All data is collected only through the Xoxoday Platform.
  </Accordion>

  <Accordion title="Describe how you make sure the customer's data is properly segregated from other customers' in multi-tenant solutions.">
    Yes. The data is segregated with a client-specific key for proper handling and representation. Physical segregation is done for production and non-production environments.
  </Accordion>

  <Accordion title="Would you support encryption keys generated by our own PKI that would be used to encrypt data?">
    We use a split key mechanism to ensure that every client's key is unique. It's generated automatically from our end.
  </Accordion>

  <Accordion title="What type of mechanisms do you implement to make sure Data Integrity is protected against errors, corruption or misuse?">
    We have WAF, IDS/IPS, AWS GuardDuty, Cloudflare, and encrypted data. We conduct code reviews per compliance requirements and VAPT annually with a third-party vendor. We are equipped to detect and mitigate threats, DDoS attacks, session hijacks, login spoofs, or any other data extraction strategies.
  </Accordion>

  <Accordion title="Describe how you make sure the application is properly protected against exploitation of CVE vulnerabilities prior to allowing it to go to production.">
    Yes. We do testing before deploying in the production environment.
  </Accordion>

  <Accordion title="Is data import and export conducted over secure, industry-accepted standardized network protocols?">
    All data is collected only through the Xoxoday Platform.
  </Accordion>

  <Accordion title="Is sensitive information transferred to external recipients? If so, are controls in place to protect it?">
    We do not transfer any data externally. However, we have implemented encryption, VPN, Firewall, IDS/IPS, and monitoring systems.
  </Accordion>

  <Accordion title="Do procedures exist to protect documents and computer media from unauthorized disclosure, modification, removal, and destruction?">
    We have disabled all ports and users do not have access to USB, CD-ROM, Disks, tapes, or Hard drives. All data including backups has been encrypted. We use TLS 1.2 for data in transit and AES-256 for data at rest.
  </Accordion>

  <Accordion title="Are there security procedures for the decommissioning of IT equipment and storage devices which contain sensitive information?">
    All customer data including backup data is stored on AWS virtual platform cloud and does not store anything locally. We use TLS 1.2 for data in transit and AES-256 for data at rest. We have also implemented the Media handling procedure.
  </Accordion>

  <Accordion title="Is the data classified top secret/confidential/PII stored separately from public data or data of other organizations residing on the same cloud?">
    Yes.
  </Accordion>

  <Accordion title="How is data loss prevented and how is high availability ensured?">
    Our web application, email records, and endpoints are sealed with data loss prevention techniques. We have the capability to respond immediately.
  </Accordion>

  <Accordion title="If other tenants' information/data is compromised, how is the vendor making sure that the customer organization's data is not impacted?">
    We logically segment or encrypt customer data such that data may be produced for a single tenant only, without inadvertently accessing another tenant's data.
  </Accordion>

  <Accordion title="What security measures are implemented by the Application Service Provider for guarding against data leakage/data corruption/data breach?">
    All security mechanisms and policies are established to prevent data leaks in transit as well as at rest. Exhaustive VAPT has been conducted along with business logic testing based on the OWASP framework, which incorporates 120+ test cases.
  </Accordion>

  <Accordion title="Is the data for multiple customers co-mingled in the same database or schema?">
    No. We use logical data isolation with the help of company-specific encryption keys.
  </Accordion>

  <Accordion title="Is any DLP solution in place? What is implemented to prevent data leaks?">
    Yes. We have implemented Data Loss Prevention techniques on AWS.
  </Accordion>

  <Accordion title="Are rules pertaining to remote access monitoring configured on DLP solution?">
    We have implemented data loss prevention techniques to make sure that the data is not lost permanently.
  </Accordion>

  <Accordion title="Are policies configured to monitor and detect data leakage over different file types?">
    It's a part of our data loss prevention techniques.
  </Accordion>

  <Accordion title="Is the current DLP solution capable of enforcing policies even when the endpoint is disconnected from the corporate network?">
    Our web assets, email records, and endpoints are sealed with data loss prevention techniques even when the endpoint is disconnected from the corporate network.
  </Accordion>

  <Accordion title="How the encryption keys used are secured and protected from unauthorized access?">
    Each tenant's data is uniquely encrypted using a client-specific key. We use AES-256 bit encryption for data at rest. Our network communication is encrypted with highly restricted protocols. The cryptographic keys, including data encryption and SSL certificates, are managed by Xoxoday for optimal security.
  </Accordion>

  <Accordion title="Any centralized crypto materials and key management infrastructure in place?">
    We use a split key mechanism to ensure that every client's key is unique. We perform annual key rotation. Keys are generated using KMS service whenever needed. We store keys in KMS.
  </Accordion>

  <Accordion title="Please describe your Key Management controls including key rotation, key generation, key storage.">
    We use a split key mechanism to ensure that every client's key is unique. We perform annual key rotation. Keys are generated using KMS service whenever needed. We store keys in KMS.
  </Accordion>

  <Accordion title="Does your system support dynamic key for encryption? How to store the key?">
    We use logical data isolation with the help of company-specific encryption keys.
  </Accordion>

  <Accordion title="Authentication mechanisms must not allow passwords to be sent in clear text, using a minimum of TLS 1.2, and an encryption algorithm and strength of AES-256.">
    Password can be reset by employees. We do not send the password in plain text. We use TLS 1.2 for data in transit and AES-256 for data at rest.
  </Accordion>

  <Accordion title="Passwords must be Hashed while stored using a salted non-reversible hash.">
    We store passwords hashed. We have SHA-512 hash with unique salt for every password.
  </Accordion>

  <Accordion title="Which groups of staff have access to personal and sensitive data?">
    Only our product engineering team members have access as per their job functions and role-based logical access. We do not provide access to any third parties and all development and testing is done by internal employees.
  </Accordion>

  <Accordion title="Is sensitive data encrypted when stored on laptops, desktops, and server hard drives?">
    Yes. We use TLS 1.2 for data in transit and AES-256 for data at rest. All data including backups is encrypted.
  </Accordion>

  <Accordion title="Does the provider retain rights to the customer data even if data is removed from the provider?">
    Our data cleaning process goes through an organized purge. Once the data is purged, it's purged from all places.
  </Accordion>

  <Accordion title="CLOUD SERVICE PROVIDER must be able to ensure any data and/or system disposal in case of service termination and in case of data and/or system end of life.">
    Yes. Per our policies and procedures, we ensure secure disposal and removal of data from every storage media. The data cannot be recovered by any computer forensic means. We assure secure data disposal when storage is decommissioned or when the contract comes to an end.
  </Accordion>

  <Accordion title="Will the application collect and/or host any User Generated Content (UGC)?">
    The only user data stored within the system is personal information — names, emails, and contact numbers. This data is not put to any use by Xoxoday and resides within the system. The data can be deleted upon the tenant's request.
  </Accordion>

  <Accordion title="Entities shall be responsible for defining and updating the information/data retention policy and procedure.">
    We have implemented the Data Retention and Disposal Policy.
  </Accordion>

  <Accordion title="Retain audit logs in accordance with retention requirements: 90 days for non-PHI activities and one year for PHI related activities.">
    We retain logs for a minimum of 180 days and in accordance with the Company's records retention guidelines. We do not process any e-PHI.
  </Accordion>
</AccordionGroup>

***

## Patch Management

<AccordionGroup>
  <Accordion title="Are system and security patches applied to workstations on a routine basis?">
    We update patches on a routine basis.
  </Accordion>

  <Accordion title="Are system and security patches applied to servers on a routine basis?">
    We update patches on a routine basis for servers as well.
  </Accordion>

  <Accordion title="Are system and security patches tested prior to implementation in the production environment?">
    We test patches before implementation in the production environment.
  </Accordion>

  <Accordion title="Are all systems and applications patched regularly?">
    Patches are updated regularly.
  </Accordion>

  <Accordion title="How are security patches rated?">
    Security patches are rated as Critical, High, Medium, and Low.
  </Accordion>

  <Accordion title="Describe the patch management process including frequency and process to apply patches, and how rapidly you can patch vulnerabilities across all components of the solution.">
    Critical patches will be deployed immediately. High patches will be deployed within 5 days. Medium patches within 15 days. Low within 25 days. Patch Management Procedure is attached.
  </Accordion>

  <Accordion title="Does the vendor have a patch management process for the operating systems and software on their PCs, servers and network infrastructure?">
    Yes. We update patches periodically for our operating systems, software, servers, and network infrastructure.
  </Accordion>

  <Accordion title="Are all security patches tested before they are deployed? How is this accomplished?">
    Yes. We test the patches on the testing environment and deploy to production upon validation.
  </Accordion>

  <Accordion title="Are security patches regularly reviewed and applied to network and security devices?">
    Yes. Security patches are regularly monitored and applied to the network security devices. All critical patches will be deployed immediately.
  </Accordion>

  <Accordion title="Please outline your planned approach to security patching of operating systems and applications.">
    We update patches periodically. See Patch Management Procedure attached.
  </Accordion>

  <Accordion title="Is there a process in place for tracking patch compliance in terms of patches successfully applied, unapplied patch ratio, and latency in rollout?">
    Yes. We regularly update our instance and make sure we follow security best practices. There is a process in place for regularly updating the servers and monitoring for latest updates across the entire stack.
  </Accordion>

  <Accordion title="Documented patch management procedures shall be developed, implemented and maintained.">
    We have implemented the Patch Management Procedure.
  </Accordion>

  <Accordion title="In the event a patch is not approved for use by the system vendor, a reason and risk mitigating controls for that patch shall be documented.">
    We follow the Change Management process to implement the compensatory control.
  </Accordion>

  <Accordion title="In the event a patch cannot be implemented due to current operations, an official exception shall be raised.">
    We follow the Change Management process.
  </Accordion>

  <Accordion title="All supporting systems used to develop or integrate systems shall be appropriately and timely patched.">
    Patches are updated on time.
  </Accordion>

  <Accordion title="Establish a dedicated patch management process for components.">
    Critical patches will be deployed immediately. High patches within 5 days. Medium patches within 15 days. Low within 25 days. Patch Management Procedure is attached.
  </Accordion>

  <Accordion title="Test patches and updates prior to deploying software in production environments.">
    Yes. We test patches before deploying in the production environment.
  </Accordion>
</AccordionGroup>

***

## Change Management

<AccordionGroup>
  <Accordion title="Does the organisation have a formal change control process for IT changes?">
    We have implemented the Change Management Procedure. All IT changes take place as per the Change Management Procedure.
  </Accordion>

  <Accordion title="Do you have technical measures in place to ensure that changes in production environments are registered, authorized and in adherence with existing SLAs?">
    Yes. Changes to the production environment are documented, tested, and approved prior to implementation. Production software and hardware changes may include applications, systems, databases, and network devices requiring patches, service packs, and other updates.
  </Accordion>

  <Accordion title="Are the vendor's change control procedures compliant with ISO 27002?">
    Yes. Change management procedures are attached. We are compliant.
  </Accordion>

  <Accordion title="Do formal change management procedures exist for networks, systems, desktops, software releases, deployments, and software vulnerability patching activities?">
    Yes. We have implemented the change management procedures, and this applies to all Xoxoday assets, infrastructure, processes, software, and third-party activities. The procedure also applies to employees, vendors, and all other individuals who have access to, or are responsible for Xoxoday information processing facilities.
  </Accordion>

  <Accordion title="Are changes to the production environment reviewed by at least two engineers/operations staff?">
    Yes. Our production team and QA team test all new releases or changes made to the existing product.
  </Accordion>

  <Accordion title="Does the requirement discussed and agreed that CSP notify vendor for major changes of infrastructure/security configuration in cloud environment?">
    Yes. We will notify the customer if there are any major changes.
  </Accordion>

  <Accordion title="Is a communication channel established between Vendor and the customer to notify the customer on the scheduled downtime and in case of any data security breach?">
    Yes. Our customer support team will communicate.
  </Accordion>
</AccordionGroup>

***

## Antivirus & Endpoint Security

<AccordionGroup>
  <Accordion title="Is antivirus software installed on workstations?">
    We have installed antivirus on all workstations and servers.
  </Accordion>

  <Accordion title="Are controls in place to prevent administrators and other staff from downloading customer data to removable storage (USB memory sticks, CD ROM, etc.)?">
    Yes. We have the controls in place. We have blocked connecting Hard disk, USB, CD-ROM, etc. to computers and all devices are centrally managed.
  </Accordion>

  <Accordion title="What processes does the vendor have to detect and prevent viruses and other malicious software?">
    We use Bitdefender Endpoint security software to prevent malware and protect data. Additionally, we have AWS GuardDuty that continuously monitors for malicious activity and unauthorised behaviour. We use a cloud-hosted VPN with strict access controls linked with SSO/Active Directory.
  </Accordion>

  <Accordion title="Please outline any anti-malware (antivirus, etc.) tools that will be used to protect the system.">
    We use endpoint security for prevention.
  </Accordion>

  <Accordion title="In case of any exceptions due to which anti-malware activities fail, are alternative controls implemented to reduce the exposure on remote endpoints?">
    We have an alerting system in place and we perform scanning immediately to reduce the risk.
  </Accordion>

  <Accordion title="How are endpoint devices that are connected to the corporate network managed and secured?">
    We have all required security controls for protecting endpoints — VPN, Firewall, IDS/IPS, Anti-Virus software, Audit log monitoring, Active Directory, etc.
  </Accordion>

  <Accordion title="Ensure that all anti-malicious code protection is up-to-date based on entity-defined maintenance schedules.">
    We maintain up-to-date endpoint security to safeguard from attack scripts, viruses, worms, Trojan horses, backdoors, and malicious active content.
  </Accordion>

  <Accordion title="Detail Out the mechanism for Antivirus installation, monitoring and signature updates of infrastructure.">
    We are using Linux operating systems and following security best practices. We are monitoring using Prometheus/Grafana.
  </Accordion>

  <Accordion title="What are the procedures for configuration management, patch installation and malware prevention for all servers and PCs?">
    We have installed endpoint security in servers and PCs of all our employees as per compliance requirements.
  </Accordion>

  <Accordion title="Do you ensure that endpoints (laptops, desktops, etc.) have the latest available security-related patches installed?">
    Yes. We update patches periodically and ensure that all endpoints have the latest available security-related patches.
  </Accordion>

  <Accordion title="How are endpoint devices that are connected to the corporate network managed and secured?">
    We have all required security controls for protecting endpoints — VPN, Firewall, IDS/IPS, Anti-Virus software, Audit log monitoring, Active Directory, etc. We use a cloud-hosted VPN with strict access controls linked with SSO/Active Directory.
  </Accordion>
</AccordionGroup>

***

## SSO, Authentication & Integration

<AccordionGroup>
  <Accordion title="Mandatory Active Directory (SSO) Integration preferably through ADFS.">
    Yes. Our partnerships with a wide array of integration partners ensure existing customer-based SSO capability for all users to seamlessly use Xoxoday's products. With an easy DIY setup, your SSO solution would be plugged in and ready to go. Please refer to our list of integrations: [https://xoxoday.gitbook.io/plum/developer-resources/integrations](https://xoxoday.gitbook.io/plum/developer-resources/integrations)
  </Accordion>

  <Accordion title="Can your solution link to our Identity Federation Tool in order to authenticate users and retrieve their user profile using SAML or OAuth?">
    Yes. The application has robust authentication methods. We have integrated SAML 2.0 with SAP SuccessFactors and also support OAuth 2.0 for seamless authentication.
  </Accordion>

  <Accordion title="Are there interactions between the proposed solution and third-party applications/middleware?">
    API Documentation: [https://xoxoday.gitbook.io/plum/user-guide/for-admins-1/xoxo-links/xoxo-link-apis](https://xoxoday.gitbook.io/plum/user-guide/for-admins-1/xoxo-links/xoxo-link-apis)
  </Accordion>

  <Accordion title="Is API integration available?">
    Please click here to know more about API integration: [https://www.empuls.io/integrations](https://www.empuls.io/integrations)
  </Accordion>

  <Accordion title="Does the application have APIs available for user provisioning and deprovisioning?">
    The application enables user account management through API-based integration with the customer's HR management system. These APIs are used to access employee data to ensure users' accounts are created, updated, and disabled securely.
  </Accordion>

  <Accordion title="Does the application support any APIs? How are they consumed internally and externally?">
    Please click here for API Documentation: [https://xoxoday.gitbook.io/plum/user-guide/for-admins-1/xoxo-links/xoxo-link-apis](https://xoxoday.gitbook.io/plum/user-guide/for-admins-1/xoxo-links/xoxo-link-apis)
  </Accordion>

  <Accordion title="How the security of the exposed APIs is managed?">
    We have implemented WAF, IDS/IPS, and Amazon GuardDuty for maximum security. OAuth 2.0 is used to authorize all API requests. We also conduct code reviews to make sure that the APIs are secure.
  </Accordion>

  <Accordion title="Does the platform support typical Single Sign-On paradigms (e.g., Active Directory)?">
    Yes. It supports SSO.
  </Accordion>

  <Accordion title="Explain how the system supports single sign-on and an external roles-based access control system.">
    Our partnerships with a wide array of integration partners ensure existing customer-based SSO capability for all users to seamlessly use Xoxoday's products. With an easy DIY setup, your SSO solution would be plugged in and ready to go.
  </Accordion>

  <Accordion title="How to Authentication/Single Sign On (SSO): products should support the SAML2 standard?">
    Application Integrations: [https://www.application.io/integrations?tab=tab-collaborations](https://www.application.io/integrations?tab=tab-collaborations)
  </Accordion>

  <Accordion title="Products should support the secure VPN standard.">
    It's a web and mobile application.
  </Accordion>

  <Accordion title="Describe your SSO and Federated Identity Enablement integration options.">
    Our partnerships ensure existing customer-based SSO capability for all users. Our identity federation standards include SAML 2.0, SPML, WS-Federation, and more as means of authenticating and authorizing users with airtight security protocol. Please visit: xoxoday.com/integrations
  </Accordion>

  <Accordion title="Does your solution support modern authentication methods, e.g., SAML and OAuth/OIDC against Azure AD?">
    Yes. The application has robust authentication methods. We have integrated SAML 2.0 with SAP SuccessFactors and support OAuth 2.0 and Azure AD for seamless authentication.
  </Accordion>

  <Accordion title="Will the service/solution require integration with other customer solutions/data, either on-premise or in the cloud?">
    We have an option to integrate with SSO and HRMS. For more info, please visit the link: [https://www.application.io/integrations](https://www.application.io/integrations)
  </Accordion>

  <Accordion title="Does your service include Standard Reporting and Analytics Functionalities?">
    Two standard reports are available for admins on SuccessFactors at the program level — Budget and Spot Award Nomination. Using People Analytics, customers can create their own reports and dashboards combining Spot Awards data from Recognition with data from across SuccessFactors. Admins can also access similar data via a Xoxoday logon.
  </Accordion>

  <Accordion title="Can your service, via standard or custom interfaces/APIs, integrate with third party analytics?">
    Yes. Customers can extract data from SuccessFactors via Integration Center and integrate it with other third parties.
  </Accordion>

  <Accordion title="Do you support a Pub Sub architecture model for data transfer?">
    Somewhat. We have a Spot Award Approved event available via Intelligent Service Center on SuccessFactors which customers can use to build custom extensions.
  </Accordion>

  <Accordion title="Please describe user provisioning, on-boarding and off-boarding of end users to the platform.">
    User provisioning for SAP SuccessFactors — Reward and Recognition is handled the same way as the rest of SuccessFactors. For employees redeeming points via Xoxoday, user provisioning is done on the fly at the time of redeeming the awards.
  </Accordion>
</AccordionGroup>

***

## Third Party & Vendor Management

<AccordionGroup>
  <Accordion title="Do contracts with third party vendors that access or host your organization's information assets contain security requirements commensurate with your organization's security standards?">
    We make sure that they have adequate controls in place and meet the security standard.
  </Accordion>

  <Accordion title="Are you managing the offer from end to end or do you rely on suppliers and/or subcontractors?">
    We are managing the platform end to end.
  </Accordion>

  <Accordion title="Are incident reporting obligations passed on to all 3rd parties who are subcontracted by you?">
    Yes. Incident reporting obligations are passed on to all 3rd parties as well. All contracts and agreements are reviewed by the Legal Department.
  </Accordion>

  <Accordion title="Are third party connections to your network monitored and reviewed to confirm only authorized access and appropriate usage?">
    We use Amazon CloudWatch and Grafana which monitor instances and alert us through emails. Infrastructure logs are collected using the AWS Audit Trail, meanwhile application related logs are collected in our Elastic Search server and retained in long-term cloud storage. Administrative logs are part of the Cloud Dashboard and are regularly reviewed.
  </Accordion>
</AccordionGroup>

***

## Service, Support & Upgrades

<AccordionGroup>
  <Accordion title="Is application of patches and upgrades under the provider's responsibility or the customer's?">
    It will be the responsibility of Xoxoday.
  </Accordion>

  <Accordion title="How is the customer informed of application upgrades impacting the end user's client?">
    The process for upgrades is automated using Continuous Integration and Deployment. Since our services are delivered via the web, upgrades and updates are seamless and usually do not involve any actions from end-users.
  </Accordion>

  <Accordion title="Can customers control the timing of software upgrades? What support do you provide during the upgrade process?">
    Xoxoday's architecture goes through constant upliftment and experiences no downtime during upgrades and maintenance windows.
  </Accordion>

  <Accordion title="How often is the platform scheduled for software patches and updates?">
    The process for upgrades is automated using CI/CD. We try to release product hotfixes once every week and major features once every month.
  </Accordion>

  <Accordion title="What is the process for upgrades? How often are new versions released?">
    The process for upgrades is automated using CI/CD. Upgrades and updates are seamless. We try to release hotfixes once every week and major features once every month.
  </Accordion>

  <Accordion title="Support requirement (version updates, future enhancement etc.)">
    Product updates and feature enhancements are done periodically by the application team. These updates are available to all customers by default. The customer need not do anything from their end to update the product version as the application is hosted on AWS Cloud.
  </Accordion>

  <Accordion title="What SLAs apply to the product/service?">
    The time of support ranges between two to forty-eight hours. This depends on the level of service and the gravity of incidents.
  </Accordion>

  <Accordion title="What support methods are available?">
    We have Email Support and an application help center for helping users.
  </Accordion>

  <Accordion title="How would you service and support Union Pacific as a customer?">
    We will be providing training for the admin and the end user and also provide extensive support through our customer support team.
  </Accordion>

  <Accordion title="Is there an individual or group with responsibility for security within the organization?">
    Yes. We have an Information security team and group of people with responsibility for security within the organization.
  </Accordion>

  <Accordion title="If your customer later finds and reports a security hole/issue in the solution, will you provide the patch/fix at no cost?">
    Yes. We fix the issues found at no cost. We understand that consumer data protection is a high priority. We have implemented a Bug Bounty Program and encourage the reporting of security issues. If any outsiders or customers report security-related issues, we fix them free of cost.
  </Accordion>

  <Accordion title="Confirm with CSP which technologies and processes are used to ensure high levels of performance, reliability and availability.">
    We have deployed our application on Amazon Web Services (AWS) cloud platform. We are using MySQL, Salt stack, Node.js, and MongoDB technology.
  </Accordion>

  <Accordion title="Please provide a high-level diagram of your Continuous Integration and Continuous Deployment (CI/CD) pipeline.">
    See the application high-level diagram of CI/CD attached.
  </Accordion>

  <Accordion title="What are the digital infrastructure secure configuration, vulnerability management and patch management policies, procedures and processes?">
    See the following policies attached — Infrastructure Change Control Procedure, Patch Management Procedure, Information System Acquisition Development and Maintenance Procedure, SDLC Procedure, Threat and Vulnerability Management.
  </Accordion>

  <Accordion title="Do you provide customers with security administrative guides that detail configurable security settings, their interpretation and how to implement them?">
    Please click here for more details: [https://help.empuls.io/](https://help.empuls.io/)
  </Accordion>

  <Accordion title="It seems they support credit card processing for adding funds, what is their PCI DSS compliance exposure and level achieved?">
    Payments are redirected to PayU gateway or PayPal websites to complete purchases securely. We are also implementing PCI DSS compliance controls and will provide the certification as soon as possible.
  </Accordion>

  <Accordion title="Estimate implementation duration from project start to go live in first market.">
    Approximately 2 weeks.
  </Accordion>

  <Accordion title="Please describe the typical installation time and resources required for your solution.">
    No installation. We are an out-of-the-box SaaS solution.
  </Accordion>

  <Accordion title="What are any prerequisites recommended to use or access the solution/services effectively?">
    No recommendations as such. The application is a SaaS product supported by a comprehensive web application that can be accessed via desktop and mobile browsers on all compatible devices, including Android and iOS.
  </Accordion>

  <Accordion title="How do you limit data exfiltration from production endpoint devices?">
    We have a multi-layered network architecture with role-based access control. All confidential/PII data is encrypted at rest with a split key mechanism to ensure that every client's key is unique. Additionally, we have an intrusion detection/monitoring application that alerts on unauthorized access.
  </Accordion>

  <Accordion title="Do you have breach detection systems and/or anomaly detection with alerting?">
    Yes.
  </Accordion>

  <Accordion title="Are the hosts where the service is running uniformly configured?">
    Yes.
  </Accordion>

  <Accordion title="If hosted on public cloud (Amazon, Google, Azure etc.) — security configurations are aligned with public cloud vendor security requirements?">
    Yes. We have deployed our application on AWS Virtual platform cloud. We use WAF, IDS/IPS, AWS Audit Trail, Amazon GuardDuty, etc.
  </Accordion>

  <Accordion title="Is there a service that will be a separate test environment? Will this include the use of dummy or live data?">
    Yes. Segregation is done for production and non-production environments.
  </Accordion>

  <Accordion title="Which all locations is the vendor working from or are their offices located?">
    The production center location will be Bangalore.
  </Accordion>
</AccordionGroup>

***

## Compliance Statements

<AccordionGroup>
  <Accordion title="Mandatory Business ownership to be mapped for all applications on-boarded.">
    Xoxoday would act as liaison partner between customer and merchants. We process the budgets which are approved by the customer. Xoxoday application is a SaaS Product.
  </Accordion>

  <Accordion title="Logs should be sent to the customer SIEM for continuous monitoring of security events from the application.">
    The logs are automatically audited, but are not integrated with tenant's security ops. In case the tenant requests logs, they can be shared when asked by the clients.
  </Accordion>

  <Accordion title="When infrastructure is shared, the tenant environments are properly segregated and isolated.">
    It's a multi-tenant system. We use logical data isolation with the help of company-specific encryption keys and it is isolated from other customers' data.
  </Accordion>

  <Accordion title="Vendor has network forensics capabilities in place, and when required, the customer is assisted by the Vendor in performing any investigations on suspicious activities.">
    Infrastructure logs are collected using the AWS Audit Trail, meanwhile application related logs are collected in our Elastic Search server and retained in long-term cloud storage. We provide these logs on a need and approval basis for forensic investigation. We can freeze data from a specific time without freezing other data if needed.
  </Accordion>

  <Accordion title="The concept of least privilege should be employed for specific duties to adequately mitigate risk.">
    We are compliant. We have implemented the password management policy and follow the concept of least privilege. Only a limited number of approved users have privileged access. All access will be provided on a need and approval basis. We maintain a ticketing system to make sure that the appropriate process is followed.
  </Accordion>

  <Accordion title="Passwords shall be implemented on sensitive components to prevent unauthorised access and all default passwords shall be changed.">
    We have implemented the Password Management Policy for maximum security of data.
  </Accordion>

  <Accordion title="Passwords shall be changed at an agreed upon interval.">
    We are compliant. The password will be changed every 90 days.
  </Accordion>

  <Accordion title="Implement network-based technical controls that monitor communications with external systems and with key internal systems for suspicious traffic.">
    These are integrated with security operations/SIEM solutions.
  </Accordion>

  <Accordion title="Secure log-on procedures shall be in place (warning banners, protection against brute force, logging of authentication events, etc.).">
    We have a secure log-on process and are compliant with these requirements.
  </Accordion>

  <Accordion title="Secure log-off procedures shall be followed (maximum session times, termination of inactive sessions).">
    We have a secure log-off process and are compliant with these requirements.
  </Accordion>

  <Accordion title="System logging and auditing features are enabled and configured.">
    Audit logs are reviewed and recorded on a regular basis automatically. These logs are integrated with security operations/SIEM solutions.
  </Accordion>

  <Accordion title="System architecture/interconnection diagrams showing data flows, and physical and logical segmentation shall be reviewed and updated at least quarterly.">
    We review architecture diagrams and data flow diagrams on a periodical basis. This is also validated during our internal and external independent audits.
  </Accordion>

  <Accordion title="Segregation, physically and/or logically, shall be implemented ensuring that the required levels of control for data flows and users are met.">
    We logically segregate the tenant's data, and it is segregated with a client-specific key for proper handling and security reasons.
  </Accordion>

  <Accordion title="Unsecured protocols or protocols with known vulnerabilities shall not be used.">
    We do not use any unsecured protocols.
  </Accordion>

  <Accordion title="All critical applications shall be reviewed and tested after operating system changes or other major changes.">
    All critical applications are reviewed and tested before deployment.
  </Accordion>

  <Accordion title="Development, test and production environments shall be segregated.">
    We have a separate test and production environment.
  </Accordion>

  <Accordion title="Performance and capacity monitoring, such as system and network utilisation, shall be practiced.">
    We monitor systems and network utilization.
  </Accordion>

  <Accordion title="Network IDS may be provided where necessary.">
    We have implemented file integrity (host) and network intrusion detection (IDS) tools to help facilitate timely detection and investigation.
  </Accordion>

  <Accordion title="Performance improvement plans shall be outlined based on successive progression of security controls maturity and based on identified nonconformities.">
    We make sure that we follow industry best practices, the PDCA cycle, and standards in order to safeguard the Information Security System.
  </Accordion>

  <Accordion title="Service Provider shall have strict patching practice to ensure security patches are applied rapidly.">
    All critical patches are applied rapidly.
  </Accordion>

  <Accordion title="Service Provider should have capabilities to integrate security systems with the customer's Security monitoring solution (SIEM).">
    We are a multi-tenant SaaS system and all our logs will contain data of all customers. We will have our own log monitoring and security analysis.
  </Accordion>

  <Accordion title="CLOUD SERVICE PROVIDER (CSP) must ensure CLIENT that its infrastructure is always using up-to-date systems.">
    Yes. All critical patches will be deployed immediately. We ensure that our infrastructure is always using up-to-date systems.
  </Accordion>

  <Accordion title="In multi-tenancy cloud environment, CLOUD SERVICE PROVIDER must ensure the CLIENT environment is segregated from other tenants' environment.">
    We have the ability to logically segment or encrypt customer data such that data may be produced for a single tenant only, without inadvertently accessing another tenant's data.
  </Accordion>

  <Accordion title="The solution is to be deployed and operationalized in a configuration where application and data storage components will reside and operate on separate physical or virtual servers.">
    Compliant. We have deployed our application and database on separate servers.
  </Accordion>

  <Accordion title="Configure REST/Web services to explicitly validate content types.">
    Since the application is a SaaS Platform, this would not be applicable.
  </Accordion>

  <Accordion title="Applications must be designed in such a way that it captures evidence of any action taken by the user to protect itself from denying authenticity of the activity.">
    Infrastructure logs are collected using the AWS Audit Trail, meanwhile application related logs are collected in our Elastic Search server and retained in long-term cloud storage. Administrative logs are part of the Cloud Dashboard and are regularly reviewed.
  </Accordion>

  <Accordion title="The hosted application's architecture must be configured in such a way that data stores containing confidential or regulated information are logically located in a secure network segment.">
    Yes. We logically segregate the tenant's data and the application.
  </Accordion>

  <Accordion title="The hosted web application's architecture is to be deployed and configured with a web application firewall to protect the application.">
    WAF and rate limiters are installed to block multiple requests from specific IPs to prevent DDoS-type attacks.
  </Accordion>

  <Accordion title="All application created sessions, windows, forms, pages, and pop-ups that display highly confidential information must be terminated or closed after the user logs out.">
    Once the user logs out from the application, all pages, forms, and pop-ups will get closed.
  </Accordion>

  <Accordion title="Implement controls to log TLS connection failures.">
    We maintain logs and monitor on a regular basis for security reasons.
  </Accordion>

  <Accordion title="Implement processes to measure the availability, quality, and adequate capacity of resources to deliver the required system performance.">
    Compliant. We have resources to meet these requirements.
  </Accordion>
</AccordionGroup>


# DPDP Act
Source: https://help-plum.xoxoday.com/faq/security-compliance/certifications/dpdp-act

Learn about Plum's compliance with India's Digital Personal Data Protection (DPDP) Act and how it safeguards personal data.

*Learn more about Digital Personal Data Protection Act, 2023*

The Digital Personal Data Protection (DPDP) Act, 2023 governs the processing of digital personal data in India, emphasizing user consent, purpose limitation, and data accuracy. Enacted in August 2023 with rules effective from 2025, it applies to both online and offline data, protecting individual rights while allowing certain exceptions for the state.

The Digital Personal Data Protection Act, 2023 (DPDP Act) helps by protecting individuals' personal data and ensuring it is processed lawfully, transparently, and for specific purposes. It strengthens citizens' rights over their data while imposing clear obligations on organizations to prevent misuse and data breaches. This promotes trust, accountability, and responsible digital governance in India.

The complete assessment report can be shared through a proper Trust Center portal that provides controlled access and undergoes an NDA process before granting visibility.

Under the Digital Personal Data Protection Act, 2023, clients must clearly understand their role as Data Fiduciaries, while we act as a Data Processor supporting compliance. Only necessary personal data should be collected, processed for lawful purposes, and protected with reasonable security safeguards. Teams must ensure mechanisms exist to handle data principal rights (access, correction, erasure) and follow proper breach notification procedures. All responsibilities, security commitments, and data handling terms should be clearly defined in contracts.

Feedback or Questions? Write to us at [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Certifications and Compliance
Source: https://help-plum.xoxoday.com/faq/security-compliance/certifications/others-documents

Access additional compliance certifications and supporting documentation available for Plum beyond the core certifications.

<AccordionGroup>
  <Accordion title="Background Verification Procedure">
    [Open document](https://drive.google.com/file/d/10gHjDefPzKBB3EC1BPHZ4SbqpcluKLjw/view?usp=sharing)
  </Accordion>

  <Accordion title="Physical and Environmental Policy">
    [Open document](https://drive.google.com/file/d/1LyE7ogFTxdbUiaSLBOYaMbFxsvXbuI3v/view?usp=sharing)
  </Accordion>

  <Accordion title="Incident Management Procedure">
    [Open document](https://drive.google.com/file/d/1gIJySTLQSSWGoeF3P8ukvr3xZhMGGePY/view?usp=sharing)
  </Accordion>

  <Accordion title="Security Incident Reporting and Response Procedure">
    [Open document](https://drive.google.com/file/d/161zus2TDtFeoIshMKAdKe8FDDGf_aaq0/view?usp=sharing)
  </Accordion>

  <Accordion title="Service level agreement (SLA)">
    [Open document](https://drive.google.com/file/d/1LatFZLoRzeRlQf4mEemzL8XsO71YGahk/view?usp=sharing)
  </Accordion>

  <Accordion title="Ecology Policy">
    [Open document](https://drive.google.com/file/d/16ICZUl9dbFC-PGHaU2jj49rzs0jzi_-S/view?usp=sharing)
  </Accordion>

  <Accordion title="Xoxoday Plum VAPT Certificate">
    [Open document](https://drive.google.com/file/d/1dWf4on16eN2MebO7fNDFMuUJDp0CR1hW/view?usp=sharing)
  </Accordion>

  <Accordion title="Plum Web App VAPT 2022 Report">
    [Open document](https://drive.google.com/file/d/1K1zwc6qEjgYu4I8qYJcxBuPgsiPgtLnP/view?usp=sharing)
  </Accordion>
</AccordionGroup>


# Cloud Security
Source: https://help-plum.xoxoday.com/faq/security-compliance/cloud-security

Find answers to frequently asked questions about the cloud security infrastructure and safeguards protecting the Plum platform.

<AccordionGroup>
  <Accordion title="Is your infrastructure in the cloud, SDDC, co-location, or on-premise? Please state provider name, unless it is on-prem.">
    We have deployed our application on AWS Virtual platform cloud - Singapore and USA region.
  </Accordion>

  <Accordion title="Is your Data Security Architecture designed using an industry standard (e.g., CDSA, MULITSAFE, CSA Trusted Cloud Architectural Standard, FedRAMP, CAESARS)?">
    Data Security Architecture designed using an industry standard and best practices. We are adhered to CSA, ISO 27001, SOC 2 TSP. We have deployed our application on AWS Virtual platform cloud - Singapore region. The cloud infrastructure providers have high levels of physical and network security and hosting provider vendor diversity.
  </Accordion>

  <Accordion title="Do you inventory, document, and maintain data flows for data that is resident (permanent or temporary) within the services' applications and infrastructure network and systems?">
    All our customer data is stored on AWS Virtual platform cloud. And we collect the data only throguh our application platform. We do not store any customers data locally.
  </Accordion>

  <Accordion title="Are file integrity (host) and network intrusion detection (IDS) tools implemented to help facilitate timely detection, investigation by root cause analysis, and response to incidents?">
    File integrity (host) and network intrusion detection (IDS) tools implemented to help facilitate timely detection, investigation.
  </Accordion>

  <Accordion title="Does the virtual machine management infrastructure include a tamper audit or software integrity function to detect changes to the build/configuration of the virtual machine?">
    AWS CloudTrail helps to detect changes to the build/configuration of the virtual machine
  </Accordion>

  <Accordion title="Does your system's capacity requirements take into account current, projected, and anticipated capacity needs for all systems used to provide services to customers?">
    Our solution is using state of the art Cloud Native infrastructure technologies along with microservices architecture allows us to scale our operations as per the demands.
  </Accordion>

  <Accordion title="Are system and network environments protected by a firewall or virtual firewall to ensure business and customer security requirements?">
    We use Web application firewall (WAF) and pfSense firewall for security reasons. 1. The Cloudflare Web Application Firewall (Cloudflare WAF) checks incoming web requests and filters undesired traffic based on the set of rules. 2. pfSense helps to monitors incoming and outgoing network traffic and decides whether to allow or block specific traffic based on a defined set of security rules
  </Accordion>

  <Accordion title="Have you implemented the necessary measures for the appropriate isolation and segmentation of customers' access to infrastructure system and network components?">
    We isolate our machines, network and storage with respect to the AWS Standards in order to keep it safe and secure.
  </Accordion>

  <Accordion title="Are system and network environments protected by a firewall or virtual firewall to ensure protection and isolation of sensitive data?">
    We use Web application firewall (WAF) and pfSense firewall for security reasons.
  </Accordion>

  <Accordion title="Do you implement technical measures and apply defense-in-depth techniques (e.g., deep packet analysis, traffic throttling and black-holing) for detection and timely response to network-based attacks associated with anomalous ingress or egress traffic patterns and/or DDoS attacks?">
    As part of Web Application Firewall (WAF), rate limiters are installed to block multiple requests from specific IPs in order to prevent DDOS-type attacks. These are powered by intelligent daemons that detect other identifiers like URLs accessed or other client properties to automatically blacklist possible threats either temporarily or permanently.
  </Accordion>

  <Accordion title="Do you select and monitor outsourced providers in compliance with laws in the country where the data is processed, stored, and transmitted?">
    Yes. We monitor the compliance programs of AWS As we have stored the data on their cloud.
  </Accordion>

  <Accordion title="Do you have the capability to restrict the storage of customer data to specific countries or geographic locations?">
    No. Currently, all the data is stored on AWS VPC - Singapore region.
  </Accordion>

  <Accordion title="Can you provide the physical location/geography of storage of a customer's data upon request?">
    Yes, we inform the customer on the data storage location.
  </Accordion>

  <Accordion title="Do you make standards-based information security metrics (CSA, CAMM, etc.) available to your customers?">
    We are CSA STAR Level 1 compliant. Please click here to know more - [https://cloudsecurityalliance.org/star/registry/nreach-online-services-pvt-ltd-xoxoday](https://cloudsecurityalliance.org/star/registry/nreach-online-services-pvt-ltd-xoxoday)
  </Accordion>

  <Accordion title="Do you use industry standards (i.e. OWASP Software Assurance Maturity Model, ISO 27034) to incorporate security requirements into your Systems/Software Development Lifecycle (SDLC)?">
    We use OWASP Software Assurance Maturity Model
  </Accordion>

  <Accordion title="What services are contracted for appropriate disposal of hardware? Please provide a sample certificate of physical destruction?">
    Since we have deployed our application on AWS Cloud its not applicable for us.
  </Accordion>

  <Accordion title="What services are contracted for appropriate disposal of paper documents? Please provide a sample certificate of physical destruction?">
    Since we have deployed our application on AWS Cloud its not applicable for us. We provide certifite of destruction of data once the data is purged/deleted from all the places upon request from the customer.
  </Accordion>

  <Accordion title="Is physical access to data processing equipment (servers and network equipment) restricted?">
    We have deployed our product on AWS Cloud virtual platform. AWS provides physical security to the data center as a part of our subscription. AWS physical security - [https://aws.amazon.com/compliance/data-center/controls/](https://aws.amazon.com/compliance/data-center/controls/)
  </Accordion>

  <Accordion title="Are Intrusion Detection Systems (IDS) or Intrusion Prevention Systems (IPS) used by your organisation?">
    We have implemented IDS/IPS to facilitate timely detection, investigation by root cause analysis and response to incidents
  </Accordion>

  <Accordion title="Are computer systems (servers) backed up according to a regular schedule?">
    Data backups are done on daily basis and in a secured way on AWS
  </Accordion>

  <Accordion title="Does the organisation replicate data in another region?">
    Data backups are done on daily basis and in a secured way on AWS - Singapore
  </Accordion>

  <Accordion title="Are the backup tested for restoration?">
    Data backups are done on daily basis and in a secured way on AWS. This has been tested on regular basis.
  </Accordion>

  <Accordion title="Are default hardened base virtual images applied to virtualized operating systems?">
    Applies to all.
  </Accordion>

  <Accordion title="In case any the customer information is stored on vendor corporate network/systems, is there access available to employees using remote access?">
    We have deployed our application on AWS cloud virtual platform and the data is stored on it. Only approved users will have an access and We use a cloud hosted VPN with strict access controls to allow our employees to access the official network. This VPN is managed by our IT team and it's linked with the SSO/Active Directory.
  </Accordion>

  <Accordion title="Are necessary tools utilised to monitor environmental protection systems and alert personnel in the event of warnings or failures?">
    We have deployed our application on AWS cloud virtual platform. AWS provides physical security to the data center and it's a part of our subscription. AWS physical security - [https://aws.amazon.com/compliance/data-center/controls/](https://aws.amazon.com/compliance/data-center/controls/)
  </Accordion>

  <Accordion title="Is the vendor facility / critical servers related to the customer scope of work placed in secure areas?">
    Yes. We have deployed our application on AWS cloud virtual platform for maximum security.
  </Accordion>

  <Accordion title="Are servers / assets pertaining to the customer operations housed in a secure location? Are they shared with other clients?">
    Yes. Its deployed on AWS cloud virtual platform.
  </Accordion>

  <Accordion title="Is an inventory maintained for hardware, software, information, physical assets, services and all other forms of media, where information is processed or stored? If so, how often is the inventory reviewed and updated?">
    The application is deployed on AWS cloud virtual platform. We maintain the register for hardwares, softwares, physical assets etc as per the Asset management policy. All the inventories are reviewed and updated on monthly basis. We have tagged the owners for all the assets alloted by the organization. Atatched the asset management policy.
  </Accordion>

  <Accordion title="Are all external facing / web facing servers placed in DMZ?">
    Our application is deployed on AWS cloud virtual platform. We use a cloud hosted VPN with strict access controls to allow our employees to access the official network. This VPN is managed by our IT team and it's linked with the SSO/Active Directory.
  </Accordion>

  <Accordion title="Is there a dedicated infrastructure for collection, analysis and storage of logs?">
    Infrastructure logs are collected using the AWS Audit Trail, meanwhile the application related logs are collected in our Elastic Search server and retained in the long term cloud storage.
  </Accordion>

  <Accordion title="Is access to Database systems used for the customer operations logged?">
    We use AWS Platform for storing the data. Our data is stored in secured databases and there is no window to alter any data without it being logged into the system records. Our data is stored in secured databases and there is no window to alter any data without it being logged into the system records.
  </Accordion>

  <Accordion title="Do systems and network devices utilize a common time synchronization service?">
    Yes
  </Accordion>

  <Accordion title="Does the Isolation/segregation of the customer environment at vendor done by means of VLAN/ creation of zones on Firewall?">
    We have deployed our application on AWS Cloud platform.As part of Web Application Firewall (WAF), rate limiters are installed to block multiple requests from specific IPs in order to prevent DDOS-type attacks.
  </Accordion>

  <Accordion title="Are the systems used for the customer operations hardened according to hardening document/ technical specification document?">
    Yes. We comply with this.
  </Accordion>

  <Accordion title="Do you have controls to prevent storing of any confidential or highly confidential data on the desktop? Please describe any specific controls in place to prevent data leakage from your environment.">
    We monitor the user activities and spread awareness about data storage, access, sharing etc. All the custoer data is stored on AWS cloud. We are not storing any information on the computers.
  </Accordion>

  <Accordion title="Is there a backup and recovery document covering the customer processes? Is it communicated to employees working for the customer operations?">
    Data backups are done daily and in a secured way in AWS
  </Accordion>

  <Accordion title="Does the Backup and recovery procedure identify essential business information, servers, audit trail, frequency, logging, retention period, and roles and responsibilities?">
    Yes. We have implemented the Backup Recovery Procedure
  </Accordion>

  <Accordion title="Is there a secure process for onsite and offsite backup media protection during storage pertaining to the customer operations?">
    Yes. Data backups are done daily and in a secured way in AWS
  </Accordion>

  <Accordion title="Does the organization reuse, test and restore the customer backups on frequent basis?">
    We do not use the backup. We only take the backup on AWS and its stored on AWS platform itself.
  </Accordion>

  <Accordion title="What is the distance of the backup facility from the primary location?">
    Its hosted on AWS
  </Accordion>

  <Accordion title="Is there an alternate location facility and supporting facility to continue the customer operations?">
    BCP and DR facilities has been provided by AWS. We do not have any other data centers
  </Accordion>

  <Accordion title="Can the backed up data be restored and made available at the alternate site at any point in time? How can the critical data be restored and in what time frame?">
    Since we are hosting our application on AWS, they are providing us a service for backup, BCP and DR for seamless customer experience.
  </Accordion>

  <Accordion title="Is your DR backup facility provided internally or externally? If external, please indicate the name of the service provider and the backup location.">
    Since we are hosting our application on AWS, they are providing us a service for backup, BCP and DR for seamless customer experience.
  </Accordion>

  <Accordion title="Who is the Cloud Service Provider (CSP)?">
    Amazon web service (AWS)
  </Accordion>

  <Accordion title="What all services are being opted from CSP?">
    AWS Virtual platform cloud And AWS MSK
  </Accordion>

  <Accordion title="What will be the percentage up time agreed by vendor with CSP for the customer related services?">
    99.00%
  </Accordion>

  <Accordion title="Does the requirement agreed that CSP/ Vendor should not use or share the customer data without prior consent?">
    Yes. Xoxoday or AWS does not share the data.
  </Accordion>

  <Accordion title="Does the requirement discussed and agreed that CSP shall ensure data destruction upon request or post the retention timeframe, across all locations?">
    We have deployed the application on AWS and we have the controls in place to destruction upon request or post the retention timeframe. Since we are GDPR compliant we provide this option to our end users.
  </Accordion>

  <Accordion title="Does the requirement has been discussed between vendor and the customer and agreed with CSP that core the customer data should remain within India? If not, please detail the plan for local hosting.">
    We have deployed the application on AWS Singpore.
  </Accordion>

  <Accordion title="Does Data Retrieval time from primary/ backup location for the customer specific data discussed and agreed with the customer?">
    Data backup and retrieval happens on AWS platform.
  </Accordion>

  <Accordion title="What is the deployment model? (Private Cloud/Public Cloud/Hybrid Cloud/Community Cloud)">
    We use Public cloud for hosting
  </Accordion>

  <Accordion title="How does Vendor ensure Incident management for the customer services in Cloud?">
    we have an intrusion detection/monitoring application that alerts on unauthorized access.
  </Accordion>

  <Accordion title="How does vendor ensure Auditing, Logging and Monitoring requirements for the customer services on cloud?">
    We use Amazon CloudWatch and Grafana polemique which allows us to monitor instances and alerts us through emails.
  </Accordion>

  <Accordion title="How does vendor ensure Secure configurations of Web Server on cloud?">
    We have deployed the application on cloud and have AWS Guard Duty threat detection service that continuously monitors for malicious activity and unauthorized behaviour.
  </Accordion>

  <Accordion title="How vendor will ensure capacity and demand management with respect to the customer services on cloud?">
    Its provided by AWS, it's a part of AWS service.
  </Accordion>

  <Accordion title="How does vendor ensure that CSP shows compliance to applicable laws and regulations related to data security?">
    Please click here for more details about AWS Compliance Programs - [https://aws.amazon.com/compliance/programs/](https://aws.amazon.com/compliance/programs/)
  </Accordion>

  <Accordion title="How does vendor along with CSP will ensure that all the customer related core systems and data hosted in India and at no point in time those shall be moved to other country?">
    It will be hosted on AWS singapore
  </Accordion>

  <Accordion title="Does the CSP is using appropriate Data Loss Prevention (DLP) solution to identify, monitor and protect sensitive data and manage the data risk for the customer?">
    Data backups are done daily and in a secured way in AWS. The customer data cannot be lost permanently. We also have Business Continuity Policy and Business Continuity Management Procedure in place and effectivly working.
  </Accordion>

  <Accordion title="How does vendor ensure Patch Management activity for components/ devices require to deliver the customer services?">
    Data backups are done daily and in a secured way in AWS. The customer data cannot be lost permanently. We also have Business Continuity Policy and Business Continuity Management Procedure in place and effectivly working.
  </Accordion>

  <Accordion title="How does Vendor ensure that CSP have robust backup procedure for the customer related services? Does the CSP provide results / assurance on regular Backup-Restoration testing?">
    Data backups are done on daily basis and in a secured way in AWS. We monitor the same.
  </Accordion>

  <Accordion title="Provide the details of types of data that will be Collected, Stored/Retained, and Processed.">
    We collect, store and process Name, email ID and Phone numbers and it will be stored on AWS cloud and will be deleted upon termination of the contract.
  </Accordion>

  <Accordion title="What is the backup site physical address?">
    AWS Singapore
  </Accordion>

  <Accordion title="Technological competence of the service provider.">
    [Xoxoday application is a SaaS product deployed on AWS Virtual platform cloud. Please click to know more about application - https://xoxoday.gitbook.io/application/](https://xoxoday.gitbook.io/plum/)
  </Accordion>

  <Accordion title="Are media containing information protected against unauthorized access, misuse or corruption during transportation beyond the organization's physical boundary?">
    We have deployed our application on AWS virtual platform cloud and do not store any data outside cloud for security reasons. All the customer data is encrypted for maximum security. We use TLS1.3 encryption while data in transit and AES256 while data at rest
  </Accordion>

  <Accordion title="Are redundant power supplies available for supplying power to critical equipment? Is there a UPS or DG set backup for computer systems?">
    Yes. We have the backup for power supply and computer systems can be used without any interruption. We have applied the lightning protection metallic rods for the buidling for protection of premises.
  </Accordion>

  <Accordion title="Do you have a secure log-on procedure documented? Are general notices/message banner displayed upon login? Do you log successful and unsuccessful attempts? Are all user workstations and laptops part of the active directory?">
    Infrastructure logs are collected using the AWS Audit Trail, meanwhile the application related logs are collected in our ElasticSearch server and retained in the long term cloud storage. All the workstations are part of the Active directory. User accounts get locked after 15 minutes of inactivity. The accounts will get locked after the predetermined unauthorised attempts for security reasons.
  </Accordion>

  <Accordion title="Have you implemented data protection and privacy measures such DLP, IRM/DRM etc.? Have you deployed any encryption/protection mechanism (data at rest) on databases, file servers, desktops and laptops?">
    Yes, our web assets, email records, and end-points are sealed with data loss prevention techniques. All the customer data will be stored on only AWS virtual platform cloud. We do not store it offline for security reasons. AWS Guard Duty threat detection service that continuously monitors for malicious activity and unauthorized behaviour. The data is stored in our secure database and is transit scrambled for maximum security. We use TLS1.3 encryption while data in transit and AES256 while data at rest
  </Accordion>

  <Accordion title="Can the Cloud servers be configured to send their audit logs to a centralized log collector at the customer?">
    Infrastructure logs are collected using the AWS Audit Trail, meanwhile the application related logs are collected in our ElasticSearch server and retained in the long term cloud storage. logs are automatically audited, but are not integrated with tenant's security operations. In case the tenant requests for logs, they can share when asked by the clients.
  </Accordion>

  <Accordion title="All Application changes to be routed through the PMS system driven by IT Application Owner. Necessary approvals to be documented.">
    Attached the Infrastructure Change Control Procedure
  </Accordion>

  <Accordion title="Are critical transactions identified by function to be reviewed?">
    We use Amazon CloudWatch and Grafana polemique which allows us to monitor instances and alerts us through emails. Infrastructure logs are collected using the AWS Audit Trail, meanwhile the application related logs are collected in our Elastic Search server and retained in the long term cloud storage.
  </Accordion>

  <Accordion title="Are critical transactions logged and made available as a report through front end?">
    The logs are automatically audited, but are not integrated with tenant's security ops. In case the tenant requests for logs, they can shared when asked for by the clients.
  </Accordion>

  <Accordion title="All Security logs need to be enabled within the application for all menus and screens.">
    The logs are automatically audited, but are not integrated with tenant's security ops. In case the tenant requests for logs, they can shared when asked for by the clients.
  </Accordion>

  <Accordion title="Minimum Audit logging scenarios: Login successes and failures, Addition/deletion/modification of users, Changes to security settings, Privilege ID monitoring.">
    The logs are automatically audited, but are not integrated with tenant's security ops. In case the tenant requests for logs, they can shared when asked for by the clients.
  </Accordion>

  <Accordion title="Logs should be protected against overwriting by using mechanisms such as log rotation and the log files to be retained for minimum of 3 months on the server.">
    We retain the logs for at least 180 days.
  </Accordion>

  <Accordion title="Has your organisation evaluated pandemic preparedness of critical third-party suppliers?">
    AWS is one of the critical third party for us as we have deployed our application on AWS VPC. AWS is ISO 27001 and SOC 2 certified organization and compliant with the business continnuity requirements.
  </Accordion>

  <Accordion title="Operational risk arising from technology failure covering from any of below means (including system downtimes issues also).">
    Xoxoday application application has deployed on AWS Cloud virtual platform for securtity reasons and imlemented the business continuity plan. Xoxoday endeavours to provide 99.9% Uptime each month 24 hours a day 7 days a week. Business day will be considered as 24\*7 and will be available for 365 days in a year for the customer support services to be provided to the Client
  </Accordion>

  <Accordion title="Where are data subjects whose Personal Data is processed located?">
    The data will be stored on AWS Virtual platform cloud – Singapore region.
  </Accordion>

  <Accordion title="How is Personal Data being processed by Supplier?">
    The personal data will be uploaded on application application for rewards and recognition purposes and will be stored on AWS virtual platform cloud.
  </Accordion>

  <Accordion title="Who at Supplier will have access to the Personal Data, and for what purpose?">
    We have deployed our application on AWS Virtual platform cloud. We do not have physical access to the location where the personal data is stored.
  </Accordion>

  <Accordion title="What are the measures in place to prevent unauthorized personal from gaining physical access to premises, buildings or rooms where the data processing systems are located?">
    We have deployed our application on AWS Virtual platform cloud. We have the physical access controls in place. For ex – Access cards, Biometric machines, ID cards, CCTV etc..
  </Accordion>

  <Accordion title="What are the locations where Personal Data will be housed or accessed? Will Personal Data be stored on a Supplier Cloud or on prem environments?">
    The personal information will be collected through application platform and stored on AWS virtual platform cloud – Singapore region.
  </Accordion>

  <Accordion title="Can Supplier provide country location(s) for all Supplier personnel or subcontractors that may have access to Personal Data or privileged access to servers hosting Personal Data?">
    We have only one data center and deployed our application of AWS virtual platform cloud. By Default, Xoxoday will not have access to Service Data (customer's account/application and the associated data processed as part of using our services). The access control to the accounts (who can access the application instance) is managed by the admin from the customer end.
  </Accordion>

  <Accordion title="Describe the type of solution proposed (public/private/hybrid cloud, IaaS/Paas/CaaS/Saas/ASP, single-tenant/multi-tenant, etc.)">
    We use Public cloud for hosting (AWS Singapore)
  </Accordion>

  <Accordion title="Describe where the servers hosting the customer's data are located and, if the data is hosted on multiple locations, provide detailed information as to the transport of the data between the concerned locations.">
    AWS Virtual Platform Cloud - Singapore region.
  </Accordion>

  <Accordion title="Describe how you monitor changes to the regulatory requirements in relevant jurisdictions, adjust your security program for changes to legal requirements, and ensure compliance with relevant regulatory requirements.">
    We have deployed our application on AWS Virtual platform cloud and Xoxoday is GDPR certified. We have implemented the policies and procedures as per the ISMS and GDPR and implemented across the organization. We collect only three PIIs on our platform such as - Name, email ID and phone number. Xoxodau GDPR - [https://www.xoxoday.com/gdpr](https://www.xoxoday.com/gdpr) Xoxoday Privacy - [https://www.xoxoday.com/privacy-policy](https://www.xoxoday.com/privacy-policy)
  </Accordion>

  <Accordion title="Do you contractually guarantee that your data centers are not located in places that have a high probability/occurrence of high-impact environmental risks (floods, tornadoes, earthquakes, hurricanes, etc.)?">
    Yes. We have deployed our product on AWS virtual platform cloud.
  </Accordion>

  <Accordion title="Describe how you manage restoration of environment and/or data for a specific customer.">
    The data backups are done on AWS Virtual platform cloud on regular basis and implemeted the Data loss prevention techniques. We have all the capabilities to recover the data or restore. Data is available for restore within a few minutes of a backup job completing on the daily schedule. Attached the Backup Recovery Procedure
  </Accordion>

  <Accordion title="Provide a description of the physical security of your Datacenter both inside and outside the DataCenter itself.">
    AWS is responsible for providing physical security to the data center as we have deployed our application on AWS. AWS provides physical data center access only to approved employees. All employees who need data center access must first apply for access and provide a valid business justification. These requests are granted based on the principle of least privilege, where requests must specify to which layer of the data center the individual needs access, and are time-bound. Requests are reviewed and approved by authorized personnel, and access is revoked after the requested time expires. Once granted admittance, individuals are restricted to areas specified in their permissions. Third-party access is requested by approved AWS employees, who must apply for third-party access and provide a valid business justification. These requests are granted based on the principle of least privilege, where requests must specify to which layer of the data center the individual needs access, and are time-bound. These requests are approved by authorized personnel, and access is revoked after request time expires. Once granted admittance, individuals are restricted to areas specified in their permissions. Anyone granted visitor badge access must present identification when arriving on site and are signed in and escorted by authorized staff.
  </Accordion>

  <Accordion title="Provide an overview of how capacity planning is managed to limit the risk of system overload.">
    We have deployed our application on AWS Virtual platform cloud. Our solution is using state of the art Cloud Native infrastructure technologies along with microservices architecture allows us to scale our operations as per the demands.
  </Accordion>

  <Accordion title="Describe to procedure in place for responding to requests for tenant data or connection logs from governments or law enforcement bodies and how you ensure logs will be legally admissible.">
    Infrastructure logs are collected using the AWS Audit Trail, meanwhile the application related logs are collected in our Elastic Search server and retained in the long term cloud storage. We make these logs available upon tenents request.
  </Accordion>

  <Accordion title="Can logs be generated by the various components of the proposed solution be forwarded to the customer's log concentrator / SIEM / SOC?">
    We make these logs available upon tenents request
  </Accordion>

  <Accordion title="Describe how you manage to isolate logs for a specific tenant.">
    The logs are collected using the AWS Audit Trail and application related logs are collected in our Elastic Search server.
  </Accordion>

  <Accordion title="Does the organisation outsource its data storage?">
    AWS Cloud virtual platform.
  </Accordion>

  <Accordion title="Does the organisation have a Hot recovery site?">
    Its on AWS cloud virtual platform.
  </Accordion>

  <Accordion title="Are Cloud Hosting services subcontracted?">
    We have deployed our product on AWS Cloud virtual platform.
  </Accordion>

  <Accordion title="Do employees/contingent workers who have remote access connect to the customer network?">
    We do not connect to the customer network. Since it's a SaaS prodcut and deployed on cloud virtual platform only authorised individual have an access to the our production environment on need and approval basis.
  </Accordion>

  <Accordion title="Is client scoped data collected, accessed, transmitted, processed, or retained that can be classified as personally identifiable financial information under the Gramm-Leach-Bliley Act?">
    We have implemented the security measures to manage the risks introduced during the use of Organization's information assets used for managing Personally Identifiable Information. Attached the Personally Identifiable Information (PII) Policy.
  </Accordion>

  <Accordion title="Are environmental protections installed in your data centres including Cooling systems, Battery/UPS and generator backup, Redundant communications lines, Smoke/water detectors, Fire Suppression, Raised Flooring?">
    We have deployed our application on AWS cloud virtual platform. AWS provides physical security to the data center and it's a part of our subscription. AWS physical security - [https://aws.amazon.com/compliance/data-center/controls/](https://aws.amazon.com/compliance/data-center/controls/)
  </Accordion>

  <Accordion title="Are actions taken to resolve alerts generated by the monitoring tools?">
    We have deployed our application on AWS cloud virtual platform. AWS provides physical security to the data center and it's a part of our subscription. AWS physical security - [https://aws.amazon.com/compliance/data-center/controls/](https://aws.amazon.com/compliance/data-center/controls/)
  </Accordion>

  <Accordion title="If hosted on public cloud (Amazon, Google, Azure etc.) - security configurations are aligned with public cloud vendor security requirements?">
    We have deployed our application on AWS Virtual platform cloud. We use Web application firewall, IDs/IDs, AWS Audit trail, Amazon guard duty etc..
  </Accordion>

  <Accordion title="Have you applied data backup mechanism? If yes what is the frequency of backup?">
    Yes. Data backups are done on daily basis in a secured way in AWS
  </Accordion>

  <Accordion title="Does MFA is applied while accessing cloud environment / applications remotely (VPN, VDI)?">
    Yes.
  </Accordion>

  <Accordion title="Does access to privilege users / admin has MFA enabled?">
    Yes.
  </Accordion>

  <Accordion title="Does the DR is setup in some other city in India?">
    Its on AWS Cloud virtual platform Cloud.
  </Accordion>

  <Accordion title="Does the DR site also has the same level of security controls as the production site?">
    Yes
  </Accordion>

  <Accordion title="Where will vendor store the customer data? Is it stored over any shared location for all clients or the storage location is dedicated for the customer?">
    The data will be stored on AWS cloud virtual platform Singapore. Since we are a multi tenant system, we have common infrastructure for all clients.But All data volume is encrypted with AES 256-bit encryption to prevent any external snooping or unauthorized access in the multi-tenant environment.
  </Accordion>

  <Accordion title="Which all in-house or third party applications Vendor will use for the customer operations?">
    We do not use any in-house devoloped applications. We have deployed our application on AWS cloud virtual platform. And AWS is SOC 2, ISO 27001, ISO 27017 and ISO 27701 certified organization. Shared the certificates.
  </Accordion>

  <Accordion title="If Vendor is using in-house developed or third party applications for the customer process then VAPT report of application and Network is to be shared.">
    We do not use any in-house devoloped applications. We have deployed our application on AWS cloud virtual platform. And AWS is SOC 2, ISO 27001, ISO 27017 and ISO 27701 certified organization. Shared the certificates.
  </Accordion>

  <Accordion title="Are there any Cloud services which is used by vendor for the customer process? Please confirm details.">
    We have deployed our application on AWS cloud virtual platform.
  </Accordion>

  <Accordion title="Type of Cloud services and its use in the customer operations.">
    We have deployed our application on AWS cloud virtual platform.
  </Accordion>

  <Accordion title="Please confirm on Cloud License details and data storage location (domestic or International).">
    Data storage location will be AWS Singapore.
  </Accordion>

  <Accordion title="Please share details of Data Backup Procedures.">
    Data backups are done on daily and in a secured way in AWS. Attached the Backup Recovery Procedure.
  </Accordion>

  <Accordion title="Points of presence of supplier infrastructure is identified.">
    We have deployed our application on AWS Virtual platform cloud - Singapore and we operate from our corporate office located in Bangalore, India.
  </Accordion>

  <Accordion title="It is possible for the customer data to be restricted to a geographical location, if required.">
    We have deployed our application on AWS Virtual platform cloud - Singapore region and all the data will be stored there. All the end users from various parts in the world can access the platform. We inform the customer if we need to change the data center location.
  </Accordion>

  <Accordion title="Supplier has a multi-tiered firewall functionality in place, with network as well as application level protection (e.g. stateful network firewall, WAF, Network Intrusion Detection - NIPS, behavioral anomaly detection, cloud security gateways etc.).">
    As part of Web Application Firewall (WAF), rate limiters are installed to block multiple requests from specific IPs in order to prevent DDOS-type attacks. The Cloudflare Web Application Firewall (Cloudflare WAF) checks incoming web requests and filters undesired traffic based on the set of rules. pfSense generation firewall helps to monitors incoming and outgoing network traffic and decides whether to allow or block specific traffic based on a defined set of security rules We also have implemented the IDS/IPS and Amazon guard duty which continuously monitors our AWS accounts and workloads for malicious activity and delivers detailed security findings for visibility and remediation.
  </Accordion>

  <Accordion title="Vendor has a detailed backup and restoration plan in place. Security controls are applied in the same fashion for all the customer data, be that data actively used (online) or data stored in backup space.">
    We have implemented the data backup policy and attached the same. The data backups are done daily in a secured way in AWS and tested on weekly basis.These backup process are automated and does not require any mannual effort. Since we are SAAS product, we maintain backup and restore all the customer data by ourselves. We use AES 256 encryption for data at rest. All the backups are stored on Cloud and does not store any data off-cloud.
  </Accordion>

  <Accordion title="Hardware decommissioning policies are in place (when hardware is controlled by the vendor).">
    NA. We have deployed our application on AWS Virtual platform cloud.
  </Accordion>

  <Accordion title="There are security control mechanisms in place to counter denial of service attacks.">
    We have deployed our application on AWS Virtual Platform cloud. application is a cloud based application. As part of Web Application Firewall (WAF), rate limiters are installed to block multiple requests from specific IPs in order to prevent DDOS-type attacks. These are powered by intelligent daemons that detect other identifiers like URLs accessed or other client properties to automatically blacklist possible threats either temporarily or permanently.
  </Accordion>

  <Accordion title="When infrastructure is shared between tenants (typically a Cloud environment), threats and attacks directed toward other tenants do not impact the customer services provided by this infrastructure.">
    We have tools that analyze various traffic patterns and correlate network events. We have configured early warning signals that trigger alerts to our team based on event patterns and strict thresholds. We are equipped to detect and mitigate Threats, DDOS attacks, session hijack, login spoofs or any other data extraction strategies AWS Guard Duty threat detection service that continuously monitors for malicious activity and unauthorized behaviour. The data is stored in our secure database and is transit scrambled for maximum security. We use TLS1.3 encryption while data in transit and AES256 while data at rest. We also conduct periodical Vulnerability assessment and penetration testing and fixes the vulnerabilities identified in order to eliminate the risk.
  </Accordion>

  <Accordion title="There is a activity and security logging process in place, and these logs are synchronized with the same network time server (NTP).">
    Infrastructure logs are collected using the AWS Audit Trail, meanwhile the application related logs are collected in our Elastic Search server and retained in the long term cloud storage. Administrative logs are part of Cloud Dashboard and are regularly reviewed. We use Amazon CloudWatch and Grafana polemique which allows us to monitor instances and alerts us through emails. We use a synchronized time-service protocol (e.g., NTP) to ensure all systems have a common time reference
  </Accordion>

  <Accordion title="There is data/log retention process in place.">
    Yes, systems must be configured to log all successful and unsuccessful login attempts by accounts with privileged access. These authentication logs must be retained for a minimum of 180 days and in accordance with the Company's records retention guidelines.
  </Accordion>

  <Accordion title="When infrastructure is shared between tenants, the data and/or logs are also separated for all tenants. There is an intelligent system and/or process in place for analysing these logs.">
    We use logical data isolation with the help of company specific encryption keys and its solated from other customers data. Yes, audit logs are reviewed and recorded on a regular basis automatically. These logs are integrated with security operations/SIEM solutions.
  </Accordion>

  <Accordion title="Does the cloud provider deliver data back up and/or data mirroring?">
    The data backups are done daily in a secured way on AWS and tested on a weekly basis. These backup processes are automated and do not require any manual effort. Since the data backup is automated and happening on a daily basis the data backup will get replaced every day and restored, if necessary/required.
  </Accordion>

  <Accordion title="Is the Cloud Provider Privacy Shield certified?">
    Yes, AWS is certified under the EU-US Privacy Shield. [https://www.privacyshield.gov/participant?id=a2zt0000000TOWQAA4](https://www.privacyshield.gov/participant?id=a2zt0000000TOWQAA4)
  </Accordion>

  <Accordion title="Can customers define the transient and persistent points of their data (i.e. the legal jurisdiction in which their data is transported and stored)?">
    All the data will be stored on AWS cloud virtual platform cloud - Singapore region.
  </Accordion>

  <Accordion title="Is there an ability to monitor user activities? (E.g.: all actions taken by admin users)">
    All user activities are logged in the audit trail.
  </Accordion>

  <Accordion title="What availability measures do you employ to guard against threats and errors?">
    As part of Web Application Firewall (WAF), rate limiters are installed to block multiple requests from specific IPs in order to prevent DDOS-type attacks. In addition to that we also have AWS Guard Duty threat detection service that continuously monitors for malicious activity and unauthorized behaviour.
  </Accordion>

  <Accordion title="Do you have DDoS protection, and if so, how?">
    As part of Web Application Firewall (WAF), rate limiters are installed to block multiple requests from specific IPs in order to prevent DDOS-type attacks
  </Accordion>

  <Accordion title="What application security measures are used in the production environment (e.g., application-level firewall, database logging / auditing, etc.)?">
    We use Web application firewall, IDs/Ips, AWS Audit trail, Amazon guard duty etc..
  </Accordion>

  <Accordion title="Do you logically and physically segregate production and non-production environments?">
    We have a dedicated non-production environment which is in a different AWS account and allows us to segregate data from the production environment.
  </Accordion>

  <Accordion title="Do you have a policy that requires endpoints (laptops, desktops, etc.) to perform backups of specified corporate data?">
    We have implemented the Backup Recovery Procedure to protect the organization information asset from the damages that may be caused due to failure of hardware system, corruption of software etc..
  </Accordion>

  <Accordion title="Is there an audit log available which covers user/api actions?">
    Infrastructure logs are collected using the AWS Audit Trail, meanwhile the application related logs are collected in our ElasticSearch server and retained in the long term cloud storage. The event logs are stored in a bucket wherein nobody can access them without an approval from the high authorities i.e. the Chief Technical Officer. In case the tenant requests for logs, that can be shared.
  </Accordion>

  <Accordion title="If the application can be hosted in PwC's private cloud.">
    At present, application application has been deployed on AWS Virtual platform cloud.
  </Accordion>

  <Accordion title="Cost to host in PwC private cloud.">
    [This is not feasible. AWS is compliant to the Singapore Data Privacy Regulations. https://aws.amazon.com/compliance/singapore-data-privacy/](https://aws.amazon.com/compliance/singapore-data-privacy/)
  </Accordion>

  <Accordion title="NSE's data and information shall be stored in data centres within India.">
    All the data will be stored on AWS Singapore
  </Accordion>

  <Accordion title="The redundant site where NSE's data and information are replicated shall also be in India in a separate location from the primary site.">
    All the data will be collected only through our application and stored on AWS cloud platform and its situated in Singapore.
  </Accordion>

  <Accordion title="All backup media (physical, logical and virtual) of NSE's data and information shall be stored securely in India.">
    All the data will be stored on AWS Singapore
  </Accordion>

  <Accordion title="The Cloud Service Provider shall provide visibility to NSE into its infrastructure and processes, and to allow NSE to check the integrity and security of the cloud computing services.">
    We are cloud security alliance level 1 compliant. We would be happy to help NSE for checking the integrity and security of the cloud computing services and compliance to applicable policies and regulations.
  </Accordion>

  <Accordion title="Cloud Service Provider shall ensure no management ports / console shall be accessible over the internet.">
    We agreee. We comply with CSA STAR Level 1 compliance requirements.
  </Accordion>

  <Accordion title="NSE shall ensure that no insecure ports on the Cloud infrastructure are open to the internet.">
    We comply with this. We have deployed our application on AWS to ensure maximum security of data.
  </Accordion>

  <Accordion title="Cloud Service Provider and NSE shall monitor the network and security devices, virtualization platforms, operating systems, databases, applications, web servers and associated infrastructure, for security alerts and known attack vectors.">
    We agree. We combine enterprise-class security features with comprehensive audits of our applications, systems, and networks to ensure customer and business data is always protected. And our customers rest easy knowing their information is safe, their interactions are secure, and their businesses are protected. We do conduct internal and external audits and ensure that required remidiations are implemented.
  </Accordion>

  <Accordion title="Where will UP data be hosted (geographic location)?">
    The data is hosted on Amazon Web Services (AWS) For accurate latency, the data center is selected as Singapore region for Asia specific data and Oregon for US specific data which are defined as data centers.
  </Accordion>

  <Accordion title="What is the standard used for destroying data on retired or failed hardware?">
    The Xoxoday platform operates on the cloud, which means there are no removable storage devices in question. We have Media protection procedure to handle the locally stored data. We complied with the compliance requirements.
  </Accordion>

  <Accordion title="What options are available to transfer data between UP and the Supplier?">
    We do not take any data directly. The data will be provided through our platform or application and its hosted on Amazon Web Services (AWS)
  </Accordion>

  <Accordion title="How is uptime measured?">
    We rely on AWS Cloud for Uptime mesurement.
  </Accordion>

  <Accordion title="Is your service run from your own (a) data center, (b) the cloud, or (c) deployed-on premise only?">
    Yes. We have deployed our application on AWS cloud platform
  </Accordion>

  <Accordion title="Have you researched your cloud providers best security practices?">
    Yes. Please visit here for more details about AWS Cloud Security - [https://aws.amazon.com/security/](https://aws.amazon.com/security/)
  </Accordion>

  <Accordion title="What systems do you have in place that mitigate classes of web application vulnerabilities? (e.g.: WAF, proxies, etc.)">
    As part of Web Application Firewall (WAF), rate limiters are installed to block multiple requests from specific IPs in order to prevent DDOS-type attacks. These are powered by intelligent daemons that detect other identifiers like URLs accessed or other client properties to automatically blacklist possible threats either temporarily or permanently.
  </Accordion>

  <Accordion title="How do you log and alert on relevant security events? (this includes the network and application layer)?">
    We use Amazon CloudWatch and Grafana polemique which allows us to monitor instances and alerts us through emails We have implemented IDS/IPS Firewall. Our security information and event management (SIEM) system merge data sources (app logs, firewall logs, IDS logs, physical access logs, etc.) for granular analysis and alerting.
  </Accordion>

  <Accordion title="What processes and methods will be put in place, to securely back-up the system? Where will the Back-up data be stored?">
    We predominantly work on cloud-based infrastructure from Amazon Web Services which provide backup and restore services to build scalable, durable, and secure data-protection solutions Please refer to AWS site for more details: [https://aws.amazon.com/backup-restore/](https://aws.amazon.com/backup-restore/)
  </Accordion>

  <Accordion title="Will any the customer data be held on removable media including Back-ups? If so, will it be encrypted?">
    It will be stored on AWS, and It will be encrypted (AES 256-bit encryption)
  </Accordion>

  <Accordion title="What firewalls and network/host protection measures (e.g. IDS or IPS) will be in place to protect the customer data? Describe how you will configure, maintain the above and monitor alerts generated.">
    Yes. We have implemented IDS/IPS Firewall. Our security information and event management (SIEM) system merge data sources (app logs, firewall logs, IDS logs, physical access logs, etc.) for granular analysis and alerting.
  </Accordion>

  <Accordion title="What information will be contained within logs?">
    The only user data that will stored within the system is employee personal information - names, emails and contact numbers. Infrastructure logs are collected using AWS Audit Trail
  </Accordion>

  <Accordion title="AWS Provide physical security services to our data centre.">
    Please visit for more details - [https://aws.amazon.com/compliance/data-center/controls/](https://aws.amazon.com/compliance/data-center/controls/)
  </Accordion>

  <Accordion title="Is this a Cloud Solution?">
    Our application is deployed on AWS cloud platform.
  </Accordion>

  <Accordion title="All privileged and service system, network or application level passwords, required for correct operations of business units must be backed up and kept in secure location available for extraction to a specified number of people on specific circumstances.">
    We are Compliant. We have implemented the data backup policy. We do take backup of the all the users and securely stored. All our application users data back up including password will happen through AWS cloud virtual platform.
  </Accordion>

  <Accordion title="Where technically feasible, implement network and/or host-based technical controls that detect changes in access to shared networks and shared resources.">
    We have controls in place. We have implemented the firewall and IDS/IPS for detection and prevention of security.
  </Accordion>

  <Accordion title="System testing and commissioning ensures security capabilities of the system are appropriately configured and verified.">
    During the testing phase we make sure that we are meeting all the security requesrements and validate the same before the deployment.
  </Accordion>

  <Accordion title="Encryption for protection of information/data transported by carriers, tapes, removable media devices or across communication lines shall be employed.">
    All the data will be stored on AWS cloud and encrypted with Client specific keys. We do not transfer data to any external drives or media devices.
  </Accordion>

  <Accordion title="Application logs shall be verified to ensure there are no known anomalies before system deployment.">
    We monitor these logs periodically
  </Accordion>

  <Accordion title="Backup media shall be kept in a secured manner against tampering, theft, fire, flood or damage until retention period elapsed.">
    Backup data is stored on AWS cloud for maximum security.
  </Accordion>

  <Accordion title="Where technically feasible, and based on the criticality of the asset, backups shall be tested to ensure their availability and integrity for the customer recovery efforts and confirm compliance with established RPO/RTO.">
    We test the backup on a periodical basis to make sure that we follow the availability and integrity principles.
  </Accordion>

  <Accordion title="To ensure effective testing, restoration procedures shall be fully documented and tested.">
    We have documented our Data backup procedures.
  </Accordion>

  <Accordion title="For each asset, all activities/events and its details to be captured in all type of available logs for all hardware devices, operating systems, system usage, installed applications and security related events shall be identified.">
    We monitor the logs as per the compliance requirements.
  </Accordion>

  <Accordion title="Logs shall be protected against tampering and unauthorised access.">
    We are compliant.
  </Accordion>

  <Accordion title="Fault logging shall be enabled in equipment wherever technically feasible.">
    All the logs are recorded in the system.
  </Accordion>

  <Accordion title="In all instances where automated logging and monitoring is not feasible, compensating mechanisms to record and retrieve manual logs shall be provided.">
    We always make sure that componentory controls in place if monitoring is not feasible.
  </Accordion>

  <Accordion title="Service Provider shall have solid high-availability infrastructure in line with the customer requirements.">
    We have deployed our application on AWS cluod virtual platform
  </Accordion>

  <Accordion title="Only authorised personnel can access to the data centre(s). The data centre(s) have security controls such as man-traps, CCD security cameras, and on-site 24x7 security staff.">
    It's a part of cloud security services
  </Accordion>

  <Accordion title="The data centre is a purpose-built facility with environmental controls including: redundant power supply, redundant cooling, UPS, generator, fire suppressant, temperature and moisture monitors.">
    It's a part of cloud security services
  </Accordion>

  <Accordion title="What are the controls to prevent complete and permanent loss of customer data?">
    Data backups are done daily and in a secured way in AWS. The customer data cannot be lost permanently. We also have Business Continuity Policy and Business Continuity Management Procedure in place and effectivly working.
  </Accordion>

  <Accordion title="Which databases are used in the backend? Which database optimization approaches are taken?">
    The data is only stored on our application and its deployed on AWS Cloud. Our data is stored in secured databases and there is no window to alter any data without it being logged into the system records
  </Accordion>

  <Accordion title="What are security approaches along the architecture stack? Is end-to-end security ensured? Does the platform allow standardized security mechanism, e.g. Kerberos, LDAP?">
    We have deployed our application on Amaon web services (AWS) cloud platform. We are using MySQL, Salt stack, Nodejs and MongoDB technology. LDAP, SAML2, Normal username-password
  </Accordion>

  <Accordion title="Describe the hosting infrastructure.">
    We are a SAAS solution. We are cloud hosted.
  </Accordion>

  <Accordion title="How does the system scale to support growing user populations?">
    We are a SAAS Solution and have all the capabilities to supoprt huge number of users.
  </Accordion>

  <Accordion title="Describe the data center power backup.">
    Data center services are provided by AWS
  </Accordion>

  <Accordion title="Describe data backup and restore procedures.">
    Data backups are done daily and in a secured way in AWS
  </Accordion>

  <Accordion title="Do you own the data centers?">
    No. Application is deployed on AWS Cloud.
  </Accordion>

  <Accordion title="Scale Up / Down capabilities? (Storage capacity, Computing Power)">
    We have both horizontal and Vertical Scaling
  </Accordion>

  <Accordion title="Scale Out Capabilities? (Module / Feature addition / removal)">
    We have auto scaling and self healing.
  </Accordion>

  <Accordion title="What tools are used to monitor application availability? Expected availability is 99.999% monthly basis.">
    We use a variety of tools and plugins integrated with Prometheus & Cloudwatch along with health checks for facilitating our uptime/service availability
  </Accordion>

  <Accordion title="Where are your DR sites located?">
    AWS Cloud virtual platform
  </Accordion>

  <Accordion title="Are there security controls (like log generation, access control) in place to store the PII downloaded from the application?">
    We use Amazon CloudWatch and Grafana polemique which allows us to monitor instances and alerts us through emails
  </Accordion>

  <Accordion title="Are there plans in place to handle/manage contingent events or circumstances (e.g. what if the person with the key to the server room is sick)?">
    Yes. We have deployed our application on AWS virtual platform cloud. And we have the process in place to handle or manage any contingent events or circumstances. We have implemented the Business continuity management and tested annually to validate the effectiveness of the controls. Attached the Business continuity management plan.
  </Accordion>

  <Accordion title="How are physical access controls authorized? (who is responsible for managing and ensuring that only appropriate persons have keys or codes to the facility)">
    We have an Admin/Facility department who is responsible and manage the Physical security and we have provided the access cards to all the employees and visitors and installed biometric machines at all the entry and exit areas. We have also installed the CCTV cameras in our building and will be monitored 24\*7 for maximum security. AWS Data centre physical security – We have deployed our application product on AWS virtual platform cloud. Physical access is strictly controlled both at the perimeter and at building ingress points by professional security staff utilizing video surveillance, intrusion detection systems, and other electronic means. Authorized staff must pass two-factor authentication a minimum of two times to access data center floors. All visitors and contractors are required to present identification and are signed in and continually escorted by authorized staff. AWS only provides data center access and information to employees and contractors who have a legitimate business need for such privileges. When an employee no longer has a business need for these privileges, access is immediately revoked, even if they continue to be an employee of Amazon or Amazon Web Services. All physical access to data centers by AWS employees is logged and audited routinely.
  </Accordion>

  <Accordion title="Will any Personally Identifiable Information (PII) be stored with vendor? Please mention specific reports that are to be stored.">
    PII will be entered through application and stored it on AWS cloud virtual platform. We store Name, email ID and phone number of the users.
  </Accordion>

  <Accordion title="How will Vendor share reports/data to the customer i.e. through SFTP, mail with some encrypted way or in a simple excel/pdf format.">
    Reports can be generated by the admins through the application. If there are any additional support needed, our customer support team would be able to help and guide on generating report.
  </Accordion>

  <Accordion title="Have you employed sub processor(s) for processing TCS data?">
    The data will be stored on AWS Cloud and we do not share or transfer the data
  </Accordion>

  <Accordion title="A copy of any security focused questionnaires prepared for the product/environment (Cloud Security Alliance CAIQ, Shared Assessments SIG, etc.).">
    Xoxoday is CSA STAR LEVEL 1 Compliant. Please click here to download CAIQ - [https://cloudsecurityalliance.org/star/registry/nreach-online-services-pvt-ltd-xoxoday/services/nreach-online-services-pvt-ltd-xoxoday/](https://cloudsecurityalliance.org/star/registry/nreach-online-services-pvt-ltd-xoxoday/services/nreach-online-services-pvt-ltd-xoxoday/)
  </Accordion>

  <Accordion title="A list of your data center locations (primary, secondary, etc.) where services are provided from and all locations/countries where information may be processed.">
    We have deployed our application on AWS Virtual platform cloud – Singapore region.
  </Accordion>

  <Accordion title="A list of third service providers utilized to conduct any aspect of the contracted service in scope.">
    Not Applicable. We have not outsourced.
  </Accordion>

  <Accordion title="Describe your security architecture.">
    We have deployed our application on AWS Cloud virtual platform for maximum security. The data center is hosted completely in isolation so that the access is limited and controlled. Load balancer allows shifting incremental load and can auto scale based on data load experienced by application. We have implemented Amazon Cloud watch to enable monitoring of the functioning of the application. The data is encrypted using 256-encryption based SSL certificate. To manage security of data we conduct a quarterly VAPT based security audit of application.
  </Accordion>

  <Accordion title="Does product have security mechanisms against intrusion?">
    Yes, all the mechanisms related to security are implemented to facilitate timely decision and investigation by root-cause analysis. These incidences are analyzed with network intrusion detection (IDS) tools.
  </Accordion>

  <Accordion title="Please furnish historical data with reference to the solution proposed highlighting the errors /fixes/patches within security category and the resolutions undertaken to cater those.">
    We have implemented the Patch management procedures. Critical patches will be deployed immediately High patches will get deployed within 5 days Medium Patches will get deployed within 15-day Low will get deployed in 25 days.
  </Accordion>

  <Accordion title="Do you provide free security patch to the customer at no additional cost?">
    Yes. Since it's a SAAS Product we do not charge any additional cost.
  </Accordion>

  <Accordion title="Do you have a specific R&D team that keep improving your solution security through patch release. Please elaborate (how, many, where)">
    We have a team of 15+ who works for improving our solution security. We conduct periodical Vulnerability assessment and Penetration testing with the help of the Authorized third-party vendors and Fix the observations found during the testing in order to mitigate the risk. Our team is based out of Bangalore location.
  </Accordion>

  <Accordion title="Is your system able to operate on hardened web services system? Please also provide ports required for your system to operate.">
    Yes. Our SAAS solution has been deployed on AWS cloud virtual platform.
  </Accordion>

  <Accordion title="Can the security module be integrated with Middleware to provide the security services? If yes, describe the mechanism?">
    Its SAAS Product and implemented the security controls in order to provide secure services and make sure that the customer data is protected.
  </Accordion>

  <Accordion title="How easy and convenient is your solution authentication and security features for the customer.">
    We have deployed our application on AWS Cloud platform for maximum security. The data will be provided through our platform or application and its hosted-on Amazon Web Services (AWS) Our solution is very easy to use with convenient security features.
  </Accordion>

  <Accordion title="CLOUD SERVICE PROVIDER (CSP) must save access logs for any inbound and outbound access of CLIENT Cloud Infrastructure.">
    Infrastructure logs are collected using the AWS Audit Trail, meanwhile the application related logs are collected in our Elastic Search server and retained in the long term cloud storage. Administrative logs are part of Cloud Dashboard and are regularly reviewed.
  </Accordion>

  <Accordion title="CLOUD SERVICE PROVIDER (CSP) must have security infrastructure for securing any inbound and outbound connection to any of their infrastructure where CLIENT system and/or data reside.">
    We use a cloud hosted VPN with strict access controls to allow our employees to access the official network. This VPN is managed by our IT team, and it's linked with the SSO/Active Directory
  </Accordion>

  <Accordion title="CLOUD SERVICE PROVIDER (CSP) must provide onsite security as a service as the first security line to CLIENT asset that resides on CSP premises.">
    We have deployed our application on AWS Cloud virtual platform. AWS is met all the data center compliance requirements.
  </Accordion>

  <Accordion title="What types of controls are in place to mitigate the risk of malware infection and external hacking?">
    We use a cloud hosted VPN with strict access controls to allow our employees to access the official network. This VPN is managed by our IT team and it's linked with the SSO/Active Directory We have implemented intrusion detection tools, we ensure timely detection and investigation in a prompt manner. File integrity (host) and network intrusion detection (IDS) tools implemented to help facilitate timely detection, investigation. We also have Endpoint security software for all the computers for Protection from exploits, malicious web downloads and softwares, Application and device control etc.
  </Accordion>

  <Accordion title="Will any data be hosted with, or accessed by a sub-contractor?">
    We have deployed the application application on AWS Cloud platform.
  </Accordion>

  <Accordion title="Do any sub-contractors reside in offshore jurisdictions?">
    The data center is in the Singapore region
  </Accordion>

  <Accordion title="Do you have contracts with third party service providers who may have access to FINCARE data (controls such as - Confidentiality agreements, NDAs, review mechanism etc.)?">
    We have deployed our application on AWS cloud virtual platform. but, We have not outsourced any of services and third party will not have access to FINCARE data.
  </Accordion>

  <Accordion title="Is a process in place to regularly monitor your third party service providers to ensure compliance with security standards?">
    Yes. We monitor their compliance, security standards, certifications and Audit Etc.
  </Accordion>

  <Accordion title="Do you have an independent audit performed on your dependent third parties who have access to your Company or clients data?">
    [We have deployed our application on AWS cloud virtual platform. AWS is ISO 27001, ISO 27017, ISO 27701, SOC 2, PCI DSS Level 1 certified organization. Please click here for more information about AWS Audit and certification - https://aws.amazon.com/compliance/programs/](https://aws.amazon.com/compliance/programs/)
  </Accordion>

  <Accordion title="Please explain the data flow/information flow from source to destination, including all the components in the data processing lifecycle.">
    All the data will be provided through the application and it will be stored on AWS cloud virtual platform. We use Cloudflare web application firewall for maximum security. We have encrypted the data while in transit and at rest. We use TLS1.2 encryption for Data at transit and AES256 Data at rest for maximum security. Attached the application data flow diagram
  </Accordion>

  <Accordion title="Does the organization is having network security controls (including boundary controls) in place? If yes please explain and share evidence?">
    We have the security controls in place. We have installed the firewalls to monitor and control the incoming and outgoing network traffic based on predetermined security rules. It helps us to establishes a barrier between a trusted network and an untrusted network. We use a cloud hosted VPN with strict access controls to allow our employees to access the official network. This VPN is managed by our IT team and it's linked with the SSO/Active Directory. Attached the Network Access Control and Security Procedure.
  </Accordion>

  <Accordion title="Is anti-Virus / malware installed on the desktops/ laptops/ Servers and are regularly updated? If yes please explain and share evidence?">
    Yes. we have installed Bitdefender end point security in all the devices for maximum security and have controls on Anti-Virus / Malicious Software throgh End point security. We have also enabled Network Threat Prevention, Advanced Threat Defense, Web Attack Prevention, Multi-Layer Ransomware Protection. Attached the sample screenshot of Bitdefender end point security.
  </Accordion>

  <Accordion title="Applications must be deployed in PSJH Cloud environment, reviewed and approved by EIS. Development, test, and production environments must be segmented from each other.">
    The application is deployed on AWS Virtual platform cloud - Singapore region.
  </Accordion>

  <Accordion title="Application, network, infra and hosting teams shall establish an alternate storage and processing site including necessary agreements to permit the storage and retrieval of information from alternative site.">
    application application is deployed on AWS virtual platform cloud and storgae and scaling up would not be a challenge.
  </Accordion>

  <Accordion title="Application, network, infra and hosting teams shall conduct backups of user-level information, system-level information, and information system documentation at least once every 12 months.">
    Data backups are automated and done daily and in a secured way on AWS. The data at rest in encrypted only authorised individuals (CT0/Production head) will have access to protect the confidentiality, integrity, and availability of the information. These data backups are reviewed on weekly basis and has been validated during the internal and external audits.
  </Accordion>

  <Accordion title="Configure event logging for all system components to audit access and activity to individual users, including proxy users of applications and databases.">
    We use Amazon CloudWatch and Grafana polemique which allows us to monitor instances and alerts us through emails. Infrastructure logs are collected using the AWS Audit Trail, meanwhile the application related logs are collected in our Elastic Search server and retained in the long term cloud storage. Administrative logs are part of Cloud Dashboard and are regularly reviewed.
  </Accordion>

  <Accordion title="Centrally manage and audit event logs utilizing security monitoring tools (eg. Microsoft Sentinel SIEM, XSOAR, and ServiceNow solutions) where available.">
    Yes, audit logs are reviewed and recorded on a regular basis automatically. These logs are integrated with security operations/SIEM solutions. We use Amazon CloudWatch and Grafana polemique which allows us to monitor instances and alerts us through emails. Infrastructure logs are collected using the AWS Audit Trail, meanwhile the application related logs are collected in our Elastic Search server and retained in the long term cloud storage. Administrative logs are part of Cloud Dashboard and are regularly reviewed.
  </Accordion>

  <Accordion title="Use only secure and up to date third party or open source components that have been formally approved by EIS, Providence Legal, IT Contracting, and any other applicable Providence approval and governance groups.">
    We have deployed our applicaiton on AWS Virtual platform cloud. We do not use any unauthorised applications accross the organization as per the Information security policy.
  </Accordion>

  <Accordion title="Developers must not have access to both the development/test and production environments. Use cases where developers need access must be reviewed by ISRA for approval.">
    At Xoxoday the test environment and production environment has been seperated. We have dedicated non-production environment which is in different AWS account and allowing us to segregate data of production environment.
  </Accordion>

  <Accordion title="Employ controls to protect REST services against Cross-Site Request Forgery attacks.">
    we use Cloudflare Web application firewall (WAF), AWS Guard Duty threat detection service, Amazon CloudWatch, IDS/IPS etc.. for maximum security of data.
  </Accordion>

  <Accordion title="Implement controls to prevent log injection.">
    Compliant. We do not allow un-trusted and un-validated inputs and attacker cannot insert malicious data and false entries into the logs.
  </Accordion>

  <Accordion title="Implement controls to prevent sharing of source code without authorization. Application teams to use Enterprise approved Source Control Repository and Contineous deployment mechanism.">
    We do not share the source code. Our code reviews and analysis run through stringent eyes of automated technologies as well as manual source code overview to cover any security loopholes prior to the production phase.
  </Accordion>

  <Accordion title="Implement controls to restrict and limit access to source code to authorized users. Access to be extended only to PSJH accounts.">
    At Xoxday the source code is restricted to only the authorised individuals
  </Accordion>

  <Accordion title="The solution is scalable to support the customer size and complexity: 170,000 co-workers, 10% new co-workers yearly, 40% co-workers turnover, Minimum 35 countries.">
    Yes. Our solution is using state of the art Cloud Native infrastructure technologies along with microservices architecture allows us to scale our operations as per the demands.
  </Accordion>

  <Accordion title="Security model of storage of data - Please describe shortly how data is stored, in relation to vendor's data, is protected at use, in transit and at rest.">
    We have deployed our application on AWS Cloud virtual platform and all the data is stored on AWS. All the confidential/PI data are encrypted at rest and in transit with a split key mechanism to ensure that every client's key is unique. We use TLS1.3 encryption while data in transit and AES256 while data at rest.
  </Accordion>

  <Accordion title="Are there any subcontractors involved (4th Parties to Infosys) in providing services to Infosys? If yes, detail out the current process in the organization for ensuring adequate security governance.">
    we use Amazon Web Services (AWS) as our Communication service provider. We review the adequate security governance periodicall to make sure that they are also complied with all the Security and Privacy compliance requirements.
  </Accordion>

  <Accordion title="Do you process personal data as part of engagement with Infosys?">
    We are the Data processor. application is GDPR compliant. At Xoxoday, we ensure that the data is gathered, stored, and handled with respect to individual rights.
  </Accordion>

  <Accordion title="Is the logs maintained for login successful and failure attempts?">
    The audit logs are reviewed and recorded on a regular basis automatically. These logs are integrated with security operations/SIEM solutions.
  </Accordion>

  <Accordion title="Is application configured for audit trails?">
    At Xoxoday Infrastructure logs are collected using the AWS Audit Trail, meanwhile the application related logs are collected in our Elastic Search server and retained in the long term cloud storage.
  </Accordion>

  <Accordion title="Is the code repository established and back-up are taken regularly?">
    The backup is automated and happen on AWS on regular basis.
  </Accordion>

  <Accordion title="Is the application server have latest operating system, licensed and supported?">
    We have deployed our application on AWS Virtual platform cloud - Singapore region.
  </Accordion>

  <Accordion title="Is the database server are hardened for security and maintained?">
    The application and database server are hardened.
  </Accordion>

  <Accordion title="Is security audit logs and alerts are configured for application server?">
    Infrastructure logs are collected using the AWS Audit Trail, meanwhile the application related logs are collected in our Elastic Search server and retained in the long term cloud storage.
  </Accordion>

  <Accordion title="Is any server or data mentioned of/from/by application hosted or shared outside of Indian legal and juridiction bounderies?">
    We have deployed our application on AWS Virtual platform cloud - Singapore region. All the application data is stored there on AWS - Singapore.
  </Accordion>

  <Accordion title="Does the provider use a third party to provide the required services? If so, explain the services to be provided by the third party and the type of relationship between the provider and the third party.">
    We use third party to provide necessary services to the organization on need and approval basis. For ex – Background verification vendor, VA/PT authorised third party vendor, Eternal Auditors, AWS Virtual platform cloud service providers, Google workspace etc
  </Accordion>

  <Accordion title="Are the services provided by the provider scalable? Are there any limits?">
    We predominantly work on cloud-based infrastructure - Amazon Web Services which provides the Backup and Restore services to build scalable, durable, and secure data-protection solutions. No limits.
  </Accordion>

  <Accordion title="What is the process to restore data from the provider's back-up?">
    Data backups are done daily and in a secured way in AWS. And Our team review the same on regular basis.
  </Accordion>

  <Accordion title="Till how long data backup will be retained?">
    Data backups are done on daily basis and in a secured way in AWS. We have the mechanism in place to delete the data upon termination of the contract upon customer request. In addition to safeguarding the rights of data subjects under the GDPR, we have implemented the Data Retention and Disposal Policy ensuring that excessive amounts of data are not retained by us.
  </Accordion>

  <Accordion title="If using virtual infrastructure, does the solution include hardware independent restore and recovery capabilities?">
    We have deployed our application on AWS Virtual platform cloud and they provide these services.
  </Accordion>
</AccordionGroup>

<AccordionGroup>
  <Accordion title="Is your infrastructure in the cloud, SDDC, co-location, or on-premise? Please state provider name, unless it is on-prem.">
    We have deployed our application on AWS Virtual platform cloud - Singapore and USA region.
  </Accordion>

  <Accordion title="Is your Data Security Architecture designed using an industry standard (e.g., CDSA, MULITSAFE, CSA Trusted Cloud Architectural Standard, FedRAMP, CAESARS)?">
    Data Security Architecture designed using an industry standard and best practices. We are adhered to CSA, ISO 27001, SOC 2 TSP. We have deployed our application on AWS Virtual platform cloud - Singapore region. The cloud infrastructure providers have high levels of physical and network security and hosting provider vendor diversity.
  </Accordion>

  <Accordion title="Do you inventory, document, and maintain data flows for data that is resident (permanent or temporary) within the services' applications and infrastructure network and systems?">
    All our customer data is stored on AWS Virtual platform cloud. And we collect the data only throguh our application platform. We do not store any customers data locally.
  </Accordion>

  <Accordion title="Are file integrity (host) and network intrusion detection (IDS) tools implemented to help facilitate timely detection, investigation by root cause analysis, and response to incidents?">
    File integrity (host) and network intrusion detection (IDS) tools implemented to help facilitate timely detection, investigation.
  </Accordion>

  <Accordion title="Does the virtual machine management infrastructure include a tamper audit or software integrity function to detect changes to the build/configuration of the virtual machine?">
    AWS CloudTrail helps to detect changes to the build/configuration of the virtual machine
  </Accordion>

  <Accordion title="Does your system's capacity requirements take into account current, projected, and anticipated capacity needs for all systems used to provide services to customers?">
    Our solution is using state of the art Cloud Native infrastructure technologies along with microservices architecture allows us to scale our operations as per the demands.
  </Accordion>

  <Accordion title="Are system and network environments protected by a firewall or virtual firewall to ensure business and customer security requirements?">
    We use Web application firewall (WAF) and pfSense firewall for security reasons. 1. The Cloudflare Web Application Firewall (Cloudflare WAF) checks incoming web requests and filters undesired traffic based on the set of rules. 2. pfSense helps to monitors incoming and outgoing network traffic and decides whether to allow or block specific traffic based on a defined set of security rules
  </Accordion>

  <Accordion title="Have you implemented the necessary measures for the appropriate isolation and segmentation of customers' access to infrastructure system and network components?">
    We isolate our machines, network and storage with respect to the AWS Standards in order to keep it safe and secure.
  </Accordion>

  <Accordion title="Are system and network environments protected by a firewall or virtual firewall to ensure protection and isolation of sensitive data?">
    We use Web application firewall (WAF) and pfSense firewall for security reasons.
  </Accordion>

  <Accordion title="Do you implement technical measures and apply defense-in-depth techniques (e.g., deep packet analysis, traffic throttling and black-holing) for detection and timely response to network-based attacks associated with anomalous ingress or egress traffic patterns and/or DDoS attacks?">
    As part of Web Application Firewall (WAF), rate limiters are installed to block multiple requests from specific IPs in order to prevent DDOS-type attacks. These are powered by intelligent daemons that detect other identifiers like URLs accessed or other client properties to automatically blacklist possible threats either temporarily or permanently.
  </Accordion>

  <Accordion title="Do you select and monitor outsourced providers in compliance with laws in the country where the data is processed, stored, and transmitted?">
    Yes. We monitor the compliance programs of AWS As we have stored the data on their cloud.
  </Accordion>

  <Accordion title="Do you have the capability to restrict the storage of customer data to specific countries or geographic locations?">
    No. Currently, all the data is stored on AWS VPC - Singapore region.
  </Accordion>

  <Accordion title="Can you provide the physical location/geography of storage of a customer's data upon request?">
    Yes, we inform the customer on the data storage location.
  </Accordion>

  <Accordion title="Do you make standards-based information security metrics (CSA, CAMM, etc.) available to your customers?">
    We are CSA STAR Level 1 compliant. Please click here to know more - [https://cloudsecurityalliance.org/star/registry/nreach-online-services-pvt-ltd-xoxoday](https://cloudsecurityalliance.org/star/registry/nreach-online-services-pvt-ltd-xoxoday)
  </Accordion>

  <Accordion title="Do you use industry standards (i.e. OWASP Software Assurance Maturity Model, ISO 27034) to incorporate security requirements into your Systems/Software Development Lifecycle (SDLC)?">
    We use OWASP Software Assurance Maturity Model
  </Accordion>

  <Accordion title="What services are contracted for appropriate disposal of hardware? Please provide a sample certificate of physical destruction?">
    Since we have deployed our application on AWS Cloud its not applicable for us.
  </Accordion>

  <Accordion title="What services are contracted for appropriate disposal of paper documents? Please provide a sample certificate of physical destruction?">
    Since we have deployed our application on AWS Cloud its not applicable for us. We provide certifite of destruction of data once the data is purged/deleted from all the places upon request from the customer.
  </Accordion>

  <Accordion title="Is physical access to data processing equipment (servers and network equipment) restricted?">
    We have deployed our product on AWS Cloud virtual platform. AWS provides physical security to the data center as a part of our subscription. AWS physical security - [https://aws.amazon.com/compliance/data-center/controls/](https://aws.amazon.com/compliance/data-center/controls/)
  </Accordion>

  <Accordion title="Are Intrusion Detection Systems (IDS) or Intrusion Prevention Systems (IPS) used by your organisation?">
    We have implemented IDS/IPS to facilitate timely detection, investigation by root cause analysis and response to incidents
  </Accordion>

  <Accordion title="Are computer systems (servers) backed up according to a regular schedule?">
    Data backups are done on daily basis and in a secured way on AWS
  </Accordion>

  <Accordion title="Does the organisation replicate data in another region?">
    Data backups are done on daily basis and in a secured way on AWS - Singapore
  </Accordion>

  <Accordion title="Are the backup tested for restoration?">
    Data backups are done on daily basis and in a secured way on AWS. This has been tested on regular basis.
  </Accordion>

  <Accordion title="Are default hardened base virtual images applied to virtualized operating systems?">
    Applies to all.
  </Accordion>

  <Accordion title="In case any the customer information is stored on vendor corporate network/systems, is there access available to employees using remote access?">
    We have deployed our application on AWS cloud virtual platform and the data is stored on it. Only approved users will have an access and We use a cloud hosted VPN with strict access controls to allow our employees to access the official network. This VPN is managed by our IT team and it's linked with the SSO/Active Directory.
  </Accordion>

  <Accordion title="Are necessary tools utilised to monitor environmental protection systems and alert personnel in the event of warnings or failures?">
    We have deployed our application on AWS cloud virtual platform. AWS provides physical security to the data center and it's a part of our subscription. AWS physical security - [https://aws.amazon.com/compliance/data-center/controls/](https://aws.amazon.com/compliance/data-center/controls/)
  </Accordion>

  <Accordion title="Is the vendor facility / critical servers related to the customer scope of work placed in secure areas?">
    Yes. We have deployed our application on AWS cloud virtual platform for maximum security.
  </Accordion>

  <Accordion title="Are servers / assets pertaining to the customer operations housed in a secure location? Are they shared with other clients?">
    Yes. Its deployed on AWS cloud virtual platform.
  </Accordion>

  <Accordion title="Is an inventory maintained for hardware, software, information, physical assets, services and all other forms of media, where information is processed or stored? If so, how often is the inventory reviewed and updated?">
    The application is deployed on AWS cloud virtual platform. We maintain the register for hardwares, softwares, physical assets etc as per the Asset management policy. All the inventories are reviewed and updated on monthly basis. We have tagged the owners for all the assets alloted by the organization. Atatched the asset management policy.
  </Accordion>

  <Accordion title="Are all external facing / web facing servers placed in DMZ?">
    Our application is deployed on AWS cloud virtual platform. We use a cloud hosted VPN with strict access controls to allow our employees to access the official network. This VPN is managed by our IT team and it's linked with the SSO/Active Directory.
  </Accordion>

  <Accordion title="Is there a dedicated infrastructure for collection, analysis and storage of logs?">
    Infrastructure logs are collected using the AWS Audit Trail, meanwhile the application related logs are collected in our Elastic Search server and retained in the long term cloud storage.
  </Accordion>

  <Accordion title="Is access to Database systems used for the customer operations logged?">
    We use AWS Platform for storing the data. Our data is stored in secured databases and there is no window to alter any data without it being logged into the system records. Our data is stored in secured databases and there is no window to alter any data without it being logged into the system records.
  </Accordion>

  <Accordion title="Do systems and network devices utilize a common time synchronization service?">
    Yes
  </Accordion>

  <Accordion title="Does the Isolation/segregation of the customer environment at vendor done by means of VLAN/ creation of zones on Firewall?">
    We have deployed our application on AWS Cloud platform.As part of Web Application Firewall (WAF), rate limiters are installed to block multiple requests from specific IPs in order to prevent DDOS-type attacks.
  </Accordion>

  <Accordion title="Are the systems used for the customer operations hardened according to hardening document/ technical specification document?">
    Yes. We comply with this.
  </Accordion>

  <Accordion title="Do you have controls to prevent storing of any confidential or highly confidential data on the desktop? Please describe any specific controls in place to prevent data leakage from your environment.">
    We monitor the user activities and spread awareness about data storage, access, sharing etc. All the custoer data is stored on AWS cloud. We are not storing any information on the computers.
  </Accordion>

  <Accordion title="Is there a backup and recovery document covering the customer processes? Is it communicated to employees working for the customer operations?">
    Data backups are done daily and in a secured way in AWS
  </Accordion>

  <Accordion title="Does the Backup and recovery procedure identify essential business information, servers, audit trail, frequency, logging, retention period, and roles and responsibilities?">
    Yes. We have implemented the Backup Recovery Procedure
  </Accordion>

  <Accordion title="Is there a secure process for onsite and offsite backup media protection during storage pertaining to the customer operations?">
    Yes. Data backups are done daily and in a secured way in AWS
  </Accordion>

  <Accordion title="Does the organization reuse, test and restore the customer backups on frequent basis?">
    We do not use the backup. We only take the backup on AWS and its stored on AWS platform itself.
  </Accordion>

  <Accordion title="What is the distance of the backup facility from the primary location?">
    Its hosted on AWS
  </Accordion>

  <Accordion title="Is there an alternate location facility and supporting facility to continue the customer operations?">
    BCP and DR facilities has been provided by AWS. We do not have any other data centers
  </Accordion>

  <Accordion title="Can the backed up data be restored and made available at the alternate site at any point in time? How can the critical data be restored and in what time frame?">
    Since we are hosting our application on AWS, they are providing us a service for backup, BCP and DR for seamless customer experience.
  </Accordion>

  <Accordion title="Is your DR backup facility provided internally or externally? If external, please indicate the name of the service provider and the backup location.">
    Since we are hosting our application on AWS, they are providing us a service for backup, BCP and DR for seamless customer experience.
  </Accordion>

  <Accordion title="Who is the Cloud Service Provider (CSP)?">
    Amazon web service (AWS)
  </Accordion>

  <Accordion title="What all services are being opted from CSP?">
    AWS Virtual platform cloud And AWS MSK
  </Accordion>

  <Accordion title="What will be the percentage up time agreed by vendor with CSP for the customer related services?">
    99.00%
  </Accordion>

  <Accordion title="Does the requirement agreed that CSP/ Vendor should not use or share the customer data without prior consent?">
    Yes. Xoxoday or AWS does not share the data.
  </Accordion>

  <Accordion title="Does the requirement discussed and agreed that CSP shall ensure data destruction upon request or post the retention timeframe, across all locations?">
    We have deployed the application on AWS and we have the controls in place to destruction upon request or post the retention timeframe. Since we are GDPR compliant we provide this option to our end users.
  </Accordion>

  <Accordion title="Does the requirement has been discussed between vendor and the customer and agreed with CSP that core the customer data should remain within India? If not, please detail the plan for local hosting.">
    We have deployed the application on AWS Singpore.
  </Accordion>

  <Accordion title="Does Data Retrieval time from primary/ backup location for the customer specific data discussed and agreed with the customer?">
    Data backup and retrieval happens on AWS platform.
  </Accordion>

  <Accordion title="What is the deployment model? (Private Cloud/Public Cloud/Hybrid Cloud/Community Cloud)">
    We use Public cloud for hosting
  </Accordion>

  <Accordion title="How does Vendor ensure Incident management for the customer services in Cloud?">
    we have an intrusion detection/monitoring application that alerts on unauthorized access.
  </Accordion>

  <Accordion title="How does vendor ensure Auditing, Logging and Monitoring requirements for the customer services on cloud?">
    We use Amazon CloudWatch and Grafana polemique which allows us to monitor instances and alerts us through emails.
  </Accordion>

  <Accordion title="How does vendor ensure Secure configurations of Web Server on cloud?">
    We have deployed the application on cloud and have AWS Guard Duty threat detection service that continuously monitors for malicious activity and unauthorized behaviour.
  </Accordion>

  <Accordion title="How vendor will ensure capacity and demand management with respect to the customer services on cloud?">
    Its provided by AWS, it's a part of AWS service.
  </Accordion>

  <Accordion title="How does vendor ensure that CSP shows compliance to applicable laws and regulations related to data security?">
    Please click here for more details about AWS Compliance Programs - [https://aws.amazon.com/compliance/programs/](https://aws.amazon.com/compliance/programs/)
  </Accordion>

  <Accordion title="How does vendor along with CSP will ensure that all the customer related core systems and data hosted in India and at no point in time those shall be moved to other country?">
    It will be hosted on AWS singapore
  </Accordion>

  <Accordion title="Does the CSP is using appropriate Data Loss Prevention (DLP) solution to identify, monitor and protect sensitive data and manage the data risk for the customer?">
    Data backups are done daily and in a secured way in AWS. The customer data cannot be lost permanently. We also have Business Continuity Policy and Business Continuity Management Procedure in place and effectivly working.
  </Accordion>

  <Accordion title="How does vendor ensure Patch Management activity for components/ devices require to deliver the customer services?">
    Data backups are done daily and in a secured way in AWS. The customer data cannot be lost permanently. We also have Business Continuity Policy and Business Continuity Management Procedure in place and effectivly working.
  </Accordion>

  <Accordion title="How does Vendor ensure that CSP have robust backup procedure for the customer related services? Does the CSP provide results / assurance on regular Backup-Restoration testing?">
    Data backups are done on daily basis and in a secured way in AWS. We monitor the same.
  </Accordion>

  <Accordion title="Provide the details of types of data that will be Collected, Stored/Retained, and Processed.">
    We collect, store and process Name, email ID and Phone numbers and it will be stored on AWS cloud and will be deleted upon termination of the contract.
  </Accordion>

  <Accordion title="What is the backup site physical address?">
    AWS Singapore
  </Accordion>

  <Accordion title="Technological competence of the service provider.">
    [Xoxoday application is a SaaS product deployed on AWS Virtual platform cloud. Please click to know more about application - https://xoxoday.gitbook.io/application/](https://xoxoday.gitbook.io/plum/)
  </Accordion>

  <Accordion title="Are media containing information protected against unauthorized access, misuse or corruption during transportation beyond the organization's physical boundary?">
    We have deployed our application on AWS virtual platform cloud and do not store any data outside cloud for security reasons. All the customer data is encrypted for maximum security. We use TLS1.3 encryption while data in transit and AES256 while data at rest
  </Accordion>

  <Accordion title="Are redundant power supplies available for supplying power to critical equipment? Is there a UPS or DG set backup for computer systems?">
    Yes. We have the backup for power supply and computer systems can be used without any interruption. We have applied the lightning protection metallic rods for the buidling for protection of premises.
  </Accordion>

  <Accordion title="Do you have a secure log-on procedure documented? Are general notices/message banner displayed upon login? Do you log successful and unsuccessful attempts? Are all user workstations and laptops part of the active directory?">
    Infrastructure logs are collected using the AWS Audit Trail, meanwhile the application related logs are collected in our ElasticSearch server and retained in the long term cloud storage. All the workstations are part of the Active directory. User accounts get locked after 15 minutes of inactivity. The accounts will get locked after the predetermined unauthorised attempts for security reasons.
  </Accordion>

  <Accordion title="Have you implemented data protection and privacy measures such DLP, IRM/DRM etc.? Have you deployed any encryption/protection mechanism (data at rest) on databases, file servers, desktops and laptops?">
    Yes, our web assets, email records, and end-points are sealed with data loss prevention techniques. All the customer data will be stored on only AWS virtual platform cloud. We do not store it offline for security reasons. AWS Guard Duty threat detection service that continuously monitors for malicious activity and unauthorized behaviour. The data is stored in our secure database and is transit scrambled for maximum security. We use TLS1.3 encryption while data in transit and AES256 while data at rest
  </Accordion>

  <Accordion title="Can the Cloud servers be configured to send their audit logs to a centralized log collector at the customer?">
    Infrastructure logs are collected using the AWS Audit Trail, meanwhile the application related logs are collected in our ElasticSearch server and retained in the long term cloud storage. logs are automatically audited, but are not integrated with tenant's security operations. In case the tenant requests for logs, they can share when asked by the clients.
  </Accordion>

  <Accordion title="All Application changes to be routed through the PMS system driven by IT Application Owner. Necessary approvals to be documented.">
    Attached the Infrastructure Change Control Procedure
  </Accordion>

  <Accordion title="Are critical transactions identified by function to be reviewed?">
    We use Amazon CloudWatch and Grafana polemique which allows us to monitor instances and alerts us through emails. Infrastructure logs are collected using the AWS Audit Trail, meanwhile the application related logs are collected in our Elastic Search server and retained in the long term cloud storage.
  </Accordion>

  <Accordion title="Are critical transactions logged and made available as a report through front end?">
    The logs are automatically audited, but are not integrated with tenant's security ops. In case the tenant requests for logs, they can shared when asked for by the clients.
  </Accordion>

  <Accordion title="All Security logs need to be enabled within the application for all menus and screens.">
    The logs are automatically audited, but are not integrated with tenant's security ops. In case the tenant requests for logs, they can shared when asked for by the clients.
  </Accordion>

  <Accordion title="Minimum Audit logging scenarios: Login successes and failures, Addition/deletion/modification of users, Changes to security settings, Privilege ID monitoring.">
    The logs are automatically audited, but are not integrated with tenant's security ops. In case the tenant requests for logs, they can shared when asked for by the clients.
  </Accordion>

  <Accordion title="Logs should be protected against overwriting by using mechanisms such as log rotation and the log files to be retained for minimum of 3 months on the server.">
    We retain the logs for at least 180 days.
  </Accordion>

  <Accordion title="Has your organisation evaluated pandemic preparedness of critical third-party suppliers?">
    AWS is one of the critical third party for us as we have deployed our application on AWS VPC. AWS is ISO 27001 and SOC 2 certified organization and compliant with the business continnuity requirements.
  </Accordion>

  <Accordion title="Operational risk arising from technology failure covering from any of below means (including system downtimes issues also).">
    Xoxoday application application has deployed on AWS Cloud virtual platform for securtity reasons and imlemented the business continuity plan. Xoxoday endeavours to provide 99.9% Uptime each month 24 hours a day 7 days a week. Business day will be considered as 24\*7 and will be available for 365 days in a year for the customer support services to be provided to the Client
  </Accordion>

  <Accordion title="Where are data subjects whose Personal Data is processed located?">
    The data will be stored on AWS Virtual platform cloud – Singapore region.
  </Accordion>

  <Accordion title="How is Personal Data being processed by Supplier?">
    The personal data will be uploaded on application application for rewards and recognition purposes and will be stored on AWS virtual platform cloud.
  </Accordion>

  <Accordion title="Who at Supplier will have access to the Personal Data, and for what purpose?">
    We have deployed our application on AWS Virtual platform cloud. We do not have physical access to the location where the personal data is stored.
  </Accordion>

  <Accordion title="What are the measures in place to prevent unauthorized personal from gaining physical access to premises, buildings or rooms where the data processing systems are located?">
    We have deployed our application on AWS Virtual platform cloud. We have the physical access controls in place. For ex – Access cards, Biometric machines, ID cards, CCTV etc..
  </Accordion>

  <Accordion title="What are the locations where Personal Data will be housed or accessed? Will Personal Data be stored on a Supplier Cloud or on prem environments?">
    The personal information will be collected through application platform and stored on AWS virtual platform cloud – Singapore region.
  </Accordion>

  <Accordion title="Can Supplier provide country location(s) for all Supplier personnel or subcontractors that may have access to Personal Data or privileged access to servers hosting Personal Data?">
    We have only one data center and deployed our application of AWS virtual platform cloud. By Default, Xoxoday will not have access to Service Data (customer's account/application and the associated data processed as part of using our services). The access control to the accounts (who can access the application instance) is managed by the admin from the customer end.
  </Accordion>

  <Accordion title="Describe the type of solution proposed (public/private/hybrid cloud, IaaS/Paas/CaaS/Saas/ASP, single-tenant/multi-tenant, etc.)">
    We use Public cloud for hosting (AWS Singapore)
  </Accordion>

  <Accordion title="Describe where the servers hosting the customer's data are located and, if the data is hosted on multiple locations, provide detailed information as to the transport of the data between the concerned locations.">
    AWS Virtual Platform Cloud - Singapore region.
  </Accordion>

  <Accordion title="Describe how you monitor changes to the regulatory requirements in relevant jurisdictions, adjust your security program for changes to legal requirements, and ensure compliance with relevant regulatory requirements.">
    We have deployed our application on AWS Virtual platform cloud and Xoxoday is GDPR certified. We have implemented the policies and procedures as per the ISMS and GDPR and implemented across the organization. We collect only three PIIs on our platform such as - Name, email ID and phone number. Xoxodau GDPR - [https://www.xoxoday.com/gdpr](https://www.xoxoday.com/gdpr) Xoxoday Privacy - [https://www.xoxoday.com/privacy-policy](https://www.xoxoday.com/privacy-policy)
  </Accordion>

  <Accordion title="Do you contractually guarantee that your data centers are not located in places that have a high probability/occurrence of high-impact environmental risks (floods, tornadoes, earthquakes, hurricanes, etc.)?">
    Yes. We have deployed our product on AWS virtual platform cloud.
  </Accordion>

  <Accordion title="Describe how you manage restoration of environment and/or data for a specific customer.">
    The data backups are done on AWS Virtual platform cloud on regular basis and implemeted the Data loss prevention techniques. We have all the capabilities to recover the data or restore. Data is available for restore within a few minutes of a backup job completing on the daily schedule. Attached the Backup Recovery Procedure
  </Accordion>

  <Accordion title="Provide a description of the physical security of your Datacenter both inside and outside the DataCenter itself.">
    AWS is responsible for providing physical security to the data center as we have deployed our application on AWS. AWS provides physical data center access only to approved employees. All employees who need data center access must first apply for access and provide a valid business justification. These requests are granted based on the principle of least privilege, where requests must specify to which layer of the data center the individual needs access, and are time-bound. Requests are reviewed and approved by authorized personnel, and access is revoked after the requested time expires. Once granted admittance, individuals are restricted to areas specified in their permissions. Third-party access is requested by approved AWS employees, who must apply for third-party access and provide a valid business justification. These requests are granted based on the principle of least privilege, where requests must specify to which layer of the data center the individual needs access, and are time-bound. These requests are approved by authorized personnel, and access is revoked after request time expires. Once granted admittance, individuals are restricted to areas specified in their permissions. Anyone granted visitor badge access must present identification when arriving on site and are signed in and escorted by authorized staff.
  </Accordion>

  <Accordion title="Provide an overview of how capacity planning is managed to limit the risk of system overload.">
    We have deployed our application on AWS Virtual platform cloud. Our solution is using state of the art Cloud Native infrastructure technologies along with microservices architecture allows us to scale our operations as per the demands.
  </Accordion>

  <Accordion title="Describe to procedure in place for responding to requests for tenant data or connection logs from governments or law enforcement bodies and how you ensure logs will be legally admissible.">
    Infrastructure logs are collected using the AWS Audit Trail, meanwhile the application related logs are collected in our Elastic Search server and retained in the long term cloud storage. We make these logs available upon tenents request.
  </Accordion>

  <Accordion title="Can logs be generated by the various components of the proposed solution be forwarded to the customer's log concentrator / SIEM / SOC?">
    We make these logs available upon tenents request
  </Accordion>

  <Accordion title="Describe how you manage to isolate logs for a specific tenant.">
    The logs are collected using the AWS Audit Trail and application related logs are collected in our Elastic Search server.
  </Accordion>

  <Accordion title="Does the organisation outsource its data storage?">
    AWS Cloud virtual platform.
  </Accordion>

  <Accordion title="Does the organisation have a Hot recovery site?">
    Its on AWS cloud virtual platform.
  </Accordion>

  <Accordion title="Are Cloud Hosting services subcontracted?">
    We have deployed our product on AWS Cloud virtual platform.
  </Accordion>

  <Accordion title="Do employees/contingent workers who have remote access connect to the customer network?">
    We do not connect to the customer network. Since it's a SaaS prodcut and deployed on cloud virtual platform only authorised individual have an access to the our production environment on need and approval basis.
  </Accordion>

  <Accordion title="Is client scoped data collected, accessed, transmitted, processed, or retained that can be classified as personally identifiable financial information under the Gramm-Leach-Bliley Act?">
    We have implemented the security measures to manage the risks introduced during the use of Organization's information assets used for managing Personally Identifiable Information. Attached the Personally Identifiable Information (PII) Policy.
  </Accordion>

  <Accordion title="Are environmental protections installed in your data centres including Cooling systems, Battery/UPS and generator backup, Redundant communications lines, Smoke/water detectors, Fire Suppression, Raised Flooring?">
    We have deployed our application on AWS cloud virtual platform. AWS provides physical security to the data center and it's a part of our subscription. AWS physical security - [https://aws.amazon.com/compliance/data-center/controls/](https://aws.amazon.com/compliance/data-center/controls/)
  </Accordion>

  <Accordion title="Are actions taken to resolve alerts generated by the monitoring tools?">
    We have deployed our application on AWS cloud virtual platform. AWS provides physical security to the data center and it's a part of our subscription. AWS physical security - [https://aws.amazon.com/compliance/data-center/controls/](https://aws.amazon.com/compliance/data-center/controls/)
  </Accordion>

  <Accordion title="If hosted on public cloud (Amazon, Google, Azure etc.) - security configurations are aligned with public cloud vendor security requirements?">
    We have deployed our application on AWS Virtual platform cloud. We use Web application firewall, IDs/IDs, AWS Audit trail, Amazon guard duty etc..
  </Accordion>

  <Accordion title="Have you applied data backup mechanism? If yes what is the frequency of backup?">
    Yes. Data backups are done on daily basis in a secured way in AWS
  </Accordion>

  <Accordion title="Does MFA is applied while accessing cloud environment / applications remotely (VPN, VDI)?">
    Yes.
  </Accordion>

  <Accordion title="Does access to privilege users / admin has MFA enabled?">
    Yes.
  </Accordion>

  <Accordion title="Does the DR is setup in some other city in India?">
    Its on AWS Cloud virtual platform Cloud.
  </Accordion>

  <Accordion title="Does the DR site also has the same level of security controls as the production site?">
    Yes
  </Accordion>

  <Accordion title="Where will vendor store the customer data? Is it stored over any shared location for all clients or the storage location is dedicated for the customer?">
    The data will be stored on AWS cloud virtual platform Singapore. Since we are a multi tenant system, we have common infrastructure for all clients.But All data volume is encrypted with AES 256-bit encryption to prevent any external snooping or unauthorized access in the multi-tenant environment.
  </Accordion>

  <Accordion title="Which all in-house or third party applications Vendor will use for the customer operations?">
    We do not use any in-house devoloped applications. We have deployed our application on AWS cloud virtual platform. And AWS is SOC 2, ISO 27001, ISO 27017 and ISO 27701 certified organization. Shared the certificates.
  </Accordion>

  <Accordion title="If Vendor is using in-house developed or third party applications for the customer process then VAPT report of application and Network is to be shared.">
    We do not use any in-house devoloped applications. We have deployed our application on AWS cloud virtual platform. And AWS is SOC 2, ISO 27001, ISO 27017 and ISO 27701 certified organization. Shared the certificates.
  </Accordion>

  <Accordion title="Are there any Cloud services which is used by vendor for the customer process? Please confirm details.">
    We have deployed our application on AWS cloud virtual platform.
  </Accordion>

  <Accordion title="Type of Cloud services and its use in the customer operations.">
    We have deployed our application on AWS cloud virtual platform.
  </Accordion>

  <Accordion title="Please confirm on Cloud License details and data storage location (domestic or International).">
    Data storage location will be AWS Singapore.
  </Accordion>

  <Accordion title="Please share details of Data Backup Procedures.">
    Data backups are done on daily and in a secured way in AWS. Attached the Backup Recovery Procedure.
  </Accordion>

  <Accordion title="Points of presence of supplier infrastructure is identified.">
    We have deployed our application on AWS Virtual platform cloud - Singapore and we operate from our corporate office located in Bangalore, India.
  </Accordion>

  <Accordion title="It is possible for the customer data to be restricted to a geographical location, if required.">
    We have deployed our application on AWS Virtual platform cloud - Singapore region and all the data will be stored there. All the end users from various parts in the world can access the platform. We inform the customer if we need to change the data center location.
  </Accordion>

  <Accordion title="Supplier has a multi-tiered firewall functionality in place, with network as well as application level protection (e.g. stateful network firewall, WAF, Network Intrusion Detection - NIPS, behavioral anomaly detection, cloud security gateways etc.).">
    As part of Web Application Firewall (WAF), rate limiters are installed to block multiple requests from specific IPs in order to prevent DDOS-type attacks. The Cloudflare Web Application Firewall (Cloudflare WAF) checks incoming web requests and filters undesired traffic based on the set of rules. pfSense generation firewall helps to monitors incoming and outgoing network traffic and decides whether to allow or block specific traffic based on a defined set of security rules We also have implemented the IDS/IPS and Amazon guard duty which continuously monitors our AWS accounts and workloads for malicious activity and delivers detailed security findings for visibility and remediation.
  </Accordion>

  <Accordion title="Vendor has a detailed backup and restoration plan in place. Security controls are applied in the same fashion for all the customer data, be that data actively used (online) or data stored in backup space.">
    We have implemented the data backup policy and attached the same. The data backups are done daily in a secured way in AWS and tested on weekly basis.These backup process are automated and does not require any mannual effort. Since we are SAAS product, we maintain backup and restore all the customer data by ourselves. We use AES 256 encryption for data at rest. All the backups are stored on Cloud and does not store any data off-cloud.
  </Accordion>

  <Accordion title="Hardware decommissioning policies are in place (when hardware is controlled by the vendor).">
    NA. We have deployed our application on AWS Virtual platform cloud.
  </Accordion>

  <Accordion title="There are security control mechanisms in place to counter denial of service attacks.">
    We have deployed our application on AWS Virtual Platform cloud. application is a cloud based application. As part of Web Application Firewall (WAF), rate limiters are installed to block multiple requests from specific IPs in order to prevent DDOS-type attacks. These are powered by intelligent daemons that detect other identifiers like URLs accessed or other client properties to automatically blacklist possible threats either temporarily or permanently.
  </Accordion>

  <Accordion title="When infrastructure is shared between tenants (typically a Cloud environment), threats and attacks directed toward other tenants do not impact the customer services provided by this infrastructure.">
    We have tools that analyze various traffic patterns and correlate network events. We have configured early warning signals that trigger alerts to our team based on event patterns and strict thresholds. We are equipped to detect and mitigate Threats, DDOS attacks, session hijack, login spoofs or any other data extraction strategies AWS Guard Duty threat detection service that continuously monitors for malicious activity and unauthorized behaviour. The data is stored in our secure database and is transit scrambled for maximum security. We use TLS1.3 encryption while data in transit and AES256 while data at rest. We also conduct periodical Vulnerability assessment and penetration testing and fixes the vulnerabilities identified in order to eliminate the risk.
  </Accordion>

  <Accordion title="There is a activity and security logging process in place, and these logs are synchronized with the same network time server (NTP).">
    Infrastructure logs are collected using the AWS Audit Trail, meanwhile the application related logs are collected in our Elastic Search server and retained in the long term cloud storage. Administrative logs are part of Cloud Dashboard and are regularly reviewed. We use Amazon CloudWatch and Grafana polemique which allows us to monitor instances and alerts us through emails. We use a synchronized time-service protocol (e.g., NTP) to ensure all systems have a common time reference
  </Accordion>

  <Accordion title="There is data/log retention process in place.">
    Yes, systems must be configured to log all successful and unsuccessful login attempts by accounts with privileged access. These authentication logs must be retained for a minimum of 180 days and in accordance with the Company's records retention guidelines.
  </Accordion>

  <Accordion title="When infrastructure is shared between tenants, the data and/or logs are also separated for all tenants. There is an intelligent system and/or process in place for analysing these logs.">
    We use logical data isolation with the help of company specific encryption keys and its solated from other customers data. Yes, audit logs are reviewed and recorded on a regular basis automatically. These logs are integrated with security operations/SIEM solutions.
  </Accordion>

  <Accordion title="Does the cloud provider deliver data back up and/or data mirroring?">
    The data backups are done daily in a secured way on AWS and tested on a weekly basis. These backup processes are automated and do not require any manual effort. Since the data backup is automated and happening on a daily basis the data backup will get replaced every day and restored, if necessary/required.
  </Accordion>

  <Accordion title="Is the Cloud Provider Privacy Shield certified?">
    Yes, AWS is certified under the EU-US Privacy Shield. [https://www.privacyshield.gov/participant?id=a2zt0000000TOWQAA4](https://www.privacyshield.gov/participant?id=a2zt0000000TOWQAA4)
  </Accordion>

  <Accordion title="Can customers define the transient and persistent points of their data (i.e. the legal jurisdiction in which their data is transported and stored)?">
    All the data will be stored on AWS cloud virtual platform cloud - Singapore region.
  </Accordion>

  <Accordion title="Is there an ability to monitor user activities? (E.g.: all actions taken by admin users)">
    All user activities are logged in the audit trail.
  </Accordion>

  <Accordion title="What availability measures do you employ to guard against threats and errors?">
    As part of Web Application Firewall (WAF), rate limiters are installed to block multiple requests from specific IPs in order to prevent DDOS-type attacks. In addition to that we also have AWS Guard Duty threat detection service that continuously monitors for malicious activity and unauthorized behaviour.
  </Accordion>

  <Accordion title="Do you have DDoS protection, and if so, how?">
    As part of Web Application Firewall (WAF), rate limiters are installed to block multiple requests from specific IPs in order to prevent DDOS-type attacks
  </Accordion>

  <Accordion title="What application security measures are used in the production environment (e.g., application-level firewall, database logging / auditing, etc.)?">
    We use Web application firewall, IDs/Ips, AWS Audit trail, Amazon guard duty etc..
  </Accordion>

  <Accordion title="Do you logically and physically segregate production and non-production environments?">
    We have a dedicated non-production environment which is in a different AWS account and allows us to segregate data from the production environment.
  </Accordion>

  <Accordion title="Do you have a policy that requires endpoints (laptops, desktops, etc.) to perform backups of specified corporate data?">
    We have implemented the Backup Recovery Procedure to protect the organization information asset from the damages that may be caused due to failure of hardware system, corruption of software etc..
  </Accordion>

  <Accordion title="Is there an audit log available which covers user/api actions?">
    Infrastructure logs are collected using the AWS Audit Trail, meanwhile the application related logs are collected in our ElasticSearch server and retained in the long term cloud storage. The event logs are stored in a bucket wherein nobody can access them without an approval from the high authorities i.e. the Chief Technical Officer. In case the tenant requests for logs, that can be shared.
  </Accordion>

  <Accordion title="If the application can be hosted in PwC's private cloud.">
    At present, application application has been deployed on AWS Virtual platform cloud.
  </Accordion>

  <Accordion title="Cost to host in PwC private cloud.">
    [This is not feasible. AWS is compliant to the Singapore Data Privacy Regulations. https://aws.amazon.com/compliance/singapore-data-privacy/](https://aws.amazon.com/compliance/singapore-data-privacy/)
  </Accordion>

  <Accordion title="NSE's data and information shall be stored in data centres within India.">
    All the data will be stored on AWS Singapore
  </Accordion>

  <Accordion title="The redundant site where NSE's data and information are replicated shall also be in India in a separate location from the primary site.">
    All the data will be collected only through our application and stored on AWS cloud platform and its situated in Singapore.
  </Accordion>

  <Accordion title="All backup media (physical, logical and virtual) of NSE's data and information shall be stored securely in India.">
    All the data will be stored on AWS Singapore
  </Accordion>

  <Accordion title="The Cloud Service Provider shall provide visibility to NSE into its infrastructure and processes, and to allow NSE to check the integrity and security of the cloud computing services.">
    We are cloud security alliance level 1 compliant. We would be happy to help NSE for checking the integrity and security of the cloud computing services and compliance to applicable policies and regulations.
  </Accordion>

  <Accordion title="Cloud Service Provider shall ensure no management ports / console shall be accessible over the internet.">
    We agreee. We comply with CSA STAR Level 1 compliance requirements.
  </Accordion>

  <Accordion title="NSE shall ensure that no insecure ports on the Cloud infrastructure are open to the internet.">
    We comply with this. We have deployed our application on AWS to ensure maximum security of data.
  </Accordion>

  <Accordion title="Cloud Service Provider and NSE shall monitor the network and security devices, virtualization platforms, operating systems, databases, applications, web servers and associated infrastructure, for security alerts and known attack vectors.">
    We agree. We combine enterprise-class security features with comprehensive audits of our applications, systems, and networks to ensure customer and business data is always protected. And our customers rest easy knowing their information is safe, their interactions are secure, and their businesses are protected. We do conduct internal and external audits and ensure that required remidiations are implemented.
  </Accordion>

  <Accordion title="Where will UP data be hosted (geographic location)?">
    The data is hosted on Amazon Web Services (AWS) For accurate latency, the data center is selected as Singapore region for Asia specific data and Oregon for US specific data which are defined as data centers.
  </Accordion>

  <Accordion title="What is the standard used for destroying data on retired or failed hardware?">
    The Xoxoday platform operates on the cloud, which means there are no removable storage devices in question. We have Media protection procedure to handle the locally stored data. We complied with the compliance requirements.
  </Accordion>

  <Accordion title="What options are available to transfer data between UP and the Supplier?">
    We do not take any data directly. The data will be provided through our platform or application and its hosted on Amazon Web Services (AWS)
  </Accordion>

  <Accordion title="How is uptime measured?">
    We rely on AWS Cloud for Uptime mesurement.
  </Accordion>

  <Accordion title="Is your service run from your own (a) data center, (b) the cloud, or (c) deployed-on premise only?">
    Yes. We have deployed our application on AWS cloud platform
  </Accordion>

  <Accordion title="Have you researched your cloud providers best security practices?">
    Yes. Please visit here for more details about AWS Cloud Security - [https://aws.amazon.com/security/](https://aws.amazon.com/security/)
  </Accordion>

  <Accordion title="What systems do you have in place that mitigate classes of web application vulnerabilities? (e.g.: WAF, proxies, etc.)">
    As part of Web Application Firewall (WAF), rate limiters are installed to block multiple requests from specific IPs in order to prevent DDOS-type attacks. These are powered by intelligent daemons that detect other identifiers like URLs accessed or other client properties to automatically blacklist possible threats either temporarily or permanently.
  </Accordion>

  <Accordion title="How do you log and alert on relevant security events? (this includes the network and application layer)?">
    We use Amazon CloudWatch and Grafana polemique which allows us to monitor instances and alerts us through emails We have implemented IDS/IPS Firewall. Our security information and event management (SIEM) system merge data sources (app logs, firewall logs, IDS logs, physical access logs, etc.) for granular analysis and alerting.
  </Accordion>

  <Accordion title="What processes and methods will be put in place, to securely back-up the system? Where will the Back-up data be stored?">
    We predominantly work on cloud-based infrastructure from Amazon Web Services which provide backup and restore services to build scalable, durable, and secure data-protection solutions Please refer to AWS site for more details: [https://aws.amazon.com/backup-restore/](https://aws.amazon.com/backup-restore/)
  </Accordion>

  <Accordion title="Will any the customer data be held on removable media including Back-ups? If so, will it be encrypted?">
    It will be stored on AWS, and It will be encrypted (AES 256-bit encryption)
  </Accordion>

  <Accordion title="What firewalls and network/host protection measures (e.g. IDS or IPS) will be in place to protect the customer data? Describe how you will configure, maintain the above and monitor alerts generated.">
    Yes. We have implemented IDS/IPS Firewall. Our security information and event management (SIEM) system merge data sources (app logs, firewall logs, IDS logs, physical access logs, etc.) for granular analysis and alerting.
  </Accordion>

  <Accordion title="What information will be contained within logs?">
    The only user data that will stored within the system is employee personal information - names, emails and contact numbers. Infrastructure logs are collected using AWS Audit Trail
  </Accordion>

  <Accordion title="AWS Provide physical security services to our data centre.">
    Please visit for more details - [https://aws.amazon.com/compliance/data-center/controls/](https://aws.amazon.com/compliance/data-center/controls/)
  </Accordion>

  <Accordion title="Is this a Cloud Solution?">
    Our application is deployed on AWS cloud platform.
  </Accordion>

  <Accordion title="All privileged and service system, network or application level passwords, required for correct operations of business units must be backed up and kept in secure location available for extraction to a specified number of people on specific circumstances.">
    We are Compliant. We have implemented the data backup policy. We do take backup of the all the users and securely stored. All our application users data back up including password will happen through AWS cloud virtual platform.
  </Accordion>

  <Accordion title="Where technically feasible, implement network and/or host-based technical controls that detect changes in access to shared networks and shared resources.">
    We have controls in place. We have implemented the firewall and IDS/IPS for detection and prevention of security.
  </Accordion>

  <Accordion title="System testing and commissioning ensures security capabilities of the system are appropriately configured and verified.">
    During the testing phase we make sure that we are meeting all the security requesrements and validate the same before the deployment.
  </Accordion>

  <Accordion title="Encryption for protection of information/data transported by carriers, tapes, removable media devices or across communication lines shall be employed.">
    All the data will be stored on AWS cloud and encrypted with Client specific keys. We do not transfer data to any external drives or media devices.
  </Accordion>

  <Accordion title="Application logs shall be verified to ensure there are no known anomalies before system deployment.">
    We monitor these logs periodically
  </Accordion>

  <Accordion title="Backup media shall be kept in a secured manner against tampering, theft, fire, flood or damage until retention period elapsed.">
    Backup data is stored on AWS cloud for maximum security.
  </Accordion>

  <Accordion title="Where technically feasible, and based on the criticality of the asset, backups shall be tested to ensure their availability and integrity for the customer recovery efforts and confirm compliance with established RPO/RTO.">
    We test the backup on a periodical basis to make sure that we follow the availability and integrity principles.
  </Accordion>

  <Accordion title="To ensure effective testing, restoration procedures shall be fully documented and tested.">
    We have documented our Data backup procedures.
  </Accordion>

  <Accordion title="For each asset, all activities/events and its details to be captured in all type of available logs for all hardware devices, operating systems, system usage, installed applications and security related events shall be identified.">
    We monitor the logs as per the compliance requirements.
  </Accordion>

  <Accordion title="Logs shall be protected against tampering and unauthorised access.">
    We are compliant.
  </Accordion>

  <Accordion title="Fault logging shall be enabled in equipment wherever technically feasible.">
    All the logs are recorded in the system.
  </Accordion>

  <Accordion title="In all instances where automated logging and monitoring is not feasible, compensating mechanisms to record and retrieve manual logs shall be provided.">
    We always make sure that componentory controls in place if monitoring is not feasible.
  </Accordion>

  <Accordion title="Service Provider shall have solid high-availability infrastructure in line with the customer requirements.">
    We have deployed our application on AWS cluod virtual platform
  </Accordion>

  <Accordion title="Only authorised personnel can access to the data centre(s). The data centre(s) have security controls such as man-traps, CCD security cameras, and on-site 24x7 security staff.">
    It's a part of cloud security services
  </Accordion>

  <Accordion title="The data centre is a purpose-built facility with environmental controls including: redundant power supply, redundant cooling, UPS, generator, fire suppressant, temperature and moisture monitors.">
    It's a part of cloud security services
  </Accordion>

  <Accordion title="What are the controls to prevent complete and permanent loss of customer data?">
    Data backups are done daily and in a secured way in AWS. The customer data cannot be lost permanently. We also have Business Continuity Policy and Business Continuity Management Procedure in place and effectivly working.
  </Accordion>

  <Accordion title="Which databases are used in the backend? Which database optimization approaches are taken?">
    The data is only stored on our application and its deployed on AWS Cloud. Our data is stored in secured databases and there is no window to alter any data without it being logged into the system records
  </Accordion>

  <Accordion title="What are security approaches along the architecture stack? Is end-to-end security ensured? Does the platform allow standardized security mechanism, e.g. Kerberos, LDAP?">
    We have deployed our application on Amaon web services (AWS) cloud platform. We are using MySQL, Salt stack, Nodejs and MongoDB technology. LDAP, SAML2, Normal username-password
  </Accordion>

  <Accordion title="Describe the hosting infrastructure.">
    We are a SAAS solution. We are cloud hosted.
  </Accordion>

  <Accordion title="How does the system scale to support growing user populations?">
    We are a SAAS Solution and have all the capabilities to supoprt huge number of users.
  </Accordion>

  <Accordion title="Describe the data center power backup.">
    Data center services are provided by AWS
  </Accordion>

  <Accordion title="Describe data backup and restore procedures.">
    Data backups are done daily and in a secured way in AWS
  </Accordion>

  <Accordion title="Do you own the data centers?">
    No. Application is deployed on AWS Cloud.
  </Accordion>

  <Accordion title="Scale Up / Down capabilities? (Storage capacity, Computing Power)">
    We have both horizontal and Vertical Scaling
  </Accordion>

  <Accordion title="Scale Out Capabilities? (Module / Feature addition / removal)">
    We have auto scaling and self healing.
  </Accordion>

  <Accordion title="What tools are used to monitor application availability? Expected availability is 99.999% monthly basis.">
    We use a variety of tools and plugins integrated with Prometheus & Cloudwatch along with health checks for facilitating our uptime/service availability
  </Accordion>

  <Accordion title="Where are your DR sites located?">
    AWS Cloud virtual platform
  </Accordion>

  <Accordion title="Are there security controls (like log generation, access control) in place to store the PII downloaded from the application?">
    We use Amazon CloudWatch and Grafana polemique which allows us to monitor instances and alerts us through emails
  </Accordion>

  <Accordion title="Are there plans in place to handle/manage contingent events or circumstances (e.g. what if the person with the key to the server room is sick)?">
    Yes. We have deployed our application on AWS virtual platform cloud. And we have the process in place to handle or manage any contingent events or circumstances. We have implemented the Business continuity management and tested annually to validate the effectiveness of the controls. Attached the Business continuity management plan.
  </Accordion>

  <Accordion title="How are physical access controls authorized? (who is responsible for managing and ensuring that only appropriate persons have keys or codes to the facility)">
    We have an Admin/Facility department who is responsible and manage the Physical security and we have provided the access cards to all the employees and visitors and installed biometric machines at all the entry and exit areas. We have also installed the CCTV cameras in our building and will be monitored 24\*7 for maximum security. AWS Data centre physical security – We have deployed our application product on AWS virtual platform cloud. Physical access is strictly controlled both at the perimeter and at building ingress points by professional security staff utilizing video surveillance, intrusion detection systems, and other electronic means. Authorized staff must pass two-factor authentication a minimum of two times to access data center floors. All visitors and contractors are required to present identification and are signed in and continually escorted by authorized staff. AWS only provides data center access and information to employees and contractors who have a legitimate business need for such privileges. When an employee no longer has a business need for these privileges, access is immediately revoked, even if they continue to be an employee of Amazon or Amazon Web Services. All physical access to data centers by AWS employees is logged and audited routinely.
  </Accordion>

  <Accordion title="Will any Personally Identifiable Information (PII) be stored with vendor? Please mention specific reports that are to be stored.">
    PII will be entered through application and stored it on AWS cloud virtual platform. We store Name, email ID and phone number of the users.
  </Accordion>

  <Accordion title="How will Vendor share reports/data to the customer i.e. through SFTP, mail with some encrypted way or in a simple excel/pdf format.">
    Reports can be generated by the admins through the application. If there are any additional support needed, our customer support team would be able to help and guide on generating report.
  </Accordion>

  <Accordion title="Have you employed sub processor(s) for processing TCS data?">
    The data will be stored on AWS Cloud and we do not share or transfer the data
  </Accordion>

  <Accordion title="A copy of any security focused questionnaires prepared for the product/environment (Cloud Security Alliance CAIQ, Shared Assessments SIG, etc.).">
    Xoxoday is CSA STAR LEVEL 1 Compliant. Please click here to download CAIQ - [https://cloudsecurityalliance.org/star/registry/nreach-online-services-pvt-ltd-xoxoday/services/nreach-online-services-pvt-ltd-xoxoday/](https://cloudsecurityalliance.org/star/registry/nreach-online-services-pvt-ltd-xoxoday/services/nreach-online-services-pvt-ltd-xoxoday/)
  </Accordion>

  <Accordion title="A list of your data center locations (primary, secondary, etc.) where services are provided from and all locations/countries where information may be processed.">
    We have deployed our application on AWS Virtual platform cloud – Singapore region.
  </Accordion>

  <Accordion title="A list of third service providers utilized to conduct any aspect of the contracted service in scope.">
    Not Applicable. We have not outsourced.
  </Accordion>

  <Accordion title="Describe your security architecture.">
    We have deployed our application on AWS Cloud virtual platform for maximum security. The data center is hosted completely in isolation so that the access is limited and controlled. Load balancer allows shifting incremental load and can auto scale based on data load experienced by application. We have implemented Amazon Cloud watch to enable monitoring of the functioning of the application. The data is encrypted using 256-encryption based SSL certificate. To manage security of data we conduct a quarterly VAPT based security audit of application.
  </Accordion>

  <Accordion title="Does product have security mechanisms against intrusion?">
    Yes, all the mechanisms related to security are implemented to facilitate timely decision and investigation by root-cause analysis. These incidences are analyzed with network intrusion detection (IDS) tools.
  </Accordion>

  <Accordion title="Please furnish historical data with reference to the solution proposed highlighting the errors /fixes/patches within security category and the resolutions undertaken to cater those.">
    We have implemented the Patch management procedures. Critical patches will be deployed immediately High patches will get deployed within 5 days Medium Patches will get deployed within 15-day Low will get deployed in 25 days.
  </Accordion>

  <Accordion title="Do you provide free security patch to the customer at no additional cost?">
    Yes. Since it's a SAAS Product we do not charge any additional cost.
  </Accordion>

  <Accordion title="Do you have a specific R&D team that keep improving your solution security through patch release. Please elaborate (how, many, where)">
    We have a team of 15+ who works for improving our solution security. We conduct periodical Vulnerability assessment and Penetration testing with the help of the Authorized third-party vendors and Fix the observations found during the testing in order to mitigate the risk. Our team is based out of Bangalore location.
  </Accordion>

  <Accordion title="Is your system able to operate on hardened web services system? Please also provide ports required for your system to operate.">
    Yes. Our SAAS solution has been deployed on AWS cloud virtual platform.
  </Accordion>

  <Accordion title="Can the security module be integrated with Middleware to provide the security services? If yes, describe the mechanism?">
    Its SAAS Product and implemented the security controls in order to provide secure services and make sure that the customer data is protected.
  </Accordion>

  <Accordion title="How easy and convenient is your solution authentication and security features for the customer.">
    We have deployed our application on AWS Cloud platform for maximum security. The data will be provided through our platform or application and its hosted-on Amazon Web Services (AWS) Our solution is very easy to use with convenient security features.
  </Accordion>

  <Accordion title="CLOUD SERVICE PROVIDER (CSP) must save access logs for any inbound and outbound access of CLIENT Cloud Infrastructure.">
    Infrastructure logs are collected using the AWS Audit Trail, meanwhile the application related logs are collected in our Elastic Search server and retained in the long term cloud storage. Administrative logs are part of Cloud Dashboard and are regularly reviewed.
  </Accordion>

  <Accordion title="CLOUD SERVICE PROVIDER (CSP) must have security infrastructure for securing any inbound and outbound connection to any of their infrastructure where CLIENT system and/or data reside.">
    We use a cloud hosted VPN with strict access controls to allow our employees to access the official network. This VPN is managed by our IT team, and it's linked with the SSO/Active Directory
  </Accordion>

  <Accordion title="CLOUD SERVICE PROVIDER (CSP) must provide onsite security as a service as the first security line to CLIENT asset that resides on CSP premises.">
    We have deployed our application on AWS Cloud virtual platform. AWS is met all the data center compliance requirements.
  </Accordion>

  <Accordion title="What types of controls are in place to mitigate the risk of malware infection and external hacking?">
    We use a cloud hosted VPN with strict access controls to allow our employees to access the official network. This VPN is managed by our IT team and it's linked with the SSO/Active Directory We have implemented intrusion detection tools, we ensure timely detection and investigation in a prompt manner. File integrity (host) and network intrusion detection (IDS) tools implemented to help facilitate timely detection, investigation. We also have Endpoint security software for all the computers for Protection from exploits, malicious web downloads and softwares, Application and device control etc.
  </Accordion>

  <Accordion title="Will any data be hosted with, or accessed by a sub-contractor?">
    We have deployed the application application on AWS Cloud platform.
  </Accordion>

  <Accordion title="Do any sub-contractors reside in offshore jurisdictions?">
    The data center is in the Singapore region
  </Accordion>

  <Accordion title="Do you have contracts with third party service providers who may have access to FINCARE data (controls such as - Confidentiality agreements, NDAs, review mechanism etc.)?">
    We have deployed our application on AWS cloud virtual platform. but, We have not outsourced any of services and third party will not have access to FINCARE data.
  </Accordion>

  <Accordion title="Is a process in place to regularly monitor your third party service providers to ensure compliance with security standards?">
    Yes. We monitor their compliance, security standards, certifications and Audit Etc.
  </Accordion>

  <Accordion title="Do you have an independent audit performed on your dependent third parties who have access to your Company or clients data?">
    [We have deployed our application on AWS cloud virtual platform. AWS is ISO 27001, ISO 27017, ISO 27701, SOC 2, PCI DSS Level 1 certified organization. Please click here for more information about AWS Audit and certification - https://aws.amazon.com/compliance/programs/](https://aws.amazon.com/compliance/programs/)
  </Accordion>

  <Accordion title="Please explain the data flow/information flow from source to destination, including all the components in the data processing lifecycle.">
    All the data will be provided through the application and it will be stored on AWS cloud virtual platform. We use Cloudflare web application firewall for maximum security. We have encrypted the data while in transit and at rest. We use TLS1.2 encryption for Data at transit and AES256 Data at rest for maximum security. Attached the application data flow diagram
  </Accordion>

  <Accordion title="Does the organization is having network security controls (including boundary controls) in place? If yes please explain and share evidence?">
    We have the security controls in place. We have installed the firewalls to monitor and control the incoming and outgoing network traffic based on predetermined security rules. It helps us to establishes a barrier between a trusted network and an untrusted network. We use a cloud hosted VPN with strict access controls to allow our employees to access the official network. This VPN is managed by our IT team and it's linked with the SSO/Active Directory. Attached the Network Access Control and Security Procedure.
  </Accordion>

  <Accordion title="Is anti-Virus / malware installed on the desktops/ laptops/ Servers and are regularly updated? If yes please explain and share evidence?">
    Yes. we have installed Bitdefender end point security in all the devices for maximum security and have controls on Anti-Virus / Malicious Software throgh End point security. We have also enabled Network Threat Prevention, Advanced Threat Defense, Web Attack Prevention, Multi-Layer Ransomware Protection. Attached the sample screenshot of Bitdefender end point security.
  </Accordion>

  <Accordion title="Applications must be deployed in PSJH Cloud environment, reviewed and approved by EIS. Development, test, and production environments must be segmented from each other.">
    The application is deployed on AWS Virtual platform cloud - Singapore region.
  </Accordion>

  <Accordion title="Application, network, infra and hosting teams shall establish an alternate storage and processing site including necessary agreements to permit the storage and retrieval of information from alternative site.">
    application application is deployed on AWS virtual platform cloud and storgae and scaling up would not be a challenge.
  </Accordion>

  <Accordion title="Application, network, infra and hosting teams shall conduct backups of user-level information, system-level information, and information system documentation at least once every 12 months.">
    Data backups are automated and done daily and in a secured way on AWS. The data at rest in encrypted only authorised individuals (CT0/Production head) will have access to protect the confidentiality, integrity, and availability of the information. These data backups are reviewed on weekly basis and has been validated during the internal and external audits.
  </Accordion>

  <Accordion title="Configure event logging for all system components to audit access and activity to individual users, including proxy users of applications and databases.">
    We use Amazon CloudWatch and Grafana polemique which allows us to monitor instances and alerts us through emails. Infrastructure logs are collected using the AWS Audit Trail, meanwhile the application related logs are collected in our Elastic Search server and retained in the long term cloud storage. Administrative logs are part of Cloud Dashboard and are regularly reviewed.
  </Accordion>

  <Accordion title="Centrally manage and audit event logs utilizing security monitoring tools (eg. Microsoft Sentinel SIEM, XSOAR, and ServiceNow solutions) where available.">
    Yes, audit logs are reviewed and recorded on a regular basis automatically. These logs are integrated with security operations/SIEM solutions. We use Amazon CloudWatch and Grafana polemique which allows us to monitor instances and alerts us through emails. Infrastructure logs are collected using the AWS Audit Trail, meanwhile the application related logs are collected in our Elastic Search server and retained in the long term cloud storage. Administrative logs are part of Cloud Dashboard and are regularly reviewed.
  </Accordion>

  <Accordion title="Use only secure and up to date third party or open source components that have been formally approved by EIS, Providence Legal, IT Contracting, and any other applicable Providence approval and governance groups.">
    We have deployed our applicaiton on AWS Virtual platform cloud. We do not use any unauthorised applications accross the organization as per the Information security policy.
  </Accordion>

  <Accordion title="Developers must not have access to both the development/test and production environments. Use cases where developers need access must be reviewed by ISRA for approval.">
    At Xoxoday the test environment and production environment has been seperated. We have dedicated non-production environment which is in different AWS account and allowing us to segregate data of production environment.
  </Accordion>

  <Accordion title="Employ controls to protect REST services against Cross-Site Request Forgery attacks.">
    we use Cloudflare Web application firewall (WAF), AWS Guard Duty threat detection service, Amazon CloudWatch, IDS/IPS etc.. for maximum security of data.
  </Accordion>

  <Accordion title="Implement controls to prevent log injection.">
    Compliant. We do not allow un-trusted and un-validated inputs and attacker cannot insert malicious data and false entries into the logs.
  </Accordion>

  <Accordion title="Implement controls to prevent sharing of source code without authorization. Application teams to use Enterprise approved Source Control Repository and Contineous deployment mechanism.">
    We do not share the source code. Our code reviews and analysis run through stringent eyes of automated technologies as well as manual source code overview to cover any security loopholes prior to the production phase.
  </Accordion>

  <Accordion title="Implement controls to restrict and limit access to source code to authorized users. Access to be extended only to PSJH accounts.">
    At Xoxday the source code is restricted to only the authorised individuals
  </Accordion>

  <Accordion title="The solution is scalable to support the customer size and complexity: 170,000 co-workers, 10% new co-workers yearly, 40% co-workers turnover, Minimum 35 countries.">
    Yes. Our solution is using state of the art Cloud Native infrastructure technologies along with microservices architecture allows us to scale our operations as per the demands.
  </Accordion>

  <Accordion title="Security model of storage of data - Please describe shortly how data is stored, in relation to vendor's data, is protected at use, in transit and at rest.">
    We have deployed our application on AWS Cloud virtual platform and all the data is stored on AWS. All the confidential/PI data are encrypted at rest and in transit with a split key mechanism to ensure that every client's key is unique. We use TLS1.3 encryption while data in transit and AES256 while data at rest.
  </Accordion>

  <Accordion title="Are there any subcontractors involved (4th Parties to Infosys) in providing services to Infosys? If yes, detail out the current process in the organization for ensuring adequate security governance.">
    we use Amazon Web Services (AWS) as our Communication service provider. We review the adequate security governance periodicall to make sure that they are also complied with all the Security and Privacy compliance requirements.
  </Accordion>

  <Accordion title="Do you process personal data as part of engagement with Infosys?">
    We are the Data processor. application is GDPR compliant. At Xoxoday, we ensure that the data is gathered, stored, and handled with respect to individual rights.
  </Accordion>

  <Accordion title="Is the logs maintained for login successful and failure attempts?">
    The audit logs are reviewed and recorded on a regular basis automatically. These logs are integrated with security operations/SIEM solutions.
  </Accordion>

  <Accordion title="Is application configured for audit trails?">
    At Xoxoday Infrastructure logs are collected using the AWS Audit Trail, meanwhile the application related logs are collected in our Elastic Search server and retained in the long term cloud storage.
  </Accordion>

  <Accordion title="Is the code repository established and back-up are taken regularly?">
    The backup is automated and happen on AWS on regular basis.
  </Accordion>

  <Accordion title="Is the application server have latest operating system, licensed and supported?">
    We have deployed our application on AWS Virtual platform cloud - Singapore region.
  </Accordion>

  <Accordion title="Is the database server are hardened for security and maintained?">
    The application and database server are hardened.
  </Accordion>

  <Accordion title="Is security audit logs and alerts are configured for application server?">
    Infrastructure logs are collected using the AWS Audit Trail, meanwhile the application related logs are collected in our Elastic Search server and retained in the long term cloud storage.
  </Accordion>

  <Accordion title="Is any server or data mentioned of/from/by application hosted or shared outside of Indian legal and juridiction bounderies?">
    We have deployed our application on AWS Virtual platform cloud - Singapore region. All the application data is stored there on AWS - Singapore.
  </Accordion>

  <Accordion title="Does the provider use a third party to provide the required services? If so, explain the services to be provided by the third party and the type of relationship between the provider and the third party.">
    We use third party to provide necessary services to the organization on need and approval basis. For ex – Background verification vendor, VA/PT authorised third party vendor, Eternal Auditors, AWS Virtual platform cloud service providers, Google workspace etc
  </Accordion>

  <Accordion title="Are the services provided by the provider scalable? Are there any limits?">
    We predominantly work on cloud-based infrastructure - Amazon Web Services which provides the Backup and Restore services to build scalable, durable, and secure data-protection solutions. No limits.
  </Accordion>

  <Accordion title="What is the process to restore data from the provider's back-up?">
    Data backups are done daily and in a secured way in AWS. And Our team review the same on regular basis.
  </Accordion>

  <Accordion title="Till how long data backup will be retained?">
    Data backups are done on daily basis and in a secured way in AWS. We have the mechanism in place to delete the data upon termination of the contract upon customer request. In addition to safeguarding the rights of data subjects under the GDPR, we have implemented the Data Retention and Disposal Policy ensuring that excessive amounts of data are not retained by us.
  </Accordion>

  <Accordion title="If using virtual infrastructure, does the solution include hardware independent restore and recovery capabilities?">
    We have deployed our application on AWS Virtual platform cloud and they provide these services.
  </Accordion>
</AccordionGroup>


# Cloud Security Alliance
Source: https://help-plum.xoxoday.com/faq/security-compliance/cloud-security-alliance

Find answers to frequently asked questions about Plum's Cloud Security Alliance (CSA) compliance and cloud security posture.

## Application & Interface Security

<AccordionGroup>
  <Accordion title="Application Security">
    Applications and programming interfaces (APIs) shall be designed, developed, deployed, and tested in accordance with leading industry standards (e.g., OWASP for web applications) and adhere to applicable legal, statutory, or regulatory compliance obligations.

    Yes, we ensure the same as part of our code review, static code analysis and Web Application Firewall.
  </Accordion>

  <Accordion title="Customer Access Requirements">
    Prior to granting customers access to data, assets, and information systems, identified security, contractual, and regulatory requirements for customer access shall be addressed.

    Yes, we provide API access only to vendors and systems authorized by the customer.
  </Accordion>

  <Accordion title="Data Integrity">
    Data input and output integrity routines (i.e., reconciliation and edit checks) shall be implemented for application interfaces and databases to prevent manual or systematic processing errors, corruption of data, or misuse.

    Yes, we follow multi layer application architecture to isolate database access
  </Accordion>

  <Accordion title="Data Security / Integrity">
    Policies and procedures shall be established and maintained in support of data security to include (confidentiality, integrity and availability) across multiple system interfaces, jurisdictions and business functions to prevent improper disclosure, alteration, or destruction.

    Complied with the requirement - We have Information security policy in place and working effectively
  </Accordion>
</AccordionGroup>

***

## Audit Assurance & Compliance

<AccordionGroup>
  <Accordion title="Audit Planning">
    Audit plans shall be developed and maintained to address business process disruptions. Auditing plans shall focus on reviewing the effectiveness of the implementation of security operations. All audit activities must be agreed upon prior to executing any audits.

    Complied with the requirement - We are conducting the Internal and External Audit as per the requirement and focus on the evaluation of the effectiveness security controls
  </Accordion>

  <Accordion title="Independent Audits">
    Independent reviews and assessments shall be performed at least annually to ensure that the organization addresses nonconformities of established policies, standards, procedures, and compliance obligations.

    Complied with the requirement - reviews and assessments has been performed annually.
  </Accordion>

  <Accordion title="Information System Regulatory Mapping">
    Organizations shall create and maintain a control framework which captures standards, regulatory, legal, and statutory requirements relevant for their business needs. The control framework shall be reviewed at least annually to ensure changes that could affect the business processes are reflected.

    We are complied with the requirement - Information security team is reviewing the requirements at least annually to ensure changes that could affect the business processes are reflected.
  </Accordion>
</AccordionGroup>

***

## Business Continuity Management & Operational Resilience

<AccordionGroup>
  <Accordion title="Business Continuity Planning">
    A consistent unified framework for business continuity planning and plan development shall be established, documented and adopted to ensure all business continuity plans are consistent in addressing priorities for testing, maintenance, and information security requirements. Requirements for business continuity plans include the following: • Defined purpose and scope, aligned with relevant dependencies • Accessible to and understood by those who will use them • Owned by a named person(s) who is responsible for their review, update, and approval • Defined lines of communication, roles, and responsibilities • Detailed recovery procedures, manual work-around, and reference information • Method for plan invocation

    We are complied with the requirement -We have Business continuity plan and procedure which is approved by the Management and tested annually once as per the compliance requirements.
  </Accordion>

  <Accordion title="Business Continuity Testing">
    Business continuity and security incident response plans shall be subject to testing at planned intervals or upon significant organizational or environmental changes. Incident response plans shall involve impacted customers (tenant) and other business relationships that represent critical intra-supply chain business process dependencies.

    We are complied with the requirement -We have Business continuity plan and procedure which is approved by the Management and tested annually once as per the compliance requirements.
  </Accordion>

  <Accordion title="Datacenter Utilities / Environmental Conditions">
    Datacenter utilities services and environmental conditions (e.g., water, power, temperature and humidity controls, telecommunications,and internet connectivity) shall be secured, monitored, maintained, and tested for continual effectiveness at planned intervals to ensure protection from unauthorized interception or damage, and designed with automated fail-over or other redundancies in the event of planned or unplanned disruptions.

    Yes, we use Amazon Web Services (AWS) as our CSP, and they provide the same.
  </Accordion>

  <Accordion title="Documentation">
    Information system documentation (e.g., administrator and user guides, and architecture diagrams) shall be made available to authorized personnel to ensure the following: • Configuring, installing, and operating the information system • Effectively using the system's security features

    Yes, we have such documentation
  </Accordion>

  <Accordion title="Environmental Risks">
    Physical protection against damage from natural causes and disasters, as well as deliberate attacks, including fire, flood, atmospheric electrical discharge, solar induced geomagnetic storm, wind, earthquake, tsunami, explosion, nuclear accident, volcanic activity, biological hazard, civil unrest, mudslide, tectonic activity, and other forms of natural or man-made disaster shall be anticipated, designed, and have countermeasures applied.

    We are complied with the requirement . We have Physical and Environmental Security Procedure in place and effectively working
  </Accordion>

  <Accordion title="Equipment Location">
    To reduce the risks from environmental threats, hazards, and opportunities for unauthorized access, equipment shall be kept away from locations subject to high probability environmental risks and supplemented by redundant equipment located at a reasonable distance.

    We are complied with the requirement
  </Accordion>

  <Accordion title="Equipment Maintenance">
    Policies and procedures shall be established, and supporting business processes and technical measures implemented, for equipment maintenance ensuring continuity and availability of operations and support personnel.

    Yes. We follow this and complied with the requirement
  </Accordion>

  <Accordion title="Equipment Power Failures">
    Protection measures shall be put into place to react to natural and man-made threats based upon a geographically-specific Business Impact Assessment

    We are complied with the requirement . We have Physical and Environmental Security Procedure in place and effectively working
  </Accordion>

  <Accordion title="Impact Analysis">
    There shall be a defined and documented method for determining the impact of any disruption to the organization (cloud provider, cloud consumer) that must incorporate the following: • Identify critical products and services • Identify all dependencies, including processes, applications, business partners, and third party service providers • Understand threats to critical products and services • Determine impacts resulting from planned or unplanned disruptions and how these vary over time • Establish the maximum tolerable period for disruption • Establish priorities for recovery • Establish recovery time objectives for resumption of critical products and services within their maximum tolerable period of disruption • Estimate the resources required for resumption

    We are complied with the requirement as per the Business continuity plan and procedure.
  </Accordion>

  <Accordion title="Policy">
    Policies and procedures shall be established, and supporting business processes and technical measures implemented, for appropriate IT governance and service management to ensure appropriate planning, delivery and support of the organization's IT capabilities supporting business functions, workforce, and/or customers based on industry acceptable standards (i.e., ITIL v4 and COBIT 5). Additionally, policies and procedures shall include defined roles and responsibilities supported by regular workforce training.

    Yes. We have the policies and procedures in place for approproate IT Governance and service management.
  </Accordion>

  <Accordion title="Retention Policy">
    Policies and procedures shall be established, and supporting business processes and technical measures implemented, for defining and adhering to the retention period of any critical asset as per established policies and procedures, as well as applicable legal, statutory, or regulatory compliance obligations. Backup and recovery measures shall be incorporated as part of business continuity planning and tested accordingly for effectiveness.

    We are complied with the requirement. We have data protection policy.
  </Accordion>
</AccordionGroup>

***

## Change Control & Configuration Management

<AccordionGroup>
  <Accordion title="New Development / Acquisition">
    Policies and procedures shall be established, and supporting business processes and technical measures implemented, to ensure the development and/or acquisition of new data, physical or virtual applications, infrastructure network and systems components, or any corporate, operations and/or datacenter facilities have been pre-authorized by the organization's business leadership or other accountable business role or function.

    We are complied with the requirement
  </Accordion>

  <Accordion title="Outsourced Development">
    External business partners shall adhere to the same policies and procedures for change management, release, and testing as internal developers within the organization (e.g. ITIL service management processes).

    Yes, we comply
  </Accordion>

  <Accordion title="Quality Testing">
    Organization shall follow a defined quality change control and testing process (e.g. ITIL Service Management) with established baselines, testing, and release standards that focus on system availability, confidentiality, and integrity of systems and services.

    Yes, we comply
  </Accordion>

  <Accordion title="Unauthorized Software Installations">
    Policies and procedures shall be established, and supporting business processes and technical measures implemented, to restrict the installation of unauthorized software on organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.

    We are complied with the requirement - We have installed End point security in users devices.
  </Accordion>

  <Accordion title="Production Changes">
    Policies and procedures shall be established for managing the risks associated with applying changes to: • business-critical or customer (tenant)-impacting (physical and virtual) applications and system-system interface (API) designs and configurations • infrastructure network and systems components Technical measures shall be implemented to provide assurance that all changes directly correspond to a registered change request, business-critical or customer (tenant) , and/or authorization by, the customer (tenant) as per agreement (SLA) prior to deployment.

    Yes, we follow such a CM process.
  </Accordion>
</AccordionGroup>

***

## Data Security & Information Lifecycle Management

<AccordionGroup>
  <Accordion title="Classification">
    Data and objects containing data shall be assigned a classification by the data owner based on data type, value, sensitivity, and criticality to the organization.

    Yes, We comply
  </Accordion>

  <Accordion title="Data Inventory / Flows">
    Policies and procedures shall be established to inventory, document, and maintain data flows for data that is resident (permanently or temporarily) within the service's applications and infrastructure network and systems. In particular, providers shall ensure that data that is subject to geographic residency requirements not be migrated beyond its defined bounds.

    Yes, We comply
  </Accordion>

  <Accordion title="eCommerce Transactions">
    Data related to electronic commerce (e-commerce) that traverses public networks shall be appropriately classified and protected from fraudulent activity, unauthorized disclosure, or modification in such a manner to prevent contract dispute and compromise of data.

    Yes, We comply
  </Accordion>

  <Accordion title="Handling / Labeling / Security Policy">
    Policies and procedures shall be established for the labeling, handling, and security of data and objects which contain data. Mechanisms for label inheritance shall be implemented for objects that act as aggregate containers for data.

    We are complied with the requirements with regards to data handling/Labeling/clasification
  </Accordion>

  <Accordion title="Non-Production Data">
    Production data shall not be replicated or used in non-production environments.

    Yes, We dont use LIVE data in any other environment.
  </Accordion>

  <Accordion title="Ownership / Stewardship">
    All data shall be designated with stewardship, with assigned responsibilities defined, documented, and communicated.

    Yes, We comply
  </Accordion>

  <Accordion title="Secure Disposal">
    Any use of customer data in non-production environments requires explicit, documented approval from all customers whose data is affected, and must comply with all legal and regulatory requirements for scrubbing of sensitive data elements.

    Yes, We comply
  </Accordion>
</AccordionGroup>

***

## Datacenter Security

<AccordionGroup>
  <Accordion title="Asset Management">
    Assets must be classified in terms of business criticality, service-level expectations, and operational continuity requirements. A complete inventory of business-critical assets located at all sites and/or geographical locations and their usage over time shall be maintained and updated regularly, and assigned ownership by defined roles and responsibilities.

    Yes, We comply
  </Accordion>

  <Accordion title="Controlled Access Points">
    Physical security perimeters (e.g., fences, walls, barriers, guards, gates, electronic surveillance, physical authentication mechanisms, reception desks, and security patrols) shall be implemented to safeguard sensitive data and information systems.

    Yes, We comply. Our CSP(AWS) provides the same.
  </Accordion>

  <Accordion title="Equipment Identification">
    Automated equipment identification shall be used as a method of connection authentication. Location-aware technologies may be used to validate connection authentication integrity based on known equipment location.

    Yes, We comply. Our CSP(AWS) provides the same.
  </Accordion>

  <Accordion title="Off-Site Authorization">
    Authorization must be obtained prior to relocation or transfer of hardware, software, or data to an offsite premises.

    We are complied - As per the Information security policy and Media protection procedure.
  </Accordion>

  <Accordion title="Off-Site Equipment">
    Policies and procedures shall be established for the secure disposal of equipment (by asset type) used outside the organization's premises. This shall include a wiping solution or destruction process that renders recovery of information impossible. The erasure shall consist of a full overwrite of the drive to ensure that the erased drive is released to inventory for reuse and deployment, or securely stored until it can be destroyed.

    We are complied. We have Asset Management Procedure
  </Accordion>

  <Accordion title="Policy">
    Policies and procedures shall be established, and supporting business processes implemented, for maintaining a safe and secure working environment in offices, rooms, facilities, and secure areas storing sensitive information.

    We are complied. Physical and Environmental Security Procedure
  </Accordion>

  <Accordion title="Secure Area Authorization">
    Ingress and egress to secure areas shall be constrained and monitored by physical access control mechanisms to ensure that only authorized personnel are allowed access.

    We are complied. We have Physical and Environmental Security Procedure
  </Accordion>

  <Accordion title="Unauthorized Persons Entry">
    Ingress and egress points such as service areas and other points where unauthorized personnel may enter the premises shall be monitored, controlled and, if possible, isolated from data storage and processing facilities to prevent unauthorized data corruption, compromise, and loss.

    We are complied. We have Physical and Environmental Security Procedure and we are monitoring the office building via CCTV cameras.
  </Accordion>

  <Accordion title="User Access">
    Physical access to information assets and functions by users and support personnel shall be restricted.

    We are complied. We have Physical and Environmental Security Procedure in place and provided the access card to the users to restrict the specific areas.
  </Accordion>
</AccordionGroup>

***

## Encryption & Key Management

<AccordionGroup>
  <Accordion title="Entitlement">
    Keys must have identifiable owners (binding keys to identities) and there shall be key management policies.

    Yes, We comply.
  </Accordion>

  <Accordion title="Key Generation">
    Policies and procedures shall be established for the management of cryptographic keys in the service's cryptosystem (e.g., lifecycle management from key generation to revocation and replacement, public key infrastructure, cryptographic protocol design and algorithms used, access controls in place for secure key generation, and exchange and storage including segregation of keys used for encrypted data or sessions). Upon request, provider shall inform the customer (tenant) of changes within the cryptosystem, especially if the customer (tenant) data is used as part of the service, and/or the customer (tenant) has some shared responsibility over implementation of the control.

    Yes, We comply.
  </Accordion>

  <Accordion title="Sensitive Data Protection">
    Policies and procedures shall be established, and supporting business processes and technical measures implemented, for the use of encryption protocols for protection of sensitive data in storage (e.g., file servers, databases, and end-user workstations), data in use (memory), and data in transmission (e.g., system interfaces, over public networks, and electronic messaging) as per applicable legal, statutory, and regulatory compliance obligations.

    Yes, We comply.
  </Accordion>

  <Accordion title="Storage and Access">
    Platform and data-appropriate encryption (e.g., AES-256) in open/validated formats and standard algorithms shall be required. Keys shall not be stored in the cloud (i.e. at the cloud provider in question), but maintained by the cloud consumer or trusted key management provider. Key management and key usage shall be separated duties.

    Yes, we use AES256 for data at rest.
  </Accordion>
</AccordionGroup>

***

## Governance and Risk Management

<AccordionGroup>
  <Accordion title="Baseline Requirements">
    Baseline security requirements shall be established for developed or acquired, organizationally-owned or managed, physical or virtual, applications and infrastructure system and network components that comply with applicable legal, statutory and regulatory compliance obligations. Deviations from standard baseline configurations must be authorized following change management policies and procedures prior to deployment, provisioning, or use. Compliance with security baseline requirements must be reassessed at least annually unless an alternate frequency has been established and authorized based on business need.

    We are complied with this - We have Compliance Procedure in place and reviewed by the management annually
  </Accordion>

  <Accordion title="Data Focus Risk Assessments">
    Risk assessments associated with data governance requirements shall be conducted at planned intervals and shall consider the following: • Awareness of where sensitive data is stored and transmitted across applications, databases, servers, and network infrastructure • Compliance with defined retention periods and end-of-life disposal requirements • Data classification and protection from unauthorized use, access, loss, destruction, and falsification

    We are complied - We have Risk Management Procedure and Data classification policy to protect unauthorized use, access, loss, destruction, and falsification
  </Accordion>

  <Accordion title="Management Oversight">
    Managers are responsible for maintaining awareness of, and complying with, security policies, procedures, and standards that are relevant to their area of responsibility.

    We are complied - we provied information security awareness training to all the employees annually once we per the ISMS requirements.
  </Accordion>

  <Accordion title="Management Program">
    An Information Security Management Program (ISMP) shall be developed, documented, approved, and implemented that includes administrative, technical, and physical safeguards to protect assets and data from loss, misuse, unauthorized access, disclosure, alteration, and destruction. The security program shall include, but not be limited to, the following areas insofar as they relate to the characteristics of the business: • Risk management • Security policy • Organization of information security • Asset management • Human resources security • Physical and environmental security • Communications and operations management • Access control • Information systems acquisition, development, and maintenance

    We are complied with the requirements - We have Information security management framework consisted of all the required policies and procedures. For ex - Risk management • Security policy • Organization of information security • Asset management • Human resources security • Physical and environmental security • Communications and operations management • Access control policy etc....
  </Accordion>

  <Accordion title="Management Support/Involvement">
    Executive and line management shall take formal action to support information security through clearly-documented direction and commitment, and shall ensure the action has been assigned.

    We are complied - The management is reviewing the performance if the Information Security department and taking necessing actions and providing the recommondation on a timely basis. And all the ISMS policies has been reviewed and approved by the management yearly once as per the requirements.
  </Accordion>

  <Accordion title="Policy">
    Information security policies and procedures shall be established and made readily available for review by all impacted personnel and external business relationships. Information security policies must be authorized by the organization's business leadership (or other accountable business role or function) and supported by a strategic business plan and an information security management program inclusive of defined information security roles and responsibilities for business leadership.

    We are complied. We have all the required ISMS policies and procedures in place.
  </Accordion>

  <Accordion title="Policy Enforcement">
    A formal disciplinary or sanction policy shall be established for employees who have violated security policies and procedures. Employees shall be made aware of what action might be taken in the event of a violation, and disciplinary measures must be stated in the policies and procedures.

    We have Desciplinary policy in place and created an awareness among employees regarding voilation of the polciies via ISMS training.
  </Accordion>

  <Accordion title="Policy Impact on Risk Assessments">
    Risk assessment results shall include updates to security policies, procedures, standards, and controls to ensure that they remain relevant and effective.

    We have Risk Management Procedure as per the requirement. We are complied.
  </Accordion>

  <Accordion title="Policy Reviews">
    The organization's business leadership (or other accountable business role or function) shall review the information security policy at planned intervals or as a result of changes to the organization to ensure its continuing alignment with the security strategy, effectiveness, accuracy, relevance, and applicability to legal, statutory, or regulatory compliance obligations.

    We are complied with the requirements - The management is reviewing the performance if the Information Security department and taking necessing actions and providing the recommondation on a timely basis.
  </Accordion>

  <Accordion title="Risk Assessments">
    Aligned with the enterprise-wide framework, formal risk assessments shall be performed at least annually or at planned intervals, (and in conjunction with any changes to information systems) to determine the likelihood and impact of all identified risks using qualitative and quantitative methods. The likelihood and impact associated with inherent and residual risk shall be determined independently, considering all risk categories (e.g., audit results, threat and vulnerability analysis, and regulatory compliance).

    We are conducting Risk assessment at least once in a year as per the ISMS requirements.
  </Accordion>

  <Accordion title="Risk Management Framework">
    Risks shall be mitigated to an acceptable level. Acceptance levels based on risk criteria shall be established and documented in accordance with reasonable resolution time frames and stakeholder approval.

    Risk criteria has been established as per the Risk management procedure and consuct risk assessment once in a year as per the compliance requirements.
  </Accordion>
</AccordionGroup>

***

## Human Resources

<AccordionGroup>
  <Accordion title="Asset Returns">
    Upon termination of workforce personnel and/or expiration of external business relationships, all organizationally-owned assets shall be returned within an established period.

    We are complied as a part of offboarding procedure.
  </Accordion>

  <Accordion title="Background Screening">
    Pursuant to local laws, regulations, ethics, and contractual constraints, all employment candidates, contractors, and third parties shall be subject to background verification proportional to the data classification to be accessed, the business requirements, and acceptable risk.

    We conduct background verification as per the compliance requirements and kept all the required data.
  </Accordion>

  <Accordion title="Employment Agreements">
    Employment agreements shall incorporate provisions and/or terms for adherence to established information governance and security policies and must be signed by newly hired or on-boarded workforce personnel (e.g., full or part-time employee or contingent staff) prior to granting workforce personnel user access to corporate facilities, resources, and assets.

    We are complied with it. Also all the employees have signed for the Non disclosure agreements.
  </Accordion>

  <Accordion title="Employment Termination">
    Roles and responsibilities for performing employment termination or change in employment procedures shall be assigned, documented, and communicated.

    We are complied - Roles, Responsibilities & Authorities has been defined and communicated to the respective individials.
  </Accordion>

  <Accordion title="Mobile Device Management">
    Policies and procedures shall be established, and supporting business processes and technical measures implemented, to manage business risks associated with permitting mobile device access to corporate resources and may require the implementation of higher assurance compensating controls and acceptable-use policies and procedures (e.g., mandated security training, stronger identity, entitlement and access controls, and device monitoring).

    We are complied - We have mobile device management polciy.
  </Accordion>

  <Accordion title="Non-Disclosure Agreements">
    Requirements for non-disclosure or confidentiality agreements reflecting the organization's needs for the protection of data and operational details shall be identified, documented, and reviewed at planned intervals.

    We have non-disclosure or confidentiality agreements and signed by all the employees and external parties.
  </Accordion>

  <Accordion title="Roles / Responsibilities">
    Roles and responsibilities of contractors, employees, and third-party users shall be documented as they relate to information assets and security.

    We are complied - Roles, Responsibilities & Authorities has been defined and communicated to the respective individials.
  </Accordion>

  <Accordion title="Technology Acceptable Use">
    Policies and procedures shall be established, and supporting business processes and technical measures implemented, for defining allowances and conditions for permitting usage of organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components. Additionally, defining allowances and conditions to permit usage of personal mobile devices and associated applications with access to corporate resources (i.e., BYOD) shall be considered and incorporated as appropriate.

    We are complied with the requirement - We have controls in place through policies and procedure.
  </Accordion>

  <Accordion title="Training / Awareness">
    A security awareness training program shall be established for all contractors, third-party users, and employees of the organization and mandated when appropriate. All individuals with access to organizational data shall receive appropriate awareness training and regular updates in organizational procedures, processes, and policies relating to their professional function relative to the organization.

    we are complied - We provide Information security awareness traning to all the employees and contractors, third-party users.
  </Accordion>

  <Accordion title="User Responsibility">
    All personnel shall be made aware of their roles and responsibilities for: • Maintaining awareness and compliance with established policies and procedures and applicable legal, statutory, or regulatory compliance obligations. • Maintaining a safe and secure working environment

    We are complied - We have Roles, Responsibilities & Authorities policy in place as per the compliance requirements.
  </Accordion>

  <Accordion title="Workspace">
    Policies and procedures shall be established to require that unattended workspaces do not have openly visible (e.g., on a desktop) sensitive documents and user computing sessions are disabled after an established period of inactivity.

    we are complied - we have an access control policy and IT Team have implemented accounts lockout policy to safeguard the sestive documents and personal information.
  </Accordion>
</AccordionGroup>

***

## Identity & Access Management

<AccordionGroup>
  <Accordion title="Audit Tools Access">
    Access to, and use of, audit tools that interact with the organization's information systems shall be appropriately segmented and restricted to prevent compromise and misuse of log data.

    Yes, We comply.
  </Accordion>

  <Accordion title="Credential Lifecycle / Provision Management">
    User access policies and procedures shall be established, and supporting business processes and technical measures implemented, for ensuring appropriate identity, entitlement, and access management for all internal corporate and customer (tenant) users with access to data and organizationally-owned or managed (physical and virtual) application interfaces and infrastructure network and systems components. These policies, procedures, processes, and measures must incorporate the following: • Procedures and supporting roles and responsibilities for provisioning and de-provisioning user account entitlements following the rule of least privilege based on job function • Business case considerations for higher levels of assurance and multi-factor authentication secrets • Access segmentation to sessions and data in multi-tenant architectures by any third party • Identity trust verification and service-to-service application (API) and information processing interoperability (e.g., SSO and federation) • Account credential lifecycle management from instantiation through revocation • Authentication, authorization, and accounting (AAA) rules for access to data and sessions • Adherence to applicable legal, statutory, or regulatory compliance requirements

    We are complied - Access control policy and Information security policies has been established as per the requirements. We provide an accesss to the data only to an authorised individial.
  </Accordion>

  <Accordion title="Diagnostic / Configuration Ports Access">
    User access to diagnostic and configuration ports shall be restricted to authorized individuals and applications.

    Complied with the requirements though End point security installation.
  </Accordion>

  <Accordion title="Policies and Procedures">
    Policies and procedures shall be established to store and manage identity information about every person who accesses IT infrastructure and to determine their level of access. Policies shall also be developed to control access to network resources based on user identity.

    We are complied - We have policies and procedure in place to store and manage identity information.
  </Accordion>

  <Accordion title="Segregation of Duties">
    User access policies and procedures shall be established, and supporting business processes and technical measures implemented, for restricting user access as per defined segregation of duties to address business risks associated with a user-role conflict of interest.

    We are complied - We have policies and procedure in place to have control on access of data. We provide access only to an authorised individials.
  </Accordion>

  <Accordion title="Source Code Access Restriction">
    Access to the organization's own developed applications, program, or object source code, or any other form of intellectual property (IP), and use of proprietary software shall be appropriately restricted following the rule of least privilege based on job function as per established user access policies and procedures.

    We have role based access system to make sure that only the authorised individual have an access to the required information.
  </Accordion>

  <Accordion title="Third Party Access">
    The identification, assessment, and prioritization of risks posed by business processes requiring third-party access to the organization's information systems and data shall be followed by coordinated application of resources to minimize, monitor, and measure likelihood and impact of unauthorized or inappropriate access. Compensating controls derived from the risk analysis shall be implemented prior to provisioning access.

    Yes, We comply.
  </Accordion>

  <Accordion title="Trusted Sources">
    Policies and procedures are established for permissible storage and access of identities used for authentication to ensure identities are only accessible based on rules of least privilege and replication limitation only to users explicitly defined as business necessary.

    We have role based access system to make sure that only the authorised individual have an access to the required information.
  </Accordion>

  <Accordion title="User Access Authorization">
    Provisioning user access (e.g., employees, contractors, customers (tenants), business partners and/or supplier relationships) to data and organizationally-owned or managed (physical and virtual) applications, infrastructure systems, and network components shall be authorized by the organization's management prior to access being granted and appropriately restricted as per established policies and procedures. Upon request, provider shall inform customer (tenant) of this user access, especially if customer (tenant) data is used as part the service and/or customer (tenant) has some shared responsibility over implementation of control.

    We have role based access system to make sure that only the authorised individual have an access to the required information.
  </Accordion>

  <Accordion title="User Access Reviews">
    User access shall be authorized and revalidated for entitlement appropriateness, at planned intervals, by the organization's business leadership or other accountable business role or function supported by evidence to demonstrate the organization is adhering to the rule of least privilege based on job function. For identified access violations, remediation must follow established user access policies and procedures.

    We have role based access system through access control policy to make sure that only the authorised individual have an access to the required information.
  </Accordion>

  <Accordion title="User Access Revocation">
    Timely de-provisioning (revocation or modification) of user access to data and organizationally-owned or managed (physical and virtual) applications, infrastructure systems, and network components, shall be implemented as per established policies and procedures and based on user's change in status (e.g., termination of employment or other business relationship, job change or transfer). Upon request, provider shall inform customer (tenant) of these changes, especially if customer (tenant) data is used as part the service and/or customer (tenant) has some shared responsibility over implementation of control.

    We have change management policy and Infrastructure Change Control Procedure to comply with this requirements.
  </Accordion>

  <Accordion title="User ID Credentials">
    Internal corporate or customer (tenant) user account credentials shall be restricted as per the following, ensuring appropriate identity, entitlement, and access management and in accordance with established policies and procedures: • Identity trust verification and service-to-service application (API) and information processing interoperability (e.g., SSO and Federation) • Account credential lifecycle management from instantiation through revocation • Account credential and/or identity store minimization or re-use when feasible • Adherence to industry acceptable and/or regulatory compliant authentication, authorization, and accounting (AAA) rules (e.g., strong/multi-factor, expireable, non-shared authentication secrets)

    Yes, We comply.
  </Accordion>

  <Accordion title="Utility Programs Access">
    Utility programs capable of potentially overriding system, object, network, virtual machine, and application controls shall be restricted.

    Yes, We comply.
  </Accordion>
</AccordionGroup>

***

## Infrastructure & Virtualization Security

<AccordionGroup>
  <Accordion title="Audit Logging / Intrusion Detection">
    Higher levels of assurance are required for protection, retention, and lifecyle management of audit logs, adhering to applicable legal, statutory or regulatory compliance obligations and providing unique user access accountability to detect potentially suspicious network behaviors and/or file integrity anomalies, and to support forensic investigative capabilities in the event of a security breach.

    Yes, We comply.
  </Accordion>

  <Accordion title="Change Detection">
    The provider shall ensure the integrity of all virtual machine images at all times. Any changes made to virtual machine images must be logged and an alert raised regardless of their running state (e.g. dormant, off, or running). The results of a change or move of an image and the subsequent validation of the image's integrity must be immediately available to customers through electronic methods (e.g. portals or alerts).

    Yes, We comply.
  </Accordion>

  <Accordion title="Clock Synchronization">
    A reliable and mutually agreed upon external time source shall be used to synchronize the system clocks of all relevant information processing systems to facilitate tracing and reconstitution of activity timelines.

    Yes, We comply.
  </Accordion>

  <Accordion title="Information System Documentation">
    The availability, quality, and adequate capacity and resources shall be planned, prepared, and measured to deliver the required system performance in accordance with legal, statutory, and regulatory compliance obligations. Projections of future capacity requirements shall be made to mitigate the risk of system overload.

    Yes, We comply.
  </Accordion>

  <Accordion title="Management - Vulnerability Management">
    Implementers shall ensure that the security vulnerability assessment tools or services accommodate the virtualization technologies used (e.g. virtualization aware).

    Yes, We comply.
  </Accordion>

  <Accordion title="Network Security">
    Network environments and virtual instances shall be designed and configured to restrict and monitor traffic between trusted and untrusted connections. These configurations shall be reviewed at least annually, and supported by a documented justification for use for all allowed services, protocols, and ports, and by compensating controls.

    Yes, We comply.
  </Accordion>

  <Accordion title="OS Hardening and Base Controls">
    Each operating system shall be hardened to provide only necessary ports, protocols, and services to meet business needs and have in place supporting technical controls such as: antivirus, file integrity monitoring, and logging as part of their baseline operating build standard or template.

    Yes, We comply.
  </Accordion>

  <Accordion title="Production / Non-Production Environments">
    Production and non-production environments shall be separated to prevent unauthorized access or changes to information assets. Separation of the environments may include: stateful inspection firewalls, domain/realm authentication sources, and clear segregation of duties for personnel accessing these environments as part of their job duties.

    Yes, We comply.
  </Accordion>

  <Accordion title="Segmentation">
    Multi-tenant organizationally-owned or managed (physical and virtual) applications, and infrastructure system and network components, shall be designed, developed, deployed and configured such that provider and customer (tenant) user access is appropriately segmented from other tenant users, based on the following considerations: • Established policies and procedures • Isolation of business critical assets and/or sensitive user data, and sessions that mandate stronger internal controls and high levels of assurance • Compliance with legal, statutory and regulatory compliance obligations

    Yes, We comply.
  </Accordion>

  <Accordion title="VM Security - vMotion Data Protection">
    Secured and encrypted communication channels shall be used when migrating physical servers, applications, or data to virtualized servers and, where possible, shall use a network segregated from production-level networks for such migrations.

    Yes, We comply.
  </Accordion>

  <Accordion title="VMM Security - Hypervisor Hardening">
    Access to all hypervisor management functions or administrative consoles for systems hosting virtualized systems shall be restricted to personnel based upon the principle of least privilege and supported through technical controls (e.g., two-factor authentication, audit trails, IP address filtering, firewalls, and TLS encapsulated communications to the administrative consoles).

    Yes, We comply.
  </Accordion>

  <Accordion title="Wireless Security">
    Policies and procedures shall be established, and supporting business processes and technical measures implemented, to protect wireless network environments, including the following: • Perimeter firewalls implemented and configured to restrict unauthorized traffic • Security settings enabled with strong encryption for authentication and transmission, replacing vendor default settings (e.g., encryption keys, passwords, and SNMP community strings) • User access to wireless network devices restricted to authorized personnel • The capability to detect the presence of unauthorized (rogue) wireless network devices for a timely disconnect from the network

    Yes, We comply.
  </Accordion>

  <Accordion title="Network Architecture">
    Network architecture diagrams shall clearly identify high-risk environments and data flows that may have legal compliance impacts. Technical measures shall be implemented and shall apply defense-in-depth techniques (e.g., deep packet analysis, traffic throttling, and black-holing) for detection and timely response to network-based attacks associated with anomalous ingress or egress traffic patterns (e.g., MAC spoofing and ARP poisoning attacks) and/or distributed denial-of-service (DDoS) attacks.

    Yes, We comply.
  </Accordion>
</AccordionGroup>

***

## Interoperability & Portability

<AccordionGroup>
  <Accordion title="APIs">
    The provider shall use open and published APIs to ensure support for interoperability between components and to facilitate migrating applications.

    Yes, We comply.
  </Accordion>

  <Accordion title="Data Request">
    All structured and unstructured data shall be available to the customer and provided to them upon request in an industry-standard format (e.g., .doc, .xls, .pdf, logs, and flat files)

    Yes, We comply.
  </Accordion>

  <Accordion title="Policy and Legal">
    Policies, procedures, and mutually-agreed upon provisions and/or terms shall be established to satisfy customer (tenant) requirements for service-to-service application (API) and information processing interoperability, and portability for application development and information exchange, usage, and integrity persistence.

    Yes, We comply.
  </Accordion>

  <Accordion title="Standardized Network Protocols">
    The provider shall use secure (e.g., non-clear text and authenticated) standardized network protocols for the import and export of data and to manage the service, and shall make available a document to consumers (tenants) detailing the relevant interoperability and portability standards that are involved.

    Yes, We comply.
  </Accordion>

  <Accordion title="Virtualization">
    The provider shall use an industry-recognized virtualization platform and standard virtualization formats (e.g., OVF) to help ensure interoperability, and shall have documented custom changes made to any hypervisor in use and all solution-specific virtualization hooks available for customer review.

    Yes, We comply.
  </Accordion>
</AccordionGroup>

***

## Mobile Security

<AccordionGroup>
  <Accordion title="Anti-Malware">
    Anti-malware awareness training, specific to mobile devices, shall be included in the provider's information security awareness training.

    We are complied with this - We provide information security awareness training
  </Accordion>

  <Accordion title="Application Stores">
    A documented list of approved application stores has been defined as acceptable for mobile devices accessing or storing provider managed data.

    We are complied with it by having Mobile device Management Policy
  </Accordion>

  <Accordion title="Approved Applications">
    The company shall have a documented policy prohibiting the installation of non-approved applications or approved applications not obtained through a pre-identified application store.

    We are complied with Mobile device Management Policy
  </Accordion>

  <Accordion title="Approved Software for BYOD">
    The BYOD policy and supporting awareness training clearly states the approved applications, application stores, and application extensions and plugins that may be used for BYOD usage.

    We are complied with it - We have BYOD policy and conducted the awareness training as per the requirements.
  </Accordion>

  <Accordion title="Awareness and Training">
    The provider shall have a documented mobile device policy that includes a documented definition for mobile devices and the acceptable usage and requirements for all mobile devices. The provider shall post and communicate the policy and requirements through the company's security awareness and training program.

    We are complied with it by having Mobile device Management Policy
  </Accordion>

  <Accordion title="Cloud Based Services">
    All cloud-based services used by the company's mobile devices or BYOD shall be pre-approved for usage and the storage of company business data.

    We have Mobile device policy and BYOD Policies in place and given the proper guidelines for usage as per the requirements.
  </Accordion>

  <Accordion title="Compatibility">
    The company shall have a documented application validation process to test for mobile device, operating system, and application compatibility issues.

    Yes, We comply.
  </Accordion>

  <Accordion title="Device Eligibility">
    The BYOD policy shall define the device and eligibility requirements to allow for BYOD usage.

    We are complied with requirements - We have well defined BYOD policy in place.
  </Accordion>

  <Accordion title="Device Inventory">
    An inventory of all mobile devices used to store and access company data shall be kept and maintained. All changes to the status of these devices (i.e., operating system and patch levels, lost or decommissioned status, and to whom the device is assigned or approved for usage (BYOD)) will be included for each device in the inventory.

    We are complied with the requrements.
  </Accordion>

  <Accordion title="Device Management">
    A centralized, mobile device management solution shall be deployed to all mobile devices permitted to store, transmit, or process customer data.

    We do not have a centralized mobile device management solution but having control via Google workspace admin console on the Mobile devices.
  </Accordion>

  <Accordion title="Encryption">
    The mobile device policy shall require the use of encryption either for the entire device or for data identified as sensitive on all mobile devices and shall be enforced through technology controls.

    We are complied with the requrements.
  </Accordion>

  <Accordion title="Jailbreaking and Rooting">
    The mobile device policy shall prohibit the circumvention of built-in security controls on mobile devices (e.g. jailbreaking or rooting) and shall enforce the prohibition through detective and preventative controls on the device or through a centralized device management system (e.g. mobile device management).

    We are complied with the requrements.
  </Accordion>

  <Accordion title="Legal">
    The BYOD policy includes clarifying language for the expectation of privacy, requirements for litigation, e-discovery, and legal holds. The BYOD policy shall clearly state the expectations regarding the loss of non-company data in the case a wipe of the device is required.

    We are complied with the requrements.
  </Accordion>

  <Accordion title="Lockout Screen">
    BYOD and/or company-owned devices are configured to require an automatic lockout screen, and the requirement shall be enforced through technical controls.

    We are complied with the requrements.
  </Accordion>

  <Accordion title="Operating Systems">
    Changes to mobile device operating systems, patch levels, and/or applications shall be managed through the company's change management processes.

    We are complied with the requrements.
  </Accordion>

  <Accordion title="Passwords">
    Password policies, applicable to mobile devices, shall be documented and enforced through technical controls on all company devices or devices approved for BYOD usage, and shall prohibit the changing of password/PIN lengths and authentication requirements.

    We are complied with the requrements.
  </Accordion>

  <Accordion title="Policy">
    The mobile device policy shall require the BYOD user to perform backups of data, prohibit the usage of unapproved application stores, and require the use of anti-malware software (where supported).

    We are complied with the requrements.
  </Accordion>

  <Accordion title="Remote Wipe">
    All mobile devices permitted for use through the company BYOD program or a company-assigned mobile device shall allow for remote wipe by the company's corporate IT or shall have all company-provided data wiped by the company's corporate IT.

    We are complied with the requrements.
  </Accordion>

  <Accordion title="Security Patches">
    Mobile devices connecting to corporate networks, or storing and accessing company information, shall allow for remote software version/patch validation. All mobile devices shall have the latest available security-related patches installed upon general release by the device manufacturer or carrier and authorized IT personnel shall be able to perform these updates remotely.

    We are complied with the requrements. We have defined in the policy that Devices must be kept up to date with manufacturer or network provided patches.
  </Accordion>

  <Accordion title="Users">
    The BYOD policy shall clarify the systems and servers allowed for use or access on a BYOD-enabled device.

    We are complied with the requrements.
  </Accordion>
</AccordionGroup>

***

## Security Incident Management, E-Discovery & Cloud Forensics

<AccordionGroup>
  <Accordion title="Contact / Authority Maintenance">
    Points of contact for applicable regulation authorities, national and local law enforcement, and other legal jurisdictional authorities shall be maintained and regularly updated (e.g., change in impacted-scope and/or a change in any compliance obligation) to ensure direct compliance liaisons have been established and to be prepared for a forensic investigation requiring rapid engagement with law enforcement.

    We are complied with the requrements.
  </Accordion>

  <Accordion title="Incident Management">
    Policies and procedures shall be established, and supporting business processes and technical measures implemented, to triage security-related events and ensure timely and thorough incident management, as per established IT service management policies and procedures.

    We are complied with the requrements. We also have incident management plan in place and taken care by Information security team.
  </Accordion>

  <Accordion title="Incident Reporting">
    Workforce personnel and external business relationships shall be informed of their responsibilities and, if required, shall consent and/or contractually agree to report all information security events in a timely manner. Information security events shall be reported through predefined communications channels in a timely manner adhering to applicable legal, statutory, or regulatory compliance obligations.

    We are complied with it - We have an conyratcs and SLA/MSA and all the external parties have signed the NDA as well.
  </Accordion>

  <Accordion title="Incident Response Legal Preparation">
    Proper forensic procedures, including chain of custody, are required for the presentation of evidence to support potential legal action subject to the relevant jurisdiction after an information security incident. Upon notification, customers and/or other external business partners impacted by a security breach shall be given the opportunity to participate as is legally permissible in the forensic investigation.

    Yes, We comply.
  </Accordion>

  <Accordion title="Incident Response Metrics">
    Mechanisms shall be put in place to monitor and quantify the types, volumes, and costs of information security incidents.

    We have Security Incident Management plan and communicated to all the employees.
  </Accordion>
</AccordionGroup>

***

## Supply Chain Management, Transparency and Accountability

<AccordionGroup>
  <Accordion title="Data Quality and Integrity">
    Providers shall inspect, account for, and work with their cloud supply-chain partners to correct data quality errors and associated risks. Providers shall design and implement controls to mitigate and contain data security risks through proper separation of duties, role-based access, and least-privilege access for all personnel within their supply chain.

    Yes, We comply.
  </Accordion>

  <Accordion title="Incident Reporting">
    The provider shall make security incident information available to all affected customers and providers periodically through electronic methods (e.g. portals).

    Yes, We comply.
  </Accordion>

  <Accordion title="Network / Infrastructure Services">
    Business-critical or customer (tenant) impacting (physical and virtual) application and system-system interface (API) designs and configurations, and infrastructure network and systems components, shall be designed, developed, and deployed in accordance with mutually agreed-upon service and capacity-level expectations, as well as IT governance and service management policies and procedures.

    Yes, We comply.
  </Accordion>

  <Accordion title="Provider Internal Assessments">
    The provider shall perform annual internal assessments of conformance to, and effectiveness of, its policies, procedures, and supporting measures and metrics.

    We perform annual internal assessments of conformance to, and effectiveness of, its policies, procedures, and supporting measures and metrics.
  </Accordion>

  <Accordion title="Supply Chain Agreements">
    Supply chain agreements (e.g., SLAs) between providers and customers (tenants) shall incorporate at least the following mutually-agreed upon provisions and/or terms: • Scope of business relationship and services offered • Information security requirements, provider and customer (tenant) primary points of contact for the duration of the business relationship • Notification and/or pre-authorization of any changes controlled by the provider with customer (tenant) impacts • Timely notification of a security incident (or confirmed breach) to all customers (tenants) and other business relationships impacted • Assessment and independent verification of compliance with agreement provisions and/or terms • Expiration of the business relationship and treatment of customer (tenant) data impacted • Customer (tenant) service-to-service application (API) and data interoperability and portability requirements

    We are complied with it - We have an conyratcs and SLA/MSA and all the external parties have signed the NDA as well.
  </Accordion>

  <Accordion title="Supply Chain Governance Reviews">
    Providers shall review the risk management and governance processes of their partners so that practices are consistent and aligned to account for risks inherited from other members of that partner's cloud supply chain.

    We have Risk Management Procedures in place.
  </Accordion>

  <Accordion title="Supply Chain Metrics">
    Policies and procedures shall be implemented to ensure the consistent review of service agreements (e.g., SLAs) between providers and customers (tenants) across the relevant supply chain (upstream/downstream). Reviews shall performed at least annually and identity non-conformance to established agreements. The reviews should result in actions to address service-level conflicts or inconsistencies resulting from disparate supplier relationships.

    We review the SLA/MSA and NDA with external parties annually.
  </Accordion>

  <Accordion title="Third Party Assessment">
    Providers shall assure reasonable information security across their information supply chain by performing an annual review. The review shall include all partners/third party-providers upon which their information supply chain depends on.

    We review the SLA/MSA and NDA with external parties annually.
  </Accordion>

  <Accordion title="Third Party Audits">
    Third-party service providers shall demonstrate compliance with information security and confidentiality, access control, service definitions, and delivery level agreements included in third-party contracts. Third-party reports, records, and services shall undergo audit and review at least annually to govern and maintain compliance with the service delivery agreements.

    We have ISMS framework including all the required polcieis and procedures as per the compliance requirements.
  </Accordion>
</AccordionGroup>

***

## Threat and Vulnerability Management

<AccordionGroup>
  <Accordion title="Anti-Virus / Malicious Software">
    Policies and procedures shall be established, and supporting business processes and technical measures implemented, to prevent the execution of malware on organizationally-owned or managed user end-point devices (i.e., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.

    We conduct Vulnerability assessment and Penetration testing on a timely interval and have controls on Anti-Virus / Malicious Software throgh End point security.
  </Accordion>

  <Accordion title="Vulnerability / Patch Management">
    Policies and procedures shall be established, and supporting processes and technical measures implemented, for timely detection of vulnerabilities within organizationally-owned or managed applications, infrastructure network and system components (e.g. network vulnerability assessment, penetration testing) to ensure the efficiency of implemented security controls. A risk-based model for prioritizing remediation of identified vulnerabilities shall be used. Changes shall be managed through a change management process for all vendor-supplied patches, configuration changes, or changes to the organization's internally developed software. Upon request, the provider informs customer (tenant) of policies and procedures and identfied weaknesses especially if customer (tenant) data is used as part the service and/or customer (tenant) has some shared responsibility over implementation of control.

    We conduct Vulnerability assessment and Penetration testing on a timely interval and have controls on Anti-Virus / Malicious Software throgh End point security.
  </Accordion>

  <Accordion title="Mobile Code">
    Policies and procedures shall be established, and supporting business processes and technical measures implemented, to prevent the execution of unauthorized mobile code, defined as software transferred between systems over a trusted or untrusted network and executed on a local system without explicit installation or execution by the recipient, on organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.

    We have Threat and Vulnerabilities Management procedure and we conduct Vulnerability assessment and Penetration testing through an athorised vendor.
  </Accordion>
</AccordionGroup>

## Application & Interface Security

<AccordionGroup>
  <Accordion title="Application Security">
    Applications and programming interfaces (APIs) shall be designed, developed, deployed, and tested in accordance with leading industry standards (e.g., OWASP for web applications) and adhere to applicable legal, statutory, or regulatory compliance obligations.

    Yes, we ensure the same as part of our code review, static code analysis and Web Application Firewall.
  </Accordion>

  <Accordion title="Customer Access Requirements">
    Prior to granting customers access to data, assets, and information systems, identified security, contractual, and regulatory requirements for customer access shall be addressed.

    Yes, we provide API access only to vendors and systems authorized by the customer.
  </Accordion>

  <Accordion title="Data Integrity">
    Data input and output integrity routines (i.e., reconciliation and edit checks) shall be implemented for application interfaces and databases to prevent manual or systematic processing errors, corruption of data, or misuse.

    Yes, we follow multi layer application architecture to isolate database access
  </Accordion>

  <Accordion title="Data Security / Integrity">
    Policies and procedures shall be established and maintained in support of data security to include (confidentiality, integrity and availability) across multiple system interfaces, jurisdictions and business functions to prevent improper disclosure, alteration, or destruction.

    Complied with the requirement - We have Information security policy in place and working effectively
  </Accordion>
</AccordionGroup>

***

## Audit Assurance & Compliance

<AccordionGroup>
  <Accordion title="Audit Planning">
    Audit plans shall be developed and maintained to address business process disruptions. Auditing plans shall focus on reviewing the effectiveness of the implementation of security operations. All audit activities must be agreed upon prior to executing any audits.

    Complied with the requirement - We are conducting the Internal and External Audit as per the requirement and focus on the evaluation of the effectiveness security controls
  </Accordion>

  <Accordion title="Independent Audits">
    Independent reviews and assessments shall be performed at least annually to ensure that the organization addresses nonconformities of established policies, standards, procedures, and compliance obligations.

    Complied with the requirement - reviews and assessments has been performed annually.
  </Accordion>

  <Accordion title="Information System Regulatory Mapping">
    Organizations shall create and maintain a control framework which captures standards, regulatory, legal, and statutory requirements relevant for their business needs. The control framework shall be reviewed at least annually to ensure changes that could affect the business processes are reflected.

    We are complied with the requirement - Information security team is reviewing the requirements at least annually to ensure changes that could affect the business processes are reflected.
  </Accordion>
</AccordionGroup>

***

## Business Continuity Management & Operational Resilience

<AccordionGroup>
  <Accordion title="Business Continuity Planning">
    A consistent unified framework for business continuity planning and plan development shall be established, documented and adopted to ensure all business continuity plans are consistent in addressing priorities for testing, maintenance, and information security requirements. Requirements for business continuity plans include the following: • Defined purpose and scope, aligned with relevant dependencies • Accessible to and understood by those who will use them • Owned by a named person(s) who is responsible for their review, update, and approval • Defined lines of communication, roles, and responsibilities • Detailed recovery procedures, manual work-around, and reference information • Method for plan invocation

    We are complied with the requirement -We have Business continuity plan and procedure which is approved by the Management and tested annually once as per the compliance requirements.
  </Accordion>

  <Accordion title="Business Continuity Testing">
    Business continuity and security incident response plans shall be subject to testing at planned intervals or upon significant organizational or environmental changes. Incident response plans shall involve impacted customers (tenant) and other business relationships that represent critical intra-supply chain business process dependencies.

    We are complied with the requirement -We have Business continuity plan and procedure which is approved by the Management and tested annually once as per the compliance requirements.
  </Accordion>

  <Accordion title="Datacenter Utilities / Environmental Conditions">
    Datacenter utilities services and environmental conditions (e.g., water, power, temperature and humidity controls, telecommunications,and internet connectivity) shall be secured, monitored, maintained, and tested for continual effectiveness at planned intervals to ensure protection from unauthorized interception or damage, and designed with automated fail-over or other redundancies in the event of planned or unplanned disruptions.

    Yes, we use Amazon Web Services (AWS) as our CSP, and they provide the same.
  </Accordion>

  <Accordion title="Documentation">
    Information system documentation (e.g., administrator and user guides, and architecture diagrams) shall be made available to authorized personnel to ensure the following: • Configuring, installing, and operating the information system • Effectively using the system's security features

    Yes, we have such documentation
  </Accordion>

  <Accordion title="Environmental Risks">
    Physical protection against damage from natural causes and disasters, as well as deliberate attacks, including fire, flood, atmospheric electrical discharge, solar induced geomagnetic storm, wind, earthquake, tsunami, explosion, nuclear accident, volcanic activity, biological hazard, civil unrest, mudslide, tectonic activity, and other forms of natural or man-made disaster shall be anticipated, designed, and have countermeasures applied.

    We are complied with the requirement . We have Physical and Environmental Security Procedure in place and effectively working
  </Accordion>

  <Accordion title="Equipment Location">
    To reduce the risks from environmental threats, hazards, and opportunities for unauthorized access, equipment shall be kept away from locations subject to high probability environmental risks and supplemented by redundant equipment located at a reasonable distance.

    We are complied with the requirement
  </Accordion>

  <Accordion title="Equipment Maintenance">
    Policies and procedures shall be established, and supporting business processes and technical measures implemented, for equipment maintenance ensuring continuity and availability of operations and support personnel.

    Yes. We follow this and complied with the requirement
  </Accordion>

  <Accordion title="Equipment Power Failures">
    Protection measures shall be put into place to react to natural and man-made threats based upon a geographically-specific Business Impact Assessment

    We are complied with the requirement . We have Physical and Environmental Security Procedure in place and effectively working
  </Accordion>

  <Accordion title="Impact Analysis">
    There shall be a defined and documented method for determining the impact of any disruption to the organization (cloud provider, cloud consumer) that must incorporate the following: • Identify critical products and services • Identify all dependencies, including processes, applications, business partners, and third party service providers • Understand threats to critical products and services • Determine impacts resulting from planned or unplanned disruptions and how these vary over time • Establish the maximum tolerable period for disruption • Establish priorities for recovery • Establish recovery time objectives for resumption of critical products and services within their maximum tolerable period of disruption • Estimate the resources required for resumption

    We are complied with the requirement as per the Business continuity plan and procedure.
  </Accordion>

  <Accordion title="Policy">
    Policies and procedures shall be established, and supporting business processes and technical measures implemented, for appropriate IT governance and service management to ensure appropriate planning, delivery and support of the organization's IT capabilities supporting business functions, workforce, and/or customers based on industry acceptable standards (i.e., ITIL v4 and COBIT 5). Additionally, policies and procedures shall include defined roles and responsibilities supported by regular workforce training.

    Yes. We have the policies and procedures in place for approproate IT Governance and service management.
  </Accordion>

  <Accordion title="Retention Policy">
    Policies and procedures shall be established, and supporting business processes and technical measures implemented, for defining and adhering to the retention period of any critical asset as per established policies and procedures, as well as applicable legal, statutory, or regulatory compliance obligations. Backup and recovery measures shall be incorporated as part of business continuity planning and tested accordingly for effectiveness.

    We are complied with the requirement. We have data protection policy.
  </Accordion>
</AccordionGroup>

***

## Change Control & Configuration Management

<AccordionGroup>
  <Accordion title="New Development / Acquisition">
    Policies and procedures shall be established, and supporting business processes and technical measures implemented, to ensure the development and/or acquisition of new data, physical or virtual applications, infrastructure network and systems components, or any corporate, operations and/or datacenter facilities have been pre-authorized by the organization's business leadership or other accountable business role or function.

    We are complied with the requirement
  </Accordion>

  <Accordion title="Outsourced Development">
    External business partners shall adhere to the same policies and procedures for change management, release, and testing as internal developers within the organization (e.g. ITIL service management processes).

    Yes, we comply
  </Accordion>

  <Accordion title="Quality Testing">
    Organization shall follow a defined quality change control and testing process (e.g. ITIL Service Management) with established baselines, testing, and release standards that focus on system availability, confidentiality, and integrity of systems and services.

    Yes, we comply
  </Accordion>

  <Accordion title="Unauthorized Software Installations">
    Policies and procedures shall be established, and supporting business processes and technical measures implemented, to restrict the installation of unauthorized software on organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.

    We are complied with the requirement - We have installed End point security in users devices.
  </Accordion>

  <Accordion title="Production Changes">
    Policies and procedures shall be established for managing the risks associated with applying changes to: • business-critical or customer (tenant)-impacting (physical and virtual) applications and system-system interface (API) designs and configurations • infrastructure network and systems components Technical measures shall be implemented to provide assurance that all changes directly correspond to a registered change request, business-critical or customer (tenant) , and/or authorization by, the customer (tenant) as per agreement (SLA) prior to deployment.

    Yes, we follow such a CM process.
  </Accordion>
</AccordionGroup>

***

## Data Security & Information Lifecycle Management

<AccordionGroup>
  <Accordion title="Classification">
    Data and objects containing data shall be assigned a classification by the data owner based on data type, value, sensitivity, and criticality to the organization.

    Yes, We comply
  </Accordion>

  <Accordion title="Data Inventory / Flows">
    Policies and procedures shall be established to inventory, document, and maintain data flows for data that is resident (permanently or temporarily) within the service's applications and infrastructure network and systems. In particular, providers shall ensure that data that is subject to geographic residency requirements not be migrated beyond its defined bounds.

    Yes, We comply
  </Accordion>

  <Accordion title="eCommerce Transactions">
    Data related to electronic commerce (e-commerce) that traverses public networks shall be appropriately classified and protected from fraudulent activity, unauthorized disclosure, or modification in such a manner to prevent contract dispute and compromise of data.

    Yes, We comply
  </Accordion>

  <Accordion title="Handling / Labeling / Security Policy">
    Policies and procedures shall be established for the labeling, handling, and security of data and objects which contain data. Mechanisms for label inheritance shall be implemented for objects that act as aggregate containers for data.

    We are complied with the requirements with regards to data handling/Labeling/clasification
  </Accordion>

  <Accordion title="Non-Production Data">
    Production data shall not be replicated or used in non-production environments.

    Yes, We dont use LIVE data in any other environment.
  </Accordion>

  <Accordion title="Ownership / Stewardship">
    All data shall be designated with stewardship, with assigned responsibilities defined, documented, and communicated.

    Yes, We comply
  </Accordion>

  <Accordion title="Secure Disposal">
    Any use of customer data in non-production environments requires explicit, documented approval from all customers whose data is affected, and must comply with all legal and regulatory requirements for scrubbing of sensitive data elements.

    Yes, We comply
  </Accordion>
</AccordionGroup>

***

## Datacenter Security

<AccordionGroup>
  <Accordion title="Asset Management">
    Assets must be classified in terms of business criticality, service-level expectations, and operational continuity requirements. A complete inventory of business-critical assets located at all sites and/or geographical locations and their usage over time shall be maintained and updated regularly, and assigned ownership by defined roles and responsibilities.

    Yes, We comply
  </Accordion>

  <Accordion title="Controlled Access Points">
    Physical security perimeters (e.g., fences, walls, barriers, guards, gates, electronic surveillance, physical authentication mechanisms, reception desks, and security patrols) shall be implemented to safeguard sensitive data and information systems.

    Yes, We comply. Our CSP(AWS) provides the same.
  </Accordion>

  <Accordion title="Equipment Identification">
    Automated equipment identification shall be used as a method of connection authentication. Location-aware technologies may be used to validate connection authentication integrity based on known equipment location.

    Yes, We comply. Our CSP(AWS) provides the same.
  </Accordion>

  <Accordion title="Off-Site Authorization">
    Authorization must be obtained prior to relocation or transfer of hardware, software, or data to an offsite premises.

    We are complied - As per the Information security policy and Media protection procedure.
  </Accordion>

  <Accordion title="Off-Site Equipment">
    Policies and procedures shall be established for the secure disposal of equipment (by asset type) used outside the organization's premises. This shall include a wiping solution or destruction process that renders recovery of information impossible. The erasure shall consist of a full overwrite of the drive to ensure that the erased drive is released to inventory for reuse and deployment, or securely stored until it can be destroyed.

    We are complied. We have Asset Management Procedure
  </Accordion>

  <Accordion title="Policy">
    Policies and procedures shall be established, and supporting business processes implemented, for maintaining a safe and secure working environment in offices, rooms, facilities, and secure areas storing sensitive information.

    We are complied. Physical and Environmental Security Procedure
  </Accordion>

  <Accordion title="Secure Area Authorization">
    Ingress and egress to secure areas shall be constrained and monitored by physical access control mechanisms to ensure that only authorized personnel are allowed access.

    We are complied. We have Physical and Environmental Security Procedure
  </Accordion>

  <Accordion title="Unauthorized Persons Entry">
    Ingress and egress points such as service areas and other points where unauthorized personnel may enter the premises shall be monitored, controlled and, if possible, isolated from data storage and processing facilities to prevent unauthorized data corruption, compromise, and loss.

    We are complied. We have Physical and Environmental Security Procedure and we are monitoring the office building via CCTV cameras.
  </Accordion>

  <Accordion title="User Access">
    Physical access to information assets and functions by users and support personnel shall be restricted.

    We are complied. We have Physical and Environmental Security Procedure in place and provided the access card to the users to restrict the specific areas.
  </Accordion>
</AccordionGroup>

***

## Encryption & Key Management

<AccordionGroup>
  <Accordion title="Entitlement">
    Keys must have identifiable owners (binding keys to identities) and there shall be key management policies.

    Yes, We comply.
  </Accordion>

  <Accordion title="Key Generation">
    Policies and procedures shall be established for the management of cryptographic keys in the service's cryptosystem (e.g., lifecycle management from key generation to revocation and replacement, public key infrastructure, cryptographic protocol design and algorithms used, access controls in place for secure key generation, and exchange and storage including segregation of keys used for encrypted data or sessions). Upon request, provider shall inform the customer (tenant) of changes within the cryptosystem, especially if the customer (tenant) data is used as part of the service, and/or the customer (tenant) has some shared responsibility over implementation of the control.

    Yes, We comply.
  </Accordion>

  <Accordion title="Sensitive Data Protection">
    Policies and procedures shall be established, and supporting business processes and technical measures implemented, for the use of encryption protocols for protection of sensitive data in storage (e.g., file servers, databases, and end-user workstations), data in use (memory), and data in transmission (e.g., system interfaces, over public networks, and electronic messaging) as per applicable legal, statutory, and regulatory compliance obligations.

    Yes, We comply.
  </Accordion>

  <Accordion title="Storage and Access">
    Platform and data-appropriate encryption (e.g., AES-256) in open/validated formats and standard algorithms shall be required. Keys shall not be stored in the cloud (i.e. at the cloud provider in question), but maintained by the cloud consumer or trusted key management provider. Key management and key usage shall be separated duties.

    Yes, we use AES256 for data at rest.
  </Accordion>
</AccordionGroup>

***

## Governance and Risk Management

<AccordionGroup>
  <Accordion title="Baseline Requirements">
    Baseline security requirements shall be established for developed or acquired, organizationally-owned or managed, physical or virtual, applications and infrastructure system and network components that comply with applicable legal, statutory and regulatory compliance obligations. Deviations from standard baseline configurations must be authorized following change management policies and procedures prior to deployment, provisioning, or use. Compliance with security baseline requirements must be reassessed at least annually unless an alternate frequency has been established and authorized based on business need.

    We are complied with this - We have Compliance Procedure in place and reviewed by the management annually
  </Accordion>

  <Accordion title="Data Focus Risk Assessments">
    Risk assessments associated with data governance requirements shall be conducted at planned intervals and shall consider the following: • Awareness of where sensitive data is stored and transmitted across applications, databases, servers, and network infrastructure • Compliance with defined retention periods and end-of-life disposal requirements • Data classification and protection from unauthorized use, access, loss, destruction, and falsification

    We are complied - We have Risk Management Procedure and Data classification policy to protect unauthorized use, access, loss, destruction, and falsification
  </Accordion>

  <Accordion title="Management Oversight">
    Managers are responsible for maintaining awareness of, and complying with, security policies, procedures, and standards that are relevant to their area of responsibility.

    We are complied - we provied information security awareness training to all the employees annually once we per the ISMS requirements.
  </Accordion>

  <Accordion title="Management Program">
    An Information Security Management Program (ISMP) shall be developed, documented, approved, and implemented that includes administrative, technical, and physical safeguards to protect assets and data from loss, misuse, unauthorized access, disclosure, alteration, and destruction. The security program shall include, but not be limited to, the following areas insofar as they relate to the characteristics of the business: • Risk management • Security policy • Organization of information security • Asset management • Human resources security • Physical and environmental security • Communications and operations management • Access control • Information systems acquisition, development, and maintenance

    We are complied with the requirements - We have Information security management framework consisted of all the required policies and procedures. For ex - Risk management • Security policy • Organization of information security • Asset management • Human resources security • Physical and environmental security • Communications and operations management • Access control policy etc....
  </Accordion>

  <Accordion title="Management Support/Involvement">
    Executive and line management shall take formal action to support information security through clearly-documented direction and commitment, and shall ensure the action has been assigned.

    We are complied - The management is reviewing the performance if the Information Security department and taking necessing actions and providing the recommondation on a timely basis. And all the ISMS policies has been reviewed and approved by the management yearly once as per the requirements.
  </Accordion>

  <Accordion title="Policy">
    Information security policies and procedures shall be established and made readily available for review by all impacted personnel and external business relationships. Information security policies must be authorized by the organization's business leadership (or other accountable business role or function) and supported by a strategic business plan and an information security management program inclusive of defined information security roles and responsibilities for business leadership.

    We are complied. We have all the required ISMS policies and procedures in place.
  </Accordion>

  <Accordion title="Policy Enforcement">
    A formal disciplinary or sanction policy shall be established for employees who have violated security policies and procedures. Employees shall be made aware of what action might be taken in the event of a violation, and disciplinary measures must be stated in the policies and procedures.

    We have Desciplinary policy in place and created an awareness among employees regarding voilation of the polciies via ISMS training.
  </Accordion>

  <Accordion title="Policy Impact on Risk Assessments">
    Risk assessment results shall include updates to security policies, procedures, standards, and controls to ensure that they remain relevant and effective.

    We have Risk Management Procedure as per the requirement. We are complied.
  </Accordion>

  <Accordion title="Policy Reviews">
    The organization's business leadership (or other accountable business role or function) shall review the information security policy at planned intervals or as a result of changes to the organization to ensure its continuing alignment with the security strategy, effectiveness, accuracy, relevance, and applicability to legal, statutory, or regulatory compliance obligations.

    We are complied with the requirements - The management is reviewing the performance if the Information Security department and taking necessing actions and providing the recommondation on a timely basis.
  </Accordion>

  <Accordion title="Risk Assessments">
    Aligned with the enterprise-wide framework, formal risk assessments shall be performed at least annually or at planned intervals, (and in conjunction with any changes to information systems) to determine the likelihood and impact of all identified risks using qualitative and quantitative methods. The likelihood and impact associated with inherent and residual risk shall be determined independently, considering all risk categories (e.g., audit results, threat and vulnerability analysis, and regulatory compliance).

    We are conducting Risk assessment at least once in a year as per the ISMS requirements.
  </Accordion>

  <Accordion title="Risk Management Framework">
    Risks shall be mitigated to an acceptable level. Acceptance levels based on risk criteria shall be established and documented in accordance with reasonable resolution time frames and stakeholder approval.

    Risk criteria has been established as per the Risk management procedure and consuct risk assessment once in a year as per the compliance requirements.
  </Accordion>
</AccordionGroup>

***

## Human Resources

<AccordionGroup>
  <Accordion title="Asset Returns">
    Upon termination of workforce personnel and/or expiration of external business relationships, all organizationally-owned assets shall be returned within an established period.

    We are complied as a part of offboarding procedure.
  </Accordion>

  <Accordion title="Background Screening">
    Pursuant to local laws, regulations, ethics, and contractual constraints, all employment candidates, contractors, and third parties shall be subject to background verification proportional to the data classification to be accessed, the business requirements, and acceptable risk.

    We conduct background verification as per the compliance requirements and kept all the required data.
  </Accordion>

  <Accordion title="Employment Agreements">
    Employment agreements shall incorporate provisions and/or terms for adherence to established information governance and security policies and must be signed by newly hired or on-boarded workforce personnel (e.g., full or part-time employee or contingent staff) prior to granting workforce personnel user access to corporate facilities, resources, and assets.

    We are complied with it. Also all the employees have signed for the Non disclosure agreements.
  </Accordion>

  <Accordion title="Employment Termination">
    Roles and responsibilities for performing employment termination or change in employment procedures shall be assigned, documented, and communicated.

    We are complied - Roles, Responsibilities & Authorities has been defined and communicated to the respective individials.
  </Accordion>

  <Accordion title="Mobile Device Management">
    Policies and procedures shall be established, and supporting business processes and technical measures implemented, to manage business risks associated with permitting mobile device access to corporate resources and may require the implementation of higher assurance compensating controls and acceptable-use policies and procedures (e.g., mandated security training, stronger identity, entitlement and access controls, and device monitoring).

    We are complied - We have mobile device management polciy.
  </Accordion>

  <Accordion title="Non-Disclosure Agreements">
    Requirements for non-disclosure or confidentiality agreements reflecting the organization's needs for the protection of data and operational details shall be identified, documented, and reviewed at planned intervals.

    We have non-disclosure or confidentiality agreements and signed by all the employees and external parties.
  </Accordion>

  <Accordion title="Roles / Responsibilities">
    Roles and responsibilities of contractors, employees, and third-party users shall be documented as they relate to information assets and security.

    We are complied - Roles, Responsibilities & Authorities has been defined and communicated to the respective individials.
  </Accordion>

  <Accordion title="Technology Acceptable Use">
    Policies and procedures shall be established, and supporting business processes and technical measures implemented, for defining allowances and conditions for permitting usage of organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components. Additionally, defining allowances and conditions to permit usage of personal mobile devices and associated applications with access to corporate resources (i.e., BYOD) shall be considered and incorporated as appropriate.

    We are complied with the requirement - We have controls in place through policies and procedure.
  </Accordion>

  <Accordion title="Training / Awareness">
    A security awareness training program shall be established for all contractors, third-party users, and employees of the organization and mandated when appropriate. All individuals with access to organizational data shall receive appropriate awareness training and regular updates in organizational procedures, processes, and policies relating to their professional function relative to the organization.

    we are complied - We provide Information security awareness traning to all the employees and contractors, third-party users.
  </Accordion>

  <Accordion title="User Responsibility">
    All personnel shall be made aware of their roles and responsibilities for: • Maintaining awareness and compliance with established policies and procedures and applicable legal, statutory, or regulatory compliance obligations. • Maintaining a safe and secure working environment

    We are complied - We have Roles, Responsibilities & Authorities policy in place as per the compliance requirements.
  </Accordion>

  <Accordion title="Workspace">
    Policies and procedures shall be established to require that unattended workspaces do not have openly visible (e.g., on a desktop) sensitive documents and user computing sessions are disabled after an established period of inactivity.

    we are complied - we have an access control policy and IT Team have implemented accounts lockout policy to safeguard the sestive documents and personal information.
  </Accordion>
</AccordionGroup>

***

## Identity & Access Management

<AccordionGroup>
  <Accordion title="Audit Tools Access">
    Access to, and use of, audit tools that interact with the organization's information systems shall be appropriately segmented and restricted to prevent compromise and misuse of log data.

    Yes, We comply.
  </Accordion>

  <Accordion title="Credential Lifecycle / Provision Management">
    User access policies and procedures shall be established, and supporting business processes and technical measures implemented, for ensuring appropriate identity, entitlement, and access management for all internal corporate and customer (tenant) users with access to data and organizationally-owned or managed (physical and virtual) application interfaces and infrastructure network and systems components. These policies, procedures, processes, and measures must incorporate the following: • Procedures and supporting roles and responsibilities for provisioning and de-provisioning user account entitlements following the rule of least privilege based on job function • Business case considerations for higher levels of assurance and multi-factor authentication secrets • Access segmentation to sessions and data in multi-tenant architectures by any third party • Identity trust verification and service-to-service application (API) and information processing interoperability (e.g., SSO and federation) • Account credential lifecycle management from instantiation through revocation • Authentication, authorization, and accounting (AAA) rules for access to data and sessions • Adherence to applicable legal, statutory, or regulatory compliance requirements

    We are complied - Access control policy and Information security policies has been established as per the requirements. We provide an accesss to the data only to an authorised individial.
  </Accordion>

  <Accordion title="Diagnostic / Configuration Ports Access">
    User access to diagnostic and configuration ports shall be restricted to authorized individuals and applications.

    Complied with the requirements though End point security installation.
  </Accordion>

  <Accordion title="Policies and Procedures">
    Policies and procedures shall be established to store and manage identity information about every person who accesses IT infrastructure and to determine their level of access. Policies shall also be developed to control access to network resources based on user identity.

    We are complied - We have policies and procedure in place to store and manage identity information.
  </Accordion>

  <Accordion title="Segregation of Duties">
    User access policies and procedures shall be established, and supporting business processes and technical measures implemented, for restricting user access as per defined segregation of duties to address business risks associated with a user-role conflict of interest.

    We are complied - We have policies and procedure in place to have control on access of data. We provide access only to an authorised individials.
  </Accordion>

  <Accordion title="Source Code Access Restriction">
    Access to the organization's own developed applications, program, or object source code, or any other form of intellectual property (IP), and use of proprietary software shall be appropriately restricted following the rule of least privilege based on job function as per established user access policies and procedures.

    We have role based access system to make sure that only the authorised individual have an access to the required information.
  </Accordion>

  <Accordion title="Third Party Access">
    The identification, assessment, and prioritization of risks posed by business processes requiring third-party access to the organization's information systems and data shall be followed by coordinated application of resources to minimize, monitor, and measure likelihood and impact of unauthorized or inappropriate access. Compensating controls derived from the risk analysis shall be implemented prior to provisioning access.

    Yes, We comply.
  </Accordion>

  <Accordion title="Trusted Sources">
    Policies and procedures are established for permissible storage and access of identities used for authentication to ensure identities are only accessible based on rules of least privilege and replication limitation only to users explicitly defined as business necessary.

    We have role based access system to make sure that only the authorised individual have an access to the required information.
  </Accordion>

  <Accordion title="User Access Authorization">
    Provisioning user access (e.g., employees, contractors, customers (tenants), business partners and/or supplier relationships) to data and organizationally-owned or managed (physical and virtual) applications, infrastructure systems, and network components shall be authorized by the organization's management prior to access being granted and appropriately restricted as per established policies and procedures. Upon request, provider shall inform customer (tenant) of this user access, especially if customer (tenant) data is used as part the service and/or customer (tenant) has some shared responsibility over implementation of control.

    We have role based access system to make sure that only the authorised individual have an access to the required information.
  </Accordion>

  <Accordion title="User Access Reviews">
    User access shall be authorized and revalidated for entitlement appropriateness, at planned intervals, by the organization's business leadership or other accountable business role or function supported by evidence to demonstrate the organization is adhering to the rule of least privilege based on job function. For identified access violations, remediation must follow established user access policies and procedures.

    We have role based access system through access control policy to make sure that only the authorised individual have an access to the required information.
  </Accordion>

  <Accordion title="User Access Revocation">
    Timely de-provisioning (revocation or modification) of user access to data and organizationally-owned or managed (physical and virtual) applications, infrastructure systems, and network components, shall be implemented as per established policies and procedures and based on user's change in status (e.g., termination of employment or other business relationship, job change or transfer). Upon request, provider shall inform customer (tenant) of these changes, especially if customer (tenant) data is used as part the service and/or customer (tenant) has some shared responsibility over implementation of control.

    We have change management policy and Infrastructure Change Control Procedure to comply with this requirements.
  </Accordion>

  <Accordion title="User ID Credentials">
    Internal corporate or customer (tenant) user account credentials shall be restricted as per the following, ensuring appropriate identity, entitlement, and access management and in accordance with established policies and procedures: • Identity trust verification and service-to-service application (API) and information processing interoperability (e.g., SSO and Federation) • Account credential lifecycle management from instantiation through revocation • Account credential and/or identity store minimization or re-use when feasible • Adherence to industry acceptable and/or regulatory compliant authentication, authorization, and accounting (AAA) rules (e.g., strong/multi-factor, expireable, non-shared authentication secrets)

    Yes, We comply.
  </Accordion>

  <Accordion title="Utility Programs Access">
    Utility programs capable of potentially overriding system, object, network, virtual machine, and application controls shall be restricted.

    Yes, We comply.
  </Accordion>
</AccordionGroup>

***

## Infrastructure & Virtualization Security

<AccordionGroup>
  <Accordion title="Audit Logging / Intrusion Detection">
    Higher levels of assurance are required for protection, retention, and lifecyle management of audit logs, adhering to applicable legal, statutory or regulatory compliance obligations and providing unique user access accountability to detect potentially suspicious network behaviors and/or file integrity anomalies, and to support forensic investigative capabilities in the event of a security breach.

    Yes, We comply.
  </Accordion>

  <Accordion title="Change Detection">
    The provider shall ensure the integrity of all virtual machine images at all times. Any changes made to virtual machine images must be logged and an alert raised regardless of their running state (e.g. dormant, off, or running). The results of a change or move of an image and the subsequent validation of the image's integrity must be immediately available to customers through electronic methods (e.g. portals or alerts).

    Yes, We comply.
  </Accordion>

  <Accordion title="Clock Synchronization">
    A reliable and mutually agreed upon external time source shall be used to synchronize the system clocks of all relevant information processing systems to facilitate tracing and reconstitution of activity timelines.

    Yes, We comply.
  </Accordion>

  <Accordion title="Information System Documentation">
    The availability, quality, and adequate capacity and resources shall be planned, prepared, and measured to deliver the required system performance in accordance with legal, statutory, and regulatory compliance obligations. Projections of future capacity requirements shall be made to mitigate the risk of system overload.

    Yes, We comply.
  </Accordion>

  <Accordion title="Management - Vulnerability Management">
    Implementers shall ensure that the security vulnerability assessment tools or services accommodate the virtualization technologies used (e.g. virtualization aware).

    Yes, We comply.
  </Accordion>

  <Accordion title="Network Security">
    Network environments and virtual instances shall be designed and configured to restrict and monitor traffic between trusted and untrusted connections. These configurations shall be reviewed at least annually, and supported by a documented justification for use for all allowed services, protocols, and ports, and by compensating controls.

    Yes, We comply.
  </Accordion>

  <Accordion title="OS Hardening and Base Controls">
    Each operating system shall be hardened to provide only necessary ports, protocols, and services to meet business needs and have in place supporting technical controls such as: antivirus, file integrity monitoring, and logging as part of their baseline operating build standard or template.

    Yes, We comply.
  </Accordion>

  <Accordion title="Production / Non-Production Environments">
    Production and non-production environments shall be separated to prevent unauthorized access or changes to information assets. Separation of the environments may include: stateful inspection firewalls, domain/realm authentication sources, and clear segregation of duties for personnel accessing these environments as part of their job duties.

    Yes, We comply.
  </Accordion>

  <Accordion title="Segmentation">
    Multi-tenant organizationally-owned or managed (physical and virtual) applications, and infrastructure system and network components, shall be designed, developed, deployed and configured such that provider and customer (tenant) user access is appropriately segmented from other tenant users, based on the following considerations: • Established policies and procedures • Isolation of business critical assets and/or sensitive user data, and sessions that mandate stronger internal controls and high levels of assurance • Compliance with legal, statutory and regulatory compliance obligations

    Yes, We comply.
  </Accordion>

  <Accordion title="VM Security - vMotion Data Protection">
    Secured and encrypted communication channels shall be used when migrating physical servers, applications, or data to virtualized servers and, where possible, shall use a network segregated from production-level networks for such migrations.

    Yes, We comply.
  </Accordion>

  <Accordion title="VMM Security - Hypervisor Hardening">
    Access to all hypervisor management functions or administrative consoles for systems hosting virtualized systems shall be restricted to personnel based upon the principle of least privilege and supported through technical controls (e.g., two-factor authentication, audit trails, IP address filtering, firewalls, and TLS encapsulated communications to the administrative consoles).

    Yes, We comply.
  </Accordion>

  <Accordion title="Wireless Security">
    Policies and procedures shall be established, and supporting business processes and technical measures implemented, to protect wireless network environments, including the following: • Perimeter firewalls implemented and configured to restrict unauthorized traffic • Security settings enabled with strong encryption for authentication and transmission, replacing vendor default settings (e.g., encryption keys, passwords, and SNMP community strings) • User access to wireless network devices restricted to authorized personnel • The capability to detect the presence of unauthorized (rogue) wireless network devices for a timely disconnect from the network

    Yes, We comply.
  </Accordion>

  <Accordion title="Network Architecture">
    Network architecture diagrams shall clearly identify high-risk environments and data flows that may have legal compliance impacts. Technical measures shall be implemented and shall apply defense-in-depth techniques (e.g., deep packet analysis, traffic throttling, and black-holing) for detection and timely response to network-based attacks associated with anomalous ingress or egress traffic patterns (e.g., MAC spoofing and ARP poisoning attacks) and/or distributed denial-of-service (DDoS) attacks.

    Yes, We comply.
  </Accordion>
</AccordionGroup>

***

## Interoperability & Portability

<AccordionGroup>
  <Accordion title="APIs">
    The provider shall use open and published APIs to ensure support for interoperability between components and to facilitate migrating applications.

    Yes, We comply.
  </Accordion>

  <Accordion title="Data Request">
    All structured and unstructured data shall be available to the customer and provided to them upon request in an industry-standard format (e.g., .doc, .xls, .pdf, logs, and flat files)

    Yes, We comply.
  </Accordion>

  <Accordion title="Policy and Legal">
    Policies, procedures, and mutually-agreed upon provisions and/or terms shall be established to satisfy customer (tenant) requirements for service-to-service application (API) and information processing interoperability, and portability for application development and information exchange, usage, and integrity persistence.

    Yes, We comply.
  </Accordion>

  <Accordion title="Standardized Network Protocols">
    The provider shall use secure (e.g., non-clear text and authenticated) standardized network protocols for the import and export of data and to manage the service, and shall make available a document to consumers (tenants) detailing the relevant interoperability and portability standards that are involved.

    Yes, We comply.
  </Accordion>

  <Accordion title="Virtualization">
    The provider shall use an industry-recognized virtualization platform and standard virtualization formats (e.g., OVF) to help ensure interoperability, and shall have documented custom changes made to any hypervisor in use and all solution-specific virtualization hooks available for customer review.

    Yes, We comply.
  </Accordion>
</AccordionGroup>

***

## Mobile Security

<AccordionGroup>
  <Accordion title="Anti-Malware">
    Anti-malware awareness training, specific to mobile devices, shall be included in the provider's information security awareness training.

    We are complied with this - We provide information security awareness training
  </Accordion>

  <Accordion title="Application Stores">
    A documented list of approved application stores has been defined as acceptable for mobile devices accessing or storing provider managed data.

    We are complied with it by having Mobile device Management Policy
  </Accordion>

  <Accordion title="Approved Applications">
    The company shall have a documented policy prohibiting the installation of non-approved applications or approved applications not obtained through a pre-identified application store.

    We are complied with Mobile device Management Policy
  </Accordion>

  <Accordion title="Approved Software for BYOD">
    The BYOD policy and supporting awareness training clearly states the approved applications, application stores, and application extensions and plugins that may be used for BYOD usage.

    We are complied with it - We have BYOD policy and conducted the awareness training as per the requirements.
  </Accordion>

  <Accordion title="Awareness and Training">
    The provider shall have a documented mobile device policy that includes a documented definition for mobile devices and the acceptable usage and requirements for all mobile devices. The provider shall post and communicate the policy and requirements through the company's security awareness and training program.

    We are complied with it by having Mobile device Management Policy
  </Accordion>

  <Accordion title="Cloud Based Services">
    All cloud-based services used by the company's mobile devices or BYOD shall be pre-approved for usage and the storage of company business data.

    We have Mobile device policy and BYOD Policies in place and given the proper guidelines for usage as per the requirements.
  </Accordion>

  <Accordion title="Compatibility">
    The company shall have a documented application validation process to test for mobile device, operating system, and application compatibility issues.

    Yes, We comply.
  </Accordion>

  <Accordion title="Device Eligibility">
    The BYOD policy shall define the device and eligibility requirements to allow for BYOD usage.

    We are complied with requirements - We have well defined BYOD policy in place.
  </Accordion>

  <Accordion title="Device Inventory">
    An inventory of all mobile devices used to store and access company data shall be kept and maintained. All changes to the status of these devices (i.e., operating system and patch levels, lost or decommissioned status, and to whom the device is assigned or approved for usage (BYOD)) will be included for each device in the inventory.

    We are complied with the requrements.
  </Accordion>

  <Accordion title="Device Management">
    A centralized, mobile device management solution shall be deployed to all mobile devices permitted to store, transmit, or process customer data.

    We do not have a centralized mobile device management solution but having control via Google workspace admin console on the Mobile devices.
  </Accordion>

  <Accordion title="Encryption">
    The mobile device policy shall require the use of encryption either for the entire device or for data identified as sensitive on all mobile devices and shall be enforced through technology controls.

    We are complied with the requrements.
  </Accordion>

  <Accordion title="Jailbreaking and Rooting">
    The mobile device policy shall prohibit the circumvention of built-in security controls on mobile devices (e.g. jailbreaking or rooting) and shall enforce the prohibition through detective and preventative controls on the device or through a centralized device management system (e.g. mobile device management).

    We are complied with the requrements.
  </Accordion>

  <Accordion title="Legal">
    The BYOD policy includes clarifying language for the expectation of privacy, requirements for litigation, e-discovery, and legal holds. The BYOD policy shall clearly state the expectations regarding the loss of non-company data in the case a wipe of the device is required.

    We are complied with the requrements.
  </Accordion>

  <Accordion title="Lockout Screen">
    BYOD and/or company-owned devices are configured to require an automatic lockout screen, and the requirement shall be enforced through technical controls.

    We are complied with the requrements.
  </Accordion>

  <Accordion title="Operating Systems">
    Changes to mobile device operating systems, patch levels, and/or applications shall be managed through the company's change management processes.

    We are complied with the requrements.
  </Accordion>

  <Accordion title="Passwords">
    Password policies, applicable to mobile devices, shall be documented and enforced through technical controls on all company devices or devices approved for BYOD usage, and shall prohibit the changing of password/PIN lengths and authentication requirements.

    We are complied with the requrements.
  </Accordion>

  <Accordion title="Policy">
    The mobile device policy shall require the BYOD user to perform backups of data, prohibit the usage of unapproved application stores, and require the use of anti-malware software (where supported).

    We are complied with the requrements.
  </Accordion>

  <Accordion title="Remote Wipe">
    All mobile devices permitted for use through the company BYOD program or a company-assigned mobile device shall allow for remote wipe by the company's corporate IT or shall have all company-provided data wiped by the company's corporate IT.

    We are complied with the requrements.
  </Accordion>

  <Accordion title="Security Patches">
    Mobile devices connecting to corporate networks, or storing and accessing company information, shall allow for remote software version/patch validation. All mobile devices shall have the latest available security-related patches installed upon general release by the device manufacturer or carrier and authorized IT personnel shall be able to perform these updates remotely.

    We are complied with the requrements. We have defined in the policy that Devices must be kept up to date with manufacturer or network provided patches.
  </Accordion>

  <Accordion title="Users">
    The BYOD policy shall clarify the systems and servers allowed for use or access on a BYOD-enabled device.

    We are complied with the requrements.
  </Accordion>
</AccordionGroup>

***

## Security Incident Management, E-Discovery & Cloud Forensics

<AccordionGroup>
  <Accordion title="Contact / Authority Maintenance">
    Points of contact for applicable regulation authorities, national and local law enforcement, and other legal jurisdictional authorities shall be maintained and regularly updated (e.g., change in impacted-scope and/or a change in any compliance obligation) to ensure direct compliance liaisons have been established and to be prepared for a forensic investigation requiring rapid engagement with law enforcement.

    We are complied with the requrements.
  </Accordion>

  <Accordion title="Incident Management">
    Policies and procedures shall be established, and supporting business processes and technical measures implemented, to triage security-related events and ensure timely and thorough incident management, as per established IT service management policies and procedures.

    We are complied with the requrements. We also have incident management plan in place and taken care by Information security team.
  </Accordion>

  <Accordion title="Incident Reporting">
    Workforce personnel and external business relationships shall be informed of their responsibilities and, if required, shall consent and/or contractually agree to report all information security events in a timely manner. Information security events shall be reported through predefined communications channels in a timely manner adhering to applicable legal, statutory, or regulatory compliance obligations.

    We are complied with it - We have an conyratcs and SLA/MSA and all the external parties have signed the NDA as well.
  </Accordion>

  <Accordion title="Incident Response Legal Preparation">
    Proper forensic procedures, including chain of custody, are required for the presentation of evidence to support potential legal action subject to the relevant jurisdiction after an information security incident. Upon notification, customers and/or other external business partners impacted by a security breach shall be given the opportunity to participate as is legally permissible in the forensic investigation.

    Yes, We comply.
  </Accordion>

  <Accordion title="Incident Response Metrics">
    Mechanisms shall be put in place to monitor and quantify the types, volumes, and costs of information security incidents.

    We have Security Incident Management plan and communicated to all the employees.
  </Accordion>
</AccordionGroup>

***

## Supply Chain Management, Transparency and Accountability

<AccordionGroup>
  <Accordion title="Data Quality and Integrity">
    Providers shall inspect, account for, and work with their cloud supply-chain partners to correct data quality errors and associated risks. Providers shall design and implement controls to mitigate and contain data security risks through proper separation of duties, role-based access, and least-privilege access for all personnel within their supply chain.

    Yes, We comply.
  </Accordion>

  <Accordion title="Incident Reporting">
    The provider shall make security incident information available to all affected customers and providers periodically through electronic methods (e.g. portals).

    Yes, We comply.
  </Accordion>

  <Accordion title="Network / Infrastructure Services">
    Business-critical or customer (tenant) impacting (physical and virtual) application and system-system interface (API) designs and configurations, and infrastructure network and systems components, shall be designed, developed, and deployed in accordance with mutually agreed-upon service and capacity-level expectations, as well as IT governance and service management policies and procedures.

    Yes, We comply.
  </Accordion>

  <Accordion title="Provider Internal Assessments">
    The provider shall perform annual internal assessments of conformance to, and effectiveness of, its policies, procedures, and supporting measures and metrics.

    We perform annual internal assessments of conformance to, and effectiveness of, its policies, procedures, and supporting measures and metrics.
  </Accordion>

  <Accordion title="Supply Chain Agreements">
    Supply chain agreements (e.g., SLAs) between providers and customers (tenants) shall incorporate at least the following mutually-agreed upon provisions and/or terms: • Scope of business relationship and services offered • Information security requirements, provider and customer (tenant) primary points of contact for the duration of the business relationship • Notification and/or pre-authorization of any changes controlled by the provider with customer (tenant) impacts • Timely notification of a security incident (or confirmed breach) to all customers (tenants) and other business relationships impacted • Assessment and independent verification of compliance with agreement provisions and/or terms • Expiration of the business relationship and treatment of customer (tenant) data impacted • Customer (tenant) service-to-service application (API) and data interoperability and portability requirements

    We are complied with it - We have an conyratcs and SLA/MSA and all the external parties have signed the NDA as well.
  </Accordion>

  <Accordion title="Supply Chain Governance Reviews">
    Providers shall review the risk management and governance processes of their partners so that practices are consistent and aligned to account for risks inherited from other members of that partner's cloud supply chain.

    We have Risk Management Procedures in place.
  </Accordion>

  <Accordion title="Supply Chain Metrics">
    Policies and procedures shall be implemented to ensure the consistent review of service agreements (e.g., SLAs) between providers and customers (tenants) across the relevant supply chain (upstream/downstream). Reviews shall performed at least annually and identity non-conformance to established agreements. The reviews should result in actions to address service-level conflicts or inconsistencies resulting from disparate supplier relationships.

    We review the SLA/MSA and NDA with external parties annually.
  </Accordion>

  <Accordion title="Third Party Assessment">
    Providers shall assure reasonable information security across their information supply chain by performing an annual review. The review shall include all partners/third party-providers upon which their information supply chain depends on.

    We review the SLA/MSA and NDA with external parties annually.
  </Accordion>

  <Accordion title="Third Party Audits">
    Third-party service providers shall demonstrate compliance with information security and confidentiality, access control, service definitions, and delivery level agreements included in third-party contracts. Third-party reports, records, and services shall undergo audit and review at least annually to govern and maintain compliance with the service delivery agreements.

    We have ISMS framework including all the required polcieis and procedures as per the compliance requirements.
  </Accordion>
</AccordionGroup>

***

## Threat and Vulnerability Management

<AccordionGroup>
  <Accordion title="Anti-Virus / Malicious Software">
    Policies and procedures shall be established, and supporting business processes and technical measures implemented, to prevent the execution of malware on organizationally-owned or managed user end-point devices (i.e., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.

    We conduct Vulnerability assessment and Penetration testing on a timely interval and have controls on Anti-Virus / Malicious Software throgh End point security.
  </Accordion>

  <Accordion title="Vulnerability / Patch Management">
    Policies and procedures shall be established, and supporting processes and technical measures implemented, for timely detection of vulnerabilities within organizationally-owned or managed applications, infrastructure network and system components (e.g. network vulnerability assessment, penetration testing) to ensure the efficiency of implemented security controls. A risk-based model for prioritizing remediation of identified vulnerabilities shall be used. Changes shall be managed through a change management process for all vendor-supplied patches, configuration changes, or changes to the organization's internally developed software. Upon request, the provider informs customer (tenant) of policies and procedures and identfied weaknesses especially if customer (tenant) data is used as part the service and/or customer (tenant) has some shared responsibility over implementation of control.

    We conduct Vulnerability assessment and Penetration testing on a timely interval and have controls on Anti-Virus / Malicious Software throgh End point security.
  </Accordion>

  <Accordion title="Mobile Code">
    Policies and procedures shall be established, and supporting business processes and technical measures implemented, to prevent the execution of unauthorized mobile code, defined as software transferred between systems over a trusted or untrusted network and executed on a local system without explicit installation or execution by the recipient, on organizationally-owned or managed user end-point devices (e.g., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.

    We have Threat and Vulnerabilities Management procedure and we conduct Vulnerability assessment and Penetration testing through an athorised vendor.
  </Accordion>
</AccordionGroup>


# Cryptography and Encryption
Source: https://help-plum.xoxoday.com/faq/security-compliance/cryptography-and-encryption

Find answers to frequently asked questions about the cryptography and encryption standards Plum uses to protect customer data.

<AccordionGroup>
  <Accordion title="For data in transit, do you leverage encryption to protect data during transport across and between networks instances including services like SSH, HTTPS, etc.?">
    Yes, we use AES 256-bit encryption. All the network communication for network communication is encrypted with the industry standards. Note - Please provide supporting documentation defining encryption standards and technologies.
  </Accordion>

  <Accordion title="Do you encrypt data at rest?">
    All data volume is encrypted with AES 256-bit encryption to prevent any external snooping or unauthorized access in the multi-tenant environment.
  </Accordion>

  <Accordion title="Do you segregate multi-tenant data using encryption?">
    Yes, the data is segregated with a client-specific key for proper handling and representation.
  </Accordion>

  <Accordion title="Do you provide native encryption capability for sensitive data fields? If so, are there any limits on the number of fields?">
    Yes, there's a native encryption capability when it comes to sensitive data fields. As each field is equally intricate, there are no limits to such fields.
  </Accordion>

  <Accordion title="Do you have controls in place to ensure User IDs and passwords are transmitted in an encrypted format?">
    User IDs and passwords must transmit through stringent checks in an encrypted format that complies with the current Technical Security Baseline Standards.
  </Accordion>

  <Accordion title="Are passwords stored in an encrypted or a single, one-way hash?">
    The passwords are stored after encryption for maximum security of data.
  </Accordion>

  <Accordion title="Do you support secure deletion (e.g., degaussing/cryptographic wiping) of archived and backed-up data as determined by the tenant?">
    "Yes, our policies and procedures are established as per implemented mechanisms for secure disposal and removal of data from every storage media. By this, it rests assured that the data can't be recovered by any computer forensic means. We assure secure data disposal when storage is decommissioned or when the contract comes to an end."
  </Accordion>

  <Accordion title="Can you provide a published procedure for exiting the service arrangement, including assurance to sanitize all computing resources of tenant data once a customer has exited your environment or has vacated a resource?">
    Please refer "Do you support secure deletion of data?" for an explanation. As for the procedure, here's the protocol that we follow:

    * Storage Period would be as per regulatory conditions.
    * Personal data can be deleted based on a formal written request, with justification.
    * Xoxoday would delete the data within 30 days of receiving the request.
  </Accordion>

  <Accordion title="Do you allow tenants to use their own certificates?">
    No, users must use certificates from Xoxoday. They are benchmarked as per the best industry standards to ensure complete encryption of data.
  </Accordion>

  <Accordion title="Do you utilize open encryption methodologies any time your infrastructure components need to communicate with each other via public networks (e.g., Internet-based replication of data from one environment to another)?">
    No, open encryption has proven to show cracks and bruises and that's why we only equip data traversing public networks with industrial standards to ensure protection from fraud, unauthorized disclosure, modification, or compromise of data.
  </Accordion>

  <Accordion title="Are TCCC-approved technologies used to transfer personal data? (Other than e-mail)">
    Yes, personal data is to be transmitted using firmly approved encrypted systems and in no way is it to be transmitted via email.
  </Accordion>

  <Accordion title="Are virtual images hardened by default to protect them from unauthorized access?">
    Yes, the hardened images are secure from any malicious leak or unauthorized access. These hardened images do not contain any authentication credentials.
  </Accordion>

  <Accordion title="Do you support end-to-end encryption of tenants' data in transit across all security zones?">
    Yes, our network communication is encrypted with highly restricted protocols to ensure maximum security.
  </Accordion>

  <Accordion title="Do you allow your tenant to manage all cryptographic keys (e.g., data encryption, SSL certificates) for sensitive data?">
    No, the cryptographic keys, including data encryption and SSL certificates are managed by Xoxoday for optimal security of sensitive data.
  </Accordion>

  <Accordion title="Do you provide standardized (e.g. ISO/IEC) non-proprietary encryption algorithms (3DES, AES, etc.) to customers in order for them to protect their data if it is required to move through public networks (e.g., the Internet)?">
    We have encrypted the data while in transit and at rest. We use TLS1.2 encryption for Data at transit and AES256 Data at rest for maximum security
  </Accordion>

  <Accordion title="Are policies and procedures established for data labeling and handling in order to ensure the security of data and objects that contain data?">
    Yes. We have implemented the Information Classification Policy
  </Accordion>

  <Accordion title="Do you have key management policies binding keys to identifiable owners?">
    We use a split key mechanism to ensure that every client's key is unique. • We perform annual key rotation. • Keys are generated using KMS service whenever needed. • We store keys in KMS.

    Attached the Encryption policy Name of the folder - EN01 Encryption policy
  </Accordion>

  <Accordion title="Do you have a capability to allow creation of unique encryption keys per customer?">
    Every client's key is unique.
  </Accordion>

  <Accordion title="Do you have documented ownership for each stage of the lifecycle of encryption keys?">
    Yes. Our tech team manages this.
  </Accordion>

  <Accordion title="Do you leverage encryption to protect data and virtual machine images during transport across and between networks and hypervisor instances?">
    We have encrypted the data while in transit and at rest.We use TLS1.2 encryption for Data at transit and AES256 Data at rest.
  </Accordion>

  <Accordion title="Do you store encryption keys in the cloud?">
    We store keys in KMS.
  </Accordion>

  <Accordion title="Does the organisation encrypt its backups?">
    Yes. Backup data is also encrypted.
  </Accordion>

  <Accordion title="Is the customer data always encrypted in transit?">
    The data in transit will be always be encrypted.
  </Accordion>

  <Accordion title="Are attachments sent being encrypted or password protected before sending? If yes, describe the encryption method.">
    Yes. We use google workspace and all the conversations are TLS encrypted.
  </Accordion>

  <Accordion title="Are the user access passwords displayed / stored / transmitted in clear text over the network?">
    Passwords are encrypted all the time.
  </Accordion>

  <Accordion title="Is the connectivity between the vendor and the customer with strong encryption? What is the organizations minimum standard for the protection of sensitive information? (DES, 3DES, AES-128, AES-256, etc)">
    We use logical data isolation with the help of company specific encryption keys. We generate separate test data Data at transit - TLS1.2 encryption, Data at rest - AES256.
  </Accordion>

  <Accordion title="Is the back up media password protected or encrypted as per requirement of vendor policy or as per the customer requirement?">
    Backup, passwords are protected. We use encryption.
  </Accordion>

  <Accordion title="If the customer data is stored in shared environment, what are the security controls in place to segregate the customer data from other tenants' data?">
    We have the ability to logically segment or encrypt customer data such that data may be produced for a single tenant only, without inadvertently accessing another tenant's data. our network environment is designed and configured to restrict any communication and connection between the tenant's environment.
  </Accordion>

  <Accordion title="What control measures are in place at CSP end to prevent, detect and react to breaches including data leakage and how CSP will demonstrate the same?">
    We have a multi-layered network architecture with role-based access control. All the confidential/PI data are encrypted at rest and in transit with a split key mechanism to ensure that every client's key is unique. We use TLS1.2 encryption for Data in transit and AES256 for Data at rest. Additionally, we have an intrusion detection/monitoring application that alerts on unauthorized access.
  </Accordion>

  <Accordion title="Are the customer's data encrypted while stored and transmitted? And what encryption protocol or keys are currently being used?">
    We use TLS1.2 encryption for Data in transit and AES256 for Data at rest.
  </Accordion>

  <Accordion title="Have you deployed any encryption mechanism (data in transit) to secure data in motion on communication links?">
    We use TLS1.3 encryption for Data at transit
  </Accordion>

  <Accordion title="Are Systems handling BSLI data on a separate Network segment segregated from other clients?">
    We logically segregate the tenant's data, and it is segregated with a client-specific key for proper handling and security reasons. We use TLS1.3 encryption while data in transit and AES256 while data at rest
  </Accordion>

  <Accordion title="How does the Vendor ensure compartmentalization of the customer data to prevent unauthorized access to the customer data from other customers / employees of Vendor?">
    Yes, our logic to physically separate tenant systems is made possible by assigning each tenant's data a client-specific key that is uniquely encrypted for maximum security.

    We use TLS1.3 encryption while data in transit and AES256 while data at rest
  </Accordion>

  <Accordion title="For all critical applications, application should have TLS implemented for protection of Data in transit.">
    We use logical data isolation with the help of company specific encryption keys. All data volume is encrypted with AES 256-bit encryption to prevent any external snooping or unauthorized access in the multi-tenant environment.

    We use TLS1.2 encryption for Data at transit and AES256 Data at rest for maximum security.
  </Accordion>

  <Accordion title="PII or Sensitive information should be visible only to authorized users and only to the extent needed to perform activities.">
    By default the users will not have access to our customer information or PII. These PII or Sensitive information will be visible only to authorized users and only to the extent needed to perform activities. We do not share or transfer any of the customer data with any other parties. We do not provide access to the PII/SPII to any personnel who do not need the access and implemented the role based access control mechanism.
  </Accordion>

  <Accordion title="Does Supplier have the ability to encrypt or pseudonymize Personal Data? Please explain.">
    We use TLS1.2 encryption for Data at transit and AES256 Data at rest for maximum security.
  </Accordion>

  <Accordion title="What type of encryption do you propose (algorithms, protocols, key lengths) for data in transit and data at rest?">
    We have encrypted the data while in transit and at rest. We use TLS1.2 encryption for Data at transit and AES256 Data at rest for maximum security.
  </Accordion>

  <Accordion title="Describe how you manage unique encryption keys (process, storage, usage, RACI, SOD) for your own use and for each of your tenants.">
    All the confidential/PI data are encrypted at rest and in transit with a split key mechanism to ensure that every client's key is unique. We use TLS1.2 encryption for Data in transit and AES256 for Data at rest
  </Accordion>

  <Accordion title="Are the backup tested for restoration?">
    Data backups are done on daily basis and in a secured way on AWS. This has been tested on regular basis.
  </Accordion>

  <Accordion title="If so, does the application always require encryption? If response is YES, please submit the type of encryption protocol and algorithm.">
    We use TLS1.2 encryption for Data in transit and AES256 for Data at rest.
  </Accordion>

  <Accordion title="Is the data at rest encrypted in the cloud? Share evidence of the encryption mechanism configuration.">
    Yes. The data at rest encrypted in the cloud.

    We use AES256 while data at rest. Attached the evidence.
  </Accordion>

  <Accordion title="What protocols or technologies are used for applying encryption on data at rest and data in transit (on cloud and on premises)?">
    We use TLS1.3 encryption while data in transit and AES256 while data at rest
  </Accordion>

  <Accordion title="How are the encryption keys used secured and protected from unauthorized access?">
    Each tenant data is uniquely encrypted using client specific key. We use AES 256 bit encryption for data at rest to ensure maximum security measures.

    our network communication is encrypted with highly restricted protocols to ensure maximum security. the cryptographic keys, including data encryption and SSL certificates are managed by Xoxoday for optimal security of sensitive data. The passwords are also stored after encryption for maximum security of data
  </Accordion>

  <Accordion title="Is the communication within the cloud and external to the cloud on end to end encryption? Explain.">
    Yes. All the data at rest is encrypted using AES-256-bit standards and all the data in transit encryption is HTTPS with TLS 1.2
  </Accordion>

  <Accordion title="How data is stored and handled at Vendor location (whether the customer data is encrypted, kept in logical segregation location etc)?">
    we logically segregate the tenant's data and the application.Each tenant data is uniquely encrypted using client specific key. We use TLS1.2 encryption for Data at transit and AES256 Data at rest for maximum security.
  </Accordion>

  <Accordion title="What are the regulations around indemnity / liability for data privacy breaches?">
    We are compliant with EU GDPR and CPRA (California Privacy Rights Act)
  </Accordion>

  <Accordion title="Will the solution protect data from malware and commodity cyber-attack whilst at rest and in transit?">
    We have encrypted the data while in transit and at rest. We use TLS1.2 encryption for Data at transit and AES256 Data at rest for maximum security As part of Web Application Firewall (WAF), rate limiters are installed to block multiple requests from specific IPs in order to prevent DDOS-type attacks.

    In addition to that we also have AWS Guard Duty threat detection service that continuously monitors for malicious activity and unauthorized behavior.
  </Accordion>

  <Accordion title="How do you separate one customer's data from other customers' data?">
    Our network environment is designed and configured to restrict any communication and connection between the tenant's environment and our corporate network.

    We use logical data isolation with the help of company-specific encryption keys. We use TLS1.2 encryption for Data at transit and AES256 Data at rest for maximum security.
  </Accordion>

  <Accordion title="The PII protection standards met by the cloud service provider.">
    We are EU GDPR Compliant and CPRA Certified.
  </Accordion>

  <Accordion title="How do you prevent other clients from accessing our data?">
    The data isolated between customers. We use logical data isolation with the help of company specific encryption keys. We generate separate test data Data at transit - TLS1.2 encryption, Data at rest - AES256
  </Accordion>

  <Accordion title="How and where are user IDs and Passwords stored? How are they secured?">
    The data is stored on AWS and The IDs and passwords are stored after encryption for maximum security of data
  </Accordion>

  <Accordion title="Do you employ any mechanisms that facilitate secure data exchange?">
    We also conduct Network layer vulnerability and applicatioin layer vulnerability scan. We generate separate test data Data at transit - TLS1.2 encryption, Data at rest - AES256
  </Accordion>

  <Accordion title="Is our company's data stored on the Vendor platform encrypted?">
    Yes. Data is encrypted.
  </Accordion>

  <Accordion title="What is the key management technique?">
    Each tenant data is uniquely encrypted using client specific key
  </Accordion>

  <Accordion title="Does the data transmitted by our company to Vendor involve user privacy?">
    Yes. We provide importance to user's privacy. We use AES 256-bit encryption.
  </Accordion>

  <Accordion title="According to the Cloud computing mode adopted, the Cloud Service Provider or NSE itself, shall implement encryption for data in transit and for data at rest for all NSE's sensitive data and information as per the Cryptography Policy of NSE.">
    We have a multi-layered network architecture with role-based access control. All the confidential/PI data are encrypted at rest and in transit with a split key mechanism to ensure that every client's key is unique. We use TLS1.2 encryption for Data in transit and AES256 for Data at rest. Additionally, we have an intrusion detection/monitoring application that alerts on unauthorized access.
  </Accordion>

  <Accordion title="The Cloud Service Provider shall enable NSE to back up its data and information as per the Backup Policy of NSE.">
    Since we are SAAS product, we maintain backup and restore all the customer data by ourselves. We use AES 256 encryption for data at rest. We have a multi AZ deployment with periodic backup for our DR.
  </Accordion>

  <Accordion title="How would you ensure that UP data was isolated and safeguarded from other customers?">
    We use logical data isolation with the help of company specific encryption keys. Data in non production environment is not updated with the production data. We generate separate test data Data at transit - TLS1.2 encryption, Data at rest - AES256
  </Accordion>

  <Accordion title="Will UP data be encrypted by the Supplier when In transit?">
    Yes, our network communication is encrypted with highly restricted protocols to ensure maximum security.
  </Accordion>

  <Accordion title="Will UP data be encrypted by the Supplier when At Rest?">
    We use AES 256 bit encryption for data at rest to ensure maximum security measures.
  </Accordion>

  <Accordion title="If so, how is data anonymization implemented?">
    Yes. The data anonymization implemented. We have enabled security settings with strong encryption for authentication and transmission. We use TLS1.2 encryption for Data in transit and AES256 for Data at rest
  </Accordion>

  <Accordion title="If data anonymization is implemented, how is the anonymized data used within your organization?">
    Our employees only have access to the data that is necessary for the completion of the business activity which they are involved in. We have role based access system to make sure that only the authorised individual have an access to the required information.
  </Accordion>

  <Accordion title="Please describe your general rules management in relation to role provisioning, deprovisioning, and recertification.">
    We review the role provisioning, deprovisioning, and recertification on a periodical basis and also audited by the external auditor. Our IT Team Review an access controls and approve as per the procedure. Any changes in the access levels of the users will be as per the role based logical access.
  </Accordion>

  <Accordion title="Describe your secrets management strategy: (auth tokens, passwords, API credentials, certificates)">
    We encrypt our secretes and store them in a private respository and servers.
  </Accordion>

  <Accordion title="Please describe, how the customer data will be kept logically and/or physically separated from other users' data?">
    All the network communication for network communication is encrypted to industry standards. We use logical data isolation with the help of company specific encryption keys. Data in non-production environment is not updated with the production data. We generate separate test data at transit - TLS1.2 encryption, Data at rest - AES256
  </Accordion>

  <Accordion title="Will any, or all the customer data be encrypted at rest within the system? If so to what standard its encrypted to?">
    Yes
  </Accordion>

  <Accordion title="Software packages from vendors and third parties should not be modified. However, if modification is necessary, it shall be limited to necessary changes and all changes shall be strictly controlled and documented.">
    We do very limited modification or changes wherever necessary.
  </Accordion>

  <Accordion title="A Cryptographic Key Management programme shall be established for Key Management through their whole lifecycle, including generating, storing, archiving, retrieving, distributing, retiring and destroying keys.">
    We have implemented the Encryption policy. We have defined generation, storage, archival, retrieval, distribution, retirement and destruction of keys. Attached the Encryption policy.
  </Accordion>

  <Accordion title="All documentation and materials related to cryptography shall be classified by default as Sensitive and inherits the information asset's classification if it is a higher classification, protected accordingly and be made available only on a need-to-know basis.">
    All information are classified as Restricted and encrypted.
  </Accordion>

  <Accordion title="Cryptographic keys shall be protected against tampering and destruction, and private keys must be protected from unauthorised disclosure, both in storage and transfer.">
    The data is segregated with a client-specific key for proper handling and representation.
  </Accordion>

  <Accordion title="Account credentials, sensitive information on databases and backups that require confidentiality and/or integrity shall be encrypted using strong encryption algorithms.">
    All the data including the account credentials, Backup data are encrypted in transit and at rest.
  </Accordion>

  <Accordion title="Enable the use of encryption for administration of network devices within the customer environment.">
    All the the customer data stored on our application also be encrypted for maximum security.
  </Accordion>

  <Accordion title="Proper security controls (e.g. hashing, digital signatures and cryptography) shall be adopted to ensure authenticity and/or integrity of messages during their transmission.">
    We have implemented the security controls. We use TLS1.3 encryption for Data at transit and AES256 Data at rest for maximum security.We store password hashed. We have SHA512 hash with unique salt for every password
  </Accordion>

  <Accordion title="Multiple layer strategy involving two, or more, different overlapping security mechanisms, a technique known as defence-in-depth shall be followed so that the impact of a failure in any one mechanism is minimised.">
    We make sure that we follow the Industry best practices and security standard to make sure that we secure the information asset.
  </Accordion>

  <Accordion title="Backups shall be encrypted and securely (physically and logically) retained at a centralised location in addition to two site local copies.">
    Backup is encrypted and stored on cloud.
  </Accordion>

  <Accordion title="The customer data or systems shall be segregated securely from other customers on infrastructure (network devices, server or database, etc.).">
    We use logical data isolation with the help of company specific encryption keys
  </Accordion>

  <Accordion title="Can evidence be provided of the processes that are implemented to guarantee the confidentiality of information, including a description of how our data is separated from other customer's data, and what controls are in place to prevent other customers from viewing our data?">
    We use logical data isolation with the help of company specific encryption keys. We generate separate test data Data at transit - TLS1.2 encryption, Data at rest - AES256. We have the ability to logically segment or encrypt customer data such that data may be produced for a single tenant only, without inadvertently accessing another tenant's data. our network environment is designed and configured to restrict any communication and connection between the tenant's environment.
  </Accordion>

  <Accordion title="Does a process exist to identify new laws and regulations with IT security implications? (e.g., new state breach notification requirements)">
    Yes.

    We comply with all the applicable new laws and regulations. We also have a service provider who helps us with regards to Information security, compliance and certifications etc.. We have identified the upcoming CPRA and implemented the controls and achieved the CPRA Attestation with the help of the external auditor.

    Attached the CPRA Attestation report.
  </Accordion>

  <Accordion title="Is there multiple choices of secure communications protocols/methods supported by the solution (front and back office data communication)? List them.">
    Yes. The communications are secure. We use TLS1.2 encryption for Data in transit and AES256 for Data at rest. Additionally, we have an intrusion detection/monitoring application that alerts on unauthorized access.
  </Accordion>

  <Accordion title="Please specify other Encryption/Decryption Algorithms?">
    We use TLS1.2 encryption for Data in transit and AES256 for Data at rest. We store password hashed. We have HA512 hash with unique salt for every password
  </Accordion>

  <Accordion title="Does solution provide/support data transformation (between different data formats)?">
    Yes. We use encrypted channel
  </Accordion>

  <Accordion title="Does your solution provide the Triple DES algorithms (provided by security module)?">
    Yes
  </Accordion>

  <Accordion title="Does your solution provide the RC4 algorithms (provided by security module)?">
    We use TLS1.2 encryption for Data in transit and AES256 for Data at rest. We store password hashed. We have HA512 hash with unique salt for every password
  </Accordion>

  <Accordion title="Is the data hosted in a multi-tenanted environment? Can corporate data be accessed by other clients of the service provider? How is our data segregated from other tenants' data?">
    Each tenant data is uniquely encrypted using a client specific key. All data volume is encrypted with AES 256-bit encryption to prevent any external snooping or unauthorized access in the multi-tenant environment Corporate data cannot be accessed by other clients of the service provider
  </Accordion>

  <Accordion title="Is our data encrypted during transmission, at rest (database and storage), and at backup or off-line storage?">
    Data is encrypted during transmission, at rest (database and storage), and at backup We use TLS1.2 encryption for Data in transit and AES256 for Data at rest.
  </Accordion>

  <Accordion title="Is customer information on desktop/ laptop/ servers encrypted? What Encryption standard is used? If yes please explain and share evidence?">
    We use TLS1.2 encryption for Data in transit and AES256 for Data at rest. Additionally, we have an intrusion detection/monitoring application that alerts on unauthorized access. Attached the Encryption Policy.
  </Accordion>

  <Accordion title="Do you have the ability to logically segment or encrypt customer data such that, in the event of subpoena, data may be produced for a single tenant only, without inadvertently accessing another tenant's data?">
    We have the ability to logically segment or encrypt customer data. our network environment is designed and configured to restrict any communication and connection between the tenant's environment and our corporate network.our logic to physically separate tenant systems is made possible by assigning each tenant's data a client-specific key that is uniquely encrypted for maximum security.
  </Accordion>

  <Accordion title="Type of encryption (field-level, disk-level, etc.)">
    We do field level encryption for PII and user generated content. This encryption has a unique encryption key for each client. In addition we also do disk level encryption for the entire stored data.
  </Accordion>

  <Accordion title="The information system protects the confidentiality and integrity of the information at rest and implements cryptographic mechanisms to prevent unauthorized disclosure and modification of information at rest.">
    We have implements cryptographic mechanisms to prevent unauthorized disclosure and modification of information at rest.

    We use AES 256 bit encryption for data at rest to ensure maximum security measures.

    Attached the encryption policy.
  </Accordion>

  <Accordion title="Prevent applications from storing sensitive data in log files.">
    Sensitive data is encrypted and not stored in logs. Compliant.
  </Accordion>

  <Accordion title="Cryptographic keys in memory must be protected by best possible options available in the development framework.">
    Cryptographic keys are protected. Compliant.
  </Accordion>

  <Accordion title="Cryptographic keys must be managed by Providence and stored in a centralized location (eg., Azure Key Vault managed by Providence).">
    The cryptographic keys, including data encryption and SSL certificates, are managed by Xoxoday for optimal security of sensitive data. Each tenant's data is uniquely encrypted using client specific key.
  </Accordion>

  <Accordion title="Leverage Tokenization: A special form of data masking where the algorithm used to mask the data is maintained so the information can be later restored to its original value.">
    NA. We do not store any other Sensitive personal information.

    The PII(name, email ID, phone#) are encrypted. We use TLS1.2 encryption for Data at transit and AES256 Data at rest for maximum security.
  </Accordion>

  <Accordion title="System backups are to be encrypted.">
    The application and system backup data is encrypted
  </Accordion>

  <Accordion title="Message encryption and digital signing must be configured to ensure the message confidentiality and integrity are maintained during transit.">
    We have encrypted the data while in transit and at rest. We use TLS1.2 encryption for Data at transit and AES256 Data at rest for maximum security.
  </Accordion>

  <Accordion title="All default test, sample or backup files including scripts, configuration files and web pages, etc. must be removed from the production server prior opening up the production application for consumption.">
    The back up data is encrypted and only authorised individuals will have access. Test data and backup data is seperated from the production servers.
  </Accordion>

  <Accordion title="Detail out the application workflow describing the communication happening between all the components including the protocols involved w.r.t. the services being provided to Infosys.">
    There is no integration with Infosys services/systems. The network Architecture diagram has been shared to show the TLS communication.
  </Accordion>

  <Accordion title="How is cryptographic key management performed within the organization? Please elaborate the security controls implemented around this process.">
    Yes, we use AES 256-bit encryption. All the network communication for network communication is encrypted with the industry standards

    All data volume is encrypted with AES 256-bit encryption to prevent any external snooping or unauthorized access in the multi-tenant environment
  </Accordion>

  <Accordion title="Is database encrypted as per the encryption policy?">
    We have encrypted the data while in transit and at rest. We use TLS1.2 encryption for Data at transit and AES256 Data at rest for maximum security.
  </Accordion>

  <Accordion title="Is sensitive data masked where required?">
    All the PII Are encrypted.
  </Accordion>
</AccordionGroup>


# Data Management
Source: https://help-plum.xoxoday.com/faq/security-compliance/data-management

Find answers to frequently asked questions about Plum's data management practices, including retention and lifecycle policies.

<AccordionGroup>
  <Accordion title="Do you ensure that critical data (e.g., payment card number) is properly masked and that only authorized individuals have access to the entirety of the data.">
    Yes, the payment card data is masked and encrypted to ensure that the access only lies in the hands of authorized individuals.
  </Accordion>

  <Accordion title="How do you protect digital identities and credentials and use them in cloud applications?">
    We use AES 256-bit encryption for data at rest for securing digital identities.
  </Accordion>

  <Accordion title="What data do you collect about the tenant (logs, etc.)? How is it stored? How is the data used? How long will it be stored?">
    The only user data stored within the system is their personal information - names, emails and contact numbers. This data is not put to any use by Xoxoday and resides within the system. The data can be deleted upon the tenant's request.
  </Accordion>

  <Accordion title="Under what conditions might third parties, including government agencies, have access to my data?">
    Your data is completely secure. Third parties have no access to the given data.
  </Accordion>

  <Accordion title="Can you guarantee that third-party access to shared logs and resources won't reveal critical information about tenant?">
    Yes, as stated above, your data is completely encrypted and secure, hence no critical information shall be revealed to the third parties.
  </Accordion>

  <Accordion title="Do you have data-integrity monitoring / change-detection software?">
    No. Our data is stored in secured databases and there is no window to alter any data without it being logged into the system records.
  </Accordion>

  <Accordion title="Do you have data loss prevention (DLP) solutions implemented for web, email, and end-point getaway?">
    Yes, our web assets, email records, and end-points are sealed with data loss prevention techniques.
  </Accordion>

  <Accordion title="Do you have technical controls capable of enforcing customer data retention policies?">
    Yes, our technicalities are built in tandem with the customer data retention policies.
  </Accordion>

  <Accordion title="Will you use other companies whose infrastructure is located outside that of owned premise/Data Center?">
    No, we only rely on our ironclad infrastructure to ensure maximum security of data.
  </Accordion>

  <Accordion title="Can you provide details about policies and procedures for backup? This should include procedures for the management of removable media and methods for securely destroying media no longer required.">
    The Xoxoday platform operates on the cloud, which means there are no removable storage devices in question.
  </Accordion>

  <Accordion title="Can you specify the steps taken to ensure that data which has been deleted is completely wiped and cannot be accessed by other service users?">
    Our data cleansing process goes through an organized purge. Once the data is purged, it's purged from all places.
  </Accordion>

  <Accordion title="What checks are made on the identity of users with privileged access?">
    There are user roles available for privileged and authorized members, access to which is provided via oAuth-2.0.
  </Accordion>

  <Accordion title="Are there different levels of identity checks based on the resources accessed?">
    Identities of users are verified on the events they access any resources.
  </Accordion>

  <Accordion title="What processes are in place for de-provisioning privileged credentials?">
    A support ticket has to be raised to the customer support team, after which the de-provisioning of privileged credentials will be taken care of in the back-end.
  </Accordion>

  <Accordion title="How are the accounts with the highest level of privilege authenticated and managed?">
    The accounts with highest privilege are authenticated and managed via oAuth-2.0, which can be used to implement secure access to confidential data.
  </Accordion>

  <Accordion title="Are any high-privilege roles allocated to the same person? Does this allocation break the segregation of duties or least privilege rules?">
    No, roles of high privilege are allocated to a chosen few so that it doesn't break the segregation of duties.
  </Accordion>

  <Accordion title="How do you allow for extraordinary privileged access in the event of an emergency?">
    In case of an emergency, tenants can raise a request to the customer support personnel or the key account manager. The privileged access shall be given from the back-end promptly.
  </Accordion>

  <Accordion title="How are privileged actions monitored and logged? Is there a way to check and protect the integrity of such audit logs?">
    Infrastructure logs are collected using the AWS Audit Trail, meanwhile the application related logs are collected in our Elastic Search server and retained in the long term cloud storage.
  </Accordion>

  <Accordion title="Is there mutual authentication? How could strong authentication be used? For example RSA SecurID? Is there any limitation?">
    Yes, mutual authentication exists for strong authentication via AES 256-bit encryption.
  </Accordion>

  <Accordion title="Please provide detail about what information is recorded within audit logs and for how long this is retained.">
    * Infrastructure logs are collected using AWS Audit Trail
    * Application-relatedlogs are collected in our Elastic Search server and retained in long-term cloud storage.
  </Accordion>

  <Accordion title="Is the data segmented within audit logs so they can be made available to tenant without compromising other customers?">
    No. Since we are a multi-tenant system, our logs contain information of all the tenants. We cannot isolate a single customer's information from our logs.
  </Accordion>

  <Accordion title="How are audit logs reviewed? What recorded events result in action being taken?">
    Administrative logs are part of Cloud Dashboard and are regularly reviewed.
  </Accordion>

  <Accordion title="Do you use multiple ISPs?">
    Yes, we have multiple internet service providers for uninterrupted coverage and maximum uptime.
  </Accordion>

  <Accordion title="Do you have DDoS protection, and if so, how?">
    There are gateways in place to defer DDoS attacks.
  </Accordion>

  <Accordion title="Can you provide availability of historical data?">
    No, historical data cannot be provided due to its confidentiality.
  </Accordion>

  <Accordion title="What is your downtime plan (e.g., service upgrade, patch, etc.)?">
    We don't face any downtime and keep our service uninterrupted even in the events of upgrades and patches.
  </Accordion>

  <Accordion title="Can you accommodate timely forensic investigation (e.g., eDiscovery)?">
    Yes, in case there's a need for a forensic investigation, we can accommodate time and make it happen.
  </Accordion>

  <Accordion title="Do you follow Data input and output integrity routines (i.e., reconciliation and edit checks) for application interfaces and databases to prevent manual or systematic processing errors, corruption of data, or misuse?">
    Yes. We comply with this requirement, we follow multi-layer application architecture to isolate database access.
  </Accordion>

  <Accordion title="Do you follow a defined quality change control and testing process (e.g. ITIL Service Management) with established baselines, testing, and release standards that focus on system availability, confidentiality, and integrity of systems and services?">
    Yes. We follow a defined quality change control and testing as per the Organization's policies and procedures.
  </Accordion>

  <Accordion title="Do you assign Data and objects data by the data owner based on data type, value, sensitivity, and criticality to the organization?">
    Yes. We follow a data classification policy and access control policy to provide access to the individuals based on data type, value, sensitivity, and criticality to the organization.
  </Accordion>

  <Accordion title="Do you follow Data Security & Information Lifecycle Management Ownership / Stewardship?">
    Yes, We comply with this requirement. All data has been designated with stewardship, with assigned responsibilities defined, documented, and communicated as per the compliance requirements.
  </Accordion>

  <Accordion title="Do you make sure that Each operating system has been hardened to provide only necessary ports, protocols, and services to meet business needs and have in place supporting technical controls such as: antivirus, file integrity monitoring, and logging as part of their baseline operating build standard or template.">
    Yes. We make sure that we follow access control policy and data protection policy to make sure that only authorized individual has access to the required data. And we have controls such as antivirus, file integrity monitoring, and log monitoring as per the compliance requirements.
  </Accordion>

  <Accordion title="Do you enforce data access permissions based on the rules of Authentication, Authorization and Accountability (AAA)?">
    Access to data and systems are based on the principles of least privilege for access. Accordingly, all information systems and data are classified and further segregated to support role based access requirements. Furthermore, while defining job roles and designing access roles, privileges leading to conflicts of interests are to be avoided. A strong identification and authentication system and logging systems are deployed and provides a centralized control to administer, monitor and review all critical access events.
  </Accordion>

  <Accordion title="Are access privileges to physical media assigned based on role and responsibilities?">
    We have implemented the Role based access control machanism.
  </Accordion>

  <Accordion title="Is there a process for secure disposal of both IT equipment and media?">
    Our data cleaning process goes through an organized purge. Once the data is purged, it's purged from all places. We have implemented the Media protection procedure and Data retension & Disposal policy to make sure that we dispose the data securely.
  </Accordion>

  <Accordion title="Are development, test and production environments separate?">
    Yes. All are separate.
  </Accordion>

  <Accordion title="Is production data ever used in a test environment?">
    We do not use.
  </Accordion>

  <Accordion title="Does the client scoped data include the disclosure of account numbers or identifiers to the consumer's account?">
    We not disclose or share any of the clients data.
  </Accordion>

  <Accordion title="Do fourth-parties, (e.g., subcontractors, sub-processors, sub-service organizations) have access to or process client scoped data?">
    They do not have access.
  </Accordion>

  <Accordion title="Is there appropriate segregation between the customer Work area & other facility?">
    Yes. Segregation is done.
  </Accordion>

  <Accordion title="Does the organization have security controls to restrict physical entry & exit to restricted areas containing sensitive data within the physical security perimeter?">
    Yes, we have implemented the physical security and only authorised individual can have access. We have also deployed security guards for maximum security.
  </Accordion>

  <Accordion title="What is your retention policy for retaining these logs? (30 days, 60 days, 1 year, etc)">
    At least 180 days
  </Accordion>

  <Accordion title="Is there a process of frisking or manual check for personal storage devices?">
    Yes, we do not allow any personal storgae devices.
  </Accordion>

  <Accordion title="Does the vendor agreement with CSP clearly define the data ownership mentioning that the ownership lies with vendor's customers? (the customer in this case)">
    Yes, we will delete the data upon termination of the contract of request of the end users.
  </Accordion>

  <Accordion title="Is there any data retention or data destruction period discussed with the CSP as per the requirements from vendor's customer (the customer)?">
    The data will be entered by the end users and will be deleted upon the termination of the contract.
  </Accordion>

  <Accordion title="Are the procedures for the customer's data handover documented, if the customer wants to terminate the service from CSP/ vendor?">
    Upon termination of the contract we confirm the data deletion.
  </Accordion>

  <Accordion title="Does the requirement for secure disposal of all information / data from CSP environment, immediately after termination of service, discussed and agreed with the customer?">
    We securely dispose the data upon termination of the contract and confirm you within a specified period of timeline.
  </Accordion>

  <Accordion title="Do you have a secure disposal management (Asset decommission) procedure ? Do you ensure that sensitive data has been deleted or overwritten before disposing off the equipment ?">
    We have implemented the Data Retention and Disposal Policy. Attached the document. We do not store customer information in any equipments, all the information will be stored on AWS Cloud virtual platform. We make sure that all the any data stored in any electronic devices are deleted before disposing of the equipments.
  </Accordion>

  <Accordion title="Do you allow access to administration tasks for your employees from Portable Devices (phones, PDAs, Tablets, etc...) or their own devices, if yes, please refer to section Mobile Security.">
    NO
  </Accordion>

  <Accordion title="What method do you use when deleting customer data if requested to do so. Do you provide customers with a certificate that his data was properly sanitized from all computing resources and portable storage media">
    The secure deletion standard like DoD 5220.22-M ECE is being followed and we provide a certificate that the data was properly sanitized from all computing resources and portable storage media
  </Accordion>

  <Accordion title="Are rules pertaining to remote access monitoring configured on DLP solution?">
    We have implemented the data loss prevention techniques to make sure that the data is not lost permanently.
  </Accordion>

  <Accordion title="Are policies configured to monitor and detect data leakage over different file types?">
    It's a part of our data loss prevention techniques
  </Accordion>

  <Accordion title="Is the current DLP solution capable of enforcing policies even when the endpoint is disconnected from corporate network?">
    our web assets, email records, and end-points are sealed with data loss prevention techniques even when the endpoint is disconnected from corporate network
  </Accordion>

  <Accordion title="What will be the frequency of data purging?">
    Since we are into SAAS business we purge the data upon termination of the contracts or request by the customer.
  </Accordion>

  <Accordion title="Contract end facilitates the return of customer data to the customer in a the customer usable format.">
    As per the compliance requirements we will delete the data upon a request from the customer. Our data cleaning process goes through an organized purge. Once the data is purged, it's purged from all places.
  </Accordion>

  <Accordion title="the customer data is not used for test purposes, unless properly sanitized or anonymized, and agreed upon with the customer.">
    We do not use any of our customer data for testing.
  </Accordion>

  <Accordion title="Wherever relevant, Personally Identifiable Information (PII) is stored according to relevant laws and regulations. Storing of Personally Identifiable Information (PII) is transparent to the user, i.e. report is available for an employee specifiying what personal data is stored for her in the solution and who has access to it.">
    We collect only the name and email from the customer as a mandatory PII and these data stored on AWS - Singapore region. We always transparently inform the customer about the data storage location.
  </Accordion>

  <Accordion title="Do you intend to process the Personal Data you process on behalf of the customer for your own purpose, such as product development, research or analytics, and if so, what is the legal basis for such processing?">
    No.We do not use our customer data for any of these purposes.
  </Accordion>

  <Accordion title="For how long will data be stored and available after end of term?">
    We adhere to Data Retention and Disposal Policy and make sure that the personal information of the data subject will be deleted upon requests or termination of the contract.
  </Accordion>

  <Accordion title="Can you provide assurance that Htec data stored or created within the solution will be exportable in common industry formats without loss of fidelity (and context)">
    We have implemented the Data Loss Prevention techniques and Backup of data will be taken on regular basis automatically on AWS Platform. The data backup is also encrypted and there are no possibilities of loosing the data stored.
  </Accordion>

  <Accordion title="Is the Company able to immediately erase customer data, both at the Supplier's and its service provider's premises? Please briefly describe the erasure process and used tools. How can this be validated?">
    The data can be deleted upon the tenant's request or termination of the contract. Our data cleaning process goes through an organized purge. Once the data is purged, it's purged from all places.
  </Accordion>

  <Accordion title="Can you ensure that all customer data is erased at the end of service?">
    The data can be deleted upon the tenant's request or termination of the contract.
  </Accordion>

  <Accordion title="Do you have a rigorous testing and acceptance procedure for outsourced and packaged application code?">
    We conduct the code review and get the necessary approvals from authorised personnel before releasing the new versions or developments.
  </Accordion>

  <Accordion title="Do you have a managed process for approving new 3rd Party Libraries?">
    This is part of the code review process wherein the reviewer checks the utility and security of the 3rd party library.
  </Accordion>

  <Accordion title="Is the supplier willing to cooperate with the FDA if necessary? (site inspections, providing documentation, etc.)">
    NA. We do not store any Health information or PHI.
  </Accordion>

  <Accordion title="Data Retention: How long does the service store customer data after account termination?">
    7Years. But we delete the data upon customer request as per the GDPR.
  </Accordion>

  <Accordion title="What kinds of our company's information is involved for your platform? Is there any sensitive information involved? Such as user information, our company's product information, marketing data or code information?">
    The employees Name, Email ID, DOB, designation will be involved. And other information posted on the groups will be involved.
  </Accordion>

  <Accordion title="If cardholder data is involved, does the Vendor have a PCI certificate?">
    Cardholder data is not involved.
  </Accordion>

  <Accordion title="Are controls in place to provide content monitoring and filtering, and data loss prevention?">
    Yes, our web assets, email records, and end-points are sealed with data loss prevention techniques.
  </Accordion>

  <Accordion title="Describe the circumstances in which customer data is allowed leave your production systems?">
    We can delete the customer data upon their request or after the termination of the contract. Our data cleansing process goes through an organized purge. Once the data is purged, it's purged from all places
  </Accordion>

  <Accordion title="All production information/data from test environments shall be securely deleted immediately after the testing is complete.">
    We do not use any data from our production environment for testing purposes.
  </Accordion>

  <Accordion title="Test/development/integration environments shall be physically and logically protected.">
    Our testing and production environment is on a different account. Its logically segregated for maximum security.
  </Accordion>

  <Accordion title="Copying or use of production data into test environment shall be periodically audited.">
    We do not use any data from our production environment for testing purposes.
  </Accordion>

  <Accordion title="Information consisting of vulnerabilities and potential non-compliance shall be considered as Sensitive information and be treated accordingly.">
    We treat this as sensitive and confidential
  </Accordion>

  <Accordion title="Service Provider shall ensure that the customer data will be erased securely in accordance with acceptable standards upon termination of service.">
    We securely delete the data upon termination of the contract
  </Accordion>

  <Accordion title="Service Provider shall have a procedure for securely destroying storage media which contains the customer assets.">
    Our data cleaning process goes through an organized purge.
  </Accordion>

  <Accordion title="What are the contract termination processes? How will we have access to our data on termination of the service? Would our data be completely deleted from the vendor's servers after termination?">
    We will delete the data upon termination of the contract and confirm you. Our data cleaning process goes through an organized purge. Once the data is purged, it's purged from all places.
  </Accordion>

  <Accordion title="How is data loss prevented and how is high availability ensured? What are typical measures such as MTBF (failure time) or MTTR (recovery time)?">
    our web application, email records, and end-points are sealed with data loss prevention techniques. We have the capability to do it immediately.
  </Accordion>

  <Accordion title="What security standards are used for application development?">
    our products comply with all the industrial benchmarks and standards when it comes to the Software Development Life-cycle (SDLC). All software development procedures are supervised and monitored by Xoxoday so that they include: • security requirements • independent security review of the environment by a certified individual • code reviews Quality monitoring, evaluation, and acceptance criteria for information systems, upgrades, and new versions shall be established and documented for the clients' reference.
  </Accordion>

  <Accordion title="Describe your approach to ensuring data security in the SaaS environment.">
    We have implemented policies and procedures as per ISMS and GDPR requirements. We also conduct periodical Internal and external Audit by the third party Auditor. We have deployed our application on Cloud Virtual platform for maximum security. We use Bitdefender End point security software to prevent from malware and protect the data. In addition to that we also have AWS Guard Duty threat detection service that continuously monitors for malicious activity and unauthorized behaviour. We conduct periodical Vulnerability assessment and Penetration Testing from the Inductry approved authorized vendor to make sure that all the vulnerabilities are closed and having secured applications. We use logical data isolation with the help of company specific encryption keys. Data in non production environment is not updated with the production data. We generate separate test data Data at transit - TLS1.2 encryption, Data at rest - AES256 As per the Information security policy and Data protection policy only the authorised individual have an access to the data through internal approving and ticketing system.
  </Accordion>

  <Accordion title="Is PII deleted (or scheduled to delete) from the application in case its retention period is over or on the request of a data subject?">
    Upon request or termincation of the contract we delete the data and confirm.
  </Accordion>

  <Accordion title="Does the application allow access of PII from a different region/country in which Personal Information is collected? If yes, then specify the region/country.">
    Since we are a SaaS solution, PII is collected through our application and stored on AWS virtual platform cloud. We do not provide access to anybody except an authorised individual of our product teams.
  </Accordion>

  <Accordion title="How data is stored and handling at Vendor location(whether the the customer data is encrypted, kept in logical segregation location etc).">
    we logically segregate the tenant's data and the application.Each tenant data is uniquely encrypted using client specific key. We use TLS1.2 encryption for Data at transit and AES256 Data at rest for maximum security.
  </Accordion>

  <Accordion title="PCI-DSS in case the CSP handles card holder data if card data is processed and stored.">
    NA. We do not handles the card holder data.
  </Accordion>

  <Accordion title="Does your solution provide Transaction Authorization Code? Please provide detail explanation">
    Yes. OTP will get generate before making the payment.
  </Accordion>

  <Accordion title="Does the organization is having data security controls in place? If yes please explain and share evidence?">
    We have the Data security Controls in place. We have established the Data Management System and Information Security Management system to ensure that the data is managed during the conduct of business in a safe and secure manner in delivering the business values to the interested parties. Nreach Online Services Pvt ltd, respects the individual right to their personal information and is committed to use minimum personal data with transparency, accuracy & protection of confidentiality, integrity, availability, privacy, authenticity & trustworthiness, nonrepudiation, accountability and auditability of the data received, stored, processed and destroyed for business purposes. Atatched the Xoxoday GDPR Data Security Policy
  </Accordion>

  <Accordion title="For all external data transmission, certificates must be signed by a recognized and reputable Certificate Authority (CA) and not expired.">
    We do not transfer any data to any external parties.
  </Accordion>

  <Accordion title="Session tokens generated must be sufficiently long and highly random to withstand session guessing attacks.">
    We are equipped to detect and mitigate Threats, DDOS attacks, session hijack, login spoofs or any other data extraction strategies.
  </Accordion>

  <Accordion title="PSJH or authorized administrators are to delete PSJH data or render PSJH data unreadable when an employee or workforce member's access is terminated.">
    We deleted the data upon termination of the contract or if received the request from the customers/users. Our data cleaning process goes through an organized purge. Once the data is purged, it's purged from all places.
  </Accordion>

  <Accordion title="PSJH full disk encryption software is required on servers and/or workstations containing PHI or sensitive data.">
    NA. We do not process any PHI.
  </Accordion>

  <Accordion title="Where PHI/PII is stored and processed as part of service delivery for a client engagagement the collection, use, maintenance, sharing & disposal of must be clearly established internally and agreed with client as applicable.">
    NA. We do not process any PHI.
  </Accordion>

  <Accordion title="Disclosures of Personally Identifiable Information (PII), Personal Healthcare Information (PHI) to third parties must be recorded, including what PII/PHI has been disclosed, to whom, at what time, purpose, validity, secure processing requirements, secure disposal requirements shall be documented in consultation with legal, privacy & compliance teams of providence.">
    We do not share or disclose any PII to the third parties. We do not store PHI.
  </Accordion>

  <Accordion title="Implement controls to enforce certificate based authentication for SFTP communication.">
    Not application. All the data enters via our application.
  </Accordion>

  <Accordion title="System Architecture document must depict high-risk environments and data flows, system architecture, and potential legal compliance impacts illustrating the processing, transmitting, and storing of PHI/PII.">
    We do not process any PHI. We process the PII(name, email ID, phone#) and all are encrypted. We use TLS1.2 encryption for Data at transit and AES256 Data at rest for maximum security. Attached the Network architecture diagram and data flow.
  </Accordion>

  <Accordion title="What controls are in place to ensure secure data disposal upon termination of agreement with Infosys? (i.e. Disk Wipe , Degaussing , physical destruction etc.">
    We will be deleting the data securely as per the Data retension and data disposal policy Yes, our policies and procedures are established as per implemented mechanisms for secure disposal and removal of data from every storage media. By this, it rests assured that the data can't be recovered by any computer forensic means. We assure secure data disposal when storage is decommissioned or when the contract comes to an end."
  </Accordion>

  <Accordion title="Detail Out the secure coding guidelines ( e.g. OWASP Guide, SANS CWE Top 25,CERT Secure Coding etc.) and code review practices that are followed for the application (if any), which is used for providing services to Infosys.">
    Yes, we follow all the technical guidelines for development of our code and applications that come under the Open Web Application Security Project.
  </Accordion>

  <Accordion title="Is any unsecure protocol like FTP is used for data transfer?">
    We collect the data only through our application.
  </Accordion>

  <Accordion title="Have there been incidences of security breaches resulting in the failure of core systems (e.g., Distributed Denial-of-Service (DDOS) the attack, etc.)">
    There have been no incidences of security breaches resulting in the failure of core systems. We are equipped to detect and mitigate Advanced Persistent Threats or DDOS. We use AWS Cloud watch for monitoring the configuration and infrastructure changes. This will identify several types of denial of service (DoS) attacks
  </Accordion>

  <Accordion title="What happens to the customer data at service termination?">
    The data can be deleted upon the tenant's request or termination of the contract. Our data cleaning process goes through an organized purge. Once the data is purged, it's purged from all places.
  </Accordion>

  <Accordion title="What security features exist if the provider transmits data from one location to another (if applicable)?">
    NA. We do not transmit data from one location to another.
  </Accordion>

  <Accordion title="What are the provider's data leak prevention capabilities?">
    Our web assets, email records, and endpoints are sealed with data loss prevention techniques.
  </Accordion>

  <Accordion title="How often does the provider delete data?">
    We delete the customer data upon termination of the contract or request from the data subject.
  </Accordion>

  <Accordion title="Is verification provided that data has been securely deleted?">
    Yes. We confirm once the data is securely deleted from all the sources. Our data cleaning process goes through an organized purge. Once the data is purged, it's purged from all places.
  </Accordion>

  <Accordion title="What happens to the customer data when the provider is terminated?">
    We delete the customer data upon termination of the contract or on request of the data subject.
  </Accordion>
</AccordionGroup>


# Data Security
Source: https://help-plum.xoxoday.com/faq/security-compliance/data-security

Find answers to frequently asked questions about the technical safeguards Plum uses to keep customer data secure.

<AccordionGroup>
  <Accordion title="1. Data Protection Policy">
    [Open document](https://drive.google.com/file/d/1W5QQnsnixFirx-xjZ1KRhPOA7Bi3cMRf/view)
  </Accordion>

  <Accordion title="2. Data Security Policy">
    [Open document](https://drive.google.com/file/d/1okA7QhhKPHrrO_eSUrGd19yHhqpZRnOI/view?usp=sharing)
  </Accordion>

  <Accordion title="3. Personal Identifiable Information (PII) Policy">
    [Open document](https://drive.google.com/file/d/1zsggds3GYgDOAMOE-bBT2vX1EH5R9E4A/view)
  </Accordion>

  <Accordion title="4. Anonymization and Pseudonymization Policy">
    [Open document](https://drive.google.com/file/d/1W5QQnsnixFirx-xjZ1KRhPOA7Bi3cMRf/view)
  </Accordion>

  <Accordion title="5. Data Retention and Disposal Policy">
    [Open document](https://drive.google.com/file/d/1zyr_8lViSEbl3YlClOJFe4BmqJgdO_hU/view?usp=sharing)
  </Accordion>

  <Accordion title="6. Data Subject Access Right Procedure">
    [Open document](https://drive.google.com/file/d/1S4C7STlV8n9xUKaNOY__hEMerLQbkqus/view?usp=sharing)
  </Accordion>

  <Accordion title="7. Data Breach Notification Procedure">
    [Open document](https://drive.google.com/file/d/1AUHfaBYe5lLXsbyRzP4mLMHh4LNsFY2e/view?usp=sharing)
  </Accordion>

  <Accordion title="8. Data Breach Notification Template">
    [Open document](https://drive.google.com/file/d/1KaECkPolkGh10EHfIpkUgntHn7-eK2X1/view?usp=sharing)
  </Accordion>
</AccordionGroup>


# Finance Compliance
Source: https://help-plum.xoxoday.com/faq/security-compliance/finance-compliance

Find answers to frequently asked questions about Plum's finance compliance practices and internal financial controls.

<AccordionGroup>
  <Accordion title="1. Softex Registration">
    [Open document](https://drive.google.com/file/d/1BdeOUJl-14jww0Dkm3uLHtnLRjKIYlag/view?usp=sharing)
  </Accordion>
</AccordionGroup>


# Governance, Risk and Data Compliance
Source: https://help-plum.xoxoday.com/faq/security-compliance/governance-risk-data-compliance

Find answers to frequently asked questions about Plum's governance, risk management, and data compliance practices.

<AccordionGroup>
  <Accordion title="Are policies and procedures established for labeling, handling and the security of data and objects that contain data?">
    Yes, there are established policies and procedures for labeling, handling, storing, transmitting, retention/disposal, and security of TCCC data and objects which contain data, per the TCCC Information Classification Standard and Protection Measures.
  </Accordion>

  <Accordion title="Are mechanisms for label inheritance implemented for objects that act as aggregate containers for data?">
    Yes, there are established policies and procedures for label inheritance of TCCC data and objects which contain data, per the TCCC Information Classification Standard and Protection Measures. Mechanisms for label inheritance shall be implemented for objects that act as aggregate containers for data.
  </Accordion>

  <Accordion title="Do you adhere to the tenant's retention policy?">
    Yes, we adhere to the retention policy that the tenant sends out for optimal collaboration and smooth user experience with Xoxoday's products and services.
  </Accordion>

  <Accordion title="Can you provide a published procedure for security mechanisms to prevent data leakage in transit and data at rest leakage upon request?">
    Your data is of the utmost importance. All the security mechanisms and policies are established and implemented in such ways that data leak can be prevented, in transit as well as at rest.
  </Accordion>

  <Accordion title="Can you provide tenants, upon request, documentation on how you maintain segregation of duties within your cloud service offering?">
    Yes, the policy, process, and procedure is implemented to ensure proper segregation of duties. These can be asked for and delivered upon tenants' requests. In the event of user-role conflict of interest, technical controls shall be implemented to mitigate risk (if any) from unauthorized/unintentional modification/misuse of organizations' information assets.
  </Accordion>

  <Accordion title="Do you use industry standards (Build Security in Maturity Model [BSIMM] benchmarks, Open Group ACS Trusted Technology Provider Framework, NIST, etc.) to build in security for your Systems/Software Development Lifecycle (SDLC)?">
    Yes, our products comply with all the industrial benchmarks and standards when it comes to the Software Development Life-cycle (SDLC). All software development procedures are supervised and monitored by Xoxoday so that they include:

    * security requirements
    * independent security review of the environment by a certified individual
    * code reviewsQuality monitoring, evaluation, and acceptance criteria for information systems, upgrades, and new versions shall be established and documented for the clients' reference.
  </Accordion>

  <Accordion title="Do you use automated and manual source code analysis tools to detect security defects in code prior to production?">
    Yes, our code reviews and analysis run through stringent eyes of automated technologies as well as manual source code overview to cover any security loopholes prior to the production phase.
  </Accordion>

  <Accordion title="Do you review your applications for security vulnerabilities and address any issues prior to deployment to production?">
    Yes, an independent security review is conducted by certified professionals to look for any security vulnerabilities in order to solve them before deploying to production.
  </Accordion>

  <Accordion title="Do you verify that all of your software suppliers adhere to industry standards for Systems/Software Development Lifecycle (SDLC) security?">
    Yes, our products comply with all the industrial benchmarks and standards when it comes to the Software Development Life-cycle (SDLC) security standard.
  </Accordion>

  <Accordion title="Do you provide tenants with documentation that describes your production change management procedures and their roles/rights/responsibilities within it?">
    Yes, changes to the production environment are documented, tested, and approved prior to implementation. Production software and hardware changes may include applications, systems, databases, and network devices requiring patches, service packs, and other updates and modifications. Any change in roles, rights, or responsibilities shall be documented for a seamless experience.
  </Accordion>

  <Accordion title="Are any of your data centers located in places that have a high probability/occurrence of high-impact environmental risks (floods, tornadoes, earthquakes, hurricanes, etc.)?">
    We have a consistent and unified framework for business continuity planning, disaster recovery, plan development. All the appropriate communications shall be established, documented, and adopted to ensure consistency in business continuity. This includes protection against natural and man-made disasters (e.g. fire, flood, earthquake, war, volcanic activity, biological hazard, civil unrest, mudslide, tectonic activity, utility services outages, etc.).
  </Accordion>

  <Accordion title="Do you provide tenants with geographically resilient hosting options?">
    Our hosting options are limited to Xoxoday's jurisdiction and are backed by prominent business continuity plans. Hence, we don't find the need to provide geographically diverse hosting options.
  </Accordion>

  <Accordion title="Do you provide tenants with infrastructure service failover capability to other providers?">
    The capability to transfer infrastructure service failover to other providers is not provided to the clients.
  </Accordion>

  <Accordion title="Are business continuity and disaster recovery plans subject to test at least annually and upon significant organizational or environmental changes to ensure continuing effectiveness?">
    Business continuity plans shall be subject to test at least annually or upon significant organizational or environmental changes to ensure continuing effectiveness.
  </Accordion>

  <Accordion title="Do you allow tenants to view your SOC2/ISO 27001 or similar third-party audit or certification reports?">
    Along with an aligned enterprise-wide framework, we perform independent reviews through industry professionals along with formal risk assessments. These are done at least annually or at planned intervals to determine the likelihood and impact of all identified risks. With qualitative/quantitative methods ensuring our compliances with policies, procedures, and standards, we stick to the best standards.
  </Accordion>

  <Accordion title="Do you conduct annual network penetration tests of your cloud service infrastructure regularly as prescribed by industry best practices and guidance?">
    Yes, our stringent checks and tests are conducted annually to keep up the cloud service infrastructure hygiene as per the industrial standards.
  </Accordion>

  <Accordion title="Do you perform annual audits (internal and external) and are the results available to tenants upon request?">
    Annual audits are processed both internally and externally. The audit results can be sent over to tenants upon request.
  </Accordion>

  <Accordion title="Are the results of the penetration tests available to tenants at their request?">
    Yes, the tenants can request for penetration results and get the reports from our end.
  </Accordion>

  <Accordion title="Are you storing, transmitting, and/or processing payment card data on behalf of our organization?">
    No, we do not process your payment card data for any reason other than billing purposes.
  </Accordion>

  <Accordion title="Can you prove that you are compliant for: Indian IT Act 2000?">
    Yes, we are compliant with the Indian IT Act of 2000.
  </Accordion>

  <Accordion title="Is there a formal process that details the transition of data from unsupported systems and applications to supported systems and applications?">
    There is no such process available from our end.
  </Accordion>

  <Accordion title="What will you deliver back to us on the end of service?">
    We will terminate the contract as per rules and statutes. Meanwhile your data will be stored with us and won't be given back to you. However, if the tenant wants the data to be erased, it can be done so upon request.
  </Accordion>

  <Accordion title="Do you conduct information audits to determine what personal data is being stored/processed and where is it being stored?">
    Yes, we store data that's required for seamless rewarding and recognition. We conduct regular audits to ensure safety of data like employees' names, emails, employee numbers, etc. are used for verification and rewarding purposes.
  </Accordion>

  <Accordion title="Do you have a dedicated information/cyber security team responsible for information security governance across the organization?">
    Xoxoday's information and cyber-security team keeps a watchful eye on all potential sources of threats and areas of compromise when it comes to information security.
  </Accordion>

  <Accordion title="Have you defined the information security roles and responsibilities?">
    Roles are systematically defined for information security measures to tactfully align all operations, preventing any security breaches.
  </Accordion>

  <Accordion title="Do you have an acceptable usage policy which is signed/agreed by all employees on annual basis?">
    Employees must agree with the acceptable usage policy of peripherals and devices to prevent malicious activities from the inside and out.
  </Accordion>

  <Accordion title="Is your environment SOC-2 Type-II attested or certified for the scope of the service being offered to tenant?">
    Our environment has all the capabilities to be SOC-2 Type-II compliant but the certification is yet to come through. It shall be updated soon.
  </Accordion>

  <Accordion title="Is your environment CSA-certified for the scope of the service being offered to tenant?">
    No, our environment is not CSA-certified.
  </Accordion>

  <Accordion title="Are all relevant legislative, statutory, regulatory and contractual security requirements identified, documented and tracked?">
    Xoxoday keeps track of all security requirements with respect to legislations, statutes, and contracts. They are documented in all steps.
  </Accordion>

  <Accordion title="Are appropriate procedures implemented to ensure compliance with legislative, regulatory and contractual requirements related to intellectual property rights and use of proprietary software products?">
    We have our own procedure for control of documents and records that ensures compliance related to intellectual property rights and use of proprietary software.
  </Accordion>

  <Accordion title="Have you identified legislative, regulatory, contractual and business requirements related to record management?">
    Our record management criteria checks all boxes of legislative, regulatory, contractual and business requirements.
  </Accordion>

  <Accordion title="Do you monitor effectiveness of cyber security controls through regular metrics?">
    With different metrics tracking cyber-security measures, Xoxoday keeps the effectiveness in check with regular monitoring.
  </Accordion>

  <Accordion title="Do you have an approved HR Policy document?">
    Xoxoday's Human Resource operation procedure takes all measures of employee confidentiality into consideration.
  </Accordion>

  <Accordion title="Are your employees screened before joining the organization? Are they bound to keep security of information intact even after their employment contract has ended?">
    Yes, Xoxoday performs a thorough background check on every employee before they get onboard. The Non Disclosure Agreement ensures that the information is secure even after the contract is terminated.
  </Accordion>

  <Accordion title="Do you take services from any third party which directly or indirectly impacts services given to tenant or Client of tenant?">
    Yes, our Xoxoday Store vouchers are procured from third-party vendors. These vouchers are shared with the tenants in order to be showcased to users of Xoxoday platform.
  </Accordion>

  <Accordion title="Can you provide details of these third parties including the name of the third party and the services they will be performing on your behalf?">
    No, the third parties and vendors we deal with our confidential to Xoxoday. Hence, this list cannot be shared.
  </Accordion>

  <Accordion title="Do you have a Third Party Security Policy?">
    Yes, there's a third-party security policy present to safeguard the interests of Xoxoday's tenants as well as the end users.
  </Accordion>

  <Accordion title="Do you regularly monitor the third party's compliance with security obligations?">
    Yes, our third party security policy deems it clear to comply with security obligations and we monitor their compliance regularly.
  </Accordion>

  <Accordion title="Is there a process to address any risk that may occur due to change of services being provided to the tenant?">
    Yes, we have a detailed risk management procedure in place to address situational issues like change of services being provided to tenants.
  </Accordion>

  <Accordion title="Do you permit the use of contractors in roles supporting customer operations?">
    No, our customer requests are addressed by the Xoxoday customer support team for maximum efficiency.
  </Accordion>

  <Accordion title="Do you have subscription to brand protection services?">
    Yes, Xoxoday's brand protection caters to any malicious interruptions and fallacies as they are addressed in prompt time.
  </Accordion>

  <Accordion title="Do you monitor media platforms as well for brand protection?">
    Yes, with media platforms being the biggest pedestal for information sharing, we keep an eye out for any brand protection issues.
  </Accordion>

  <Accordion title="Do you have the capability to detect/prevent unauthorized or anomalous behavior based on network traffic and host activity?">
    Yes, in the event of a rapid spike/slump in network traffic or host activity, Xoxoday analyzes the traffic to detect and prevent unauthorized or erratic behavior.
  </Accordion>

  <Accordion title="Do you have mandatory and regular privacy training and awareness module?">
    Yes, in order to ensure airtight security of data, we have a mandatory and sessional privacy training and awareness module.
  </Accordion>

  <Accordion title="What is CSA?">
    The Cloud Security Alliance (CSA) is the world's leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment.
  </Accordion>

  <Accordion title="Did you list your organization for CSA STAR LEVL – 1 self-assessment?">
    Yes, Please visit the link to view the registry - [https://cloudsecurityalliance.org/star/registry/nreach-online-services-pvt-ltd-xoxoday](https://cloudsecurityalliance.org/star/registry/nreach-online-services-pvt-ltd-xoxoday)
  </Accordion>

  <Accordion title="What are the important features of CSA STAR LEVEL – 1?">
    Important features of CSA STAR LEVL – 1 are listed below

    * Operating in a low-risk environment
    * Wanting to offer increased transparency around the security controls they have in place.
    * Looking for a cost-effective way to improve trust and transparency.
  </Accordion>

  <Accordion title="Are the applications and programming interfaces (APIs) designed, developed, deployed, and tested in accordance with leading industry standards (e.g., OWASP for web applications) and adhere to applicable legal, statutory, or regulatory compliance obligations?">
    Yes, we ensure the same as part of our code review, static code analysis, and Web Application Firewall.
  </Accordion>

  <Accordion title="Do you comply with the Physical security perimeters (e.g., fences, walls, barriers, guards, gates, electronic surveillance, physical authentication mechanisms, reception desks, and security patrols)?">
    Yes, We comply with these requirements. Our Cloud Security Platform, (CSP) Amazon Web Services (AWS) provides these securities to our data centers.
  </Accordion>

  <Accordion title="Do you use Production data in a non-production environment?">
    Production data shall not be replicated or used in non-production environments. We do not use LIVE data in any other environment. We comply with the requirement.
  </Accordion>

  <Accordion title="Do you obtain prior to relocation or transfer of hardware, software, or data to an offsite premise?">
    We take prior authorization from the concerned authority as per the Media protection procedure before relocation or transfer of hardware, software, or data to an offsite premises.
  </Accordion>

  <Accordion title="Do you have a documented application validation process to test for mobile device, operating system, and application compatibility issues?">
    As per Mobile Security Compatibility compliance requirements we have a documented application validation process to test for mobile device, operating system, and application compatibility issues.
  </Accordion>

  <Accordion title="What is the California Privacy Rights Act (CPRA)?">
    The California Privacy Rights Act (CPRA) is a state-wide data privacy bill that amends and expands the existing California Consumer Privacy Act (CCPA). The CPRA works as an addendum to the CCPA, strengthening data privacy rights for California residents, tightening business regulations, and establishing the California Privacy Protection Agency (CPPA) as lead enforcer and supervisor.
  </Accordion>

  <Accordion title="Is Xoxoday compliant with California Privacy Rights Act (CPRA)?">
    Yes. We are compliant with CPRA, and Our solution will continue to offer full compliance with the new and updated data privacy regime.
  </Accordion>

  <Accordion title="Do you provide rights to the consumers with regards to the data processing as per California Privacy Rights Act (CPRA)?">
    Yes. We support our consumers to exercise their rights as per the CPRA.
  </Accordion>

  <Accordion title="Did you implement all the CPRA Privacy controls as per the compliance requirements?">
    Yes. We have implemented all the privacy controls and audited the same with the help of external Auditors.
  </Accordion>

  <Accordion title="Do you make the CPRA Attestation report available for the customers?">
    Yes. Please reach out to our sales representative/Xoxoday POC to have access to the CPRA report.
  </Accordion>

  <Accordion title="Do you collect any data from California citizens who are not 18 years old?">
    No. We do not collect any data from any users across the globe who are not 18 years old.
  </Accordion>

  <Accordion title="Can the data subject authorize an agent (an Authorized Agent) to exercise their rights?">
    Yes. The data subject can authorize an agent (an "Authorized Agent") to exercise their rights. To do this, the data subject must provide your Authorized Agent with written permission to do, and we may request a copy of this written permission from your Authorized Agent when they make a request to exercise the rights.
  </Accordion>

  <Accordion title="How can we submit our request to exercise our Rights Under the CCPA/CPRA?">
    You may submit a Valid Request by emailing [cs@xoxoday.com](mailto:cs@xoxoday.com).
  </Accordion>

  <Accordion title="Do you sell, rent, or share Personal Data with third parties outside of our company?">
    No. We will not sell, rent, or share Personal Data with third parties outside of our company. But Personal Data may be provided where we are required to do so by any privacy laws.
  </Accordion>

  <Accordion title="What is SOC 2 compliance?">
    SOC 2 compliance is part of the AICPA Service Organization Control reporting platform. The goal of SOC 2 is to evaluate organization security and internal controls around security, availability, processing integrity, confidentiality, and privacy.
  </Accordion>

  <Accordion title="What are SOC 2 requirements?">
    SOC 2 Compliances are developed by the American Institute of CPAs (AICPA), it defines criteria for managing customer data based on five "trust service principles"—security, availability, processing integrity, confidentiality, and privacy.
  </Accordion>

  <Accordion title="Is Xoxoday SOC 2 certified?">
    Yes. Xoxoday is SOC 2 certified organization. We have implemented all the required SOC 2 controls and got them Audited with the help of Certified Public Accountants (CPA).
  </Accordion>

  <Accordion title="Is your cloud computing platform (AWS) SOC 2 Compliant?">
    Amazon Web Services (AWS) has achieved SOC 1, SOC 2, and SOC 3 reports. These reports detail the AWS controls environment and implemented controls for AICPA Trust Services Criteria (TSC) and can be leveraged as part of a cloud customer security program. AWS SOC-covered cloud services are audited periodically against the SOC reporting framework.
  </Accordion>

  <Accordion title="How do I request Xoxoday for SOC 2 report?">
    You may reach out to our sales representative/Xoxoday POC to have access to the SOC 2 report.
  </Accordion>

  <Accordion title="Who performs the independent third-party audit of Xoxoday for the SOC Report?">
    Laika Compliance LLC performs the SOC 2 audit for Xoxoday.
  </Accordion>

  <Accordion title="How long is a SOC 2 report valid?">
    The SOC 2 Type I report is valid for one year following the date the report was issued.
  </Accordion>

  <Accordion title="Is SOC 2 an international standard?">
    Yes. SOC 2 is an internationally recognized standard. The SOC 2 report and certification involve an independent audit by a third party.
  </Accordion>

  <Accordion title="Do you conduct a SOC 2 audit every year?">
    Yes. We do conduct the SOC 2 Audit on an annual basis.
  </Accordion>

  <Accordion title="Did all applicable compliances and controls are audited during the SOC 2 attestation process?">
    The Auditor has validated and tested all the applicable SOC 2 controls as per the compliance requirements.
  </Accordion>

  <Accordion title="Do you process Protected Health Information (PHI)?">
    We do not process (Collect/Store) Protected Health Information (PHI).
  </Accordion>

  <Accordion title="Is Xoxoday compliant with the Health Insurance Portability and Accountability Act (HIPAA)?">
    Yes. Xoxoday is compliant with Health Insurance Portability and Accountability Act (HIPAA).
  </Accordion>

  <Accordion title="Do you make the HIPAA Audit report available for the customers?">
    Yes. Please reach out to our sales representative/Xoxoday POC to have access to the HIPAA Audit report.
  </Accordion>

  <Accordion title="Do you have the process in place for providing Access Rights to the data subject as per EU GDPR?">
    Yes. We have implemented the Data Subject Access Rights Procedure to make sure that all the data subjects will have the opportunities to exercise their rights as per the privacy laws.
  </Accordion>

  <Accordion title="What method do you use when deleting customer data if requested to do so?">
    The secure deletion standard like DoD 5220.22-M ECE is being followed and we provide a certificate that the data was properly sanitized from all computing resources and portable storage media.
  </Accordion>

  <Accordion title="Do you have procedures in place for responding to a data subject request that involves a customer's Personal Data?">
    Yes. Xoxoday is GDPR Compliant. We have implemented the Data Subject Access Rights Procedure as per the GDPR and made all the data subject rights available as per the data protection laws. This procedure sets out the key features regarding handling or responding to requests for access to personal data made by data subjects, their representatives or other interested parties.
  </Accordion>

  <Accordion title="Do you perform audits on its Sub-processors to demonstrate their compliance?">
    Yes. We validate the compliance requirements of the Sub-processor and obtain the Compliance certificates and audit reports such as – ISO 27001:2013, SOC 2 Type II, ISO 27017, ISO 27701, ISO 27018, Cloud Security Alliance Controls, etc.
  </Accordion>

  <Accordion title="Do you conduct independent audits? (Third-Party)">
    We conduct the independent Audits for - ISO 27001:2013, SOC 2 Type I, CPRA/CCPA, HIPAA, VA/PT Assessments.
  </Accordion>

  <Accordion title="Does your organization have a plan or framework for business continuity management or disaster recovery management plan and policy in place? Frequency of testing?">
    Xoxoday maintains a disaster recovery program to ensure services remain available or are easily recoverable in the case of a disaster. Customers can stay up-to-date on availability issues through a publicly available status website covering scheduled maintenance and service incident history. The BCP and DR Plans are tested and reviewed every year. The Xoxoday BCP and DR plans are reviewed and audited as part of ISO 27001 standards and SOC 2 Type II covering availability as one of the trust service principles.
  </Accordion>

  <Accordion title="Do you have controls in place to restrict and monitor the installation of unauthorized software onto your systems?">
    Users are not having admin access to their computer machines and only IT Support admins can install or uninstall the softwares.
  </Accordion>

  <Accordion title="Are the responsibilities regarding data stewardship defined, assigned, documented, and communicated?">
    CTOs and Production heads are responsible for safeguarding the customers data. Only authorised individual will have access to the production environment.
  </Accordion>

  <Accordion title="Can you provide a published procedure for exiting the service arrangement, including assurance to sanitize all computing resources of customer data once a customer has exited your environment or has vacated a resource?">
    We delete the customer data upon request/termination of the contract and confirm the secure deletion. Our data cleaning process goes through an organized purge. Once the data is purged, it's purged from all places.
  </Accordion>

  <Accordion title="Do you classify your assets in terms of business criticality, service-level expectations, and operational continuity requirements?">
    We clasify the Information assets into Confidential, Restricted , Internal and Public etc..
  </Accordion>

  <Accordion title="Do you maintain a complete inventory of all of your critical assets located at all sites/ or geographical locations and their assigned ownership?">
    We maintain the records of all our assets.
  </Accordion>

  <Accordion title="Do you have procedures and technical measures in place for data access segmentation in multi-customer system architectures?">
    we logically segregate the tenant's data, and it is segregated with a client-specific key for proper handling and security reasons.
  </Accordion>

  <Accordion title="Is user access to diagnostic and configuration ports restricted to authorized individuals and applications?">
    We have restricted the ports for all the users as per Xoxoday IT Policy
  </Accordion>

  <Accordion title="Do you support password (e.g., minimum length, age, history, complexity) and account lockout (e.g., lockout threshold, lockout duration) policy enforcement?">
    The password needs to be minimum 8 characters long and should contain at least one capital letter, special characters among '# \$ % \* &' and 1 digit Maximum Password Age – 45 days Minimum Password Age – 1 day Computer machines will lockout in 15 mins from the time it became inactive.
  </Accordion>

  <Accordion title="Is physical and logical user access to audit logs restricted to authorized personnel?">
    Yes. Only authorised individual have access.
  </Accordion>

  <Accordion title="Can you provide evidence that due diligence mapping of regulations and standards to your controls/architecture/processes has been performed?">
    We use best practices and industry standards to achieve compliance with industry-accepted general security and privacy frameworks. We use enterprise-class security features and conduct comprehensive audits of our applications, systems, and networks to protect customer and business data. Our customers rest easy knowing their information is safe, their interactions are secure, and their businesses are protected. Please click here to know about Xoxoday Security framework - [https://www.xoxoday.com/security](https://www.xoxoday.com/security)
  </Accordion>

  <Accordion title="Is system performance monitored and tuned in order to continuously meet regulatory, contractual, and business requirements for all the systems used to provide services to the customers?">
    We are compliant. We monitor the system performance.
  </Accordion>

  <Accordion title="Do you maintain current architecture diagrams that include data flows between security domains/zones?">
    Yes. We maintain current architecture diagrams that include data flows between security domains/zones
  </Accordion>

  <Accordion title="Are operating systems hardened to provide only the necessary ports, protocols, and services to meet business needs using technical controls (e.g., antivirus, file integrity monitoring, and logging) as part of their baseline build standard or template?">
    All operating systems are hardened as per Xoxoday hardening guidelines.
  </Accordion>

  <Accordion title="Do you use a network segregated from production-level networks when migrating physical servers, applications, or data to virtual servers?">
    We are compliant. We have deployed our applications on AWS Virtual platform cloud.
  </Accordion>

  <Accordion title="Do you provide policies and procedures (i.e. service level agreements) governing the migration of application data to and from your service?">
    Please click here for SLA - [https://drive.google.com/file/d/1LatFZLoRzeRlQf4mEemzL8XsO71YGahk/view](https://drive.google.com/file/d/1LatFZLoRzeRlQf4mEemzL8XsO71YGahk/view)
  </Accordion>

  <Accordion title="Do you maintain liaisons and points of contact with local authorities in accordance with contracts and appropriate regulations?">
    Appropriate roles and responsibilities have been defined and documented. Finance, Leagl, Admin, Infosec departments are active part of it.
  </Accordion>

  <Accordion title="Do you integrate customer requirements into your security incident response plans?">
    Since its SaaS platform is not applicable.
  </Accordion>

  <Accordion title="Have you tested your security incident response plans in the last year?">
    Yes. we conduct the testing on frequent basis to comply with the requirements.
  </Accordion>

  <Accordion title="Does your incident response plan comply with industry standards for legally admissible chain-of-custody management processes and controls?">
    Yes. Its compliant with ISO 27001 and SOC 2 trust service principles.
  </Accordion>

  <Accordion title="Do you design and implement controls to mitigate and contain data security risks through proper separation of duties, role-based access, and least-privileged access for all personnel within your supply chain?">
    Yes. We mitigate all the risk identified.
  </Accordion>

  <Accordion title="Do you make security incident information available to all affected customers and providers periodically through electronic methods (e.g., portals)?">
    We inform the customer if there is any incidents as per the security and privacy laws.
  </Accordion>

  <Accordion title="Do you perform annual internal assessments of conformance and effectiveness of your policies, procedures, and supporting measures and metrics?">
    Yes. We do conduct an internal Audit.
  </Accordion>

  <Accordion title="Do third-party agreements include provision for the security and protection of information and assets?">
    Yes. Privacy and security is a part of the Master Service agreements.
  </Accordion>

  <Accordion title="Are systems in place to monitor for privacy breaches and notify customers expeditiously if a privacy event may have impacted their data?">
    Xoxoday is compliant with GDPR, HIPAA, CCPA/CPRA privacy laws. And we inform the customer if there is any data breaches as per the compliance requirements.
  </Accordion>

  <Accordion title="Do you have the ability to measure and address non-conformance of provisions and/or terms across the entire supply chain (upstream/downstream)?">
    Yes. We provide report on SLA.
  </Accordion>

  <Accordion title="Do you mandate annual information security reviews and audits of your third party providers to ensure that all agreed upon security requirements are met?">
    We do conduct an External Audit with the help of the independent auditor.
  </Accordion>

  <Accordion title="Do you verify that your software suppliers adhere to industry standards for Systems/Software Development Lifecycle (SDLC) security?">
    Yes. we conduct the assessment on annual basis.
  </Accordion>

  <Accordion title="All sub-processors are subject to regular due diligence">
    AWS is a sub-processor as we are storing data on AWS VPC. And they are AWS SOC 2, ISO 27001, ISO 27017 and ISO 27018 certified We monitor the compliances of sub-processor on frequent basis.
  </Accordion>

  <Accordion title="Privacy training is provided to all staff on induction and at least annually thereafter">
    We continuosly train employees on privacy and security.
  </Accordion>

  <Accordion title="Do you have a member in your organisation with dedicated information security duties?">
    Yes. We have member in our organisation with dedicated information security duties. Xoxoday's primary security focus is to safeguard our customers or users data. This is the reason that Xoxoday has invested in the appropriate resources and controls to protect and service our customers.
  </Accordion>

  <Accordion title="Do employees have a unique log-in ID when accessing data?">
    All our employees are having the unique log in IDs.
  </Accordion>

  <Accordion title="Are network boundaries protected by firewalls?">
    We have installed the firewall for maximum securty and configured to restrict unauthorized traffic
  </Accordion>

  <Accordion title="Are all servers, end user devices (All systems) configured according to security standards as part of the build process?">
    All are configured according to security standards as part of the build process
  </Accordion>

  <Accordion title="Has the Data back-up and recovery process been verified?">
    Its part of our Internal and external Audits and validated by the indeendent auditors.
  </Accordion>

  <Accordion title="Is there formal control of access to System Administrator privileges?">
    We have implemented the access control policy and access will be provided only upon need and approval basis. Attached the access control policy.
  </Accordion>

  <Accordion title="Are servers configured to capture who accessed a system and what changes were made?">
    We have track of the changes. Infrastructure logs are collected using the AWS Audit Trail, meanwhile the application related logs are collected in our Elastic Search server and retained in the long term cloud storage.
  </Accordion>

  <Accordion title="Are computer rooms protected against fire and flood?">
    We have installed Smoke detectors and Fire extinguishers for physical security.
  </Accordion>

  <Accordion title="Are security incidents reviewed to capture the root cause and act on key learnings?">
    security incidents reviewed to capture the root cause.
  </Accordion>

  <Accordion title="Does the organisation receive an SSAE-16 SOC Report?">
    We are SOC 2 compliant and we have engaged Laika Compliance LLC, an independent assessor firm, to conduct a SOC 2 Type 1 and SOC 2 Type 2 examination for the Xoxoday Platform against the Security and Confidentiality Trust Services Categories.
  </Accordion>

  <Accordion title="Does the organisationis been audited for ISO 27001 or for other security standards?">
    Attached the ISO 27001:2013 certificate.
  </Accordion>

  <Accordion title="Does the Cloud Hosting Provider provide independent audit reports (e.g., Service Operational Control - SOC) for their cloud hosting services?">
    We provide Software as a Service.(SAAS). We are ISO 27001 certified and GDPR compliant. Attached the document.
  </Accordion>

  <Accordion title="Is the Cloud Service Provider certified by an independent third party for compliance with domestic or international control standards (e.g., the National Institute of Standards and Technology - NIST, the International Organization for Standardization - ISO)?">
    We are ISO 27001 certified and GDPR compliant. Attached the document.
  </Accordion>

  <Accordion title="Do employees/contingent workers who have remote access connect to the customer network?">
    Since it's a SaaS prodcut and deployed on cloud virtual platform only authorised individual have an access to the our production environment on need and approval basis.
  </Accordion>

  <Accordion title="If an employee no longer requires remote access to the customer network, is there a process to inform the the customer in a timely manner to revoke access?">
    We inform the client to revoke access.
  </Accordion>

  <Accordion title="Are controls implemented to restrict sharing of files via conferencing/collaboration tools to the external parties (Microsoft Teams, Skype, Cisco WebEx etc.)?">
    We use Google workspace and have secure mode of sharing the data.
  </Accordion>

  <Accordion title="Does the current DLP solution have the capability to monitor all the endpoints within the Organization?">
    We can manage all the enpoints centrally.
  </Accordion>

  <Accordion title="Is client scoped data collected, accessed, transmitted, processed, or retained that can be classified as personally identifiable financial information under the Gramm-Leach-Bliley Act?">
    We have implemented the security measures to manage the risks introduced during the use of Organization's information assets used for managing Personally Identifiable Information.
  </Accordion>

  <Accordion title="Is there a formalized Risk Assessment process that identifies, quantifies, and prioritizes risks based on the risk acceptance levels relevant to the organization?">
    We have a formal risk assessment process and conduct the risk assessment annually.
  </Accordion>

  <Accordion title="Do contracts with all subcontractors include Non-Disclosure/Confidentiality Agreements, data breach notification, Indemnification/liability and termination/exit clause?">
    All the contractors/vendors have signed the NDA and contracts All the necessary clauses has been included in the agreements with regards to Confidentiality, liabilities, termination etc
  </Accordion>

  <Accordion title="Is Risk Assessment Activity carried out for the organization covering the processes and assets of the customer operations?">
    Yes. We do conduct the Risk Assessment every year.
  </Accordion>

  <Accordion title="Does the organization has a mechanism to classify & protect sensitive IT assets covering the customer operations?">
    Yes. We have implemented the Data security and Information clasification policy. Attached the same.
  </Accordion>

  <Accordion title="Do all employees, contractors and third party users sign terms and conditions of employment stating that they agree to adhere to the information security requirements for their role(s) within the organization?">
    Yes. They have signed for the agreements.
  </Accordion>

  <Accordion title="Describe the security controls in place to restrict physical entry & exit (e.g. badge access control systems, biometric systems, man traps, etc)">
    We have a biometric systems and access cards. only authorised individual can have access.
  </Accordion>

  <Accordion title="What are the fire protection & detection mechanisms placed in critical IT locations pertaining to the customer operations?">
    We have deployed Sensors for fire detection and fire extinguishers to detect and protect from the fire.
  </Accordion>

  <Accordion title="Are the major changes affecting the risk profile of the provider environment notified to the customer?">
    Yes, we will notify
  </Accordion>

  <Accordion title="Is there an established SPOC for notifying these changes and ensuring documentation?">
    Yes. Our Customer support team will notify.
  </Accordion>

  <Accordion title="Are user e-mail accounts at the vendor processing facility created after necessary management / HR approvals?">
    Yes. We create an email accounts only after the approval from reporting managers.
  </Accordion>

  <Accordion title="Are e-mail ids created if the vendor operations are outsourced / sub-contracted to other parties? If yes, Are proper approvals taken for the same?">
    We have not outsourced and does not create any email ids
  </Accordion>

  <Accordion title="Is there a structured mechanism for ensuring accountability of shared email accounts, if any?">
    Yes. IT Team is responsible.
  </Accordion>

  <Accordion title="Describe your company's policies, procedures, and practices regarding email security controls?">
    Yes. We have a Email Security Policy and attached the same
  </Accordion>

  <Accordion title="Is attachment size defined? Are the mail attachments for the customer process scanned for Virus and other malicious content?">
    Yes, we have implemented the security controls for email with the help of Google workspace and installed the end point security for all the laptops of the employees. All the incoming and outgoing attachments are scanned.
  </Accordion>

  <Accordion title="Does e-mail communication from the vendor include a standard disclaimer as a part of the contents?">
    Yes.
  </Accordion>

  <Accordion title="Is there restriction for usage & access to internet from systems in the customer operations?">
    Yes, We have implemented the Acceptable Usage Policy and have restricted for usage and access to internet.
  </Accordion>

  <Accordion title="Has the vendor maintained redundancy for firewall & other network components? How it is ensured that network uptime is 100%">
    As part of Web Application Firewall (WAF), rate limiters are installed to block multiple requests from specific IPs in order to prevent DDOS-type attacks. Since our application is deployed on AWS cloud we will ensure the best uptime in the insudtry.
  </Accordion>

  <Accordion title="Do the modifications in the firewall rule-base for the customer operations go through the change management routine?">
    Yes. All the changes takes place as per the change management policy implemented.
  </Accordion>

  <Accordion title="Is there a mechanism to ensure that only licensed softwares / applications are installed on the systems?">
    Yes. We have software register and only approved and licensed softwares will be used.
  </Accordion>

  <Accordion title="Is each operating system up to date with patches provided by the manufacturer?">
    Yes, all are up to date.
  </Accordion>

  <Accordion title="Whether the capacity demands are monitored and projections of future capacity requirements are made, to ensure that adequate processing power and storage are available. Example: Monitoring hard disk space, RAM and CPU on critical servers.">
    Yes, we have capacity planning and monitor the hard disk space, RAM, CPU etc.
  </Accordion>

  <Accordion title="Does the vendor address AntiVirus Signature Management covering systems used for the customer operations? Is frequency defined?">
    All the employees laptop is secured with Bitdefender end point security software
  </Accordion>

  <Accordion title="Are the AV signatures up to date?">
    Yes
  </Accordion>

  <Accordion title="Did the business continuity test include all third parties, including sub-contractors, that support the the customer's business process?">
    Yes. Taken into consideration
  </Accordion>

  <Accordion title="What is the frequency of these tests?">
    Annually
  </Accordion>

  <Accordion title="Does the organization have a documented IT DR plan addressing people, process & systems related to the customer operations? Is it communicated to concerned employees?">
    Yes. Attached the same.
  </Accordion>

  <Accordion title="What were the criteria for selecting CSP? (Capability of securely handling Critical Information, Reputation, Financial Position, Market Recognition, past security breaches, past service history, Cost etc) Please share the documents / records.">
    We do consider all of these, addition to that we also validate the controls in place with regards to cloud security, BCP, Uptime etc. AWS is ISO 27001, SOC 2 Type II certified and complied with CSA start level 2. Please click here for more details about AWS Compliance Programs - [https://aws.amazon.com/compliance/programs/](https://aws.amazon.com/compliance/programs/)
  </Accordion>

  <Accordion title="Is there a legal agreement signed between vendor and CSP?">
    Yes. We have an agreement.
  </Accordion>

  <Accordion title="How does vendor ensure protection against Malicious Code and Monitoring on cloud?">
    We have implemented policies and procedures as per ISMS and GDPR requirements. We also conduct periodical Internal and external Audit by the third party Auditor. We have deployed our application on Cloud Virtual platform for maximum security. We use Bitdefender End point security software to prevent from malware and protect the data. In addition to that we also have AWS Guard Duty threat detection service that continuously monitors for malicious activity and unauthorized behaviour. We conduct periodical Vulnerability assessment and Penetration Testing from the Inductry approved authorized vendor to make sure that all the vulnerabilities are closed and having secured applications.
  </Accordion>

  <Accordion title="How does vendor along with CSP ensure that Change Management to be followed for changes related to the customer services at cloud environment?">
    Xoxoday and AWS both are ISO 27001:2013 certified and implemented the change management procedure. We ensure that we follow the policies and procedures with regards to any changes to be made.
  </Accordion>

  <Accordion title="Does security controls implemented by CSP are as per Internationally accepted guidelines / standards (e.g. CSA Cloud Matrix, NIST, SANS, CIS Critical Controls, OWAPS, ISO)?">
    Yes. AWS is ISO 27017, ISO 27001:2013, ISO 2018, SOC 2 certified.
  </Accordion>

  <Accordion title="Is there a provision of demanding and review of compliance certificate like ISO27001 / PCI:DSS / NIST etc from CSP?">
    Yes. Attached the AWS ISO 27001 certificate
  </Accordion>

  <Accordion title="Does CSP is having documented and tested Business Continuity (BCP) and Disaster Recovery Plan (DRP) available with consideration of multifacility deployment within India for the customer related services?">
    Yes. Tested our BCP plan
  </Accordion>

  <Accordion title="How does vendor and CSP ensure the confidentiality, integrity, availability and privacy of data collected, processes, stored and disposed through cloud services?">
    We ensure that we maintain confidentiality, integrity, availability and privacy of data collected, processes, stored through implementing policies and procedures. And we do conduct the internal and external Audits periodically to make sure that all the controls are working effeectively.
  </Accordion>

  <Accordion title="Are the roles and responsibility / duties for cloud services engagement clearly been segregated between the customer and vendor and between Vendor and CSP?">
    Yes
  </Accordion>

  <Accordion title="Is there a communication procedure available along with escalation matrix for vendor?">
    Yes
  </Accordion>

  <Accordion title="In event of legal / federal investigation of CSP / other tenants, how the security (C, I & A) of Vendor / the customer data is being maintained?">
    Since we have logically segregated the data and ISO 27001 certified and GDPR compliant we do not disclose or provide any of the the customer data.
  </Accordion>

  <Accordion title="Has the service been audited in the past year for any of the following, by any independent entities? - Privacy - Information Security - Disaster Recovery - Operations - Technology - Other:">
    Yes. Audited by the independent Auditor and all the aspects of Privacy, information security, BCP, DR, Production, VAPT has been validated.
  </Accordion>

  <Accordion title="Have any of the audits addressed above resulted in any exceptions or findings?">
    NO
  </Accordion>

  <Accordion title="What is the production site physical address (DC, DR and Operations Location)?">
    Production Site - No.17, Bhagyalakshmi Square, 2nd Floor, Sector 3, HSR Layout, Bangalore -560102 We have deployed our application on AWS Singapore. Since we have deployed our application on AWS cloud they only provide DR Services.
  </Accordion>

  <Accordion title="Are there any additional location(s) where target data (the customer data) is stored/ accessed/ processes/ transferred/ administered?">
    No other location
  </Accordion>

  <Accordion title="Please provide details in the following areas in scope to services being provided to the customer: - Operating system(s) - Workstations # of devices - Servers # of devices - List Applications in scope. - Number of employees by function (e.g., development, systems operations, information security)">
    We provide our application to the customer. We have 230+ employees. 100+ employees are involved in the production/devolopment and we have a sepearate team for IT Support and Information security. We have provided separate computers to each employees. Altogether we are having around 250 computer machines. Our application is deployed on AWS cloud virtual platform.
  </Accordion>

  <Accordion title="Share following certifications/ assessment reports: - any Security/ privacy/ compliance related certifications, clearly mentioning all the scoped location and services/ applications/ products/ platforms (ISO 27001; SOC - 2 Report etc.) - latest cloud security reports (e.g. AWS Inspector Report; Azure Security and Compliance Centre Threat Management report etc.)">
    We are ISO27001;2013 certified and GDPR compliant.Attached the ISO 27001:2013 certificate. We are SOC 2 compliant and in the last phase of final Audit. Attached the engagement letter that we have with our external Auditors.
  </Accordion>

  <Accordion title="Details of control mechanism which will be deployed by the function to ensure that the service provider does not violate the internal norms of the insurer or the regulatory requirements set in the local regulator's guidelines? For example sample testing, maker checker, system controls, etc.">
    Xoxoday is ISO 27001:2013 certified, GDPR compliant and SOC 2 type I certified organization and have all the required technical and organizational controls in place and auditred during the internal and external audits.
  </Accordion>

  <Accordion title="Are all the information systems equipment's maintained in accordance with the supplier's recommended service intervals and specifications? Are records kept of all suspected or actual faults and all maintenance activities performed on equipment's? Is the maintenance carried out by authorized personnel only?">
    We are ISO 27001 Certified organization. We make sure that all the required records are maintained and compliant with the requirements.
  </Accordion>

  <Accordion title="Do you have documented procedures for the identification, capture, tracking, escalation and resolution of operational problems/incidents (all systems, applications or facility-related problems)? Do you have any Security incident reporting / handling and breach response procedures? Are procedures established to intimate BSLI of information security incidents concerning BSLI data?">
    Attached the Security Incident Reporting & Response Procedure and Incident Management Procedure
  </Accordion>

  <Accordion title="Do you maintain an information labelling and handling procedures? Are documented information tagged/labelled as per your asset classification schema which is at par with BSLI Information classification policy?">
    We have implemented the Information classification Policy to protect against unauthorised access, disclosure, modification, or other misuse. All our assets are labelled as per the requirement.
  </Accordion>

  <Accordion title="Are access privileges associated with each system product allotted to users on a need-to-use and event-by-event basis? Are users provided administrator rights on their systems? Do you maintain a repository of personnel with administrator privileges and other high-level privileges per application, OS, database, network system? Do you have specific procedures established and maintained in order to avoid the unauthorized use of generic administration user IDs (super admin, super user IDs), according to systems' configuration capabilities">
    Access to data and systems are based on the principles of least privilege for access. Accordingly, all information systems and data are classified and further segregated to support role-based access requirements. A strong identification and authentication system and logging systems are deployed and provide a centralized control to administer, monitor and review all critical access. We have a role-based access system through access control policy to make sure that only the authorised individual has access to the required information. An Identity and Access Management (IAM) solution has been defined to manage user access through role-based access profiles that support the implementation of accesses based on the principles of need-to-know basis and support segregation of duties. The approvers are either the Product Heads or respective function Heads are their authorized delegates.
  </Accordion>

  <Accordion title="Are secure work areas adequately protected against environmental hazards? Do you have fire alarm/suppression systems installed across office (secure areas/work areas)? Do you have a VESDA system installed? Do you have temperature and humidity controls deployed? Do you have UPS and DG set systems in place? Do you have precision AC's installed? Do you have smoke detectors installed?">
    We have the Fire alarams, Smoke detectors, UPS, Temperature controler, Air conditioner, etc.. for protecting against the environmental hazards.
  </Accordion>

  <Accordion title="Are users required to sign a statement to keep personal secret authentication information confidential and to keep group information (i.e. shared) secret authentication information solely within the members of the group?">
    Yes, all our - both full-time and on-contract are bound by an agreement of non-disclosure and a confidentiality agreement as a condition of employment to protect the customers and tenant's information.
  </Accordion>

  <Accordion title="Do you use CCTV cameras to monitor the facility on a 7x24-hour basis? If Yes, are all cameras operating and positioned properly to view activity at all entrances/exits to the facility and sensitive areas (e.g.. call center, computer room)?">
    We use the CCTV cameras to monitor the building on a 24\_7\_365 basis. All the enterances, exit, restricted areas are under surveilance for security reasons.
  </Accordion>

  <Accordion title="Is there a dedicated team responsible for Information Security?">
    Yes. We have the Information security team.
  </Accordion>

  <Accordion title="Whether all network Infra (Router, Switch, Firewall, etc.,) are integrated with the Service provider Domain and that a central IDAM solution or TACACS (Radius) is implemented for managing access to the network components?">
    We are compliant
  </Accordion>

  <Accordion title="Whether audit requirements and activities involving checks on operational systems are carefully planned and agreed to minimize the risk of disruptions to business process? Do you agree to allow BSLI Auditors or Contracted Third Parties conduct IS Audit at your premise? Do your agree to allow Surprise Adits to be conducted by BSLI Auditors or Contracted Third Parties?">
    In accordance with Data Protection Laws, we make available to Controller on request in a timely manner such information as is necessary to demonstrate compliance by Processor with its obligations under Data Protection Laws. Upon Controller's written request and subject to the confidentiality obligations set forth in the Agreement, we will make available to Controller a copy of Nreach the most recent third-party audits or certifications, as applicable. We do not agree for the Surprise audits.
  </Accordion>

  <Accordion title="The organization has a Disaster Recovery Plan in place to support its key products & services? The organization has a Test Calendar in place to test its Disaster Recovery Plan? Disaster Recovery Plan is tested atleast once in a year and test results/learnings are communicated to the customer? The organization has a Business Continuity Policy in place?">
    We have the Buiness continuity and Disaster Recovery Plan in place. These controls has been tested at least annually as per the compliacne requirements. Attached the policies for your referrence.
  </Accordion>

  <Accordion title="The organization has a Crisis Management in place for any Crisis Impacting its Operations? The organization has a Business Continuity/Alternate Site Plan in place to support/resume its key products & services? The Business Continuity plan complies to the recovery requirements of the customer (RTO,RPO & ROL) The organization has a Pandemic Plan in place to support its key products & services? The organization has a Test Calendar in place to test its Business Continuity / Alternate Site Plan? Business Continuity / Alternate Site Plan is tested atleast once in a year and test results/learnings are communicated to the customer?">
    We have the Crisis management is in place. Attache the same. We have provided an option to work from home/remotely due to this pandamic with necessary infrastructure and security. Business continuity plan has been tested on annual basis and audited during the internal and external audits. Atatched the business continuity policy and plan.
  </Accordion>

  <Accordion title="No Generic IDs to issued / used within the application">
    Generic IDs are not used
  </Accordion>

  <Accordion title="Appropriate architecture and processes to be set to ensure application meets the availability requirements through implementaton of HA / DR and Processes like Backup and restoration For SaaS applications SLAs need to be adhered to as well for uptime assurances provided">
    [Please click here for SLA - https://drive.google.com/file/d/1LatFZLoRzeRlQf4mEemzL8XsO71YGahk/view](https://drive.google.com/file/d/1LatFZLoRzeRlQf4mEemzL8XsO71YGahk/view)
  </Accordion>

  <Accordion title="Ability to selective delete any Sensitive / PII information basis retention policy, customer request or as needed due to any business requirement">
    We have the ability to delete the data upon request by the data subject or termination of the contract. Attached the data retension and disposal policy.
  </Accordion>

  <Accordion title="Does your organisation have a pandemic plan? Please submit a copy of the Pandemic plan mentioning the business continuity strategies for services rendered to the customer">
    We have implemented the Business continuity policy and we have the ability to resume our operation from potential threats, Pandemic, flood, fire, earthquake etc. Due this pandemic/WFH situation, VPN access has been enabled with 2FA For such authorized individuals, for ensuring business continuity. We have the required controls in place for working from home or remotely due to this pandemic situation.
  </Accordion>

  <Accordion title="Is there a designated point-of-contact for pandemic preparedness activities within the organisation? If yes, please share details">
    Its a part of our Business continuity plan and IT Support Head, HR Head, CTO, Infosec Head will be involved in the preparedness activities.
  </Accordion>

  <Accordion title="How would your company protect its employees and clients against getting infected in the Workplace? Please elaborate">
    We have provided WFH option to all the employees to get protected from COVID 19.
  </Accordion>

  <Accordion title="Is there a mechanism to identify and send sick employees or visitors home? Please elaborate">
    We have provided WFH option to all the employees to get protected from COVID 19.
  </Accordion>

  <Accordion title="Are the mentioned business continuity strategies tested in the last 12 months?">
    We test the Business continuity plan on annual basis. It was tested in the month of Aug 2021 for the last time.
  </Accordion>

  <Accordion title="Does the business continuity strategies defined for pandemic fulfill the Recovery Time Objective, Recovery Point Objective & Revised Operating Level (MBCO) requirements as agreed contractually or mutually">
    It has been well defined in the in the Business continuity policy and plans. Attached the same for your referrence.
  </Accordion>

  <Accordion title="Are Crisis communicaiton procedures defined to notify the customer in case of any impact to your organisation due to pandemic situation and providing periodic updates on the developments.">
    We inform our customer on any crisis and if that is effecting on our customers.
  </Accordion>

  <Accordion title="Does Supplier consider itself a Controller or Processor, or Joint Controller with the customer?">
    Xoxoday is a data processor.
  </Accordion>

  <Accordion title="Does Supplier have an automatic method for advising the customer of new Sub Processors?">
    NO. We obtain consent before such activities from the customer.
  </Accordion>

  <Accordion title="Does Supplier have adequate written agreements on data protection requiring appropriate technical and organisational measures in place with such Sub Processors or will be put into place prior to any subcontracting?">
    We have the DPA and appropriate controls in place – We are compliant.
  </Accordion>

  <Accordion title="What certifications does Supplier have in place (i.e. SSAE 16 or ISAE 3402, ISO 27001 etc.)?">
    ISO 27001;2013, SOC 2 Type I Certified and GDPR compliant.
  </Accordion>

  <Accordion title="Does Supplier have business continuity plans that have been implemented and tested?">
    YES. We have implemented the Business continuity plans and tested them annually.
  </Accordion>

  <Accordion title="Does Supplier have cybersecurity insurance? If so, please provide material details of the coverage?">
    No. But we are in the process of getting the insurance from the Insurance company.
  </Accordion>

  <Accordion title="Confirm how Supplier demonstrates compliance with its data processing obligations.">
    We conduct the internal and External audits on a periodical basis as per the compliance requirements and obtain Audit reports and certifications. We provide the same with the customers.
  </Accordion>

  <Accordion title="Provide any details on whether the Supplier is subject to any enforcement actions, investigations, inquiries, or litigation related to privacy or information security relating to the processing of Personal Data?">
    NO. We are not subjected to any actions as such.
  </Accordion>

  <Accordion title="Provide the detailed Technical Architecture description of all the components of the proposed solution including monitoring solutions used by the provider">
    application by Xoxoday, the RnR platform is a cloud-based SaaS platform hosted on VPC infrastructure of AWS. The data centers are hosted completely in isolation so that the access is limited and controlled. Each instance (EC2 Instance) under fortified VPC network is further conglomeration of Docker Container Web Services and APIs and application layer running on top of it. This helps in managing various aspects and features of application without affecting the functioning of each other and achieving a modular architecture to work as plug and play model. Amazon Cloud Watch is implemented to enable monitoring of the functioning of the application. We have Web application firewall (WAF), IDS/IPS, AWS Guardduty, and the data has been encrypted for security reasons. Attached the Architecture diagram.
  </Accordion>

  <Accordion title="Can you list the security certifications of you company and can the customer get a certificate/report of the relevant certications">
    Xoxoday is ISO 27001:2013 certified and GDPR compliant.
  </Accordion>

  <Accordion title="Provide an overview of the various standards, methodologies, processes and tools used to build in Security in your SDLC and detect security defects and vulnerabilities in your applications (internal or outsourced developments) prior to deployment to production (BSIMM, NIST, Manual or automated source code analysis, peer review, etc)">
    Xoxoday is ISO 27001:2013 certified and GDPR compliant. And we follow ISO 27001, NIST, CSA standards and best practices. We have Web application firewall (WAF), IDS/IPS, AWS Guardduty, Coudflare and the data has been encrypted for security reasons. We conduct code reviews as per the compliance requirements. We also conduct the Vulnerability assessment and penetration testing on annual basis with the help of the third party authorised vendor. Attached the latest VAPT certificate and ISO 27001 certificate.
  </Accordion>

  <Accordion title="Can the customer get a copy of the last 2 reports of each of the audits performed and the action plan conducted to fix the identified issues?">
    Attached the ISO 27001:2013 certificate and 1st Year Surveilance audit report. We did not have any non-confirmities.
  </Accordion>

  <Accordion title="Describe the status of your readiness regarding European Directive EU 2016/1148 (NIS Directive) regarding the Security of the Network and Information System">
    We are compliant with the data privacy and security requirements. We are having the controls in place with regards to Cyber security, Risk management, crisis management, business continuity, Network security, application security etc. Attached the Business continuity management and Cyber Crisis Management Plan, incident management procedures, SDLC etc.
  </Accordion>

  <Accordion title="Provide the Continuity of Activity plan in place, including the frequency of the tests performed to ensure continuing effectiveness">
    Attached the Business continuity plan and procedure. We test the BCP controls on annual basis as per the compliance requirements and it has been auditted during the internal and external audits.
  </Accordion>

  <Accordion title="Provide an overview of the various standards, methodologies, tools, policies and processes in place to support service operations (ITIL v4 and COBIT 5, etc.)">
    Xoxoday is ISO 27001:2013 certified, CSA START Level 1 and GDPR compliant. And we follow ISO 27001, NIST, CSA standards and best practices. We have Web application firewall (WAF), IDS/IPS, AWS Guardduty, Coudflare and the data has been encrypted for security reasons. We conduct code reviews as per the compliance requirements. We also conduct the Vulnerability assessment and penetration testing on annual basis with the help of the third party authorised vendor. Attached the below policies and procedures - 1. Encryption Policy 2. Password Management Policy 3. IT Policy 4. Information Classification Policy 5. Threat and Vulnerability Management 6. Cyber Crisis Management Plan 7. Backup Recovery Procedure 8. Access Control Procedure 9. Incident Management Procedure 10. Change Management Procedure
  </Accordion>

  <Accordion title="Describe how high availability of the proposed solution is addressed including redundancy mechanisms, geographical resilient hosting options, service failover capability to other providers, etc. Also describe the process in place to test redundancy and how frequent the test is performed.">
    Data centers are designed to anticipate and tolerate failure while maintaining service levels. In case of failure, automated processes move traffic away from the affected area. These are tested on annual basis. AWS is also ISO 27001, ISO 27017, ISO 27701, ISO 27018, SOC 2 compliant organizatin. Please click here for more details - [https://aws.amazon.com/compliance/programs/](https://aws.amazon.com/compliance/programs/) Please click here to know more about AWS security - [https://aws.amazon.com/compliance/data-center/controls/](https://aws.amazon.com/compliance/data-center/controls/) Please click here to know more about Xoxoday Service level agreement - [https://drive.google.com/file/d/1LatFZLoRzeRlQf4mEemzL8XsO71YGahk/view](https://drive.google.com/file/d/1LatFZLoRzeRlQf4mEemzL8XsO71YGahk/view)
  </Accordion>

  <Accordion title="Describe the SLAs you are committed to regarding the impact of any disruption of your organization to your customers (degraded performances, service interruption, etc.) and what security KPI are made available to the customer in the contractual SLAs engaging the provider">
    Please click here to know more about Xoxoday Service level agreement - [https://drive.google.com/file/d/1LatFZLoRzeRlQf4mEemzL8XsO71YGahk/view](https://drive.google.com/file/d/1LatFZLoRzeRlQf4mEemzL8XsO71YGahk/view)
  </Accordion>

  <Accordion title="Provide an overview of your Data Governance policy and its associated management system to monitor continuous compliance.(i.e. identification and location of sensitive data, protection from unauthorized use, access, loss, etc...)">
    Please click here to know more about data governance - [https://www.xoxoday.com/gdpr](https://www.xoxoday.com/gdpr)
  </Accordion>

  <Accordion title="Provide the documentation regarding your program in place to manage risk">
    Attached the Risk Management Procedure
  </Accordion>

  <Accordion title="Do you have a cyber insurance?">
    We have plan for having the cyber insurance. - In progress.
  </Accordion>

  <Accordion title="Describe how you provide training about Security and compliance to your staff, how often the awareness is performed, how you document their acknowledgment and the formal disciplinary or sanction policy established for employees who have violated security policies and procedures.">
    Each employee, when inducted, signs a confidentiality agreement and acceptable use policy, after which they undergo training in information security, privacy, and compliance. Furthermore, we evaluate their understanding through tests and quizzes to determine which topics they need further training in. We provide training on specific aspects of security that they may require based on their roles. We have implemented the Information security policy and Disciplinary policy.
  </Accordion>

  <Accordion title="Describe how firewalling and vulnerability assessments accommodating the virtualization technologies is performed (e.g. virtualization aware)?">
    As part of Web Application Firewall (WAF), rate limiters are installed to block multiple requests from specific IPs in order to prevent DDOS-type attacks. These are powered by intelligent daemons that detect other identifiers like URLs accessed or other client properties to automatically blacklist possible threats either temporarily or permanently.
  </Accordion>

  <Accordion title="What is your process to monitor that system performance continuously meets all requirements (contractual, business, regulatory) to provide proper service to your customers. Can the customer run his own performance measurement?">
    Please click here to know more about the Application SLA - [https://drive.google.com/file/d/1LatFZLoRzeRlQf4mEemzL8XsO71YGahk/view?usp=sharing](https://drive.google.com/file/d/1LatFZLoRzeRlQf4mEemzL8XsO71YGahk/view?usp=sharing)
  </Accordion>

  <Accordion title="How often do you perform revalidations of the policies of FW, IPS, WAF, etc. and document the business justification in the access control lists.">
    We review and get an approval from the management on annual basis as per the compliance requirements.
  </Accordion>

  <Accordion title="Describe the process to manage the Antivirus/antimalware and specify how frequently the patterns are updated and controlled.">
    We have installed End point security on all the computers and monitored and updated on regular basis.
  </Accordion>

  <Accordion title="Describe how your tenants can report Bugs and security vulnerabilities and the process in place to remedy reported defects. Are your customers informed of discovered defects and the relevant remediation plan?">
    Yes. Our tenants can report the Bugs and security vulnerabilities to [cs@xoxoday.com](mailto:cs@xoxoday.com) We also have Bug Bounty Program at Xoxoday and please click here to know more about - [https://www.xoxoday.com/bug-bounty](https://www.xoxoday.com/bug-bounty)
  </Accordion>

  <Accordion title="Describe how reversibility is addressed, and more specifically can virtual machine images be downloaded and ported to a new cloud provider or to on-site storage, how long the customer's data is available for his retrieval, under what format (e.g. OVF), etc.">
    Since application is a SaaS platform and deployed on AWS virtual platform cloud
  </Accordion>

  <Accordion title="If you are relying on supplier/subcontractors, provide a full list of those involved in providing the contracted service and specify if you will stand Accountable for any security breach originating from one of your suppliers/subcontractors">
    NA. We have the full time employees.
  </Accordion>

  <Accordion title="Provide an overview of the periodic reviews you perform to check the conformance and effectiveness of your policies, procedures and supporting measures and metrics. Specify how these reviews extend to all your partners upstream/downstream">
    We conduct the review and update the policies, procedures etc..and take an approval from the management on annual basis as per the compliance requirements. We also communicate all the policies and procesures to all the employees, contractors through HRMS platform.
  </Accordion>

  <Accordion title="If administrators are allowed to access the infrastructure hosting the proposed solution using mobile devices, provide an exhaustive overview of your centralized MDM solution and more specifically of how you control integrity and security level of the private device and how you guarantee that no customer data is locally cached on the personal device">
    We do not allow to access the infrastructure hosting.
  </Accordion>

  <Accordion title="Have the information security policy and standards been approved by senior management?">
    All the information security policy and standards been approved by senior management.
  </Accordion>

  <Accordion title="Is antivirus software installed on workstations?">
    We have installed the antivirus on all the workstations and servers.
  </Accordion>

  <Accordion title="Does the organisation have security measures in place for data protection?">
    Customer data security is an essential part of our product, processes, and team culture. Our facilities, processes and systems are reliable, robust, and tested by reputed quality control and data security organizations. We continuously look for opportunities to make improvements in the dynamic technology landscape and give you a highly secure, scalable system to provide a great experience. Attached the GDPR - Data security policy.
  </Accordion>

  <Accordion title="Are End User Devices (Servers, Desktops, Laptops, Tablets, Smartphones) used for transmitting, processing or storing Data has anti-malware, file integrity monitoring or application whitelisting deployed in the organisation?">
    We have installed Bidefender endpoint security and restricted the access of external hard drives, USB etc to have restriction on data transfer. we use file integrity and network intrusion detection (IDS) tools to help facilitate timely detection, investigation by root cause analysis, and response to incidents
  </Accordion>

  <Accordion title="Are non-company managed PCs used to connect to the company network?">
    We do not use.
  </Accordion>

  <Accordion title="What is the frequency of BC/DR plan Testing?">
    Annually
  </Accordion>

  <Accordion title="Have BC/DR drill been conducted at reguralar planed intervals?">
    We have conducted the BCP test on 6th Aug 2021. Attached the Business continuity policy.
  </Accordion>

  <Accordion title="Are computer rooms protected against fire and flood? (2)">
    We have installed Smoke detectors and Fire extinguishers for physical security.
  </Accordion>

  <Accordion title="Is there an established incident management program approved by management, communicated to appropriate constituents, maintain and revieweed?">
    Attached the incident management procedure. All our policies are reveiwed annuaaly and approved by the top level management.
  </Accordion>

  <Accordion title="Are security incidents reviewed to capture the root cause and act on key learnings? (2)">
    security incidents reviewed to capture the root cause.
  </Accordion>

  <Accordion title="Does the organisation have a formal Incident Response plan?">
    Attached the Security Incident Reporting and Response Procedure
  </Accordion>

  <Accordion title="Are all potential incidents assessed to determine appropriate classification, severity and impact?">
    Classification of Incidents are done. Attached the Incident Management Procedure
  </Accordion>

  <Accordion title="Has the organisation experienced an information security breach in the past three to five years?">
    No Security breaches till date.
  </Accordion>

  <Accordion title="Does the organisation receive an SSAE-16 SOC Report? (2)">
    We are SOC 2 compliant and we have engaged Laika Compliance LLC, an independent assessor firm, to conduct a SOC 2 Type 1 and SOC 2 Type 2 examination for the Xoxoday Platform against the Security and Confidentiality Trust Services Categories. Attached the engagement letter.
  </Accordion>

  <Accordion title="Does the organisationis been audited for ISO 27001 or for other security standards? (2)">
    Attached the ISO 27001:2013 certificate.
  </Accordion>

  <Accordion title="Do contracts with third party vendors that access or host your organization's information assets contain security requirements commensurate with your organization's security standards">
    We make sure that they have adequate controls in place and meet the security standard.
  </Accordion>

  <Accordion title="Is the Cloud Service Provider certified by an independent third party for compliance with domestic or international control standards (e.g., the National Institute of Standards and Technology - NIST, the International Organization for Standardization - ISO)? (2)">
    We are ISO 27001 certified and GDPR compliant. Attached the document.
  </Accordion>

  <Accordion title="Are Global Blocklist and Whitelist configurations (such as URL's/domains inaccessible/accessible through the organization's proxies) enabled and reveiwed annually">
    We review these to make sure the all the controls in place.
  </Accordion>

  <Accordion title="Users may have a legitimate business requirement to access blocked websites. If such a need arises, is there a process to request and obtain approval for the same?">
    We provide access only upon need and approval basis.
  </Accordion>

  <Accordion title="Are controls implemented to restrict sharing of files via conferencing/collaboration tools to the external parties (Microsoft Teams, Skype, Cisco WebEx etc.)? (2)">
    We use Google workspace and have secure mode of sharing the data.
  </Accordion>

  <Accordion title="Does the current DLP solution have the capability to monitor all the endpoints within the Organization? (2)">
    We can manage all the enpoints centrally.
  </Accordion>

  <Accordion title="Is there a formalized risk governance plan that defines the Enterprise Risk Management program requirements?">
    Attached the Risk Management Procedure
  </Accordion>

  <Accordion title="Is there a formalized Risk Assessment process that identifies, quantifies, and prioritizes risks based on the risk acceptance levels relevant to the organization? (2)">
    We have a formal risk assessment process and conduct the risk assessment annually.
  </Accordion>

  <Accordion title="Do contracts with all subcontractors include Non-Disclosure/Confidentiality Agreements, data breach notification, Indemnification/liability and termination/exit clause? (2)">
    All the contractors/vendors have signed the NDA and contracts All the necessary clauses has been included in the agreements with regards to Confidentiality, liabilities, termination etc
  </Accordion>

  <Accordion title="Is the Saas Solution deployed on public cloud or cloud hosted by Saas Vendor?">
    The SaaS solution is deployed on Public cloud.
  </Accordion>

  <Accordion title="Are hardening standards defined and followed for all infrastructure components (OS, Network Devices, Servers, Firewalls, DBs etc.)">
    Yes
  </Accordion>

  <Accordion title="Are you using Anti-Virus tool if yes, share the name of the tool.">
    Yes. We are using Bitdefender endpoint security.
  </Accordion>

  <Accordion title="Is VPN and VPC services used for transmitting data securely e.g. tunneling services?">
    Yes. We use for security reasons
  </Accordion>

  <Accordion title="What kind of access the vendor employees will have on the application and how access to the customer data in the application is restricted from being accessed by Vendor employees?">
    Our employees will not have access by default. The data will be accessed only upon need an approval basis. The access is controlled through the AWS Identity and Access Management system that also enforces two-factor authentication
  </Accordion>

  <Accordion title="What policies are configured for restricting PII leakage from the system?">
    We collect only 3 types of the personal Information such as Name, email ID, phone#. , personal data is to be transmitted using firmly approved encrypted systems. We have implemented the role based acccess control to make sure that the acccess has been granted to only authorised individual.
  </Accordion>

  <Accordion title="Is user access controlled and has limited access to the data and configuration settings on cloud?">
    Yes.
  </Accordion>

  <Accordion title="Vendor shall immediately inform the customer about any security incident.">
    Yes. We inform the client about any security incidents.
  </Accordion>

  <Accordion title="Do you have change and incient management process in place to record, response and resolve an incident within SLA and to control the changes in the system / application? If yes, please share.">
    Yes. Attached Incident management policy and SLA
  </Accordion>

  <Accordion title="Does the agreement contains right to audit the service provider Information System">
    Yes
  </Accordion>

  <Accordion title="Compliant with all regulatory requirements">
    Yes
  </Accordion>

  <Accordion title="Compliance to IT Act and other Acts applicable to data">
    We are compliant.
  </Accordion>

  <Accordion title="ISO 27001:2013 or any equivalent Information Secuirty Management System">
    Yes, We are ISO 27001:2013 certified. Attached the certificate.
  </Accordion>

  <Accordion title="Service Organization Control SOC type 2 or any equivalent compliance report">
    We are SOC 2 Type 1 compliant. The audit has been completed and auditor is working on the Draft audit report. We will be able to share once the report is finalized.
  </Accordion>

  <Accordion title="ISO 27018:2018 Code of Practice for Protection of PII in Public Cloud, if PII data is stored on the cloud.">
    NA. But AWS Virtual platform cloud is ISO 27017 and 27018 certified and attached the report.
  </Accordion>

  <Accordion title="PCI-DSS in case the CSP handles card holder data if card data is processed and stored.">
    NA. We do not handles the card holder data.
  </Accordion>

  <Accordion title="Which all processes Vendor is handling currently and how the customer is sharing the data with them?">
    the customer will be using the application product and all the information will be entered only through our application.
  </Accordion>

  <Accordion title="How data sharing between vendor and the customer will take place?">
    The data sharing between vendor and the customer will take place only through application product. There will be no manual data sharing or transfer.
  </Accordion>

  <Accordion title="Will any Personally Identifiable Information (PII) be stored with vendor? Please mention specific reports that are to be stored.">
    PII will be entered through application and stored it on AWS cloud virtual platform. We store Name, email ID and phone number of the users.
  </Accordion>

  <Accordion title="Sub-contractor responsibilities and dependencies are clarified, and risks of employment of subcontractors are fully managed. Subcontractor is subject to all requirements the Contractor is.">
    We do not have any sub-contractors. We have deployed our application on AWS Virtual platform cloud. And AWS is ISO 27001, SOC 2, ISO 27017, ISO 27018, ISO 27701, CSA Compliant etc..
  </Accordion>

  <Accordion title="Vendor has relevant encryption capabilities, and is able to apply encryption at the customer data at rest and in transit (when solution is to be hosted on the customer datacenter solution, it should be secured using a the customer approved digital certificate), whenever deemed necessary and required by the customer or relevant external regulation. The solution should provide secure and reliable ways to exchange data with the customer backend systems and SaaS applications as well.">
    We have deployed our application on AWS Virtual Platform cloud. application is a cloud based application. We have encrypted the data while in transit and at rest. We use TLS1.2 encryption for Data at transit and AES256 Data at rest for maximum security. All the confidential/PI data are encrypted at rest and in transit with a split key mechanism to ensure that every client's key is unique We do not decrypt the data until and unless if there any specific request from the customer.
  </Accordion>

  <Accordion title="Sufficient service uptime is guaranteed, meeting the customer expectations (on availability, RTO, RPO). Vendor has a BCP and DRP in place, ensuring service downtimes are kept as short as possible.">
    Xoxoday endeavours to provide 99.9% Uptime each month 24 hours a day 7 days a week ("Agreed Hours of Service"). Uptime is measured based on the monthly average of availability, rounded down to the nearest minute. Please click here to know about Xoxoday SLA - [https://drive.google.com/file/d/1LatFZLoRzeRlQf4mEemzL8XsO71YGahk/view](https://drive.google.com/file/d/1LatFZLoRzeRlQf4mEemzL8XsO71YGahk/view) Xoxoday has a formal Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP) defined and implemented to enable people and process support during any crisis or business interruptions. The BCP and DR Plan is tested and reviewed on a yearly basis as per the compliance requirements. The BCP and DR plan of Xoxoday is reviewed and audited as part of ISO 27001 standards and SOC 2 Audits by the independent auditor. Attached the Business Continuity Plans (BCP) and Disaster Recovery Plan (DRP) documents.
  </Accordion>

  <Accordion title="There is proper control in place for the usage of system utilities to circumvent application controls, and this possibility is disabled.">
    Since it's a SaaS platform, there are no process as such.
  </Accordion>

  <Accordion title="Contractor is certified under external security best practices and standards (e.g. ISO). Contract shall include an audit clause that gives the customer the right to obtain independent audit reports (ISAE 3402 type 2, SOC 2, SSAE 18, ISO27k, PCI-DSS Level 1, etc.), network/application penetration testing reports, and vulnerability scanning results. The results can be summarized (not containing confidential technical details), or detailed when limited to the systems used by the customer. Furthermore, the customer should be allowed to initiate independent vulnerability scanning / penetration testing on the services received by the Vendor.">
    Attached the below mentioned coompliance certifications - Attached the Audit reports. 1. ISO 27001 certificate 3. VAPT Certificates 4. VAPT Audit reports 5. SOC 2 Audit reports. 6. GDPR Data Privacy Impact assessment report 7. California Privacy Rights Act (CPRA) attestation report. 8. CSA STAR LEVEL 1 compliant - [https://cloudsecurityalliance.org/star/registry/nreach-online-services-pvt-ltd-xoxoday](https://cloudsecurityalliance.org/star/registry/nreach-online-services-pvt-ltd-xoxoday) We conduct these audit on annual basis and we will share it upon request.
  </Accordion>

  <Accordion title="Guarantees are offered to the customer on resolving security incidents / outages.">
    We always provide our best service to resolve security incidents / outages. Attached the Service Level Agreement (SLA)
  </Accordion>

  <Accordion title="Provide a general description of the information security measures applicable to the services you offer to the customer.">
    Xoxoday is committed to ensuring the integrity, confidentiality, availability, and security of its physical and information assets and maintaining privacy when serving the customers and organization's needs while meeting appropriate legal, statutory, and regulatory requirements. To provide adequate protection for information assets, Xoxoday has built the Information Security Management System (ISMS), enabling everyone to follow these policies diligently, consistently, and impartially. Xoxoday will implement procedures and controls at all levels to protect the confidentiality and integrity of information stored and processed on its systems and ensure that information is available only to authorized individuals as and when required. Please click here to know more about Xoxoday Security - [https://www.xoxoday.com/security](https://www.xoxoday.com/security)
  </Accordion>

  <Accordion title="the customer requires transfer outside of the EEA to have a valid legal basis. Please describe the legal basis for each of the countries that personal data is transferred to.">
    We have deployed our application on AWS Virtual platform cloud - Singapore region. We are GDPR compliant. And we have an agreement and Standard contractual clauses (SCC) as per GDPR Compliance requirements.
  </Accordion>

  <Accordion title="Are you, or have you been involved in any legal proceedings, civil or public, relating to processing of Personal Data in connection with the services that you offer to the customer, in the last five years? If so, please elaborate on the nature and document the outcome of these proceedings.">
    NO
  </Accordion>

  <Accordion title="Are you aware of any legal proceedings, civil or public, that any of your (sub) processors have been involved in, relating to processing of Personal Data in connection with the services that you offer to the customer, in the last five years? If so, please elaborate on the nature and outcome of these proceedings.">
    NO
  </Accordion>

  <Accordion title="Have you reported any Personal Data Breaches, as defined in art. 4 (12) of the GDPR, relating to your processing of personal data in connection with the services that is offered to the customer, to any of your Customers, any Data Protection Authorities or any Data Subjects, in the last five years? If so, please elaborate on the nature of the breach(es).">
    No. There were no Personal Data Breaches.
  </Accordion>

  <Accordion title="To the extent applicable: 1) Describe the certifications and audit scheme that you have or will put in place, to allow the customer to verify compliance with applicable law and the Data Processing Agreement during the contract period 2) Describe the regularity and scope of any third party audits with regard to information security, data protection compliance and to what extent (sub) contractors are covered by the audit schemes 3) Describe how the customer will obtain access to reports from audits for any transfer of Personal Data to countries outside the EEA.">
    Xoxoday is committed to ensuring the integrity, confidentiality, availability, and security of its physical and information assets and maintaining privacy when serving the customers and organization's needs while meeting appropriate legal, statutory, and regulatory requirements. To provide adequate protection for information assets, Xoxoday has built the Information Security Management System (ISMS), enabling everyone to follow these policies diligently, consistently, and impartially. Xoxoday will implement procedures and controls at all levels to protect the confidentiality and integrity of information stored and processed on its systems and ensure that information is available only to authorized individuals as and when required. Attached the below documents - 1. ISO 27001 Certificate 2. SOC 2 Audit report. 3. California Privacy Rights Act (CPRA) attestation report. 4. VAPT Certificates 5. GDPR DPIA Assessment report. 6. CSA START LEVEL 1 Compliant - [https://cloudsecurityalliance.org/star/registry/nreach-online-services-pvt-ltd-xoxoday](https://cloudsecurityalliance.org/star/registry/nreach-online-services-pvt-ltd-xoxoday) the customer can request the Xoxoday POC for these reports and we will provide the latest Audit reports upon request.
  </Accordion>

  <Accordion title="Through discussions with the vendor, try to obtain an overview of the value chain from the cloud vendor and backwards to subcontractors">
    We are storing all the customer data on AWS Virtual platform cloud – Singapore region and consider AWS as a Sub-Processor as per EU GDPR. AWS is ISO 27001, SOC 2, ISO 27017, ISO 27018, CSA STAR, ISO 27701 certified organization. Please click here to know about AWS Compliance offerings - [https://aws.amazon.com/compliance/programs/](https://aws.amazon.com/compliance/programs/)
  </Accordion>

  <Accordion title="Does the contract detail the scope and functionality of the online services?">
    Scope and functionalities are the part of the agreement.
  </Accordion>

  <Accordion title="Any written documentation for the SLA? Are SLA objectives measurable and have relevant penalties? Do they cover availability, response times or other? What does the SLA cover?">
    Please click here for SLA - [https://drive.google.com/file/d/1LatFZLoRzeRlQf4mEemzL8XsO71YGahk/view](https://drive.google.com/file/d/1LatFZLoRzeRlQf4mEemzL8XsO71YGahk/view) We do not offer any credits/ penalties.
  </Accordion>

  <Accordion title="Are there any technical and organisational measures that aim to remedy the risks entailed by lack of control and lack of information featuring in the cloud computing environment? E.g. measures aimed at ensuring availability, integrity, confidentiality, isolation, intervenability and portability.">
    We have implemented all the technical and organisational measures to ensure the integrity, confidentiality, availability, and security of its physical and information assets and maintain privacy when serving the customers and organization's needs while meeting appropriate legal, statutory, and regulatory requirements. To provide adequate protection for information assets, Xoxoday has built the Information Security Management System (ISMS), enabling everyone to follow these policies diligently, consistently, and impartially.
  </Accordion>

  <Accordion title="What kind of certifications does the cloud vendor have (ISO 2001, SOC report etc.)?">
    [ISO 27001 certificate VAPT Certificate SOC 2 Audit reports. California Privacy Rights Act (CPRA) attestation report. CSA STAR LEVEL 1 compliant - https://cloudsecurityalliance.org/star/registry/nreach-online-services-pvt-ltd-xoxoday We have shared these certifications and Audit reports.](https://cloudsecurityalliance.org/star/registry/nreach-online-services-pvt-ltd-xoxoday)
  </Accordion>

  <Accordion title="Is there a clause saying that no data shall be processed by Supplier or any subcontractors for other purposes than the one specified in the contract?">
    We do not process the data for other purposes than the one specified in the contract,
  </Accordion>

  <Accordion title="Does the contract specify that Supplier may not communicate the data to third parties, even for preservation purposes unless it is provided for in the contract that there will be subcontractors?">
    We do not share the data with third parties. But we store it on AWS Virtual platform cloud and we consider AWS as a Sub-processor. We do not disclose any of our customers personal information to any third parties. We reserve the right to disclose PI if required by law or if we reasonably believe that use or disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or comply with a law, court order, or legal process. We reject any non-legally binding requests for disclosure.
  </Accordion>

  <Accordion title="Does the data processing agreement specify the types of personal data processed by Supplier?">
    We process only the Name, phone# and Email ID as mandatory information.
  </Accordion>

  <Accordion title="Does the contract ensure a logging of processing operations on personal data performed by Supplier and its sub-contractors?">
    We process the information as per the terms of use - [https://www.xoxoday.com/terms-of-use](https://www.xoxoday.com/terms-of-use)
  </Accordion>

  <Accordion title="Does the Supplier ensure lawfulness of cross-border data transfers and do they have a list of locations in which the services may be provided from? May the customer limit the vendor's right to change or disregard such a list?">
    We are storing all the customer data on AWS Virtual platform cloud and we operate or provide services from Bangalore, India.
  </Accordion>

  <Accordion title="Does the contract include any clause specifying that Supplier must inform the customer of any intended changes in regards to changes in sub-processors? the customer shall retain at all times the possibility to object to such changes or to terminate the contract.">
    We inform the customer of any changes in regards to changes in sub-processors.
  </Accordion>

  <Accordion title="Any specific restrictions in the right to use? Acceptable use policy is one example that should be considered versus the customer's needs.">
    Xoxoday Terms & conditions - [https://www.xoxoday.com/terms-of-use](https://www.xoxoday.com/terms-of-use)
  </Accordion>

  <Accordion title="Does the cloud provider have right to suspend services for specific reasons? As an example, in a situation with non-payment? If yes, is there a notice period or other important conditions to be observed?">
    Yes, the cloud provider does have a right to suspend services for specific reasons; more detailed in Section 3.3 of the Master Services Agreement. Section 3.3(a) read along with Section 2 of the MSA
  </Accordion>

  <Accordion title="Which law is the contract subject to? What are the legal venue for disputes arising under the contract? What are the regulations around dispute resolution?">
    The Contract is subject to the laws of India. For disputes arising under this contract, courts of Delhi has an exclusive jurisdiction. Arbitration & Conciliation Act, 1996
  </Accordion>

  <Accordion title="Do you perform a regular information security risk assessment?">
    We conduct the periodical Risk assessment. and it has been audited during the internal and external audits.
  </Accordion>

  <Accordion title="Do you provide customers with ongoing visibility and reporting of your SLA performance?">
    We also provide SLA performance report to the customer on need basis.
  </Accordion>

  <Accordion title="Do you have the capability to respond to security alerts, and report security vulnerabilities and information security incidents within 24 hours of discovering them">
    we have the capability to respond to security alerts, and report security vulnerabilities and information security incidents within 24 hours of discovering them
  </Accordion>

  <Accordion title="Are there policies and procedures in place to triage and remedy reported bugs and security vulnerabilities for product and service offerings?">
    [We also have Bug Bounty program - https://www.xoxoday.com/bug-bounty](https://www.xoxoday.com/bug-bounty)
  </Accordion>

  <Accordion title="Do you specifically train your employees regarding their specific role and the information security controls they must fulfil?">
    We train our employees on their role and responsibilities and also comminicate before joining the organizatin
  </Accordion>

  <Accordion title="Name and description of the software/service.">
    application is an all-in-one employee engagement and motivation platform that offers Rewards & Recognition, Pulse Surveys, 1-on-1 Feedback, Social Intranet and People Analytics in one powerful solution.
  </Accordion>

  <Accordion title="Is there a respondent information security function responsible for security initiatives?">
    Information security department is responsible for security initiatives and the Head of the Information security reports to the Board of Director of the company.
  </Accordion>

  <Accordion title="Can the respondent do Creation, review and approve of information security policies?">
    The policies and procedures have been created, reviewed and approved by the Top level management of the company.
  </Accordion>

  <Accordion title="Is there an information security policy that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy? Kindly share the artefact">
    The information security policies have been uploaded on KEKA HRMS Application and communicated to all the employees. Attached the screenshot for your reference.
  </Accordion>

  <Accordion title="Is there a risk management framework pertaining to the information security and privacy program management? Kindly share the artefacts?">
    Attached the Risk Management Procedure.
  </Accordion>

  <Accordion title="Kindly share the recent internal audit report for information security and privacy program management">
    Attached the internal audit report.
  </Accordion>

  <Accordion title="What are your data leak prevention capabilities?">
    Your data is of the utmost importance. All the security mechanisms and policies are established and implemented in such ways that data leak can be prevented, in transit as well as at rest.
  </Accordion>

  <Accordion title="Do you have a policy that requires endpoints (laptops,desktops,etc) to have anti-malware software? What capabilities does the anti-malware solution has? (Signature based detections, NGAV, EDR, etc.)">
    We have installed Bitdefender endpoint security in all the endpoints. Bitdefender is based on a layered next-gen endpoint protection platform with the industry's best prevention, detection and blocking capabilities, using proven machine learning techniques, behavioural analysis and continuous monitoring of running processes.
  </Accordion>

  <Accordion title="Does your IT provide remote wipe or corporate data wipe for all endpoints (laptops,desktops,etc) and company-accepted BYOD devices?">
    We have the capability to wipe out the data remotely for all endpoints including BYOD devices.
  </Accordion>

  <Accordion title="Is the solution provided to Customer part of a valid ISO 27001 certification? If so, please provide a valid ISO/IEC 27001 certificate with corresponding SOA - Statement of Applicability">
    Attached the ISO 27001:2013 certificate and Statement of applicability.
  </Accordion>

  <Accordion title="Do you allow tenants to view your SOC2/ISO 27001 or similar third-party audit or certification reports? (2)">
    We provide tpliance certifications upon request.
  </Accordion>

  <Accordion title="Does the Company use Software Development Life Cycle (SDLC) process to ensure quality and correctness of the solution built?">
    We use the Software Development Life Cycle (SDLC) process. It is aligned with ISO 27001;2013 and SOC 2 frameworks.
  </Accordion>

  <Accordion title="Are security related requirements specially marked during development?">
    During the development and testing security related requirements are specially considered.
  </Accordion>

  <Accordion title="What is the strategy around application Secure Code Scanning & management?">
    We have SDLC Policy as per ISMS requirements and we follow General Coding Practice. For example - We Conduct data validation on a trusted system, All cryptographic functions used to protect secrets from the application user.
  </Accordion>

  <Accordion title="Is there a status page available for communication about the application's untime status, or any ongoing and past incidents?">
    We can also provide uptime status on a need basis.
  </Accordion>

  <Accordion title="Are the retained logs sufficient to permit forensic analysis on security events?">
    We have proper forensic procedures for data collection and analysis for incident responses
  </Accordion>

  <Accordion title="Does the provider's logging and monitoring framework allow isolation of an incident to specific tenants?">
    Yes, in case specific incidents arise for particular tenants, our logging and monitoring framework allows isolation of incidents.
  </Accordion>

  <Accordion title="What is your SLA - uptime and availability?">
    Xoxoday endeavours to provide 99.9% Uptime each month 24 hours a day 7 days a week. Uptime is measured based on the monthly average of availability.
  </Accordion>

  <Accordion title="What is the penalty offered to the customers for SLA violations?">
    We do not offer any penalty.
  </Accordion>

  <Accordion title="What level of support is provided to the clients? Mention the time slots where support is available">
    Attached the SLA
  </Accordion>

  <Accordion title="ISO certification for the APP and Security related documentation required to proceed with security reviews internally 1. Application Pentest results 2. Architecture Documentation to show the dataflow and data security in the hosting location 3. Hosting Vendor ceritification similaret to Microsoft MCST 4. SLA and Support Documentation">
    Attached the below documents - 1. ISO 27001:2013 certificate 2. VA/PT Certificate 3. VA/PT Executive report 4. application Architecture Diagram 5. We have deployed our aplication on AWS Virtual platform Cloud and attached AWS Compliance certificates - ISO 27001, ISO 27017 & ISO 27018. 5. application SLA
  </Accordion>

  <Accordion title="Please provide support covered under standard annual license and annual maintenance where applicable">
    Customer Support is available on all working days (Mon - Fri) between 3.30 AM GMT to 1:30 PM GMT.
  </Accordion>

  <Accordion title="Details of certifications Which includes for each certification: Certification Body First Certification Date Current Certification date">
    Xoxoday is – ISO 27001:2013 certified CPRA (California Privacy Rights Act) EU GDPR Compliant CSA STAR LEVEL 1 Compliant – Click here Vulnerability Assessment and Penetration Testing (VAPT) Attached these above certificates and Reports.
  </Accordion>

  <Accordion title="The vendor should detail how frequently backups of customer data are made, how long they are retained, and how soon customer data is purged following deletion by an end user">
    The backups are automated and taken on a daily basis. We delete the data upon receiving the request from the customer/end users/termination of the contract. Our data cleaning process goes through an organized purge. Once the data is purged, it's purged from all places.
  </Accordion>

  <Accordion title="Define Service monitoring.">
    We have an ELK setup in place to ensure data monitoring in the most optimal manner. The audit logs are reviewed and recorded on a regular basis automatically. These logs are integrated with security operations/SIEM solutions.
  </Accordion>

  <Accordion title="Does the role of Quality unit during product development and/or during service provision define?">
    As per the SDLC Policy we follow several distinct stages, including planning, design, building, testing, code review, deployment and maintenance etc. Our code reviews and analysis run through stringent eyes of automated technologies as well as manual source code overview to cover any security loopholes prior to the production phase.
  </Accordion>

  <Accordion title="When our company needs to access the logs of Vendor and our company or that of our company's users for case investigation, how long does it take Vendor to provide complete logs to our company? (1-24 hours is appropriate)">
    It would depend on the criticality of the investigation and the type of service subscribed. Our team will be able to provide the ETA as soon as they receive the request from you and start acting immediately.
  </Accordion>

  <Accordion title="In the admin console, is there an interactive interface to look up our company's user's detailed information?">
    Yes. You can check this information from the user management option available for Admin console.
  </Accordion>

  <Accordion title="What kind of permission request process do Vendor's O&M personnel, including DBAs, would go through if they want to refer to our company's data stored in the Vendor backend system?">
    You can reach out to us with the help of the help center or can write an email to customer support team
  </Accordion>

  <Accordion title="When the Vendor's operation and maintenance personnel, including the DBA, try to refer to our company's data stored in the Vendor backend system, is there an audit log record of the entire operation process?">
    Yes. We maintain and record the Audit logs and complying with various compliance requirements.
  </Accordion>

  <Accordion title="When the logs which described above are needed, whether or not can it be completely provided to our company when there is a need for case investigation?">
    Yes. You may reach out to our support team anytime for requesting these records and they would be able to help you out on this requirement.
  </Accordion>

  <Accordion title="When the logs which described above are needed, how long does it take Vendor to provide them to our company? (1-24 hours is appropriate)">
    It would depend on the criticality of the investigation and the type of service subscribed. Our team will be able to provide the ETA as soon as they receive the request from you and start acting immediately.
  </Accordion>

  <Accordion title="Is your system and related data is set to back up automatically on a regular basis?">
    Yes. We deployed our application on AWS and AWS provides the data backup service as well.
  </Accordion>

  <Accordion title="Are there any other compliance qualifications? If so, please list out in detail">
    Yes. We are ISO 27001:2013 certified and GDPR Compliant.
  </Accordion>

  <Accordion title="Summary of key risks based on risk assessment reports">
    We have implemented the risk assessment procedure and conduct the risk assessment annually as per the compliance requirements.Risk assessment is used to identify the risks encountered by the information-processing facilities (or individual system components). The aim is to estimate the impact and probability of a threat occurrence. The risk assessment procedure is having Risk, Likelihood and Impact. The risk ranking is done based on the Residual Risk Rating such as High, medium and low. Attached the Risk Management Procedure for your reference.
  </Accordion>

  <Accordion title="A risk management process shall be used to balance the benefits of cloud computing with the security risks associated before engaging with a Cloud Service provider.">
    Risk Management Procedure has been used to validate the security compliance of AWS. AWS Compliance certifications and attestations are assessed by a third-party independent auditor and result in a certification, audit report, or attestation of compliance. AWS is ISO 27001, SOC 2 Type II certified and complied with CSA start level 2. Please click here for more details about AWS Compliance Programs - [https://aws.amazon.com/compliance/programs/](https://aws.amazon.com/compliance/programs/)
  </Accordion>

  <Accordion title="The risk assessment framework adopted by NSE may be used for the cloud service risk assessment.">
    Yes. We can use the risk assessment framework adopted by NSE for cloud service risk assessment.. Please provide the same.
  </Accordion>

  <Accordion title="The outcome of the risk management process shall determine the model and controls that shall be adopted.">
    We comply with this requirement. The risk assessment procedure has defined the Risk Acceptance Criteria, Benefits, Components, Impact Rating, Risk Treatment, Risk Acceptance etc and all the controls identified in our risk assessment as per the industrial standard like ISO, SOC2, NIST, GDPR etc.
  </Accordion>

  <Accordion title="The Cloud Service Provider shall ensure that it will demonstrate compliance with NSE policy requirements and regulatory requirements.">
    Sure. We are ISO 27001;2013 and GDPR compliant. We have policies and procedures in place with all the required compliance controls.
  </Accordion>

  <Accordion title="The Cloud Service Provider shall conduct annual audit by an independent third-party auditor to check the design effectiveness as well as their operating effectiveness of their internal controls covering the principles of Security, Availability, Confidentiality, and Privacy.">
    We comply with this requirement. We conduct annual audit by the independent auditors to test the controls in place with regards to Information Security management system(ISMS) and also for testing the service organization controls(SOC)covering the principles of Security, Availability, Confidentiality, and Privacy. AWS is also SOC 2 certified.
  </Accordion>

  <Accordion title="NSE shall be provided access to these reports as and when required.">
    Sure. Attached the ISO certificate and we are in the Audit process for SOC 2. we will provide the same once the audit is completed.
  </Accordion>

  <Accordion title="The Cloud Service Provider shall provide complete visibility to ensure NSE's services are being processes and delivered in a secure manner.">
    We are ISO 27001;2013 certified, GDPR compliant and in the process of SOC 2 audit. We make sure that our customer data is safe and secure and meet all the compliance requirements and industry best practices. Xoxoday has built the Information Security Management System (ISMS) which includes the respective policies to be followed in a diligent, consistent, and impartial manner.
  </Accordion>

  <Accordion title="NSE shall have all the Service Level arrangements documented in the agreement/ contract with the Cloud Service provider guided by NSE's Outsourcing Policy.">
    Our legal team would review and agree the terms and conditions.
  </Accordion>

  <Accordion title="NSE shall review the Service Level Agreements (SLA) for amendments, annually or as when required.">
    We agree. NSE can review.
  </Accordion>

  <Accordion title="Cloud Service Provider shall provide regular reports on the SLA achieved and compliance to the agreement/contract to NSE. The frequency of reporting shall be mandated in the agreement / contract.">
    Our legal team would review and agree the terms and conditions.
  </Accordion>

  <Accordion title="Any breach in the SLA by Cloud Service provider shall be reported as mandated by NSE.">
    We will inform NSE if there is any breach.
  </Accordion>

  <Accordion title="In a multi-tenant cloud architecture, the Cloud Service Provider shall ensure that NSE's data shall be isolated and inaccessible to any other tenants.">
    The data isolated between customers. We use logical data isolation with the help of company specific encryption keys.We use TLS1.2 encryption for Data in transit and AES256 for Data at rest
  </Accordion>

  <Accordion title="Any access by other tenants to NSE's data shall be considered as a breach and the Cloud Service Provider shall ensure the breach notification process is followed.">
    We agree. We have implemented the data breach notification procedure.
  </Accordion>

  <Accordion title="Cloud Service provider shall notify NSE of any potential breach incident or any actual breach as mandated by NSE.">
    We agree. We will notify NSE.
  </Accordion>

  <Accordion title="NSE shall ensure that the cloud computing services can be ported to any other Cloud Service Provider or to other data centres with least impact to business.">
    We agree.Currently, we do not have any plans as such.
  </Accordion>

  <Accordion title="The Cloud Service Provider shall ensure all the information related to NSE is handed over to NSE in a useable format.">
    All the data will be stored on AWS cloud We have the disposal policy in place and implemented mechanisms for secure disposal and removal of data.
  </Accordion>

  <Accordion title="On completion of the transfer, the Cloud Service Provider shall delete all the data and information from its infrastructure and provide a certificate to NSE that the data has been securely deleted and the same cannot be recovered by any means.">
    We agree. We will delete the data upon termination of the contract or request and confirm. Our data cleaning process goes through an organized purge. Once the data is purged, it's purged from all places.
  </Accordion>

  <Accordion title="Wherever applicable, NSE shall maintain an up to date inventory of hardware, software and virtual assets hosting NSE's applications and data.">
    We have implemented Asset Management Procedure in place and maintain all the records of IT Assets like, hardware, software, licenses, accessories etc.
  </Accordion>

  <Accordion title="The inventory shall be reviewed and updated as per the Asset Management Policy of NSE.">
    We review and update the inventory as per the Asset management policy.
  </Accordion>

  <Accordion title="Cloud Service Provider shall ensure that no database server, application server or storage devices hosting NSE's data & information be made publicly available over the internet.">
    The database server, application server or storage devices hosting NSE's data & information is not made available publicly. We isolate our machines, network and storage with respect to the AWS Standards in order to keep it safe and secure
  </Accordion>

  <Accordion title="When is live (standard service) phone technical support available? Is backup (phone or email) available for off-hours?">
    Yes, one can write to us at our 24\*7 support team at [cs@xoxoday.com](mailto:cs@xoxoday.com)
  </Accordion>

  <Accordion title="Describe the training that is available with the initial system installation.">
    We help the clinets in setting up from both admin and end user side, and traiing is also provided on how application can be used for hasslefree awards distribution
  </Accordion>

  <Accordion title="What type of training does your company recommend, require, and offer?">
    We provide trainging over internet , if possible we provide telephonic assistance also.
  </Accordion>

  <Accordion title="Do you provide on-demand training over the Internet? If so, what training is available to users? Is there an associated cost?">
    Yes we provide "on demand training" , this incur no additional cost to the company
  </Accordion>

  <Accordion title="What is your escalation process for support issues? Describe in detail.">
    We have a 24\*7 available support team, once a ticket is generated , It is assigned to one of the cs team executive and we intent to solve the issue within next 24hrs.
  </Accordion>

  <Accordion title="Who will have access to UP data? (Just Supplier employees? Contractors? Employees and contingent employees?)">
    Xoxoday employees and third party would have an access. We provide acess on case to case basis as per the Information security and access control policy. We also have role based access system to meet the compliance requirements of the data security . The data is hosted on Amazon Web Services (AWS)
  </Accordion>

  <Accordion title="Describe your employee and contractor background checks">
    We do conduct employees and contractors background verification as per the compliance requirements before onboarding process. We will onboard them only after passing the background verification. We are ISO 27001:2013 certified organization.
  </Accordion>

  <Accordion title="How do you monitor third parties that have access to UP data?">
    We conduct periodical review of the access provided and make the necessary chages as per the Role based access management and access control policy. We also conduct Internal and external audits in a timely manner.
  </Accordion>

  <Accordion title="Does the cloud service provider require the use of two-factor authentication for the administrative control of servers, routers, switches and firewalls?">
    Our Information security compliance policies and procedures are established and implemented to enforce two-factor authentication
  </Accordion>

  <Accordion title="How is user access monitored and documented?">
    We are ISO 27001:2013 certified organization The User access are monitored and recorded internally as per the compliance requirement and Access Control Procedures.
  </Accordion>

  <Accordion title="Network IDS?">
    Yes we have implemented intrusion detection tools, we ensure timely detection and investigation in a prompt manner.
  </Accordion>

  <Accordion title="Host IDS?">
    Yes. file integrity (host) and network intrusion detection (IDS) tools implemented to help facilitate timely detection, investigation.
  </Accordion>

  <Accordion title="SIEM?">
    Yes. Implemented SIEM
  </Accordion>

  <Accordion title="Are security controls audited on an annual basis?">
    Yes. All the controls are audited annually.
  </Accordion>

  <Accordion title="Can documentation be provided that can show how UP data cannot be compromised by other customers or non-customers of the Supplier?">
    Yes, We will share the Data protection policy. Access control policy and Information security policies
  </Accordion>

  <Accordion title="What is the size and relevant experience (in years) of the security and incident response teams?">
    Size of the team is 5 and all are having 5+ years of experience
  </Accordion>

  <Accordion title="What data is required to be shared and stored by the Supplier?">
    personal data is stored are registered databases that comply to all necessary inputs of a standard inventory repository and its transit scrambled for maximum security.
  </Accordion>

  <Accordion title="How is the data stored?">
    We use AWS Platform for storing the data. Our data is stored in secured databases and there is no window to alter any data without it being logged into the system records. Our data is stored in secured databases and there is no window to alter any data without it being logged into the system records.
  </Accordion>

  <Accordion title="How are users authorized to access data through provided service?">
    As per the Information security policy and Data protection policy only the authorised individual have an access to the data through internal approving and ticketing system.
  </Accordion>

  <Accordion title="Is planned/scheduled maintenance included in the calculated uptime? Will it count against the SLA?">
    No. Planned downtime will not be calculated uptime
  </Accordion>

  <Accordion title="Does planned/scheduled maintenance count against the SLA?">
    No. Planned downtime will not count against the SLA
  </Accordion>

  <Accordion title="What is your resiliency, reliability, back-up and disaster recovery strategy?">
    We have Business Continuity Policy and Business Continuity Management Procedure in place and effectivly working.
  </Accordion>

  <Accordion title="How often are these processes tested?">
    We test it annually once as per the compliance requirements.
  </Accordion>

  <Accordion title="Describe your established maintenance window.">
    Xoxoday's architecture goes through constant upliftment and experiences no downtime during upgrades and maintenance windows.
  </Accordion>

  <Accordion title="Describe in detail your service or mitigation plans to continue to make the service available to customers during a denial of service attack.">
    We have Business Continuity Policy and Business Continuity Management Procedure in place and tested periodically. And also our Policies has been reviwed and Audited annually.
  </Accordion>

  <Accordion title="Does the architecture of the provided service include redundancy of security systems, including firewalls, IDS/IPS, any other critical security service?">
    Yes. We have implemented IDS/IPS, Firewall and our security information and event management (SIEM) system merge data sources (app logs, firewall logs, IDS logs, physical access logs, etc.) for granular analysis and alerting
  </Accordion>

  <Accordion title="Does Supplier have established procedures for cooperating with local government and law enforcement requesting customer data?">
    Yes. We have procedures in place to support Government
  </Accordion>

  <Accordion title="Describe your established procedures for cooperating with local government and law enforcement requesting customer data.">
    We have the clauses for suppporting local government and law enforcement requesting customer data in data protection policy. We will share the copy of it.
  </Accordion>

  <Accordion title="Which cloud providers do you rely on?">
    We have deployed our application on Amaon web services (AWS) AWS is designed to help us build secure, high-performing, resilient, and efficient infrastructure for our applications. AWS is also ISO 27001:2013 and SOC 2 type II Certified and provide all applicable security to the data center.
  </Accordion>

  <Accordion title="Does the penetration test follow an industry approved methodology, please describe">
    Yes. We have industry approved vendor called Appknox for Vulnerability assessment anf Penetration Testing. Appknox performs Static, Dynamic, API, and as well as Behavioral Analysis. And they helps to detect and address security vulnerabilities.
  </Accordion>

  <Accordion title="Please describe the company/user data you require to provide your service: personal information, financial data, confidential/sensitive data, government data">
    We collect only personal information through our application. We collect name, email ID and mobile numbers.
  </Accordion>

  <Accordion title="Do you have capabilities to anonymize data?">
    Yes. We have capabilities to anonymize data. By Anonymization users are able to make use of sensitive information without having access to the identifiable data items. And its used within a secure environment with employee access on a need to know basis.
  </Accordion>

  <Accordion title="Do you keep sensitive data (as defined by your data classification matrix) in hard copy (e.g. paper copies)? If so, please describe.">
    No. we do not have it in hard copy
  </Accordion>

  <Accordion title="How do you regularly audit your critical vendors?">
    Yes. We conduct vendor Risk assessment and also external Auditor validate the critical vendor documentations during the annual and Internal Audit.
  </Accordion>

  <Accordion title="Do you have a formal Information Security Program (InfoSec SP) in place?">
    Yes. We have Information Security Program
  </Accordion>

  <Accordion title="Do you review your Information Security Policies at least once a year?">
    Yes. We review Information Security Policies every year.
  </Accordion>

  <Accordion title="Do you have a Information security risk management program (InfoSec RMP)?">
    Yes. We have Information security risk management program
  </Accordion>

  <Accordion title="Do you have management support or a security management forum to evaluate and take action on security risks?">
    Yes. Our management is supportive and evaluate, Recommend and take action on security risks
  </Accordion>

  <Accordion title="Do you have a dedicated information security team? If so, what is the composition and reporting structure?">
    Yes, we have Information security team and the Infosec head is reporting to Chief Operating Officer of Xoxoday.
  </Accordion>

  <Accordion title="Do you publish a path for responisble disclosure of security vulnerabilities (ie security@ or /security)?">
    Yes
  </Accordion>

  <Accordion title="Do you have an established bug bounty program?">
    Yes. Please visit here for more details - [https://www.xoxoday.com/bug-bounty](https://www.xoxoday.com/bug-bounty)
  </Accordion>

  <Accordion title="Are all endpoint laptops that connect directly to production networks centrally managed?">
    Yes. All the endpoint laptops that connect directly to production networks centrally managed
  </Accordion>

  <Accordion title="Describe standard employee issued device security configuration/features. (Login Password, antimalware, Full Disk Encryption, Administrative Privileges, Firewall, Auto-lock, etc.)">
    All the employees laptop is secured with Bitdefender end point security software. We use a cloud hosted VPN with strict access controls to allow our employees to access the official network. This VPN is managed by our IT team and is linked with the SSO/Active Directory.
  </Accordion>

  <Accordion title="Does sensitive or private data ever reside on endpoint devices? How is this policy enforced?">
    No. sensitive or private data never reside on endpoint devices. This is enforced throgh access control policy.
  </Accordion>

  <Accordion title="How do you keep aware of potential security vulnerabilities and threats that may affect your service?">
    We use Bitdefender End point security software to prevent from malware and protect the data. In addition to that we also have AWS Guard Duty threat detection service that continuously monitors for malicious activity and unauthorized behaviour.
  </Accordion>

  <Accordion title="How is your Incident Response Plan tested? Include how often.">
    Yes. Our incient response plan is tested every year as per the ISMS requirements.
  </Accordion>

  <Accordion title="Describe how threat modelling is incorporated in the design phase of development?">
    We follow SDLC policy during the design phase of devolopment. See SDLC procedure attached
  </Accordion>

  <Accordion title="How do you train developers in SSDLC / Secure Coding Practices?">
    We have SDLC procedure and Information System Acquisition Development and Maintenance Procedure. Devolopers are trained on the Secure Coding Practices as soon as they joined our organization
  </Accordion>

  <Accordion title="How do you monitor vulnerabilities in dependencies?">
    We conduct vendor risk assessment and collect all the required security policies, procedures, VAPT reports, ISO 27001, SOC 2 reports. And also our internal and exteranal auditors validate the security controls of our crtical vendors during the Audit.
  </Accordion>

  <Accordion title="Do you outsource development? (contracted with a 3rd party? open source project inclusion?)">
    NO
  </Accordion>

  <Accordion title="What types of security reviews do you perform on custom-built software?">
    NA. We do not have custom-built software
  </Accordion>

  <Accordion title="Does application support IP whitelisting for API access?">
    Yes
  </Accordion>

  <Accordion title="How do you conduct internal audits (audits lead by your personnel) of the service? please describe the scope, remediation process and frequency of audits.">
    Internal Audit has been conducted by the inhouse Infosec and ISMS Lead Auditor. All the projects, business processes and ISMS controls has been included in the scope and opportunity of improvements has been communicated to all the respective teams with the remideiation plan. And the frequency of the Internal audit is annually.
  </Accordion>

  <Accordion title="How do you conduct external (third-party) audits of the service? please describe the scope and frequency of audits.">
    We have the external Auditor for ISMS Audit. All the projects, business processes and ISMS controls has been included in the scope and opportunity of improvements has been communicated to all the respective teams with the remideiation plan. And the frequency of the external audit is annually.
  </Accordion>

  <Accordion title="Please provide a copy of the most recent report.">
    See ISOIEC 270012013 Certificate and Internal Audit report attached.
  </Accordion>

  <Accordion title="Do you seek a right to use or own customer derived data for your own purposes?">
    NA. We do not use for own purposes
  </Accordion>

  <Accordion title="Do your information security and privacy policies align with industry standards (ISO-27001, NIST Cyber Security Framework, ISO-22307, CoBIT, etc.)?">
    Yes
  </Accordion>

  <Accordion title="Are all personnel required to sign Confidentiality Agreements to protect customer information, as a condition of employment?">
    Yes. All the employees and third party service providers are required to sign Confidentiality Agreements to protect customer information as per ISMS compliance requirements.
  </Accordion>

  <Accordion title="Hardware security">
    We have dedicated IT Team and Admin team who looks after the hardware security and, we have implemented the security controls as per the ISO 27001:2013 and SOC 2 Compliance requirements. We are hosting our application on AWS, and they are providing physical security to our data centre. We have Asset Management Procedure in place to identify, classify, label, and handle the Information and Information assets according to their criticality and sensitivity. We have Media protection procedure to handle the locally stored data as per the Information security compliance requirements.
  </Accordion>

  <Accordion title="Paper Document Security">
    As per the Physical and Environmental Security policy we have security guards and CCTV Camera's to safeguard the office building and also to provide an access to the building only for the authorized individuals. We also have Media protection policy which also defines on how to handle the Paper documents as per the compliance requirements. Physical documents are handled with at most care and followed the policies and procedures of an organisation to make sure that the data is protected.
  </Accordion>

  <Accordion title="Physical access control">
    We have Physical and Environmental Security policy and Vendor management guidelines in place and working effectively. We have implemented controls on Physical entry, Securing offices, rooms, facilities, Working in secure areas, Delivery and Loading areas etc. Only the authorised individuals will get an access upon verification. And we also conduct periodical verification of the effectiveness of these controls periodically through internal and external Audit. We provide access to the outsiders or suppliers on approval and escorting mechanism of vendor management guidelines by issuing the access cards.
  </Accordion>

  <Accordion title="Maintenance - Describe here how physical maintenance of hardware is managed">
    All our assets are classified, labelled, and maintained in the register by our IT Team. Access granted only to, authorized individuals. We have locked environment for our hardware's which would store the data. We also have implemented the Media protection procedure to protect the data which are stored physically.
  </Accordion>

  <Accordion title="Backups - Indicate here how backups are managed. Clarify whether they are stored in safe place">
    Yes. Backups are stored in a safe place. We have backup Recovery Procedure and implemented the controls to protect the organization information asset from the damages that may be caused due to failure of hardware system, corruption of software, breaches leading to data destruction and or not being able to retrieve and use. We predominantly work on cloud-based infrastructure and the teams may consider adoption of Amazon Web Services which provides the Backup and Restore services to build scalable, durable and secure data-protection solutions. AWS claims the following benefits and the teams may evaluate the benefits to the respective context that may lead to realize the following outcomes: 1. Data Type and Durability 2. Flexibility and Scalability 3. Security and Compliance The following AWS based offering for the following use cases offered by AWS may be considered based on the contractual needs of the subject under consideration: 1. Hybrid Cloud Backup 2. Data Lifecycle Management 3. Tape Replacement 4. Global Data Resiliency 5. Data Backup 6. Archive & Compliance
  </Accordion>

  <Accordion title="Governance - Describe the documentary base setting out data protection objectives and rules">
    We are ISO 27001:2013 certified and GDPR compliant organization. We have Information security policy and Data security policies in place with regards to data protection. We make sure that the below principle of data security has been followed as per the compliance requirements. 1. Fairness and lawfulness When personal data processed by us, we make sure that the individual rights of the data subjects must be protected. We will ensure that the personal data is collected and processed in a legal and fair manner. 2. Confidentiality - Restriction to a specific purpose We make sure that the any processing of personal data should be lawful, fair, and transparent. Personal data will be processed only for the purpose that was defined before the data was collected. Subsequent changes to the purpose are only possible to a limited extent and require substantiation. 3. Transparency We make sure that we maintain the transparency with regards to the data collected, stored and disposed. We also provide rights to data subjects as per the GDPR compliance requirements. For ex - Right to Rectification, Right to Portability and Right to be Forgotten. 4. Integrity and data security Personal data is subjected to the data secrecy. We have controls on confidentiality, Integrity and data security. We follow secured suitable organizational and technical measures to make sure that the data is protected from an unauthorized access, illegal processing or distribution, as well as accidental loss, modification or destruction etc. Sensitive data - We do Inform involved parties about how we will process their data Inform involved parties about who has access to their information Have provisions in cases of lost, corrupted, or compromised data Allow involved parties to request that we modify, erase, reduce or correct data contained in our databases. Sensitive data - We do not Communicated informally. Stored for more than a specified amount of time. Distribute to any party other than the ones agreed upon by the data's owner (exempting legitimate requests from law enforcement authorities. In addition to ways of handling the data the company has direct obligations towards people to whom the data belongs.
  </Accordion>

  <Accordion title="Managing Privacy Risk - Describe processes to control the risks that processing operations performed by the organisation">
    We have controls in place to protect the information or to maintain privacy. We conduct Data Privacy impact assessment and Audits periodically as per the compliance requirements. We have Personally Identifiable Information Policy, Data Security policy, Data Subject Access Rights Procedure, Data Retention and Disposal Policy as per GDPR compliance.
  </Accordion>

  <Accordion title="If the customer data will be held by a subcontractor to your organisation, how will you ensure that their Information Security meets required standards?">
    We conduct periodic vendor risk assessment. Information security documents are validated by theiInternal and external auditors during the assessments.
  </Accordion>

  <Accordion title="Will an asset register be completed to log all assets holding the customer data and who is responsible for updating it?">
    Yes.
  </Accordion>

  <Accordion title="How will you decide which of your staff (support, development etc.) need access to the the customer system and data? How will you manage that access and what controls are in place, to ensure that privileged access rights will be restricted and controlled?">
    We have an access control policy. The policy is attached for reference. Only authorised employees will have access to the data.
  </Accordion>

  <Accordion title="Is your organisation ISO/IEC 27001 or similarly certified or compliant? Please provide details. If yes please provide evidence and skip section 5.">
    Yes. Xoxoday is ISO/IEC 27001:2013 certified organization. See certificate attached.
  </Accordion>

  <Accordion title="Have all information security responsibilities within your organisation been defined and allocated including: maintaining appropriate contacts with relevant authorities and groups ensuring information security is addressed in project management ensuring that conflicting duties and areas of responsibility are segregated">
    Yes. We have a well-defined policy for roles and responsibilities. We have communicated each employee about their responsibilities across the organization. We do maintain appropriate contracts with relevant authorities and ensure that applicable regulations are complied with
  </Accordion>

  <Accordion title="When a person working with the customer data no longer performs that role, are their permissions to the customer data revoked?">
    Yes. We provide these rights to the data subject as per GDPR
  </Accordion>

  <Accordion title="Is your organisation's Information Security Management System (i.e. control objectives, controls, policies, processes and procedures for information security) reviewed, internally and independently audited for compliance at planned intervals or when significant changes to the security implementation occurs?">
    Yes. We conduct internal and external audits and all the applicable controls have been validated as per the compliance requirements.
  </Accordion>

  <Accordion title="Have all relevant statutory, regulatory, contractual requirements, (including: intellectual property rights, protection of records, protection of personally identifiable information and cryptographic controls) and the organisation's approach to meet these requirements, been explicitly identified, documented and kept up to date, for the/each the customer information system?">
    Yes
  </Accordion>

  <Accordion title="Describe how and when media containing the customer data would be securely destroyed and how you would evidence this?">
    We have a media handling procedure. See attached for reference.
  </Accordion>

  <Accordion title="Will any physical media containing the customer data, be transferred outside your organisation and if so, what procedures will be in place to protect the media from compromise?">
    No. We do not transfer the data outside our organization.
  </Accordion>

  <Accordion title="Is there a documented standard procedure followed for building and hardening host machines? If so please attach a copy.">
    Yes. See Infrastructure Change Control Procedure attached.
  </Accordion>

  <Accordion title="Are these procedures periodically reviewed and kept in line with current best practice?">
    Yes.
  </Accordion>

  <Accordion title="How will security incidents relating to the customer data be reported to the customer?">
    Security inceidents will be reported by our Information security team or customer support team within 48 hours.
  </Accordion>

  <Accordion title="What physical measures (e.g. CCTV, Coded Locks, Guards) will be in place to protect the customer data that is stored: At your offices/location At the data centre How will these controls be managed and monitored?">
    We have implemented physical security controls as per the compliance requirements. We have CCTV, access cards, security guards for monitoring and only authorised individual have access.
  </Accordion>

  <Accordion title="Emergency, temporary or test accounts should be documented, have a specified period of validity and terminated immediately after validity period expires.">
    Segregation is done for production and non-production or Testing environments. We maintain the test accounts seperately and delete or terminate the accounts immediately once the testing is completed. Only Admins have an access to create these tests accounts on need and approval basis.
  </Accordion>

  <Accordion title="Responsibilities and duties for system users shall be segregated based on the defined roles.">
    We have implemented the Roles and Resposibilities policy and defined the Duties of all the system users and segragated based on the defined roles. Only authorised individual will have an access to the Information system on need and approval basis.
  </Accordion>

  <Accordion title="There should be a minimum three types of user groups for systems and applications (e.g. operator, supervisor, engineer, domain administrator, etc.) where technically feasible.">
    We maintain these records for Audit purposes.
  </Accordion>

  <Accordion title="Role based user accounts shall be implemented for operation users (operators, supervisors, shift controller, engineer, etc.) with specific and defined privileges based on the principle of least privilege for each role.">
    We have controls in place to monitor the user access system. We have implemented Role based access management system through access control policy. Our application also supports Role based access control system to make sure that only authorised individual will have an access to the Information system on need and approval basis.
  </Accordion>

  <Accordion title="Privileges for all accounts used with the customer assets shall be identified and documented.">
    We maintain these records for Audit purposes.
  </Accordion>

  <Accordion title="All the customer system accounts shall be secured utilising the following mechanisms: - Default credentials shall be removed, disabled and/or changed (e.g. guest, administrator, factory configured user, etc.). - Authorised service accounts shall have mitigating controls in place. (e.g. no interactive login, etc.) and be configured to never expire nor auto-disable. - Interactive logon for service accounts shall be disabled and wherever feasible, managed service accounts shall be used). - Both successful and failed login attempts shall be logged. - Multi-factor authentication shall be used wherever possible for all privileged access. - Ensure that privileged accounts are used only for system administration activities. - Enable account lockout for invalid login attempts wherever feasible; when this feature cannot be enabled, ensure alternate compensating controls are in place. - Ensure password history shall not allow reuse of last ten (10) passwords.">
    We are Compliant. We monitor these controls on a periodical basis and also during the internal and external Audits. Successful and failed login attempts will be logged, we use privileged accounts are used only for system administration activities,we remove default credentials and use the new credentials for all our systems.
  </Accordion>

  <Accordion title="Where strong authentication and identity verification is required, authentication methods alternative, or additional, to passwords, such as cryptographic means, smart cards, tokens or biometric means, shall be used.">
    We use Multifactor authentication menthods to make sure that only authenticated individual have an access to the Information system wherever strong authentication is required. We use Biomentric verification and access cards methods for physical security purposes.
  </Accordion>

  <Accordion title="When an asset cannot support the use of automated mechanisms to enforce access restrictions, alternate security controls shall be used. The justification and details for those controls should be documented to support subsequent audits, including: Restricting physical access. Monitoring and recording physical access. Ensuring authorised individuals are trustworthy and reliable. Conducting post-maintenance audits to validate that changes are implemented correctly.">
    We have these controls in place. We have a restriction for Physical access, monitor these access periodically and validate to make sure that only the authorised individual have an access.
  </Accordion>

  <Accordion title="Temporary account user name and passwords shall be communicated in a secure manner following these practices: When users are required to change the passwords, they should initially be provided with secure temporary authentication information, which they are immediately forced to change. Verify the identity of a user prior to providing a new, replacement or temporary password. Temporary authentication information shall be unique to a user. Users shall acknowledge the receipt of temporary passwords.">
    The credentilas has been comminocated via secured mode to make sure that confidentiality is maintained.
  </Accordion>

  <Accordion title="All access to the customer networks and services, local or remote, shall be specifically authorised through processes prior to allowing such connections. Processes shall ensure that all entity networks and services information security requirements are met before approvals.">
    We are Compliant.These controls are audited during the internal and external Audits.
  </Accordion>

  <Accordion title="All users and access to the customer networks and services shall be documented.">
    We are Compliant.Only authorised individual will have an access.
  </Accordion>

  <Accordion title="Where technically feasible, ensure all authentication attempts (successful and unsuccessful) are logged up to the capabilities of the authentication system.">
    We are cothe customerant. We maintain the records of Audit logs.
  </Accordion>

  <Accordion title="Only protocol ports and services required for proper functioning of the system or application shall be allowed on each system.">
    We have restricted the access of external harddrives, USB etc for all the systems through Active directory and End point security.
  </Accordion>

  <Accordion title="All network filtering mechanisms (e.g. firewalls) shall apply an opt-in principle with a fail-safe mechanism (i.e. default deny rule that drops all traffic, except that which is explicitly allowed and if an error/failure occurs the system should fail in a secure manner: security controls and settings remain in effect and are enforced).">
    We have the security controls in place. We have installed the firewalls to monitor and control the incoming and outgoing network traffic based on predetermined security rules. It helps us to establishes a barrier between a trusted network and an untrusted network.
  </Accordion>

  <Accordion title="All equipment connected to the customer networks shall be identified and classified based on the defined classification scheme. All equipment connected to the customer networks should have appropriate technical and/or business justifications supporting the need for that connection.">
    We have implemented the asset management procedure to identify, classify, label and handle the Information and Information assets according to their criticality and sensitivity.
  </Accordion>

  <Accordion title="Unique identifiers shall be developed in, or attached to, the equipment to indicate whether the asset is permitted to connect to the network.">
    We have labeled the aseets in order to identify and make sure that the access control permissions are maintained.
  </Accordion>

  <Accordion title="Where technically feasible, implement network-based technical controls that detect and prevent connections and/or attempts to connect equipment to the customer networks.">
    we have implemented intrusion detection and prevention tools, we ensure timely detection and investigation in a prompt manner.
  </Accordion>

  <Accordion title="Detection capabilities should be augmented with event correlation (e.g. SIEM) used to correlate approved and expected connections of equipment to the customer networks.">
    These are integrated with security operations/SIEM solutions.
  </Accordion>

  <Accordion title="All routing equipment shall be specifically authorised through processes prior to allowing equipment or routing connections. Processes shall ensure that approvals are based on clearly defined technical and business justifications for those communications.">
    We take an approval from the concerned authority before procuring the equipment or routing connections and test the same before installing it.
  </Accordion>

  <Accordion title="Network devices shall be securely configured taking following measures into consideration: Source and address violation rules. Router protection (e.g. hardening). Specific sub-netting for publicly accessible systems. Boundary protection device for external connections. Monitoring for suspicious traffic.">
    All the network devices are securely configured and we always make sure that we monitor the same on regular basis and take appropriate action on any detections.
  </Accordion>

  <Accordion title="Wherever feasible, vendor-supplied software packages shall be used without any changes.">
    We use vendor supplied softwares without any changes wherever feasible, if all the security controls are in place.
  </Accordion>

  <Accordion title="When changes to software packages are required, the following shall be considered: Responsibility for future maintenance of the software. Compatibility with existing application software. Risks of existing application controls being altered or compromised.">
    We consider these factors before making these changes to the softwares.
  </Accordion>

  <Accordion title="Where technically feasible, any changes to software shall be tested in a non-production/test environment before moving it to a production environment.">
    Yes, we test the changes made on testing environment before moving it to a production environment.
  </Accordion>

  <Accordion title="Based on the information asset's classification, controls shall be applied to restrict access to information and applications.">
    Only authorised individual have an acces to the approved information assets.
  </Accordion>

  <Accordion title="Service account passwords or application hard-coded passwords that cannot be changed shall be documented and additional compensating controls shall be identified to protect and monitor such systems.">
    we are compliant. We document or have a track of all the changes made to protect the information system.
  </Accordion>

  <Accordion title="Security requirements shall consider: The level of confidence required towards the claimed identity of users, to derive user authentication requirements. Access provisioning and authorisation processes, for business users as well as for privileged or technical users. Users and operator's duties and responsibilities. Requirements derived from business processes, such as transaction logging and monitoring, nonrepudiation requirements. Requirements mandated by other security controls, e.g. interfaces to logging and monitoring or data leakage detection system.">
    We are compliant and have these controls in place.
  </Accordion>

  <Accordion title="Contracts with vendors shall include the requirements for secure design, coding, testing practices and a warranty clause that the software/system is free from security vulnerabilities.">
    We have the appropriate clauses in the agreements wherever necessary.
  </Accordion>

  <Accordion title="Document/guide for secure use or operation of the supplied system or component shall be provided">
    We provide guidance for using our products appropriately and take all the possible benefits.
  </Accordion>

  <Accordion title="Patch management policy and process is in place to cover patch qualification, patch distribution, update and auditing process">
    We have the controls in place. All the Critical patches will be deployed immediately
  </Accordion>

  <Accordion title="Third parties shall address security vulnerabilities brought to its attention by the customer in a timely manner.">
    We inform our customers on the vulnerabilities wherever is required from the compliance perspective.
  </Accordion>

  <Accordion title="For any hardware, software or firmware, supplied, a quality certificate (QC) ensuring that all provided hardware, software or firmware is free from any dormant malicious programmes should be provided.">
    Our product is free from dormant malicious programmes
  </Accordion>

  <Accordion title="All systems shall be tested prior to acquisition and prior to accepting new systems into operational environment based on predefined criteria.">
    We test the systems before deploying into operational environment.
  </Accordion>

  <Accordion title="Identify and document criteria for testing new features or enhancements to existing systems or assets.">
    We have implemented the System Devolopment Life Cycle procedures and all the testing of new features are documented.
  </Accordion>

  <Accordion title="Define criteria for accepting products (e.g. in terms of their functionality), to ensure identified security requirements are met.">
    We conduct security assessments before accepting the products and take appropriate approval to make sure that all the security requirements are met.
  </Accordion>

  <Accordion title="Ensure tests are performed and results are documented.">
    All the test results are documented.
  </Accordion>

  <Accordion title="Where the functionality in a proposed product does not satisfy the specified requirement, the risk introduced, and associated controls should be documented and reconsidered prior to purchasing the product.">
    We record these in the Risk register and documented before purchasing the product.
  </Accordion>

  <Accordion title="All system vendors and third parties shall follow security test processes outlined in the system and services acquisition process document (e.g. FAT, SAT, unit testing, integration testing and UAT)">
    We make sure that these are met before acquiring and products.
  </Accordion>

  <Accordion title="the customer responsible staff shall sign-off and certify that all relevant security requirements have been tested satisfactorily before turn-over to operations.">
    The customer responsible staff can confirm upon validation of the security requirements.
  </Accordion>

  <Accordion title="Any variation between system design and system implementation shall be recorded and security risk assessment shall be conducted to determine mitigation strategies.">
    All the design and implemetation has been documented. We conduct the security Risk assessment in order to identify and mitigate the risks.
  </Accordion>

  <Accordion title="Transfer and use of production data in development and test environments is prohibited and where and when technically not feasible shall be authorised, protected (encryption, access control etc.), logged and only for a determined period.">
    We have kept Testing and production environment seperately. We do not use any data from our production environment for testing purposes.
  </Accordion>

  <Accordion title="All software and hardware acquisition contracts shall include identified rules and requirements and require compliance and the possibility to audit the development processes.">
    All our contracts or agreeements are having appropriate clauses with regards to security compliance, privacy, Audit requirements etc.
  </Accordion>

  <Accordion title="Only licensed third-party libraries and components shall be used.">
    we use only licensed softwares or assets
  </Accordion>

  <Accordion title="Formal change control processes shall be used to manage changes to software code, taking into account that: Impacts of changes to software are understood using risk assessment methodologies. Changes do not compromise exiting security and control measures. Existing documentation is updated. Acceptance testing is performed to validate if system behaves only as expected.">
    We are compliant. We maintain these records for Audit purposes.
  </Accordion>

  <Accordion title="When software or application development is outsourced, the following security requirements shall be controlled: Licensing arrangements, code ownership and intellectual property rights related to the outsourced content. Contractual requirements for secure design, coding and testing practices. Provision of the approved threat model to the outsourced developer. Acceptance testing for the quality and accuracy of the deliverables. Provision of evidence/certification that security thresholds were used to establish minimum acceptable levels of security and privacy quality. Rights of access for audit of the quality and accuracy of work.">
    We have not outsourced.
  </Accordion>

  <Accordion title="Vendors and third parties shall provide documented artefacts to ensure that security controls as requested within this manual are instituted in the system.">
    Attached the Information Security Manual. It prescribes the policies that govern the management and administration of the Information Security Management System (ISMS) for application.It specifies the scope and the requirements for establishing, implementing, operating, monitoring, reviewing, maintaining and improving the information security controls.
  </Accordion>

  <Accordion title="All supply chain requirements are also applicable to work subcontracted by vendors and third parties to develop, test or integrate systems for the customer.">
    We have not subcontracted or outsourced any of services with regards to the product.
  </Accordion>

  <Accordion title="All conditions under which the transfer of information/data must be protected shall be documented and maintained.">
    We have documented the Transfer of Information and it's a part of our Information security policy
  </Accordion>

  <Accordion title="Actions to be taken when issues arise regarding the transfer of information/data must be identified and documented.">
    We do not transfer the data. But if its necessary it will be done only upon the approval of the management.
  </Accordion>

  <Accordion title="To ensure information is adequately protected during transfer, specific controls and procedures shall be identified. Security controls shall be appropriate to the strictest classification level of the information/data to be handled. Such countermeasures may include encryption and/or cryptographic signatures, physical restriction to assets and/or access control mechanisms.">
    We have documented the Transfer of Information and it's a part of our Information security policy
  </Accordion>

  <Accordion title="An exchange of information agreement with each external party outlining clear roles and responsibilities of each party must be established. Consider security conditions such as: Ensuring traceability and non-repudiation. Responsibilities for tracking message transmission, dispatch, and receipt. Licensing and escrow agreements. Ownership and responsibilities for data protection, copyright, license compliance, etc. Responsibilities and liabilities in the event of security incidents, such as loss or disclosure of data. Selection and audit criteria for couriers or escrow agents. Maintaining chains of custody for information being stored or transferred, including documentation and management of access control levels.">
    We do not transfer the data. But we follow these compliance requirements if there are any data transfers. We have implemented the Information security and Data security policies in order to make sure that we secure our organizational and customers information.
  </Accordion>

  <Accordion title="Records of media transfer shall be kept.">
    We maintain these records for Audit purposes.
  </Accordion>

  <Accordion title="Monitor and audit the log records to ensure requirements are being met.">
    We monitor and audit the logs.
  </Accordion>

  <Accordion title="Document and maintain up-to-date all points of interconnection between information/data systems and the types of information/data to be protected regarding the identified interconnections.">
    We are complied. We have controls in place to make sure that Information system is protected.
  </Accordion>

  <Accordion title="A security risk assessment shall be conducted to determine which message's authenticities and integrities are critical to prevent unacceptable impacts to the customer.">
    We conduct the Risk assessment to identify and mitigate the risks involved.
  </Accordion>

  <Accordion title="Monitor message tampering and source spoofing for messages for which authenticity and/or integrity need to be ensured.">
    We use Google workspace as email solution and adequate security features has been enabled to make sure that Information system is protected.
  </Accordion>

  <Accordion title="Large Screen Displays (LSD) connected through Video Controllers/Ethernet cards shall not be shared with any the customer corporate network. However, sharing direct LSD ports with any other network without connecting through Video Controller can be allowed.">
    We do not connect.NA
  </Accordion>

  <Accordion title="Appropriate compensating controls shall be in place to protect against security threats to weak protocols (e.g. protocols lacking encryption or authentication mechanisms).">
    We make sure that all the controls and compensatory controls are in place in order to protect against the Security threats.
  </Accordion>

  <Accordion title="Any traffic between OT/IT networks shall to be officially approved after a security risk assessment on the suggested traffic, and documented with business justification, the risk it represents and the controls that will be used to reduce the risk to an acceptable level.">
    We have implemeted the risk management procedure and defined the Risk Treatment, Risk Treatment, Risk Mitigation, and Risk transfer etc
  </Accordion>

  <Accordion title="Serial Interfaces shall be secured based on security risk taking in consideration the following: Employ protection and detection capabilities where applicable and subject to vendor's confirmation of proven performance. Compensating/alternate security controls shall be employed where mitigation measures cannot be applied due to technical or operational infeasibility.">
    We have implemeted the risk management procedure and defined the Risk Treatment, Risk Treatment, Risk Mitigation, and Risk transfer etc We implement the Compensating security controls wherever measures cannot be applied due to technical or operational infeasibility.
  </Accordion>

  <Accordion title="Ensure security requirements and service outages are captured in service level agreements for network services. Include auditable security requirements.">
    We maintain these records for Audit purposes.
  </Accordion>

  <Accordion title="Audit network services provider as defined in the service agreement.">
    It's a part of our Internal and external Audits.
  </Accordion>

  <Accordion title="All systems and equipment shall be maintained to assure that security has not been degraded below the accepted level. Preventive maintenance shall be performed at least once a year.">
    We make sure that these controls are in place and security has not been degraded below the accepted level. We also validate these controls during our internal and external Audits.
  </Accordion>

  <Accordion title="Temporary override of security controls such as application whitelisting, DLP, HIPS, etc. shall be allowed only for legitimate job requirements by authorised personnel with approval after a security risk assessment and compensating controls are implemented.">
    We have implemented the role based access system and change management policy in order to make sure that we provide an access to an individual only upon need and approval basis. All the changes has been tracked and maintained the records for audit purposes.
  </Accordion>

  <Accordion title="Identify all products and components (e.g. physical and logical) used within the entity that are programmable/configurable (this may be acquired through, and documented within, the asset inventory).">
    We have a up to date records of all the assets used.
  </Accordion>

  <Accordion title="Define and document mandatory products and components configuration baselines based on security best practices and the customer defined standards.">
    We make sure that we follow the Industry best practices and security standard to make sure that we secure the information asset.
  </Accordion>

  <Accordion title="Any deviations to the the customer defined configuration baseline (e.g. application/system incompatibility, lack of vendor approval, etc.) should be recorded and appropriate compensating controls shall be implemented.">
    We make sure that we follow the existing security controls and implement the compensatory controls to make sure that the information system is secure.
  </Accordion>

  <Accordion title="Passwords protecting the BIOS/initial logon from unauthorised change shall be implemented. For systems where it is not technically feasible to password protect the bios, alternative measures shall be implemented.">
    We have implemented the control.
  </Accordion>

  <Accordion title="Potential adverse impacts to the customer environment associated with the use of troubleshooting and other tools shall be evaluated through security risk assessment before approving the use of these tools.">
    We conduct the Risk assessment to identify and mitigate the risks involved.
  </Accordion>

  <Accordion title="Security health checks shall also be carried out and documented during each maintenance cycle. Include topics such as: Inventory register check for any inconsistencies. Inter-communication architecture. Open ports and services. System hardening. Protection from malicious code. Up-to-date security patches. Equipment backup. Performance and capacity monitoring. Renewal of subscription licenses.">
    Compliant.We review and validate these controls on a periodical basis and These are part of an Internal and external Audits.
  </Accordion>

  <Accordion title="If during security health checks changes to approved baselines are discovered a report shall be generated and reviewed.">
    Compliant.We review and validate these controls on a periodical basis.
  </Accordion>

  <Accordion title="Records shall be maintained, for a period of five years or as legal, regulatory or operationally required, of all suspected and actual faults, and all preventive and corrective maintenance activities.">
    We maintain these records for Audit purposes.
  </Accordion>

  <Accordion title="All test and development environments shall be required to meet specifically defined security requirements designed to support the integrity of these environments and prevent introduction of threats to the production environment.">
    We have the required security controls in place.
  </Accordion>

  <Accordion title="Obsolete systems shall not be used and plans to replace/refresh must be established to reach an acceptable risk level and support.">
    We do not use outdated computer hardware, software, technology, services or practices
  </Accordion>

  <Accordion title="Upgrade plan for OS obsolescence, HW/SW obsolescence etc. for all systems, assets and components shall be based on the criteria that it is obsolete and/or resulting high maintenance costs and no system vendor support is available.">
    We upgrade the systems make sure that do not use outdated computer hardware, software, technology, services or practices
  </Accordion>

  <Accordion title="Where technically feasible, employ anti-malicious code protection mechanisms for the network devices as well as servers, workstations, laptops and other devices connected to the the customer environment.">
    We have installed the end point security software on all the computers and servers to keep the computer and personal information protected.
  </Accordion>

  <Accordion title="Anti-malicious code protection (including supported anti-malware products, configuration settings, etc.) for IT\OT assets shall be endorsed by the vendor.">
    We have installed the end point security software on all the computers and servers to keep the computer and personal information protected.
  </Accordion>

  <Accordion title="Any deviations to the entity-defined anti-malicious code requirements (e.g. application/system incompatibility, lack of vendor approval, etc.) shall be recorded. Risks due to deviations shall be managed to entity acceptable levels through compensating controls.">
    We are compliant.
  </Accordion>

  <Accordion title="Anti-malicious code protection tools shall be monitored for detection events and alerts.">
    We have enabled these features.
  </Accordion>

  <Accordion title="Anti-malicious code shall be deployed with defined scanning, update, and monitoring requirements across OT/IT assets.">
    We have installed end point security softwares to safeguard from attack scripts, viruses, worms, Trojan horses, backdoors and malicious active content. We also conduct periodical scanning in order to make sure that all the information assets are safe. These are centrally managed and have control on all the end points.
  </Accordion>

  <Accordion title="All documentation related to Technical Vulnerability Management shall be classified as Sensitive, protected accordingly and shall be made available only on a need-to-know basis.">
    It is available on need to know basis
  </Accordion>

  <Accordion title="All new system/asset shall not be considered in production until a vulnerability assessment has been conducted and vulnerabilities addressed.">
    We make sure the Vulnerability assessment has been conducted for our products as per the compliance requirements.
  </Accordion>

  <Accordion title="In the absence of an approved entity-specific retention schedule, data backup shall be retained as per defined logging standard, after which tapes or another storage backup media may be overwritten.">
    We are compliant.
  </Accordion>

  <Accordion title="Periodically verification if the customer sensitive information is exposed to the general public and/or exposed to internal network shall be conducted.">
    the customer Sensitive information will not be exposed to the general public.
  </Accordion>

  <Accordion title="Information regarding potential security issues shall be collected, analysed and reported in a timely manner.">
    We document and maintain all the security issues.
  </Accordion>

  <Accordion title="Time distribution/clock synchronization shall be implemented in all environments from a secure and accurate source that uses an accepted secure standard protocol (e.g. IEEE 1588-2008/IEC 61588:2009).">
    We are complaint.
  </Accordion>

  <Accordion title="Requirements for monitoring shall be identified: Types of systems and assets. Outline which aspects must be monitored. How monitoring is to be performed. Account for instances where automated monitoring is not technically feasible. Logs and realtime traffic shall be monitored and analysed.">
    We are compliant. We have clasified, labeled our assets and periodically monitored. All the logs and realtime trafic is monitored.
  </Accordion>

  <Accordion title="A Security Incident and Event Management (SIEM) solution, or equivalent, shall be implemented.">
    Implemented. We are compliant.
  </Accordion>

  <Accordion title="Does the CSP agreement include security requirements that address the following security controls? 1. Data ownership 2. Data protection and storage 3. Information security incidents handling 4. Change, Recovery and Restoration 5. Data handling and storing location 6. Portability and continuity 7. Compliance and monitoring rights and methods">
    These are all part of CSP agreement.
  </Accordion>

  <Accordion title="Supporting Utilities: Short-term UPS to facilitate an orderly shutdown of critical in the event of primary power source loss. Long-term alternate power supply capable of maintaining minimum operational capability in case of long term power loss. Primary and alternate telecommunications equipment to support reliable operations.">
    We have these controls in place as a part of our Business continuity plan.
  </Accordion>

  <Accordion title="Cabling Security: Power, system and communication cables shall be secured. Based on information security risk, communication cables might need to be monitored against network tap attempts and network tampering, specifically when protective technical controls are not technically feasible.">
    We have these controls in place as a part of our Business continuity plan. It has been tested periodically and part of our internal and external Audit.
  </Accordion>

  <Accordion title="Risk Assessment shall be conducted to identify potential risks to the customer Information assets as a result of third party access or engagement with the customer. The analysis of risks related to external party access must consider: The classification of the information assets. Possible impacts to the controls of the information assets and processing facilities involved. Processes for identifying, authorising, authenticating and reviewing access rights of the external party. Security controls to be used by the external party when storing, processing, communicating, sharing or exchanging the customer information.">
    We have conducted the risk assessment as per the industrial standard.
  </Accordion>

  <Accordion title="Third party compliance to the customer security policies and procedures shall be ensured and addressed by formal contract and signed Non-Disclosure Agreement (NDA) between the customer and the third party">
    Agreed. We will sign the NDA
  </Accordion>

  <Accordion title="Service Level Agreements shall be documented and agreed upon by all parties to ensure there is no possibility for misunderstanding between the customer and the third party regarding each party's obligations to fulfil relevant information security requirements set forth by the customer security policies and procedures.">
    SLA can be documented and agreed by the both the party.
  </Accordion>

  <Accordion title="Prior to authorizing access of third parties to information resources, Head of Department working with third party, Information Owners and Information Custodians must confirm that: The terms and conditions of access are documented (e.g. Service Level Agreement (SLA), Contracts, Non-Disclosure Agreements, Memoranda of Understanding, etc.). Responsibilities for managing and monitoring the external party access have been assigned and documented. Security Controls have been implemented and tested against identified risks.">
    Only authorised individual have an acces to the approved information assets.
  </Accordion>

  <Accordion title="External Parties shall be responsible for ensuring its personnel uphold and upkeep the customer Security Policies. All software/hardware used by the External Parties personnel inside/outside the customer premises for accessing the customer information shall be declared and may be subjected to an audit. The External Parties shall co-operate with the customer and its entities in ensuring the same.">
    We allow our customer to audit but atlease 30 days prior notice with the scope of the audit needs to be communicated
  </Accordion>

  <Accordion title="Any exceptions to the entity defined Supplier Service Delivery requirements shall be recorded. Risks due to exceptions shall be managed to acceptable levels through application of compensating controls.">
    Its documented as per the Risk management procedure.
  </Accordion>

  <Accordion title="Service agreements shall include a methodology for communicating change management issues between the customer and the external/third party.">
    We have all the details in SLA
  </Accordion>

  <Accordion title="the customer shall conduct audits of external/third parties in conjunction with review of independent auditor's reports, if available, and follow-up on issues identified.">
    We can make our audit reports available
  </Accordion>

  <Accordion title="Entities shall maintain appropriate reports and records, to monitor and measure the compliance with the security requirements as documented in the agreements with the third-parties.">
    We maintain appropriate reports and records, to monitor and measure the compliance with the security requirements.
  </Accordion>

  <Accordion title="Changes to the provision of services provided by third parties shall be managed through risk assessment taking into consideration the criticality of business process, systems and security requirements. The following aspects should be taken into considerations: Changes to third-party agreements; Changes to the third parity organisational structure; Sub-contracting; Modifications or updates of the third party's policies and procedures; Changes to the third-party risk profile.">
    We make sure that we follow the risk management procedure and take these factors into consideration.
  </Accordion>

  <Accordion title="Disaster Recovery plans and procedures shall be in place to prevent and recover from any major breakdown or disaster.">
    We have these in place and tested annually.
  </Accordion>

  <Accordion title="Disaster recovery plans and procedures shall take into account information security requirements applicable to adverse situations.">
    We have these in place and tested annually.
  </Accordion>

  <Accordion title="Disaster recovery plan shall include a full recovery and reconstitution of the customer assets.">
    Our BCP/DR plan supports this.
  </Accordion>

  <Accordion title="Recovery procedures shall be reviewed on a yearly basis.">
    We review these on annual basis
  </Accordion>

  <Accordion title="Disaster recovery plan and procedures shall be communicated to all stakeholders internal and external to the organisation (employees, third parties).">
    We have cmmunicated to all the internal and external parties.
  </Accordion>

  <Accordion title="Contingency roles, responsibilities shall be documented with contact information, and activities associated with restoring the system after a disruption or failure, in the disaster recovery plans.">
    It's a part of Business continuity documents and attached the same for your reference.
  </Accordion>

  <Accordion title="Continuity plans shall be tested periodically, and the lessons learned documented.">
    The BCP Test and lessons learned has been documented.
  </Accordion>

  <Accordion title="When changes occur, disaster recovery plans shall be reviewed and updated, such as: Acquisition of new equipment or upgrading of systems, assets or components; Personnel; Addresses or telephone numbers; Business strategy; Location, facilities and resources; Legislation; Contractors, suppliers and key customers; Processes, or new or withdrawn ones; Risk (HSE, operational and financial, etc.).">
    It's a part of BCP documents and we review and update when changes takes place.
  </Accordion>

  <Accordion title="Technical compliance validation shall be performed by an authorised subject matter expert to determine whether security controls have been properly implemented within the the customer environment.">
    These are part of internal and external audits
  </Accordion>

  <Accordion title="Following corrective action shall be taken when non-compliance is identified: Identify the immediate and underlying causes of the non-compliance. Assess and document the risks introduced by non-compliance. Evaluate actions to be taken to attain compliance. Implement the proper corrective action.">
    We have implemented the Corrective Action Procedure.
  </Accordion>

  <Accordion title="Review whether the corrective action taken is effective shall be conducted: Document results generated from reviews and corrective actions. Observe those results over time in order to identify trends and implement further corrective action.">
    We have implemented the Corrective Action Procedure. We review rhe corrective action taken.
  </Accordion>

  <Accordion title="Security assessments shall be conducted only by resources identified by the relevant the customer department/role and shall be carefully planned and agreed upon when performed against operational environment.">
    We conduc the security assessments by the Internal and external auditors
  </Accordion>

  <Accordion title="Necessary data or equipment can be shared with the members of internal or external assessment team subject to management approval.">
    We share the data with our Internal and external auditors
  </Accordion>

  <Accordion title="Measures taken to ensure assessment activities minimise the risk of disruptions to the environment and business processes shall be documented and communicated. In particular, assessment activities shall not include network scanning or penetration testing on OT systems, as it may degrade the performance and impact the plant operations.">
    We make sure the Assessments and Audits will be conducted and reported independently.
  </Accordion>

  <Accordion title="Sensitive information shall be verified or assessed in-site and shall not be handed out or distributed.">
    All the Sensitive information shall be handled as per Policies and procedures implemented.
  </Accordion>

  <Accordion title="An action plan that describes how the identified non-conformities will be addressed shall be developed and maintained on regular basis.">
    We have defined it in our compliance policy and Corrective Action Procedure
  </Accordion>

  <Accordion title="the customer shall plan and conduct assessments of the information security controls in place through an established assurance process which will be continuously identifying technical and non-technical gaps.">
    We allow our customer to audit or assess but atlease 30 days prior notice with the scope of the audit needs to be communicated
  </Accordion>

  <Accordion title="Performance improvement plans shall consider and develop strategies to identify the suitability, adequacy and effectiveness of information security controls in place.">
    We continuously monitor and improve Information security framework to make sure that we safegurd the Information and all the controls are in place.
  </Accordion>

  <Accordion title="Performance improvement plan shall leverage and document security metrics and measurements from incident reports, and audits for future improvement.">
    We make sure that we brings these improvements to Information security systems from the incidents reported and audit observations etc
  </Accordion>

  <Accordion title="The implementation of performance improvement plan shall be monitored on a regular basis: Document and maintain corrective and/or continuous improvement actions taken. Review and report the effectiveness of corrective and/or continuous improvement actions.">
    We have implemented the corrective action plan procedure and review the policies and procedures on annual basis.
  </Accordion>

  <Accordion title="Service shall have acceptable clause regarding data ownership and intellectual property rights as per UAE regulations and the customer policies">
    It can be included in the agreement and our legal team will review and confirm
  </Accordion>

  <Accordion title="Contract / statement of work / order form clearly details the services to be provided.">
    Statement of work will have a details of product/service to be provided
  </Accordion>

  <Accordion title="Contract includes service levels or a separate SLA has been signed (with uptime and support response at the minimum) and consequences if service levels are not met (e.g. rebates; liquidated damages).">
    We can include the service levels in the agreement. We are not currently having an options for service credits/liquidated damages, if SLA are not met.
  </Accordion>

  <Accordion title="Service provider shall have clear and secure controls associated with approving access to the customer data or systems by service provider staff for support and/or troubleshooting purposes.">
    We make sure that we have all the controls in place.
  </Accordion>

  <Accordion title="Service provider should have cyber insurance covering security breaches.">
    We will do this as part of the agreement
  </Accordion>

  <Accordion title="Detailed access and audit logs shall be available for the customer to obtain via an API or other means, which should align with the customer security monitoring requirements">
    We are a multi tenant SAAS system and all our logs will contain data of all customers. We will have our own log monitoring and security analysis.
  </Accordion>

  <Accordion title="Service Provider shall have solid DR and Business continuity plan in line with the customer requirements">
    Attached the BCP/DR documents
  </Accordion>

  <Accordion title="Service Provider shall have solid endpoint security controls such as AV, EDR, exploitation protection, HIPS, App whitelisting IDS, DDOS, malware sandboxing, etc.">
    We end point security in place
  </Accordion>

  <Accordion title="Service Provider should allow the customer to preform technical and compliance audits on provider infrastructure that host the customer systems">
    We allow our customer to audit, but atlease 30 days prior notice with the scope of the audit needs to be communicated
  </Accordion>

  <Accordion title="Describe your security model, including network, data, and application security; data center security; application and system support; upgrades and maintenance; and personnel access rights.">
    We have deployed our application on Amazon web services (AWS) Virtual platform cloud. AWS provides data center security to our application. AWS is ISO 27001;2013, ISO 27017, ISO 27018, SOC 2 certified organization. Xoxoday is also ISO 27001:2013 and GDPR compliant organization. Only the authorised individual have an access as per Access control policy. We use TLS1.2 encryption for Data in transit and AES256 for Data at rest. As part of Web Application Firewall (WAF), rate limiters are installed to block multiple requests from specific IPs in order to prevent DDOS-type attacks. Additionally, we have an intrusion detection/monitoring application that alerts on unauthorized access. Xoxoday's architecture goes through constant upliftment and experiences no downtime during upgrades and maintenance windows.
  </Accordion>

  <Accordion title="How often is the platform scheduled for software patches and updates?">
    Since our services are delivered via. Web, the upgrades and updates to the services are seamless and usually do not involve any actions from the end-users. We try to release our product hotfixes once every week & major features once every month.
  </Accordion>

  <Accordion title="Does the vendor allow security audits by the customer or by agents of the customer (e.g. an appointed Audit firm)?">
    Yes. Annually once.
  </Accordion>

  <Accordion title="Is there security accreditation in place such as SAS70/SSAE 16 Type II, ISO 27002 etc?">
    Yes. We are ISO 27001:2013 and GDPR Compliant. We are also compliant with SOC 2 type 1 and on the last phase of Audit. We will share the report once we have it from the Auditor. Attached the ISO 27001 certificate and engagement letter that we have for SOC 2 Audit.
  </Accordion>

  <Accordion title="What processes does the vendor have to detect and prevent viruses and other malicious software from damaging the service and the customer's data?">
    We use Bitdefender End point security software to prevent from malware and protect the data. In addition to that we also have AWS Guard Duty threat detection service that continuously monitors for malicious activity and unauthorized behaviour. We use a cloud hosted VPN with strict access controls to allow our employees to access the official network. This VPN is managed by our IT team and it's linked with the SSO/Active Directory
  </Accordion>

  <Accordion title="What are the security and malpractice escalation processes?">
    All the employees initially inform the IT Support team through ticketing systemb the Infosec manager and Final level will be DPO and the management.
  </Accordion>

  <Accordion title="What are the controls over interruption to the service? (SLA). What is the RPO (recovery point objective) and RTO (recovery time objective) for the service?">
    The time of support ranges depends on the level of service. RTO and RPO is - 6 mins
  </Accordion>

  <Accordion title="What security standards are used for application development?">
    our products comply with all the industrial benchmarks and standards when it comes to the Software Development Life-cycle (SDLC). All software development procedures are supervised and monitored by Xoxoday so that they include: security requirements independent security review of the environment by a certified individual code reviews Quality monitoring, evaluation, and acceptance criteria for information systems, upgrades, and new versions shall be established and documented for the clients' reference.
  </Accordion>

  <Accordion title="Describe the network topology.">
    The data centers are hosted completely in isolation so that the access is limited and controlled. Load balancer allows shifting incremental load and can auto scale based on data load experienced by application. Each instance (EC2 Instance) under fortified VPC network is further conglomeration of Docker Container Web Services and APIs and application layer running on top of it. This helps in managing various aspects and features of application without affecting the functioning of each other and achieving a modular architecture to work as plug and play model. Amazon Cloud Watch is implemented to enable monitoring of the functioning of the application. The data is encrypted using 256-encryption based SSL certificate. To manage security of data Xoxoday plans a quarterly VAPT based security audit of application.
  </Accordion>

  <Accordion title="Describe your approach to ensuring data security in the SaaS environment.">
    We have implemented policies and procedures as per ISMS and GDPR requirements. We also conduct periodical Internal and external Audit by the third party Auditor. We have deployed our application on Cloud Virtual platform for maximum security. We use Bitdefender End point security software to prevent from malware and protect the data. In addition to that we also have AWS Guard Duty threat detection service that continuously monitors for malicious activity and unauthorized behaviour. We conduct periodical Vulnerability assessment and Penetration Testing from the Inductry approved authorized vendor to make sure that all the vulnerabilities are closed and having secured applications. We use logical data isolation with the help of company specific encryption keys. Data in non production environment is not updated with the production data. We generate separate test data Data at transit - TLS1.2 encryption, Data at rest - AES256 As per the Information security policy and Data protection policy only the authorised individual have an access to the data through internal approving and ticketing system.
  </Accordion>

  <Accordion title="TSL IT Security Compliance?">
    We comply with Information security compliance - ISO 27001;2013, SOC 2 and GDPR
  </Accordion>

  <Accordion title="Data Governance & Management features?">
    Our product is ISO 27001 and GDPR compliant and have the features.
  </Accordion>

  <Accordion title="Intelligence to predict failures and auto-corrections? Failures can be Infrastructure / Process transaction with validations as per TSL business rules">
    We have health checks along with Self healing mechanisms in place
  </Accordion>

  <Accordion title="What is the percentage that the SLA guarantees (in case the platform provides the services in a Saas Model)?">
    99.99%
  </Accordion>

  <Accordion title="Can evidence be provided of the processes that are implemented to guarantee the confidentiality of information, including a description of how our data is separated from other customer's data, and what controls are in place to prevent other customers from viewing our data?">
    We use logical data isolation with the help of company specific encryption keys. We generate separate test data Data at transit - TLS1.2 encryption, Data at rest - AES256. We have the ability to logically segment or encrypt customer data such that data may be produced for a single tenant only, without inadvertently accessing another tenant's data. our network environment is designed and configured to restrict any communication and connection between the tenant's environment.
  </Accordion>

  <Accordion title="Are there controls in place to prevent administrators and other staff from the Vendor's organisation from downloading customer data to removable storage (USB memory sticks, CD ROM etc)?">
    Yes. We have the controls in place. We have blocked connecting Hard disk, USB, CD ROM etc to computers and all the devices are centrally managed.
  </Accordion>

  <Accordion title="Which databases are used in the backend? Which database optimization approaches are taken?">
    The data is only stored on our application and its deployed on AWS Cloud. Our data is stored in secured databases and there is no window to alter any data without it being logged into the system records
  </Accordion>

  <Accordion title="Describe the hosting infrastructure.">
    We are a SAAS solution. We are cloud hosted.
  </Accordion>

  <Accordion title="How is system usage and performance monitored?">
    We use a variety of tools and plugins integrated with Prometheus & Cloudwatch along with health checks for facilitating our uptime/service availability
  </Accordion>

  <Accordion title="Can customers control the timing of software upgrades? What support do you provide during the upgrade process?">
    Xoxoday's architecture goes through constant upliftment and experiences no downtime during upgrades and maintenance windows.
  </Accordion>

  <Accordion title="Is your DR plan based on active-active or active-passive?">
    active-passive
  </Accordion>

  <Accordion title="Does the application provides users a notification and choice to accept or deny cookies?">
    Yes. we have implemented the cookies policy
  </Accordion>

  <Accordion title="Does the application or solution have Access Control Mechanism to ensure restricted/controlled access to PII (as per business requirement)?">
    Yes, we have the access controls
  </Accordion>

  <Accordion title="Are logs being maintained for processing activities performed on PII?">
    Yes
  </Accordion>

  <Accordion title="Is there an Access Control Mechanism to ensure restricted/controlled Third Party access to the application?">
    Yes, we have the access controls
  </Accordion>

  <Accordion title="Does the application allow PII to be updated in case there is a requirement for the same?">
    Yes. Users can updated their information
  </Accordion>

  <Accordion title="What is the services you are going to provide to Darwinbox">
    Xoxoday - application platform has been integrated with Darwinbox with the objective of creating a reward system for employees. Organizations that are using DarwinBox will not only be able to automate their HR processes but can also reward employees to keep them motivated and engaged. Xoxoday application offers a unified rewarding platform that helps organizations build a winning organizational culture through reward and recognition programs that have a global catalog consisting of products and experiences from more than 700+ brands. Please click here to know more - [https://xoxoday.gitbook.io/application/developer-resources/integrations/darwinbox-+-application](https://xoxoday.gitbook.io/application/developer-resources/integrations/darwinbox-+-application)
  </Accordion>

  <Accordion title="Has your organization formally appointed a central point of contact for security coordination? If so, whom, and what is their position within the organization? Are responsibilities clearly documented? i.e. job descriptions, information security policy">
    Yes. Xoxoday's primary security focus is to safeguard our customers or users' data. This is the reason that Xoxoday has invested in the appropriate resources and controls to protect and service our customers. We have an Infosec Manager who is responsible for Information security and reports to the Board of Directors of the company. All the job descriptions, role and responsibilities has been documented as per the compliance requirements.
  </Accordion>

  <Accordion title="Have your employees been provided formal information security training? Have policies been communicated to your employees? Are periodic security reminders provided? i.e. New employee orientation, annual training, posters in public areas, email reminders, etc.">
    Xoxoday has developed a comprehensive set of security policies covering a range of topics. These policies are shared with and made available to all employees and contractors with access to Xoxoday information assets. Each employee, when inducted, signs a confidentiality agreement and acceptable use policy, after which they undergo training in information security, privacy, and compliance. Furthermore, we evaluate their understanding through tests and quizzes to determine which topics they need further training in. We provide training on specific aspects of security that they may require based on their roles. We spread awareness about the Information security among the employees through posters in public areas, emails, training and orientations etc..
  </Accordion>

  <Accordion title="Are your employees required to sign a non-disclosure agreement? If so, are employees required to sign the non-disclosure agreement annually? Non-disclosure and/or confidentiality form at initial employment">
    Yes. All new hires are required to sign Non-Disclosure and Confidentiality agreements. The Employee expressly agrees that he/she shall not use Confidential Information provided by the Company in the development or delivery or for personal gain from providing any products or services for his/her own account or for the account of any third party. The NDA signed will be valid till the termination from an employement.
  </Accordion>

  <Accordion title="Do you have a formal process to manage the termination and or transfer of employees? i.e. All equipment is returned, user ID's disabled in systems, Windows, badges and/or keys returned. On Transfer is existing access reviewed for relevance?">
    Yes, We have implemented the process for termination from an employement. Once the employee is terminated all the access will be revoked, IDs are disabled, assets are returned and recorded as a part of the exit clearance. We have implemented the access control procedure and all the access will be revoked upon termination or transfer of an emplyees as per the compliance requirements.
  </Accordion>

  <Accordion title="Has antivirus software been deployed and installed on your computers and supporting systems (e.g., desktops, servers and gateways)? 1) Product installed? Centrally managed? Updated daily? Reviewed for being current?">
    Anti-Virus is deployed in all systems and servers for protection against virus and malware. We use Bitdefender end point security for protecting the systems from virus and this has been updated on daily basis and centrally managed.
  </Accordion>

  <Accordion title="Whom do we contact if we identify a security issue or breach involving or impacting your product? Please provide an email address and/or full contact information b) What is their expected SLA to respond to initial contact? c) What is the definition of issue priority (ex: minor vs. major, 0-4 scale)? d) What is their expected SLA to implement changes needed to fix issues according to priority?">
    1. Reach out to us at [cs@xoxoday.com](mailto:cs@xoxoday.com) to raise a ticket, if you happen to notice any potential security issue whilst meeting all the required criteria in our policy. 2. The validation of the reported issue in terms of severity & authenticity will be done by our security team in around 90 days. 3. Post validation, steps will be taken to fix the security issues in accordance with our security policies. 4. The owner of the ticket will be informed once the issue is resolved. Security Severity has been categorized as High, Medium and Low. Once the reported vulnerability is closed we will conform the same.
  </Accordion>

  <Accordion title="If vendor shares reports/data with the customer over emails, is that email ID blocked for sharing any data over other public domains? Please confirm the same by sending a test email to -Information.Security@the customerinsurance.com Please share the screenshot of the blocked email for confirmation.">
    Reports can be generated by the admins through the application. If there are any additional support needed, our customer support team would be able to help and guide on generating report.
  </Accordion>

  <Accordion title="Which all in-house or third party applications Vendor will use for the customer operations?">
    We do not use any in-house devoloped applications. We have deployed our application on AWS cloud virtual platform. And AWS is SOC 2, ISO 27001, ISO 27017 and ISO 27701 certified organization. Shared the certificates.
  </Accordion>

  <Accordion title="Does the application support any APIs? And how are they consumed internally and externally? What controls are implemented for sharing such APIs externally?">
    [Please click here to know more about API Documentation - https://xoxoday.gitbook.io/application/user-guide/for-admins-1/xoxo-links/xoxo-link-apis https://xoxoday.gitbook.io/application/developer-resources/storefront-integration/api-endpoints](https://xoxoday.gitbook.io/plum/user-guide/for-admins-1/xoxo-links/xoxo-link-apis)
  </Accordion>

  <Accordion title="How the security of the exposed APIs is managed?">
    We have implemented the Web application firewall, IDs/IPs and amazon guard duty etc for maximum security. OAuth2 is used to authorize all API requests. We also conduct code review to make sure that the APIs are secure.
  </Accordion>

  <Accordion title="Are your admins are cloud certified?">
    Yes. Our employees are having required education and certifications to perform the job.
  </Accordion>

  <Accordion title="Do you have a setup of processes for regular internal audit for data protection compliance?">
    We do conduct Internal and external Audit very year
  </Accordion>

  <Accordion title="Have you conducted training and awareness program related to data breach for your employees?">
    Yes, It's a part og our ISMS training. Attached the training calender as an advace.
  </Accordion>

  <Accordion title="A copy of the third-party information security program validation performed on the product/ environment, such as: SOC 2 Type II report and/or ISO 27001 certificate.">
    Xoxoday is compliant with - ISO 27001:2013, CPRA (California Privacy Rights Act), SOC 2 Type I, CSA STAR Level 1 and GDPR(General Data Protection Regulation). Attached the below mentioned documents. 1. Xoxoday ISOIEC 270012013 Certificate 2. Xoxoday SOC 2 Type 1 Report 2021 3. Xoxoday VAPT Certificate (Conducted by 3rd party vendor) 4. Xoxoday application VAPT Report (Conducted by 3rd party vendor) 5. Xoxoday CPRA Attestation Report 6. CSA STAR LEVEL 1 Compliant - [https://cloudsecurityalliance.org/star/registry/nreach-online-services-pvt-ltd-xoxoday](https://cloudsecurityalliance.org/star/registry/nreach-online-services-pvt-ltd-xoxoday)
  </Accordion>

  <Accordion title="A copy of audit reports from the data center where the production instance of your product is hosted (SOC1, SOC2, bridge Letters, ISO27001, other security certifications, etc.).">
    We have deployed our application on AWS Virtual platform cloud. The AWS Compliance Program helps to understand the robust controls in place at AWS to maintain security and compliance in the cloud. Attached the below compliance certificates and Audit reports – 1. Amazon Web Services ISO 27001 Certificate 2. AWS ISO 27017\_certification 3. AWS ISO 27018\_certification 4. AWS SOC 2 Report 5. AWS SOC 2 Type I Privacy Report 6. AWS CSA STAR Certificate
  </Accordion>

  <Accordion title="Do you follow any particular internationally accepted best practices or standards?">
    Yes. We follow ISO 27001:2013, SOC-2 and GDPR We are ISO 27001:2013 certified and GDPR Compliant.
  </Accordion>

  <Accordion title="Does the system have an international certification/award in System Security?">
    Yes. We are ISO 27001:2013 certified and GDPR Compliant. We are also complied with Cloud Security Alliance (CSA) STAR level 1.
  </Accordion>

  <Accordion title="Can a user login be prevented during non-office hours (e.g., off-shift, on leaves)?">
    Its SAAS Solution and available 24\*7
  </Accordion>

  <Accordion title="Does solution provide/support remote procedure calls?">
    It's a web application. And it can be presented over the calls like MS Teams, Zoom, Google meet etc.
  </Accordion>

  <Accordion title="Does solution provide/support message-oriented middleware?">
    Yes. We have an integration with other applications and provide secure communications.
  </Accordion>

  <Accordion title="Does solution use SSL (If use web service)?">
    Yes
  </Accordion>

  <Accordion title="Does solution support SFTP (both sending and receiving file)?">
    Yes. Files will be transferred securely.
  </Accordion>

  <Accordion title="Does solution support Data encryption/decryption?">
    Yes.
  </Accordion>

  <Accordion title="Can the security module be integrated with Middleware to provide the security services? If yes, describe the mechanism?">
    The solutions integrated with other solutions like Zoho CRM, HubSpot, Darwin box, SurveyMonkey, Freshdesk etc
  </Accordion>

  <Accordion title="Does your solution provide the CheckSum as data validation module?">
    NA. It's a SAAS Solution and does not require.
  </Accordion>

  <Accordion title="CLIENT must have the ability to govern the data stored in cloud.">
    The data will be in our control. And AWS Cloud provide service for deploying our application. AWS is also ISO 27001 and SOC 2 certified organization and adhered to the data governance.
  </Accordion>

  <Accordion title="Related division must do risk assessment to uphold Cloud Infrastructure Administration including CIA (Confidentiality, Integrity and Availability) for any system and/or data that want to be put in cloud.">
    It's a part of our Risk assessment and we validate the compliance requirements of AWS cloud virtual platform annually.
  </Accordion>

  <Accordion title="CLOUD SERVICE PROVIDER (CSP) must have security policy, standard and procedure/guideline, which at least on the same level as CLIENT ISMS and must be uphold to protect CLIENT data from any security threats.">
    We have implemented all the required Infosec Policies and procedures as per ISO 27001:2013, GDPR and SOC-2
  </Accordion>

  <Accordion title="Are independent IT security testing programs, assurance, audit and/or assessments performed? How frequently? Are results communicated to clients? How often?">
    We perform Internal Audit and external Audits annually. We also conduct Security assessments and testing like Vulnerability assessment and Penetration testing every six months. Yes. We communicate these assessment results to clients on a yearly basis.
  </Accordion>

  <Accordion title="What arrangements are in place for return of data to customer upon contract conclusion or termination?">
    We have the arrangements in place. Storage Period would be as per regulatory conditions. Personal data can be deleted based on a formal written request. Xoxoday would delete the data within 30 days of receiving the request. We will delete the data of the customers upon the termination of the contract and Our data cleansing process goes through an organized purge. Once the data is purged, it's purged from all places
  </Accordion>

  <Accordion title="Can the service provider provide the latest copy of SOC 2 Type II report or equivalent?">
    We have implemented all the SOC controls and in the last phase of Audit. We would be able to provide SOC 2 Type I report in next 2-3 weeks
  </Accordion>

  <Accordion title="Provide information on your solutions/services BCP/DR.">
    We have BCP/DR Policy as per the Infosec compliance requirements and we conduct the BCP test annually. See Business Continuity Management Procedure attached.
  </Accordion>

  <Accordion title="Please provide a copy of the incident management standard and procedures?">
    See attached Incident Management Procedure attached
  </Accordion>

  <Accordion title="Has an independent security third party audit been completed on you? (If so, please name the auditing firm and last audit date in the comment box)">
    Yes. An independent security third party audit been completed by "TUV NORD". The last last day of Audit was 29th June 2021
  </Accordion>

  <Accordion title="Does the organization is having an Information security organization is in place? If yes please explain and share evidence?">
    We have establised the Information security management systemIt specifies the scope and the requirements for establishing, implementing, operating, monitoring, reviewing, maintaining and improving the information security management system (ISMS) at Xoxoday. Xoxoday is committed to ensure Integrity, Confidentiality, Availability and Security of its Physical and Information Assets and also maintaining privacy for serving the needs of the customers and organization while meeting appropriate legal, statutory and regulatory requirements. Attached the Information Security Management System Manual.
  </Accordion>

  <Accordion title="What are your process and procedures for maintaining client data security? please explain and share evidence?">
    We have the Data security Controls in place. We have implemented IDS/IPS, Firewall and our security information and event management (SIEM) system merge data sources (app logs, firewall logs, IDS logs, physical access logs, etc.) for granular analysis and alerting. We have Cloudflare web application firewall for maximum security of data. We have implemented the role based access control system to make sure that the data os available only to an authorised individual. Nreach Online Services Pvt ltd, respects the individual right to their personal information and is committed to use minimum personal data with transparency, accuracy & protection of confidentiality, integrity, availability, privacy, authenticity & trustworthiness, nonrepudiation, accountability and auditability of the data received, stored, processed and destroyed for business purposes. Atatched the Xoxoday GDPR Data Security Policy
  </Accordion>

  <Accordion title="Do you take special measures to make sure the customer data is secure during the collection process? If so, describe the measures briefly.">
    We are compliant. We collect the data only throigh our application. We have role based access system to make sure that only the authorised individual have an access to the required information All the devices and emails are having adequate security controls. We use a cloud hosted VPN with strict access controls to allow our employees to access the official network. We have installed the firewalls to monitor and control the incoming and outgoing network traffic based on predetermined security rules. It helps us to establishes a barrier between a trusted network and an untrusted network. We use a cloud hosted VPN with strict access controls to allow our employees to access the official network. This VPN is managed by our IT team and is linked with the SSO/Active Directory for more security. We use TLS1.2 encryption for Data in transit and AES256 for Data at rest. Additionally, we have an intrusion detection/monitoring application that alerts on unauthorized access.We have SDLC Policy as per ISMS requirements and we follow General Coding Practice. For example - We Conduct data validation on a trusted system, All cryptographic functions used to protect secrets from the application user.We also have Implemented least privilege; restrict users to only the functionality, data and system information that is required to perform their tasks.
  </Accordion>

  <Accordion title="Have we implemented Email Gateway solution to block the SPAM emails? Have we implemented SPF/ DKIM/ DMARC effectively?">
    Yes. We have Implemented the SPF/ DKIM/ DMARC effectively.
  </Accordion>

  <Accordion title="What is the password standard for the applications users, administrators, network users, etc. please describe in details. How are initial passwords communicated to users? Are all new users issued random initial passwords? Are users forced to change their password upon first logon? How is user's identity verified prior to resetting a password? What is the minimum password length? After how many days does a password expire? How many passwords are stored in the password history? What is the number of invalid password attempts prior to lockout? Can PINs or secret questions be used as a stand-alone method of authentication?">
    We are compliant. We have implemented the Password Management Policy We store password hashed. We have SHA512 hash with unique salt for every password. The password needs to be minimum 8 characters long and should contain at least one capital letter, special characters among '# \$ % \* &' and 1 digit. Maximum Password Age is 45 days. User IDs and passwords transmit through stringent checks in an encrypted format that complies with the current Technical Security Baseline Standards. All the user can set their own password from the very first login attempt. Passwords once used cannot be reused with the password history technique in order to disallow the reuse of old passwords.
  </Accordion>

  <Accordion title="CSP ISO/IEC 27001/27002:2013 independent attestation, CSP ISO/IEC 27018:2014 independent attestation, CSP SOC 2 Type 2 independent attestation">
    [AWS is ISO 27001, ISO 27017, ISO 27701, SOC 2, PCI DSS Level 1 certified organization. Please click here for more information about AWS Audit and certification - https://aws.amazon.com/compliance/programs/](https://aws.amazon.com/compliance/programs/)
  </Accordion>

  <Accordion title="Will you notify FINCARE in case of any request to provide information, in the form of a subpoena, a warrant, or court order in which access to the FINCARE data is requested?">
    We inform Fincare if these regulatory authories agreed to inform.
  </Accordion>

  <Accordion title="Do you include right to audit by consumer to your environment?">
    Yes. 30 days prior notice and scope of the Audit needs to communicated.
  </Accordion>

  <Accordion title="Will you make necessary audit logs and activity monitoring available when requested?">
    We are a multi tenant SAAS system and all our logs will contain data of all customers. We will have our own log monitoring and security analysis.
  </Accordion>

  <Accordion title="Do you encrypt sensitive data in PaaS applications and storage and sensitive volumes in IaaS">
    Its a SAAS product and we use We use TLS1.2 encryption for Data in transit and AES256 for Data at rest.
  </Accordion>

  <Accordion title="Do you have controls in place to prevent data leakage or intentional/accidental compromise between tenants in a multitenant environment?">
    Yes
  </Accordion>

  <Accordion title="Does your data management policies and procedures address tenant and service level conflicts of interests?">
    Yes
  </Accordion>

  <Accordion title="Can you demonstrate the data sovereignty and residency issues and provide details of jurisdiction of data storage and the local laws applicable?">
    [We store data on AWS Singapore.AWS is ISO 27001, ISO 27017, ISO 27701, SOC 2, PCI DSS Level 1 certified organization. Please click here for more information about AWS Audit and certification - https://aws.amazon.com/compliance/programs/](https://aws.amazon.com/compliance/programs/)
  </Accordion>

  <Accordion title="Are these datacenters are owned by you? If not, provide the details of the datacenter service provider">
    We do not own the data centers. We deploy our application on AWS cloud virtual platform.
  </Accordion>

  <Accordion title="Datacenter security standard and procedure">
    [We store data on AWS Singapore.AWS is ISO 27001, ISO 27017, ISO 27701, SOC 2, PCI DSS Level 1 certified organization. Please click here for more information about AWS Audit and certification - https://aws.amazon.com/compliance/programs/](https://aws.amazon.com/compliance/programs/)
  </Accordion>

  <Accordion title="Third party assessment reports and attestations - ISO 27001, PCI DSS, etc">
    Attached the ISO27001:2013 certificate. We do not collect and store any Payment card details. PCI DSS is not applicable for us.
  </Accordion>

  <Accordion title="Any change to the design that impacts security posture of the system must be reviewed and approved by EIS Architecture Team, before a new component (e.g., custom built modules, 3rd party components, vendor supplied components) is released.">
    We inform the client if there is any changes of the design that impacts security posture of the system.
  </Accordion>

  <Accordion title="Minimum security standards and latest vendor security updates must be applied to all components. Wherever it is not supported or cannnot be applied, compensating controls must be evaluated with ISRA and implemented to reduce the risk.">
    We take steps to securely develop and test against security threats to ensure the safety of our customer data. We maintain a Secure development Lifecycle, in which training our developers and performing design and code reviews takes a primary role. In addition, Xoxoday employs third-party security experts to perform detailed penetration tests on different applications. application is ISO 27001, GDPR, CPRA/CCPA, CSA STAR certified.
  </Accordion>

  <Accordion title="Project teams must maintain: Accurate (Create/Update/Delete) inventories of project components that are required for application to be up & running (including Production & Non-Production).">
    Our technical team maintains these records.
  </Accordion>

  <Accordion title="Implement version control practices (for Source code, binaries, container images) to govern development and provide auditing. Ensure versions are stored in a centralized repository, the change can be reversed/ rolled back during a security incident.">
    We consuct the code review as per the compliance requirements and maintain the code repository. Attached the SDLC Proedures.
  </Accordion>

  <Accordion title="Applications should be architected with a minimum of three separate tiers: web, application, and storage/database.">
    Compliant.
  </Accordion>

  <Accordion title="All remote system administrative functionality and remote access to an operating system (e.g., RDP, SSH, etc.) must be disabled and not directly accessible from the Internet, and only PSJH Information Security-approved remote access technologies are allowed.">
    Since application is a SaaS Platform this would be not applicable.
  </Accordion>

  <Accordion title="All public IP addresses must be removed from the subscription, except those that were coordinated with and approved by PSJH Cloud Engineering and Information Security Architecture.">
    Since application is a SaaS Platform this would be not applicable.
  </Accordion>

  <Accordion title="Access to the PaaS must be provisioned using PSJH IAM team, privileged access should be determined by business justification, and granted by IAM.">
    Since application is a SaaS Platform this would be not applicable.
  </Accordion>

  <Accordion title="Ensure that all encryption and hashing methods comply with policies and organizational requirements for protection of information.">
    We are compliant with the requiremenrts.
  </Accordion>

  <Accordion title="If Cryptographic keys have to be tranferred manually, then encrypted channels to be used Eg., use Secure Email of O365, ProofPoint Secure Email.">
    We do not transfer manually. NA And we use Google workspace for emailing solution.
  </Accordion>

  <Accordion title="Ensure that the integrity of cryptographic key is protected while they are stored. Eg., use Hashing SHA256, Digital Signatures">
    cryptographic keys are protected. Compliant.
  </Accordion>

  <Accordion title="PHI, PII, and regulated or confidential data must use a minimum protocol of TLS 1.2, and an encryption algorithm and strength of AES-256 while in transit.">
    We do not store any PHI. The PII(name, email ID, phone#) are encrypted. We use TLS1.2 encryption for Data at transit and AES256 Data at rest for maximum security.
  </Accordion>

  <Accordion title="Application that handles PHI, PCI, PII (and other regulated data) must comply with applicable federal laws, Executive Orders, directives, policies, regulations.">
    We store only the PII(name, email ID, phone#) and does not store/process PHI & PCI. We are compliant with ISO 27001, CCPA/CPRA, EU GDPR, CSA etc. Attached these compliance certificates/audit reports.
  </Accordion>

  <Accordion title="File-integrity monitoring tools should be in place to monitor modifications to critical system files, configuration files, and content files (leverage Crowdstrike as applicable).">
    Yes, all the mechanisms related to security and policies are implemented to facilitate timely decision and investigation by root-cause analysis. These incidences are analyzed with network intrusion detection (IDS) tools.
  </Accordion>

  <Accordion title="Application must ensure that the information used for authentication must be securely stored and transmitted in an encrypted form using algorithms in accordance to the Providence's information security policy.">
    The information used for authentication is securely stored and transmitted. We store password hashed. We have SHA512 hash with unique salt for every password
  </Accordion>

  <Accordion title="The application must be partitioned into public and restricted areas using separate folders for authenticated and non-authenticated users.">
    Not applicable since application is a SaaS platform.
  </Accordion>

  <Accordion title="Mobile applications that are homegrown/ procured shall be released to caregivers via MDM & MAM solutions (such as Microsoft InTune).">
    At Xoxoday we use Google workspace and activated the MDM features. application also has iOS and Androind mobile applications.
  </Accordion>

  <Accordion title="The mobile application must time out after 15 or fewer minutes of inactivity, requiring a user to re-enter a password, PIN, or re-initiate a biometric authentication mechanism before application content can be viewed again.">
    This feature can be configured with the help of the MDM Solution that the customer use.
  </Accordion>

  <Accordion title="Code obfuscation is applied to native apps">
    At Xoxoday we use Google workspace and activated the MDM features.
  </Accordion>

  <Accordion title="Roles must be assigned to manage updates on the server, resources, and/or other supporting assets.">
    Compliant. We have segreated the roles and assign the responsibilities to our employees.
  </Accordion>

  <Accordion title="PSJH-managed EDR (running real-time scanning on a continuous basis) on the solution's servers, workstations, and/or other applicable devices is required.">
    Since its a Cloud hosted SaaS platform deploying of the application on cloud and server scannings are under the scope of Xoxoday.
  </Accordion>

  <Accordion title="PSJH-managed host-based firewall client is required on the solution's servers, workstations, and/or other applicable devices.">
    We use Web application firewall (WAF) and pfSense firewall for security reasons. 1. The Cloudflare Web Application Firewall (Cloudflare WAF) checks incoming web requests and filters undesired traffic based on the set of rules. 2. pfSense helps to monitors incoming and outgoing network traffic and decides whether to allow or block specific traffic based on a defined set of security rules.
  </Accordion>

  <Accordion title="Ensure the user session is invalidated on the server-side when the user logs out.">
    At xoxoday we monitor and maintain the logs. The Infrastructure logs are collected using the AWS Audit Trail, meanwhile the application related logs are collected in our Elastic Search server and retained in the long term cloud storage.
  </Accordion>

  <Accordion title="Implement REST and web services using session based authentication.">
    At Xoxoday we have implemented the Active directory and the system will get locked if its inactive for more than 15 mins and re-autentication would require.
  </Accordion>

  <Accordion title="Require a standardized approach to structured exception and error handling across all layers.">
    We have the process in place for standardized approach to structured exception and error handling across all layers.
  </Accordion>

  <Accordion title="All input validation failures must result in input rejection and must be logged.">
    At Xoxoday the validation has been done during the development and testing and we are compliant with the requirements.
  </Accordion>

  <Accordion title="Product Owners must integrate compliance of security requirements in corresponding criteria in Definition of Done (DoD). Any requirement & recommendations provided by EIS that are not met by the application will need to have a security exception through ISRA">
    At Xoxoday Security and compliance requirements are considered during the development stage and we are ISO 27001, CPRA, CSA STAR level 1, GDPR compliant.
  </Accordion>

  <Accordion title="Implement generic error or notification messages in applications to limit information useful for attacks.">
    We have implemented the controls to monitor the application and safegurd from the attacks. We use Amazon CloudWatch and Grafana polemique which allows us to monitor instances and alerts us through emails.
  </Accordion>

  <Accordion title="Manual input of file names and file paths must be avoided where possible.">
    Since application is SaaS Platform it would be not applicable.
  </Accordion>

  <Accordion title="Vulnerabilities are to be identified, reported, and remediated through the software-development life cycle. Effective utilization of enterprise SAST, DAST, OSA, IaC Security, Penetration Testing etc., to be adopted throughout the lifecycle of system development (and periodically).">
    We have implemented the Software Development Life Cycle (SDLC) procedure and attached the same for your reference. Vulnerability scanning gives us deep insight for quick identification of out-of-compliance or potentially vulnerable systems. In addition to our extensive internal scanning and testing program, Xoxoday employs third-party security experts to perform a vulnerability assessment and penetration testing. We remidiate or fixes the issues identified during the VA/PT assessment and make sure that the application is free from the vulnerabilities.
  </Accordion>

  <Accordion title="How do you handle data from Russia and China?">
    Since it's a SaaS platform and deployed on AWS cloud virtual platform Singapore region. All the data will be stored on AWS VPC.
  </Accordion>

  <Accordion title="Description of your general Security concept including on how you handle Confidentiality, Integrity and Availability.">
    Xoxoday is ISO 27001:2013 certified. An ISMS is a framework of policies and procedures that includes all legal, physical and technical controls involved in an organisation's information risk management processes with the aim of keeping information secure. With ISO's robust information security management system (ISMS) in place, you gain the additional reassurance that a full spectrum of security best practices is implemented across the organization Our Goal is to protect three aspects of information - Confidentiality: only the authorized persons have the right to access information. Integrity: only the authorized persons can change the information. Availability: the information must be accessible to authorized persons whenever it is needed.
  </Accordion>

  <Accordion title="What are the security controls and restrictions implemented to control the upload, download, viewing and modification of Infosys data (including structured and unstructured data e.g. emails, databases etc.) by users within your organization, including admin users?">
    We have implemented the Access control policy to control the upload, download, viewing and modification
  </Accordion>

  <Accordion title="Specify the frequency of AV scans and list down the events/scenarios that triggers the scans">
    AV Scans takes place every week and users also can scan it whenever they can scan the machine. We have prescheduled the scanning once in a week.
  </Accordion>

  <Accordion title="In a multi tenant model, please explain what controls are present to prevent infections spreading across to Infosys specific applications/infra from other tenants/customers sharing the same infrastructure?">
    We are using linux operating system which is inherently secure along with security practices like web application firewall etc We make sure that the customer data is well segregated and compartmantalized
  </Accordion>

  <Accordion title="Have there been any information security breaches within the organization in the last 1 year (even if they did not impact Infosys)? If yes, please detail out the corrective and preventive actions taken by the organization to strengthen the information security program.">
    No Breaches taken place.
  </Accordion>

  <Accordion title="Provide details about the Information security framework and controls that are deployed within your organization to safeguard Infosys data and ensure compliance to applicable industry standards">
    We are having Robust Information security compliance framework and we are ISO 27001:2013 and GDPR complied. We follow all the applicable infosec compliance requirements to comply with the regulations
  </Accordion>

  <Accordion title="Is cyber security compliance review of application and risk assesement conducted atleast annually?">
    We conduct the Risk assessment and compliance review on annual basis as per the compliance requirements.
  </Accordion>

  <Accordion title="Are cyber security compliance review findings mitigated? Please highlight any open points.">
    Yes. All the compliance and audit findings has been mitigated.
  </Accordion>

  <Accordion title="Are detected vulnerabilities patched timely?">
    All the vulnerabilities identified during the assessment has been fixed.
  </Accordion>

  <Accordion title="Is anti-malware and anti-virus installed on servers and development machines?">
    We use Bitdefender end point security and installed on servers and development machines.
  </Accordion>

  <Accordion title="Is anti-malware and anti-virus updated regularly?">
    Its updated on regular basis.
  </Accordion>

  <Accordion title="Are the duties for application access and environment segregated and supported with a documented authorization matrix?">
    Our roles and job duties are segregated through role-based access to ensure maximum security. Access to data and systems are based on the principles of least privilege for access. A strong identification and authentication system and logging systems are deployed and provides a centralized control to administer, monitor and review all critical access events.
  </Accordion>

  <Accordion title="Is the code restricted from publicly available?">
    Its restricted and not available to the public.
  </Accordion>

  <Accordion title="Is the application server are hardened for security and maintained?">
    We follow the best practices ans servers are hardened for security reasons.
  </Accordion>

  <Accordion title="Is the database server comply with identity and access control policy?">
    We have implemented the Identity access management (IAM) and follow the Access control policy.
  </Accordion>

  <Accordion title="Is the database server comply with password policy?">
    At Xoxoday we follow the password policy.
  </Accordion>

  <Accordion title="Is the database server have latest operating system, licensed and supported?">
    We have deployed our application on AWS Virtual platform cloud - Singapore region.
  </Accordion>

  <Accordion title="Is application server configuration is backed-up and can be restored within RPO and RTO?">
    RTO and RPO is 60 Minutes.
  </Accordion>

  <Accordion title="Is incidents are logged, investigated and reported timely?">
    We have implemented the Incident Management Procedure and attached the same for your reference.
  </Accordion>

  <Accordion title="Explain the limitations to how the customer can use the service as outlined in the provider's acceptable usage policies, licensing rights or other providers usage restrictions.">
    Since application is a SaaS product and the customer can use the product and services as soon as subscribed for application product usage. the customer will have the legal rights to use the Product.
  </Accordion>

  <Accordion title="What advance notice will be provided by the provider for any change of terms?">
    We do not change the terms frequently. We will provide 30 days' notice period for any changes of terms.
  </Accordion>

  <Accordion title="Does the contract/terms of service outline meaningful liability for the provider in the event that the the customer environment/data is breached?">
    We notify Client in case of any unauthorized disclosure of or breach of any confidentiality obligation of Xoxoday with respect to Confidential Information, data or information of Client and Xoxoday shall take all necessary and required steps and measures to mitigate such unauthorized disclosure or breach and shall co-operate with Client , at Xoxoday 's cost, to mitigate or control the loss or liability arising out of such disclosure or breach and to retrieve such data or information.
  </Accordion>

  <Accordion title="Does the provider have an active SLA in place that identifies minimum performance (e.g., uptime, etc.)?">
    Yes. have an active SLA in place that identifies minimum performance of the Product.
  </Accordion>

  <Accordion title="Describe the SLA">
    We have the SLA in place. application endeavours to provide 99.9% Uptime each month 24 hours a day 7 days a week. Uptime is measured based on the monthly average of availability.
  </Accordion>

  <Accordion title="Does the provider provide regular service management reports (e.g., SLA performance)? If so, state the frequency of such reporting.">
    We would be able to provide a report on need basis.
  </Accordion>

  <Accordion title="Describe penalties associated with SLA non-compliance.">
    No penalties are associated with SLA.
  </Accordion>

  <Accordion title="Does the provider monitor service continuity with upstream providers in the event of provider failure?">
    We monitor the service continuously and make sure that the product and service is available to use all the time. We have a documented Business Continuity and Disaster Recovery Plan defined and implemented to enable people and process support during any crisis or business interruptions.
  </Accordion>

  <Accordion title="Do we have the planed downtime scheduled (e.g., service, upgrade, patch, etc.)?">
    Since our services are delivered via. Web, the upgrades and updates to the services are seamless and usually do not involve any actions from the end-users.
  </Accordion>

  <Accordion title="Are the same security controls implemented at the failover site as that of primary site?">
    Yes.
  </Accordion>

  <Accordion title="Are the provider's routine maintenance windows manageable for the customer?">
    Our architecture goes through constant upliftment and experiences no downtime during upgrades and maintenance windows. If there is any major activity and the service will be unavailable, the Maintenance hours were communicated well in advance at least 3-4 day by application.
  </Accordion>

  <Accordion title="Describe the process to terminate the service">
    Termination clause will be the part of Master Service agreement and both the parties can review and agree during entering into an agreement.
  </Accordion>

  <Accordion title="Can the customer data and the service be moved/transferred to another provider at any time?">
    Since it's a SaaS product, this is not applicable.
  </Accordion>

  <Accordion title="Does the customer have the right to terminate if the provider introduces material modifications to service terms?">
    Termination clause will be the part of Master Service agreement and both the parties can review and agree before entering into an agreement.
  </Accordion>

  <Accordion title="What standards does the provider follow for application development? Do these include rigorous testing and acceptance protocols?">
    Yes. changes to the production environment or development are documented, tested, and approved prior to implementation or any new releases. We conduct internal reviews and audited by the external auditors for our security standard certification. We conduct periodical Vulnerability assessment and Penetration Testing from the Industry approved authorized vendor to make sure that all the vulnerabilities are closed and having secured applications.
  </Accordion>

  <Accordion title="Where and how will the customer data be stored? Are there impacts on security in light of the differences in legal/regulatory compliance requirements depending on storage location?">
    the customer data will stored on AWS virtual platform cloud Singapore. There is no impact on security.
  </Accordion>

  <Accordion title="Does the provider have a cyber plan in place? If so, please provide details.">
    At Xoxoday we have implemented the Cyber Crisis Management Plan to provide and support capability for reporting and responding to cyber security incidents, to eliminate or minimize impacts of such incidents
  </Accordion>

  <Accordion title="Have there been any major security incident(s) reported with the provider in the last two years? If so, detail the incident(s) and resolution(s)">
    No.
  </Accordion>

  <Accordion title="What activities are logged by the provider? Consider: Network traffic, file and server access, Security systems">
    We monitor the logs on regular basis with regards to network, file and server, and security system. To provide more information, the infrastructure logs are collected using AWS Audit Trail and Application related logs are collected in our Elastic Search server and retained in long term cloud storage.
  </Accordion>

  <Accordion title="Does the provider's logging and monitoring framework allow isolation of an incident to specific tenants? (2)">
    No. Since we are a multi-tenant system, our logs contain information of all the tenants. We cannot isolate a single customer's information from our logs.
  </Accordion>

  <Accordion title="Who can set up activities to be logged?">
    At Xoxoday the Audit logs reviewed on a regular basis for security events. audit logs are set up, reviewed by our Technical team and logs are recorded on a regular basis automatically. These logs are integrated with security operations/SIEM solutions.
  </Accordion>

  <Accordion title="What is the provider's incident response procedure for handling a security or data breach?">
    We are GDPR Compliant. Our information security team and Customer support team will inform the POC of Client via email communication with Preliminary Incident Synopsis and Root Cause Analysis report (RCA) including the details of Business Impact, Issue Description, Root Cause, and Corrective Actions.
  </Accordion>

  <Accordion title="Does the provider's incident response plan comply with industry standards for legally admissible chain-of-custody management processes and controls?">
    Yes. We have implemented the incident response plan and it complies with industry standards ISO 27001:2013, SOC-2, GDPR.
  </Accordion>

  <Accordion title="When are audits conducted (i.e., frequency)? What standard/certification is used to conduct audits (e.g., ISO 27001, SSAE 16 SOC 2, etc.)? Will the customer receive a copy of the audit report when finalized? Is this requirement outlined in the contract with the service provider?">
    We are ISO 27001:2013 certified and attached the certificate.
  </Accordion>
</AccordionGroup>

<AccordionGroup>
  <Accordion title="Are mechanisms for label inheritance implemented for objects that act as aggregate containers for data?">
    Yes, there are established policies and procedures for label inheritance of TCCC data and objects which contain data, per the TCCC Information Classification Standard and Protection Measures. Mechanisms for label inheritance shall be implemented for objects that act as aggregate containers for data.
  </Accordion>

  <Accordion title="Do you adhere to the tenant's retention policy?">
    Yes, we adhere to the retention policy that the tenant sends out for optimal collaboration and smooth user experience with Xoxoday's products and services.
  </Accordion>

  <Accordion title="Can you provide a published procedure for security mechanisms to prevent data leakage in transit and data at rest leakage upon request?">
    Your data is of the utmost importance. All the security mechanisms and policies are established and implemented in such ways that data leak can be prevented, in transit as well as at rest.
  </Accordion>

  <Accordion title="Can you provide tenants, upon request, documentation on how you maintain segregation of duties within your cloud service offering?">
    Yes, the policy, process, and procedure is implemented to ensure proper segregation of duties. These can be asked for and delivered upon tenants' requests. In the event of user-role conflict of interest, technical controls shall be implemented to mitigate risk (if any) from unauthorized/unintentional modification/misuse of organizations' information assets.
  </Accordion>

  <Accordion title="Do you use industry standards (Build Security in Maturity Model [BSIMM] benchmarks, Open Group ACS Trusted Technology Provider Framework, NIST, etc.) to build in security for your Systems/Software Development Lifecycle (SDLC)?">
    Yes, our products comply with all the industrial benchmarks and standards when it comes to the Software Development Life-cycle (SDLC). All software development procedures are supervised and monitored by Xoxoday so that they include:

    * security requirements
    * independent security review of the environment by a certified individual
    * code reviewsQuality monitoring, evaluation, and acceptance criteria for information systems, upgrades, and new versions shall be established and documented for the clients' reference.
  </Accordion>

  <Accordion title="Do you use automated and manual source code analysis tools to detect security defects in code prior to production?">
    Yes, our code reviews and analysis run through stringent eyes of automated technologies as well as manual source code overview to cover any security loopholes prior to the production phase.
  </Accordion>

  <Accordion title="Do you review your applications for security vulnerabilities and address any issues prior to deployment to production?">
    Yes, an independent security review is conducted by certified professionals to look for any security vulnerabilities in order to solve them before deploying to production.
  </Accordion>

  <Accordion title="Do you verify that all of your software suppliers adhere to industry standards for Systems/Software Development Lifecycle (SDLC) security?">
    Yes, our products comply with all the industrial benchmarks and standards when it comes to the Software Development Life-cycle (SDLC) security standard.
  </Accordion>

  <Accordion title="Do you provide tenants with documentation that describes your production change management procedures and their roles/rights/responsibilities within it?">
    Yes, changes to the production environment are documented, tested, and approved prior to implementation. Production software and hardware changes may include applications, systems, databases, and network devices requiring patches, service packs, and other updates and modifications. Any change in roles, rights, or responsibilities shall be documented for a seamless experience.
  </Accordion>

  <Accordion title="Are any of your data centers located in places that have a high probability/occurrence of high-impact environmental risks (floods, tornadoes, earthquakes, hurricanes, etc.)?">
    We have a consistent and unified framework for business continuity planning, disaster recovery, plan development. All the appropriate communications shall be established, documented, and adopted to ensure consistency in business continuity. This includes protection against natural and man-made disasters (e.g. fire, flood, earthquake, war, volcanic activity, biological hazard, civil unrest, mudslide, tectonic activity, utility services outages, etc.).
  </Accordion>

  <Accordion title="Do you provide tenants with geographically resilient hosting options?">
    Our hosting options are limited to Xoxoday's jurisdiction and are backed by prominent business continuity plans. Hence, we don't find the need to provide geographically diverse hosting options.
  </Accordion>

  <Accordion title="Do you provide tenants with infrastructure service failover capability to other providers?">
    The capability to transfer infrastructure service failover to other providers is not provided to the clients.
  </Accordion>

  <Accordion title="Are business continuity and disaster recovery plans subject to test at least annually and upon significant organizational or environmental changes to ensure continuing effectiveness?">
    Business continuity plans shall be subject to test at least annually or upon significant organizational or environmental changes to ensure continuing effectiveness.
  </Accordion>

  <Accordion title="Do you allow tenants to view your SOC2/ISO 27001 or similar third-party audit or certification reports?">
    Along with an aligned enterprise-wide framework, we perform independent reviews through industry professionals along with formal risk assessments. These are done at least annually or at planned intervals to determine the likelihood and impact of all identified risks. With qualitative/quantitative methods ensuring our compliances with policies, procedures, and standards, we stick to the best standards.
  </Accordion>

  <Accordion title="Do you conduct annual network penetration tests of your cloud service infrastructure regularly as prescribed by industry best practices and guidance?">
    Yes, our stringent checks and tests are conducted annually to keep up the cloud service infrastructure hygiene as per the industrial standards.
  </Accordion>

  <Accordion title="Do you perform annual audits (internal and external) and are the results available to tenants upon request?">
    Annual audits are processed both internally and externally. The audit results can be sent over to tenants upon request.
  </Accordion>

  <Accordion title="Are the results of the penetration tests available to tenants at their request?">
    Yes, the tenants can request for penetration results and get the reports from our end.
  </Accordion>

  <Accordion title="Are you storing, transmitting, and/or processing payment card data on behalf of our organization?">
    No, we do not process your payment card data for any reason other than billing purposes.
  </Accordion>

  <Accordion title="Can you prove that you are compliant for: Indian IT Act 2000?">
    Yes, we are compliant with the Indian IT Act of 2000.
  </Accordion>

  <Accordion title="Is there a formal process that details the transition of data from unsupported systems and applications to supported systems and applications?">
    There is no such process available from our end.
  </Accordion>

  <Accordion title="What will you deliver back to us on the end of service?">
    We will terminate the contract as per rules and statutes. Meanwhile your data will be stored with us and won't be given back to you. However, if the tenant wants the data to be erased, it can be done so upon request.
  </Accordion>

  <Accordion title="Do you conduct information audits to determine what personal data is being stored/processed and where is it being stored?">
    Yes, we store data that's required for seamless rewarding and recognition. We conduct regular audits to ensure safety of data like employees' names, emails, employee numbers, etc. are used for verification and rewarding purposes.
  </Accordion>

  <Accordion title="Do you have a dedicated information/cyber security team responsible for information security governance across the organization?">
    Xoxoday's information and cyber-security team keeps a watchful eye on all potential sources of threats and areas of compromise when it comes to information security.
  </Accordion>

  <Accordion title="Have you defined the information security roles and responsibilities?">
    Roles are systematically defined for information security measures to tactfully align all operations, preventing any security breaches.
  </Accordion>

  <Accordion title="Do you have an acceptable usage policy which is signed/agreed by all employees on annual basis?">
    Employees must agree with the acceptable usage policy of peripherals and devices to prevent malicious activities from the inside and out.
  </Accordion>

  <Accordion title="Is your environment SOC-2 Type-II attested or certified for the scope of the service being offered to tenant?">
    Our environment has all the capabilities to be SOC-2 Type-II compliant but the certification is yet to come through. It shall be updated soon.
  </Accordion>

  <Accordion title="Is your environment CSA-certified for the scope of the service being offered to tenant?">
    No, our environment is not CSA-certified.
  </Accordion>

  <Accordion title="Are all relevant legislative, statutory, regulatory and contractual security requirements identified, documented and tracked?">
    Xoxoday keeps track of all security requirements with respect to legislations, statutes, and contracts. They are documented in all steps.
  </Accordion>

  <Accordion title="Are appropriate procedures implemented to ensure compliance with legislative, regulatory and contractual requirements related to intellectual property rights and use of proprietary software products?">
    We have our own procedure for control of documents and records that ensures compliance related to intellectual property rights and use of proprietary software.
  </Accordion>

  <Accordion title="Have you identified legislative, regulatory, contractual and business requirements related to record management?">
    Our record management criteria checks all boxes of legislative, regulatory, contractual and business requirements.
  </Accordion>

  <Accordion title="Do you monitor effectiveness of cyber security controls through regular metrics?">
    With different metrics tracking cyber-security measures, Xoxoday keeps the effectiveness in check with regular monitoring.
  </Accordion>

  <Accordion title="Do you have an approved HR Policy document?">
    Xoxoday's Human Resource operation procedure takes all measures of employee confidentiality into consideration.
  </Accordion>

  <Accordion title="Are your employees screened before joining the organization? Are they bound to keep security of information intact even after their employment contract has ended?">
    Yes, Xoxoday performs a thorough background check on every employee before they get onboard. The Non Disclosure Agreement ensures that the information is secure even after the contract is terminated.
  </Accordion>

  <Accordion title="Do you take services from any third party which directly or indirectly impacts services given to tenant or Client of tenant?">
    Yes, our Xoxoday Store vouchers are procured from third-party vendors. These vouchers are shared with the tenants in order to be showcased to users of Xoxoday platform.
  </Accordion>

  <Accordion title="Can you provide details of these third parties including the name of the third party and the services they will be performing on your behalf?">
    No, the third parties and vendors we deal with our confidential to Xoxoday. Hence, this list cannot be shared.
  </Accordion>

  <Accordion title="Do you have a Third Party Security Policy?">
    Yes, there's a third-party security policy present to safeguard the interests of Xoxoday's tenants as well as the end users.
  </Accordion>

  <Accordion title="Do you regularly monitor the third party's compliance with security obligations?">
    Yes, our third party security policy deems it clear to comply with security obligations and we monitor their compliance regularly.
  </Accordion>

  <Accordion title="Is there a process to address any risk that may occur due to change of services being provided to the tenant?">
    Yes, we have a detailed risk management procedure in place to address situational issues like change of services being provided to tenants.
  </Accordion>

  <Accordion title="Do you permit the use of contractors in roles supporting customer operations?">
    No, our customer requests are addressed by the Xoxoday customer support team for maximum efficiency.
  </Accordion>

  <Accordion title="Do you have subscription to brand protection services?">
    Yes, Xoxoday's brand protection caters to any malicious interruptions and fallacies as they are addressed in prompt time.
  </Accordion>

  <Accordion title="Do you monitor media platforms as well for brand protection?">
    Yes, with media platforms being the biggest pedestal for information sharing, we keep an eye out for any brand protection issues.
  </Accordion>

  <Accordion title="Do you have the capability to detect/prevent unauthorized or anomalous behavior based on network traffic and host activity?">
    Yes, in the event of a rapid spike/slump in network traffic or host activity, Xoxoday analyzes the traffic to detect and prevent unauthorized or erratic behavior.
  </Accordion>

  <Accordion title="Do you have mandatory and regular privacy training and awareness module?">
    Yes, in order to ensure airtight security of data, we have a mandatory and sessional privacy training and awareness module.
  </Accordion>

  <Accordion title="What is CSA?">
    The Cloud Security Alliance (CSA) is the world's leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment.
  </Accordion>

  <Accordion title="Did you list your organization for CSA STAR LEVL – 1 self-assessment?">
    Yes, Please visit the link to view the registry - [https://cloudsecurityalliance.org/star/registry/nreach-online-services-pvt-ltd-xoxoday](https://cloudsecurityalliance.org/star/registry/nreach-online-services-pvt-ltd-xoxoday)
  </Accordion>

  <Accordion title="What are the important features of CSA STAR LEVEL – 1?">
    Important features of CSA STAR LEVL – 1 are listed below

    * Operating in a low-risk environment
    * Wanting to offer increased transparency around the security controls they have in place.
    * Looking for a cost-effective way to improve trust and transparency.
  </Accordion>

  <Accordion title="Are the applications and programming interfaces (APIs) designed, developed, deployed, and tested in accordance with leading industry standards (e.g., OWASP for web applications) and adhere to applicable legal, statutory, or regulatory compliance obligations?">
    Yes, we ensure the same as part of our code review, static code analysis, and Web Application Firewall.
  </Accordion>

  <Accordion title="Do you comply with the Physical security perimeters (e.g., fences, walls, barriers, guards, gates, electronic surveillance, physical authentication mechanisms, reception desks, and security patrols)?">
    Yes, We comply with these requirements. Our Cloud Security Platform, (CSP) Amazon Web Services (AWS) provides these securities to our data centers.
  </Accordion>

  <Accordion title="Do you use Production data in a non-production environment?">
    Production data shall not be replicated or used in non-production environments. We do not use LIVE data in any other environment. We comply with the requirement.
  </Accordion>

  <Accordion title="Do you obtain prior to relocation or transfer of hardware, software, or data to an offsite premise?">
    We take prior authorization from the concerned authority as per the Media protection procedure before relocation or transfer of hardware, software, or data to an offsite premises.
  </Accordion>

  <Accordion title="Do you have a documented application validation process to test for mobile device, operating system, and application compatibility issues?">
    As per Mobile Security Compatibility compliance requirements we have a documented application validation process to test for mobile device, operating system, and application compatibility issues.
  </Accordion>

  <Accordion title="What is the California Privacy Rights Act (CPRA)?">
    The California Privacy Rights Act (CPRA) is a state-wide data privacy bill that amends and expands the existing California Consumer Privacy Act (CCPA). The CPRA works as an addendum to the CCPA, strengthening data privacy rights for California residents, tightening business regulations, and establishing the California Privacy Protection Agency (CPPA) as lead enforcer and supervisor.
  </Accordion>

  <Accordion title="Is Xoxoday compliant with California Privacy Rights Act (CPRA)?">
    Yes. We are compliant with CPRA, and Our solution will continue to offer full compliance with the new and updated data privacy regime.
  </Accordion>

  <Accordion title="Do you provide rights to the consumers with regards to the data processing as per California Privacy Rights Act (CPRA)?">
    Yes. We support our consumers to exercise their rights as per the CPRA.
  </Accordion>

  <Accordion title="Did you implement all the CPRA Privacy controls as per the compliance requirements?">
    Yes. We have implemented all the privacy controls and audited the same with the help of external Auditors.
  </Accordion>

  <Accordion title="Do you make the CPRA Attestation report available for the customers?">
    Yes. Please reach out to our sales representative/Xoxoday POC to have access to the CPRA report.
  </Accordion>

  <Accordion title="Do you collect any data from California citizens who are not 18 years old?">
    No. We do not collect any data from any users across the globe who are not 18 years old.
  </Accordion>

  <Accordion title="Can the data subject authorize an agent (an Authorized Agent) to exercise their rights?">
    Yes. The data subject can authorize an agent (an "Authorized Agent") to exercise their rights. To do this, the data subject must provide your Authorized Agent with written permission to do, and we may request a copy of this written permission from your Authorized Agent when they make a request to exercise the rights.
  </Accordion>

  <Accordion title="How can we submit our request to exercise our Rights Under the CCPA/CPRA?">
    You may submit a Valid Request by emailing [cs@xoxoday.com](mailto:cs@xoxoday.com).
  </Accordion>

  <Accordion title="Do you sell, rent, or share Personal Data with third parties outside of our company?">
    No. We will not sell, rent, or share Personal Data with third parties outside of our company. But Personal Data may be provided where we are required to do so by any privacy laws.
  </Accordion>

  <Accordion title="What is SOC 2 compliance?">
    SOC 2 compliance is part of the AICPA Service Organization Control reporting platform. The goal of SOC 2 is to evaluate organization security and internal controls around security, availability, processing integrity, confidentiality, and privacy.
  </Accordion>

  <Accordion title="What are SOC 2 requirements?">
    SOC 2 Compliances are developed by the American Institute of CPAs (AICPA), it defines criteria for managing customer data based on five "trust service principles"—security, availability, processing integrity, confidentiality, and privacy.
  </Accordion>

  <Accordion title="Is Xoxoday SOC 2 certified?">
    Yes. Xoxoday is SOC 2 certified organization. We have implemented all the required SOC 2 controls and got them Audited with the help of Certified Public Accountants (CPA).
  </Accordion>

  <Accordion title="Is your cloud computing platform (AWS) SOC 2 Compliant?">
    Amazon Web Services (AWS) has achieved SOC 1, SOC 2, and SOC 3 reports. These reports detail the AWS controls environment and implemented controls for AICPA Trust Services Criteria (TSC) and can be leveraged as part of a cloud customer security program. AWS SOC-covered cloud services are audited periodically against the SOC reporting framework.
  </Accordion>

  <Accordion title="How do I request Xoxoday for SOC 2 report?">
    You may reach out to our sales representative/Xoxoday POC to have access to the SOC 2 report.
  </Accordion>

  <Accordion title="Who performs the independent third-party audit of Xoxoday for the SOC Report?">
    Laika Compliance LLC performs the SOC 2 audit for Xoxoday.
  </Accordion>

  <Accordion title="How long is a SOC 2 report valid?">
    The SOC 2 Type I report is valid for one year following the date the report was issued.
  </Accordion>

  <Accordion title="Is SOC 2 an international standard?">
    Yes. SOC 2 is an internationally recognized standard. The SOC 2 report and certification involve an independent audit by a third party.
  </Accordion>

  <Accordion title="Do you conduct a SOC 2 audit every year?">
    Yes. We do conduct the SOC 2 Audit on an annual basis.
  </Accordion>

  <Accordion title="Did all applicable compliances and controls are audited during the SOC 2 attestation process?">
    The Auditor has validated and tested all the applicable SOC 2 controls as per the compliance requirements.
  </Accordion>

  <Accordion title="Do you process Protected Health Information (PHI)?">
    We do not process (Collect/Store) Protected Health Information (PHI).
  </Accordion>

  <Accordion title="Is Xoxoday compliant with the Health Insurance Portability and Accountability Act (HIPAA)?">
    Yes. Xoxoday is compliant with Health Insurance Portability and Accountability Act (HIPAA).
  </Accordion>

  <Accordion title="Do you make the HIPAA Audit report available for the customers?">
    Yes. Please reach out to our sales representative/Xoxoday POC to have access to the HIPAA Audit report.
  </Accordion>

  <Accordion title="Do you have the process in place for providing Access Rights to the data subject as per EU GDPR?">
    Yes. We have implemented the Data Subject Access Rights Procedure to make sure that all the data subjects will have the opportunities to exercise their rights as per the privacy laws.
  </Accordion>

  <Accordion title="What method do you use when deleting customer data if requested to do so?">
    The secure deletion standard like DoD 5220.22-M ECE is being followed and we provide a certificate that the data was properly sanitized from all computing resources and portable storage media.
  </Accordion>

  <Accordion title="Do you have procedures in place for responding to a data subject request that involves a customer's Personal Data?">
    Yes. Xoxoday is GDPR Compliant. We have implemented the Data Subject Access Rights Procedure as per the GDPR and made all the data subject rights available as per the data protection laws. This procedure sets out the key features regarding handling or responding to requests for access to personal data made by data subjects, their representatives or other interested parties.
  </Accordion>

  <Accordion title="Do you perform audits on its Sub-processors to demonstrate their compliance?">
    Yes. We validate the compliance requirements of the Sub-processor and obtain the Compliance certificates and audit reports such as – ISO 27001:2013, SOC 2 Type II, ISO 27017, ISO 27701, ISO 27018, Cloud Security Alliance Controls, etc.
  </Accordion>

  <Accordion title="Do you conduct independent audits? (Third-Party)">
    We conduct the independent Audits for - ISO 27001:2013, SOC 2 Type I, CPRA/CCPA, HIPAA, VA/PT Assessments.
  </Accordion>

  <Accordion title="Does your organization have a plan or framework for business continuity management or disaster recovery management plan and policy in place? Frequency of testing?">
    Xoxoday maintains a disaster recovery program to ensure services remain available or are easily recoverable in the case of a disaster. Customers can stay up-to-date on availability issues through a publicly available status website covering scheduled maintenance and service incident history. The BCP and DR Plans are tested and reviewed every year. The Xoxoday BCP and DR plans are reviewed and audited as part of ISO 27001 standards and SOC 2 Type II covering availability as one of the trust service principles.
  </Accordion>

  <Accordion title="Do you have controls in place to restrict and monitor the installation of unauthorized software onto your systems?">
    Users are not having admin access to their computer machines and only IT Support admins can install or uninstall the softwares.
  </Accordion>

  <Accordion title="Are the responsibilities regarding data stewardship defined, assigned, documented, and communicated?">
    CTOs and Production heads are responsible for safeguarding the customers data. Only authorised individual will have access to the production environment.
  </Accordion>

  <Accordion title="Can you provide a published procedure for exiting the service arrangement, including assurance to sanitize all computing resources of customer data once a customer has exited your environment or has vacated a resource?">
    We delete the customer data upon request/termination of the contract and confirm the secure deletion. Our data cleaning process goes through an organized purge. Once the data is purged, it's purged from all places.
  </Accordion>

  <Accordion title="Do you classify your assets in terms of business criticality, service-level expectations, and operational continuity requirements?">
    We clasify the Information assets into Confidential, Restricted , Internal and Public etc..
  </Accordion>

  <Accordion title="Do you maintain a complete inventory of all of your critical assets located at all sites/ or geographical locations and their assigned ownership?">
    We maintain the records of all our assets.
  </Accordion>

  <Accordion title="Do you have procedures and technical measures in place for data access segmentation in multi-customer system architectures?">
    we logically segregate the tenant's data, and it is segregated with a client-specific key for proper handling and security reasons.
  </Accordion>

  <Accordion title="Is user access to diagnostic and configuration ports restricted to authorized individuals and applications?">
    We have restricted the ports for all the users as per Xoxoday IT Policy
  </Accordion>

  <Accordion title="Do you support password (e.g., minimum length, age, history, complexity) and account lockout (e.g., lockout threshold, lockout duration) policy enforcement?">
    The password needs to be minimum 8 characters long and should contain at least one capital letter, special characters among '# \$ % \* &' and 1 digit Maximum Password Age – 45 days Minimum Password Age – 1 day Computer machines will lockout in 15 mins from the time it became inactive.
  </Accordion>

  <Accordion title="Is physical and logical user access to audit logs restricted to authorized personnel?">
    Yes. Only authorised individual have access.
  </Accordion>

  <Accordion title="Can you provide evidence that due diligence mapping of regulations and standards to your controls/architecture/processes has been performed?">
    We use best practices and industry standards to achieve compliance with industry-accepted general security and privacy frameworks. We use enterprise-class security features and conduct comprehensive audits of our applications, systems, and networks to protect customer and business data. Our customers rest easy knowing their information is safe, their interactions are secure, and their businesses are protected. Please click here to know about Xoxoday Security framework - [https://www.xoxoday.com/security](https://www.xoxoday.com/security)
  </Accordion>

  <Accordion title="Is system performance monitored and tuned in order to continuously meet regulatory, contractual, and business requirements for all the systems used to provide services to the customers?">
    We are compliant. We monitor the system performance.
  </Accordion>

  <Accordion title="Do you maintain current architecture diagrams that include data flows between security domains/zones?">
    Yes. We maintain current architecture diagrams that include data flows between security domains/zones
  </Accordion>

  <Accordion title="Are operating systems hardened to provide only the necessary ports, protocols, and services to meet business needs using technical controls (e.g., antivirus, file integrity monitoring, and logging) as part of their baseline build standard or template?">
    All operating systems are hardened as per Xoxoday hardening guidelines.
  </Accordion>

  <Accordion title="Do you use a network segregated from production-level networks when migrating physical servers, applications, or data to virtual servers?">
    We are compliant. We have deployed our applications on AWS Virtual platform cloud.
  </Accordion>

  <Accordion title="Do you provide policies and procedures (i.e. service level agreements) governing the migration of application data to and from your service?">
    Please click here for SLA - [https://drive.google.com/file/d/1LatFZLoRzeRlQf4mEemzL8XsO71YGahk/view](https://drive.google.com/file/d/1LatFZLoRzeRlQf4mEemzL8XsO71YGahk/view)
  </Accordion>

  <Accordion title="Do you maintain liaisons and points of contact with local authorities in accordance with contracts and appropriate regulations?">
    Appropriate roles and responsibilities have been defined and documented. Finance, Leagl, Admin, Infosec departments are active part of it.
  </Accordion>

  <Accordion title="Do you integrate customer requirements into your security incident response plans?">
    Since its SaaS platform is not applicable.
  </Accordion>

  <Accordion title="Have you tested your security incident response plans in the last year?">
    Yes. we conduct the testing on frequent basis to comply with the requirements.
  </Accordion>

  <Accordion title="Does your incident response plan comply with industry standards for legally admissible chain-of-custody management processes and controls?">
    Yes. Its compliant with ISO 27001 and SOC 2 trust service principles.
  </Accordion>

  <Accordion title="Do you design and implement controls to mitigate and contain data security risks through proper separation of duties, role-based access, and least-privileged access for all personnel within your supply chain?">
    Yes. We mitigate all the risk identified.
  </Accordion>

  <Accordion title="Do you make security incident information available to all affected customers and providers periodically through electronic methods (e.g., portals)?">
    We inform the customer if there is any incidents as per the security and privacy laws.
  </Accordion>

  <Accordion title="Do you perform annual internal assessments of conformance and effectiveness of your policies, procedures, and supporting measures and metrics?">
    Yes. We do conduct an internal Audit.
  </Accordion>

  <Accordion title="Do third-party agreements include provision for the security and protection of information and assets?">
    Yes. Privacy and security is a part of the Master Service agreements.
  </Accordion>

  <Accordion title="Are systems in place to monitor for privacy breaches and notify customers expeditiously if a privacy event may have impacted their data?">
    Xoxoday is compliant with GDPR, HIPAA, CCPA/CPRA privacy laws. And we inform the customer if there is any data breaches as per the compliance requirements.
  </Accordion>

  <Accordion title="Do you have the ability to measure and address non-conformance of provisions and/or terms across the entire supply chain (upstream/downstream)?">
    Yes. We provide report on SLA.
  </Accordion>

  <Accordion title="Do you mandate annual information security reviews and audits of your third party providers to ensure that all agreed upon security requirements are met?">
    We do conduct an External Audit with the help of the independent auditor.
  </Accordion>

  <Accordion title="Do you verify that your software suppliers adhere to industry standards for Systems/Software Development Lifecycle (SDLC) security?">
    Yes. we conduct the assessment on annual basis.
  </Accordion>

  <Accordion title="All sub-processors are subject to regular due diligence">
    AWS is a sub-processor as we are storing data on AWS VPC. And they are AWS SOC 2, ISO 27001, ISO 27017 and ISO 27018 certified We monitor the compliances of sub-processor on frequent basis.
  </Accordion>

  <Accordion title="Privacy training is provided to all staff on induction and at least annually thereafter">
    We continuosly train employees on privacy and security.
  </Accordion>

  <Accordion title="Do you have a member in your organisation with dedicated information security duties?">
    Yes. We have member in our organisation with dedicated information security duties. Xoxoday's primary security focus is to safeguard our customers or users data. This is the reason that Xoxoday has invested in the appropriate resources and controls to protect and service our customers.
  </Accordion>

  <Accordion title="Do employees have a unique log-in ID when accessing data?">
    All our employees are having the unique log in IDs.
  </Accordion>

  <Accordion title="Are network boundaries protected by firewalls?">
    We have installed the firewall for maximum securty and configured to restrict unauthorized traffic
  </Accordion>

  <Accordion title="Are all servers, end user devices (All systems) configured according to security standards as part of the build process?">
    All are configured according to security standards as part of the build process
  </Accordion>

  <Accordion title="Has the Data back-up and recovery process been verified?">
    Its part of our Internal and external Audits and validated by the indeendent auditors.
  </Accordion>

  <Accordion title="Is there formal control of access to System Administrator privileges?">
    We have implemented the access control policy and access will be provided only upon need and approval basis. Attached the access control policy.
  </Accordion>

  <Accordion title="Are servers configured to capture who accessed a system and what changes were made?">
    We have track of the changes. Infrastructure logs are collected using the AWS Audit Trail, meanwhile the application related logs are collected in our Elastic Search server and retained in the long term cloud storage.
  </Accordion>

  <Accordion title="Are computer rooms protected against fire and flood?">
    We have installed Smoke detectors and Fire extinguishers for physical security.
  </Accordion>

  <Accordion title="Are security incidents reviewed to capture the root cause and act on key learnings?">
    security incidents reviewed to capture the root cause.
  </Accordion>

  <Accordion title="Does the organisation receive an SSAE-16 SOC Report?">
    We are SOC 2 compliant and we have engaged Laika Compliance LLC, an independent assessor firm, to conduct a SOC 2 Type 1 and SOC 2 Type 2 examination for the Xoxoday Platform against the Security and Confidentiality Trust Services Categories.
  </Accordion>

  <Accordion title="Does the organisationis been audited for ISO 27001 or for other security standards?">
    Attached the ISO 27001:2013 certificate.
  </Accordion>

  <Accordion title="Does the Cloud Hosting Provider provide independent audit reports (e.g., Service Operational Control - SOC) for their cloud hosting services?">
    We provide Software as a Service.(SAAS). We are ISO 27001 certified and GDPR compliant. Attached the document.
  </Accordion>

  <Accordion title="Is the Cloud Service Provider certified by an independent third party for compliance with domestic or international control standards (e.g., the National Institute of Standards and Technology - NIST, the International Organization for Standardization - ISO)?">
    We are ISO 27001 certified and GDPR compliant. Attached the document.
  </Accordion>

  <Accordion title="Do employees/contingent workers who have remote access connect to the customer network?">
    Since it's a SaaS prodcut and deployed on cloud virtual platform only authorised individual have an access to the our production environment on need and approval basis.
  </Accordion>

  <Accordion title="If an employee no longer requires remote access to the customer network, is there a process to inform the the customer in a timely manner to revoke access?">
    We inform the client to revoke access.
  </Accordion>

  <Accordion title="Are controls implemented to restrict sharing of files via conferencing/collaboration tools to the external parties (Microsoft Teams, Skype, Cisco WebEx etc.)?">
    We use Google workspace and have secure mode of sharing the data.
  </Accordion>

  <Accordion title="Does the current DLP solution have the capability to monitor all the endpoints within the Organization?">
    We can manage all the enpoints centrally.
  </Accordion>

  <Accordion title="Is client scoped data collected, accessed, transmitted, processed, or retained that can be classified as personally identifiable financial information under the Gramm-Leach-Bliley Act?">
    We have implemented the security measures to manage the risks introduced during the use of Organization's information assets used for managing Personally Identifiable Information.
  </Accordion>

  <Accordion title="Is there a formalized Risk Assessment process that identifies, quantifies, and prioritizes risks based on the risk acceptance levels relevant to the organization?">
    We have a formal risk assessment process and conduct the risk assessment annually.
  </Accordion>

  <Accordion title="Do contracts with all subcontractors include Non-Disclosure/Confidentiality Agreements, data breach notification, Indemnification/liability and termination/exit clause?">
    All the contractors/vendors have signed the NDA and contracts All the necessary clauses has been included in the agreements with regards to Confidentiality, liabilities, termination etc
  </Accordion>

  <Accordion title="Is Risk Assessment Activity carried out for the organization covering the processes and assets of the customer operations?">
    Yes. We do conduct the Risk Assessment every year.
  </Accordion>

  <Accordion title="Does the organization has a mechanism to classify & protect sensitive IT assets covering the customer operations?">
    Yes. We have implemented the Data security and Information clasification policy. Attached the same.
  </Accordion>

  <Accordion title="Do all employees, contractors and third party users sign terms and conditions of employment stating that they agree to adhere to the information security requirements for their role(s) within the organization?">
    Yes. They have signed for the agreements.
  </Accordion>

  <Accordion title="Describe the security controls in place to restrict physical entry & exit (e.g. badge access control systems, biometric systems, man traps, etc)">
    We have a biometric systems and access cards. only authorised individual can have access.
  </Accordion>

  <Accordion title="What are the fire protection & detection mechanisms placed in critical IT locations pertaining to the customer operations?">
    We have deployed Sensors for fire detection and fire extinguishers to detect and protect from the fire.
  </Accordion>

  <Accordion title="Are the major changes affecting the risk profile of the provider environment notified to the customer?">
    Yes, we will notify
  </Accordion>

  <Accordion title="Is there an established SPOC for notifying these changes and ensuring documentation?">
    Yes. Our Customer support team will notify.
  </Accordion>

  <Accordion title="Are user e-mail accounts at the vendor processing facility created after necessary management / HR approvals?">
    Yes. We create an email accounts only after the approval from reporting managers.
  </Accordion>

  <Accordion title="Are e-mail ids created if the vendor operations are outsourced / sub-contracted to other parties? If yes, Are proper approvals taken for the same?">
    We have not outsourced and does not create any email ids
  </Accordion>

  <Accordion title="Is there a structured mechanism for ensuring accountability of shared email accounts, if any?">
    Yes. IT Team is responsible.
  </Accordion>

  <Accordion title="Describe your company's policies, procedures, and practices regarding email security controls?">
    Yes. We have a Email Security Policy and attached the same
  </Accordion>

  <Accordion title="Is attachment size defined? Are the mail attachments for the customer process scanned for Virus and other malicious content?">
    Yes, we have implemented the security controls for email with the help of Google workspace and installed the end point security for all the laptops of the employees. All the incoming and outgoing attachments are scanned.
  </Accordion>

  <Accordion title="Does e-mail communication from the vendor include a standard disclaimer as a part of the contents?">
    Yes.
  </Accordion>

  <Accordion title="Is there restriction for usage & access to internet from systems in the customer operations?">
    Yes, We have implemented the Acceptable Usage Policy and have restricted for usage and access to internet.
  </Accordion>

  <Accordion title="Has the vendor maintained redundancy for firewall & other network components? How it is ensured that network uptime is 100%">
    As part of Web Application Firewall (WAF), rate limiters are installed to block multiple requests from specific IPs in order to prevent DDOS-type attacks. Since our application is deployed on AWS cloud we will ensure the best uptime in the insudtry.
  </Accordion>

  <Accordion title="Do the modifications in the firewall rule-base for the customer operations go through the change management routine?">
    Yes. All the changes takes place as per the change management policy implemented.
  </Accordion>

  <Accordion title="Is there a mechanism to ensure that only licensed softwares / applications are installed on the systems?">
    Yes. We have software register and only approved and licensed softwares will be used.
  </Accordion>

  <Accordion title="Is each operating system up to date with patches provided by the manufacturer?">
    Yes, all are up to date.
  </Accordion>

  <Accordion title="Whether the capacity demands are monitored and projections of future capacity requirements are made, to ensure that adequate processing power and storage are available. Example: Monitoring hard disk space, RAM and CPU on critical servers.">
    Yes, we have capacity planning and monitor the hard disk space, RAM, CPU etc.
  </Accordion>

  <Accordion title="Does the vendor address AntiVirus Signature Management covering systems used for the customer operations? Is frequency defined?">
    All the employees laptop is secured with Bitdefender end point security software
  </Accordion>

  <Accordion title="Are the AV signatures up to date?">
    Yes
  </Accordion>

  <Accordion title="Did the business continuity test include all third parties, including sub-contractors, that support the the customer's business process?">
    Yes. Taken into consideration
  </Accordion>

  <Accordion title="What is the frequency of these tests?">
    Annually
  </Accordion>

  <Accordion title="Does the organization have a documented IT DR plan addressing people, process & systems related to the customer operations? Is it communicated to concerned employees?">
    Yes. Attached the same.
  </Accordion>

  <Accordion title="What were the criteria for selecting CSP? (Capability of securely handling Critical Information, Reputation, Financial Position, Market Recognition, past security breaches, past service history, Cost etc) Please share the documents / records.">
    We do consider all of these, addition to that we also validate the controls in place with regards to cloud security, BCP, Uptime etc. AWS is ISO 27001, SOC 2 Type II certified and complied with CSA start level 2. Please click here for more details about AWS Compliance Programs - [https://aws.amazon.com/compliance/programs/](https://aws.amazon.com/compliance/programs/)
  </Accordion>

  <Accordion title="Is there a legal agreement signed between vendor and CSP?">
    Yes. We have an agreement.
  </Accordion>

  <Accordion title="How does vendor ensure protection against Malicious Code and Monitoring on cloud?">
    We have implemented policies and procedures as per ISMS and GDPR requirements. We also conduct periodical Internal and external Audit by the third party Auditor. We have deployed our application on Cloud Virtual platform for maximum security. We use Bitdefender End point security software to prevent from malware and protect the data. In addition to that we also have AWS Guard Duty threat detection service that continuously monitors for malicious activity and unauthorized behaviour. We conduct periodical Vulnerability assessment and Penetration Testing from the Inductry approved authorized vendor to make sure that all the vulnerabilities are closed and having secured applications.
  </Accordion>

  <Accordion title="How does vendor along with CSP ensure that Change Management to be followed for changes related to the customer services at cloud environment?">
    Xoxoday and AWS both are ISO 27001:2013 certified and implemented the change management procedure. We ensure that we follow the policies and procedures with regards to any changes to be made.
  </Accordion>

  <Accordion title="Does security controls implemented by CSP are as per Internationally accepted guidelines / standards (e.g. CSA Cloud Matrix, NIST, SANS, CIS Critical Controls, OWAPS, ISO)?">
    Yes. AWS is ISO 27017, ISO 27001:2013, ISO 2018, SOC 2 certified.
  </Accordion>

  <Accordion title="Is there a provision of demanding and review of compliance certificate like ISO27001 / PCI:DSS / NIST etc from CSP?">
    Yes. Attached the AWS ISO 27001 certificate
  </Accordion>

  <Accordion title="Does CSP is having documented and tested Business Continuity (BCP) and Disaster Recovery Plan (DRP) available with consideration of multifacility deployment within India for the customer related services?">
    Yes. Tested our BCP plan
  </Accordion>

  <Accordion title="How does vendor and CSP ensure the confidentiality, integrity, availability and privacy of data collected, processes, stored and disposed through cloud services?">
    We ensure that we maintain confidentiality, integrity, availability and privacy of data collected, processes, stored through implementing policies and procedures. And we do conduct the internal and external Audits periodically to make sure that all the controls are working effeectively.
  </Accordion>

  <Accordion title="Are the roles and responsibility / duties for cloud services engagement clearly been segregated between the customer and vendor and between Vendor and CSP?">
    Yes
  </Accordion>

  <Accordion title="Is there a communication procedure available along with escalation matrix for vendor?">
    Yes
  </Accordion>

  <Accordion title="In event of legal / federal investigation of CSP / other tenants, how the security (C, I & A) of Vendor / the customer data is being maintained?">
    Since we have logically segregated the data and ISO 27001 certified and GDPR compliant we do not disclose or provide any of the the customer data.
  </Accordion>

  <Accordion title="Has the service been audited in the past year for any of the following, by any independent entities? - Privacy - Information Security - Disaster Recovery - Operations - Technology - Other:">
    Yes. Audited by the independent Auditor and all the aspects of Privacy, information security, BCP, DR, Production, VAPT has been validated.
  </Accordion>

  <Accordion title="Have any of the audits addressed above resulted in any exceptions or findings?">
    NO
  </Accordion>

  <Accordion title="What is the production site physical address (DC, DR and Operations Location)?">
    Production Site - No.17, Bhagyalakshmi Square, 2nd Floor, Sector 3, HSR Layout, Bangalore -560102 We have deployed our application on AWS Singapore. Since we have deployed our application on AWS cloud they only provide DR Services.
  </Accordion>

  <Accordion title="Are there any additional location(s) where target data (the customer data) is stored/ accessed/ processes/ transferred/ administered?">
    No other location
  </Accordion>

  <Accordion title="Please provide details in the following areas in scope to services being provided to the customer: - Operating system(s) - Workstations # of devices - Servers # of devices - List Applications in scope. - Number of employees by function (e.g., development, systems operations, information security)">
    We provide our application to the customer. We have 230+ employees. 100+ employees are involved in the production/devolopment and we have a sepearate team for IT Support and Information security. We have provided separate computers to each employees. Altogether we are having around 250 computer machines. Our application is deployed on AWS cloud virtual platform.
  </Accordion>

  <Accordion title="Share following certifications/ assessment reports: - any Security/ privacy/ compliance related certifications, clearly mentioning all the scoped location and services/ applications/ products/ platforms (ISO 27001; SOC - 2 Report etc.) - latest cloud security reports (e.g. AWS Inspector Report; Azure Security and Compliance Centre Threat Management report etc.)">
    We are ISO27001;2013 certified and GDPR compliant.Attached the ISO 27001:2013 certificate. We are SOC 2 compliant and in the last phase of final Audit. Attached the engagement letter that we have with our external Auditors.
  </Accordion>

  <Accordion title="Details of control mechanism which will be deployed by the function to ensure that the service provider does not violate the internal norms of the insurer or the regulatory requirements set in the local regulator's guidelines? For example sample testing, maker checker, system controls, etc.">
    Xoxoday is ISO 27001:2013 certified, GDPR compliant and SOC 2 type I certified organization and have all the required technical and organizational controls in place and auditred during the internal and external audits.
  </Accordion>

  <Accordion title="Are all the information systems equipment's maintained in accordance with the supplier's recommended service intervals and specifications? Are records kept of all suspected or actual faults and all maintenance activities performed on equipment's? Is the maintenance carried out by authorized personnel only?">
    We are ISO 27001 Certified organization. We make sure that all the required records are maintained and compliant with the requirements.
  </Accordion>

  <Accordion title="Do you have documented procedures for the identification, capture, tracking, escalation and resolution of operational problems/incidents (all systems, applications or facility-related problems)? Do you have any Security incident reporting / handling and breach response procedures? Are procedures established to intimate BSLI of information security incidents concerning BSLI data?">
    Attached the Security Incident Reporting & Response Procedure and Incident Management Procedure
  </Accordion>

  <Accordion title="Do you maintain an information labelling and handling procedures? Are documented information tagged/labelled as per your asset classification schema which is at par with BSLI Information classification policy?">
    We have implemented the Information classification Policy to protect against unauthorised access, disclosure, modification, or other misuse. All our assets are labelled as per the requirement.
  </Accordion>

  <Accordion title="Are access privileges associated with each system product allotted to users on a need-to-use and event-by-event basis? Are users provided administrator rights on their systems? Do you maintain a repository of personnel with administrator privileges and other high-level privileges per application, OS, database, network system? Do you have specific procedures established and maintained in order to avoid the unauthorized use of generic administration user IDs (super admin, super user IDs), according to systems' configuration capabilities">
    Access to data and systems are based on the principles of least privilege for access. Accordingly, all information systems and data are classified and further segregated to support role-based access requirements. A strong identification and authentication system and logging systems are deployed and provide a centralized control to administer, monitor and review all critical access. We have a role-based access system through access control policy to make sure that only the authorised individual has access to the required information. An Identity and Access Management (IAM) solution has been defined to manage user access through role-based access profiles that support the implementation of accesses based on the principles of need-to-know basis and support segregation of duties. The approvers are either the Product Heads or respective function Heads are their authorized delegates.
  </Accordion>

  <Accordion title="Are secure work areas adequately protected against environmental hazards? Do you have fire alarm/suppression systems installed across office (secure areas/work areas)? Do you have a VESDA system installed? Do you have temperature and humidity controls deployed? Do you have UPS and DG set systems in place? Do you have precision AC's installed? Do you have smoke detectors installed?">
    We have the Fire alarams, Smoke detectors, UPS, Temperature controler, Air conditioner, etc.. for protecting against the environmental hazards.
  </Accordion>

  <Accordion title="Are users required to sign a statement to keep personal secret authentication information confidential and to keep group information (i.e. shared) secret authentication information solely within the members of the group?">
    Yes, all our - both full-time and on-contract are bound by an agreement of non-disclosure and a confidentiality agreement as a condition of employment to protect the customers and tenant's information.
  </Accordion>

  <Accordion title="Do you use CCTV cameras to monitor the facility on a 7x24-hour basis? If Yes, are all cameras operating and positioned properly to view activity at all entrances/exits to the facility and sensitive areas (e.g.. call center, computer room)?">
    We use the CCTV cameras to monitor the building on a 24\_7\_365 basis. All the enterances, exit, restricted areas are under surveilance for security reasons.
  </Accordion>

  <Accordion title="Is there a dedicated team responsible for Information Security?">
    Yes. We have the Information security team.
  </Accordion>

  <Accordion title="Whether all network Infra (Router, Switch, Firewall, etc.,) are integrated with the Service provider Domain and that a central IDAM solution or TACACS (Radius) is implemented for managing access to the network components?">
    We are compliant
  </Accordion>

  <Accordion title="Whether audit requirements and activities involving checks on operational systems are carefully planned and agreed to minimize the risk of disruptions to business process? Do you agree to allow BSLI Auditors or Contracted Third Parties conduct IS Audit at your premise? Do your agree to allow Surprise Adits to be conducted by BSLI Auditors or Contracted Third Parties?">
    In accordance with Data Protection Laws, we make available to Controller on request in a timely manner such information as is necessary to demonstrate compliance by Processor with its obligations under Data Protection Laws. Upon Controller's written request and subject to the confidentiality obligations set forth in the Agreement, we will make available to Controller a copy of Nreach the most recent third-party audits or certifications, as applicable. We do not agree for the Surprise audits.
  </Accordion>

  <Accordion title="The organization has a Disaster Recovery Plan in place to support its key products & services? The organization has a Test Calendar in place to test its Disaster Recovery Plan? Disaster Recovery Plan is tested atleast once in a year and test results/learnings are communicated to the customer? The organization has a Business Continuity Policy in place?">
    We have the Buiness continuity and Disaster Recovery Plan in place. These controls has been tested at least annually as per the compliacne requirements. Attached the policies for your referrence.
  </Accordion>

  <Accordion title="The organization has a Crisis Management in place for any Crisis Impacting its Operations? The organization has a Business Continuity/Alternate Site Plan in place to support/resume its key products & services? The Business Continuity plan complies to the recovery requirements of the customer (RTO,RPO & ROL) The organization has a Pandemic Plan in place to support its key products & services? The organization has a Test Calendar in place to test its Business Continuity / Alternate Site Plan? Business Continuity / Alternate Site Plan is tested atleast once in a year and test results/learnings are communicated to the customer?">
    We have the Crisis management is in place. Attache the same. We have provided an option to work from home/remotely due to this pandamic with necessary infrastructure and security. Business continuity plan has been tested on annual basis and audited during the internal and external audits. Atatched the business continuity policy and plan.
  </Accordion>

  <Accordion title="No Generic IDs to issued / used within the application">
    Generic IDs are not used
  </Accordion>

  <Accordion title="Appropriate architecture and processes to be set to ensure application meets the availability requirements through implementaton of HA / DR and Processes like Backup and restoration For SaaS applications SLAs need to be adhered to as well for uptime assurances provided">
    [Please click here for SLA - https://drive.google.com/file/d/1LatFZLoRzeRlQf4mEemzL8XsO71YGahk/view](https://drive.google.com/file/d/1LatFZLoRzeRlQf4mEemzL8XsO71YGahk/view)
  </Accordion>

  <Accordion title="Ability to selective delete any Sensitive / PII information basis retention policy, customer request or as needed due to any business requirement">
    We have the ability to delete the data upon request by the data subject or termination of the contract. Attached the data retension and disposal policy.
  </Accordion>

  <Accordion title="Does your organisation have a pandemic plan? Please submit a copy of the Pandemic plan mentioning the business continuity strategies for services rendered to the customer">
    We have implemented the Business continuity policy and we have the ability to resume our operation from potential threats, Pandemic, flood, fire, earthquake etc. Due this pandemic/WFH situation, VPN access has been enabled with 2FA For such authorized individuals, for ensuring business continuity. We have the required controls in place for working from home or remotely due to this pandemic situation.
  </Accordion>

  <Accordion title="Is there a designated point-of-contact for pandemic preparedness activities within the organisation? If yes, please share details">
    Its a part of our Business continuity plan and IT Support Head, HR Head, CTO, Infosec Head will be involved in the preparedness activities.
  </Accordion>

  <Accordion title="How would your company protect its employees and clients against getting infected in the Workplace? Please elaborate">
    We have provided WFH option to all the employees to get protected from COVID 19.
  </Accordion>

  <Accordion title="Is there a mechanism to identify and send sick employees or visitors home? Please elaborate">
    We have provided WFH option to all the employees to get protected from COVID 19.
  </Accordion>

  <Accordion title="Are the mentioned business continuity strategies tested in the last 12 months?">
    We test the Business continuity plan on annual basis. It was tested in the month of Aug 2021 for the last time.
  </Accordion>

  <Accordion title="Does the business continuity strategies defined for pandemic fulfill the Recovery Time Objective, Recovery Point Objective & Revised Operating Level (MBCO) requirements as agreed contractually or mutually">
    It has been well defined in the in the Business continuity policy and plans. Attached the same for your referrence.
  </Accordion>

  <Accordion title="Are Crisis communicaiton procedures defined to notify the customer in case of any impact to your organisation due to pandemic situation and providing periodic updates on the developments.">
    We inform our customer on any crisis and if that is effecting on our customers.
  </Accordion>

  <Accordion title="Does Supplier consider itself a Controller or Processor, or Joint Controller with the customer?">
    Xoxoday is a data processor.
  </Accordion>

  <Accordion title="Does Supplier have an automatic method for advising the customer of new Sub Processors?">
    NO. We obtain consent before such activities from the customer.
  </Accordion>

  <Accordion title="Does Supplier have adequate written agreements on data protection requiring appropriate technical and organisational measures in place with such Sub Processors or will be put into place prior to any subcontracting?">
    We have the DPA and appropriate controls in place – We are compliant.
  </Accordion>

  <Accordion title="What certifications does Supplier have in place (i.e. SSAE 16 or ISAE 3402, ISO 27001 etc.)?">
    ISO 27001;2013, SOC 2 Type I Certified and GDPR compliant.
  </Accordion>

  <Accordion title="Does Supplier have business continuity plans that have been implemented and tested?">
    YES. We have implemented the Business continuity plans and tested them annually.
  </Accordion>

  <Accordion title="Does Supplier have cybersecurity insurance? If so, please provide material details of the coverage?">
    No. But we are in the process of getting the insurance from the Insurance company.
  </Accordion>

  <Accordion title="Confirm how Supplier demonstrates compliance with its data processing obligations.">
    We conduct the internal and External audits on a periodical basis as per the compliance requirements and obtain Audit reports and certifications. We provide the same with the customers.
  </Accordion>

  <Accordion title="Provide any details on whether the Supplier is subject to any enforcement actions, investigations, inquiries, or litigation related to privacy or information security relating to the processing of Personal Data?">
    NO. We are not subjected to any actions as such.
  </Accordion>

  <Accordion title="Provide the detailed Technical Architecture description of all the components of the proposed solution including monitoring solutions used by the provider">
    application by Xoxoday, the RnR platform is a cloud-based SaaS platform hosted on VPC infrastructure of AWS. The data centers are hosted completely in isolation so that the access is limited and controlled. Each instance (EC2 Instance) under fortified VPC network is further conglomeration of Docker Container Web Services and APIs and application layer running on top of it. This helps in managing various aspects and features of application without affecting the functioning of each other and achieving a modular architecture to work as plug and play model. Amazon Cloud Watch is implemented to enable monitoring of the functioning of the application. We have Web application firewall (WAF), IDS/IPS, AWS Guardduty, and the data has been encrypted for security reasons. Attached the Architecture diagram.
  </Accordion>

  <Accordion title="Can you list the security certifications of you company and can the customer get a certificate/report of the relevant certications">
    Xoxoday is ISO 27001:2013 certified and GDPR compliant.
  </Accordion>

  <Accordion title="Provide an overview of the various standards, methodologies, processes and tools used to build in Security in your SDLC and detect security defects and vulnerabilities in your applications (internal or outsourced developments) prior to deployment to production (BSIMM, NIST, Manual or automated source code analysis, peer review, etc)">
    Xoxoday is ISO 27001:2013 certified and GDPR compliant. And we follow ISO 27001, NIST, CSA standards and best practices. We have Web application firewall (WAF), IDS/IPS, AWS Guardduty, Coudflare and the data has been encrypted for security reasons. We conduct code reviews as per the compliance requirements. We also conduct the Vulnerability assessment and penetration testing on annual basis with the help of the third party authorised vendor. Attached the latest VAPT certificate and ISO 27001 certificate.
  </Accordion>

  <Accordion title="Can the customer get a copy of the last 2 reports of each of the audits performed and the action plan conducted to fix the identified issues?">
    Attached the ISO 27001:2013 certificate and 1st Year Surveilance audit report. We did not have any non-confirmities.
  </Accordion>

  <Accordion title="Describe the status of your readiness regarding European Directive EU 2016/1148 (NIS Directive) regarding the Security of the Network and Information System">
    We are compliant with the data privacy and security requirements. We are having the controls in place with regards to Cyber security, Risk management, crisis management, business continuity, Network security, application security etc. Attached the Business continuity management and Cyber Crisis Management Plan, incident management procedures, SDLC etc.
  </Accordion>

  <Accordion title="Provide the Continuity of Activity plan in place, including the frequency of the tests performed to ensure continuing effectiveness">
    Attached the Business continuity plan and procedure. We test the BCP controls on annual basis as per the compliance requirements and it has been auditted during the internal and external audits.
  </Accordion>

  <Accordion title="Provide an overview of the various standards, methodologies, tools, policies and processes in place to support service operations (ITIL v4 and COBIT 5, etc.)">
    Xoxoday is ISO 27001:2013 certified, CSA START Level 1 and GDPR compliant. And we follow ISO 27001, NIST, CSA standards and best practices. We have Web application firewall (WAF), IDS/IPS, AWS Guardduty, Coudflare and the data has been encrypted for security reasons. We conduct code reviews as per the compliance requirements. We also conduct the Vulnerability assessment and penetration testing on annual basis with the help of the third party authorised vendor. Attached the below policies and procedures - 1. Encryption Policy 2. Password Management Policy 3. IT Policy 4. Information Classification Policy 5. Threat and Vulnerability Management 6. Cyber Crisis Management Plan 7. Backup Recovery Procedure 8. Access Control Procedure 9. Incident Management Procedure 10. Change Management Procedure
  </Accordion>

  <Accordion title="Describe how high availability of the proposed solution is addressed including redundancy mechanisms, geographical resilient hosting options, service failover capability to other providers, etc. Also describe the process in place to test redundancy and how frequent the test is performed.">
    Data centers are designed to anticipate and tolerate failure while maintaining service levels. In case of failure, automated processes move traffic away from the affected area. These are tested on annual basis. AWS is also ISO 27001, ISO 27017, ISO 27701, ISO 27018, SOC 2 compliant organizatin. Please click here for more details - [https://aws.amazon.com/compliance/programs/](https://aws.amazon.com/compliance/programs/) Please click here to know more about AWS security - [https://aws.amazon.com/compliance/data-center/controls/](https://aws.amazon.com/compliance/data-center/controls/) Please click here to know more about Xoxoday Service level agreement - [https://drive.google.com/file/d/1LatFZLoRzeRlQf4mEemzL8XsO71YGahk/view](https://drive.google.com/file/d/1LatFZLoRzeRlQf4mEemzL8XsO71YGahk/view)
  </Accordion>

  <Accordion title="Describe the SLAs you are committed to regarding the impact of any disruption of your organization to your customers (degraded performances, service interruption, etc.) and what security KPI are made available to the customer in the contractual SLAs engaging the provider">
    Please click here to know more about Xoxoday Service level agreement - [https://drive.google.com/file/d/1LatFZLoRzeRlQf4mEemzL8XsO71YGahk/view](https://drive.google.com/file/d/1LatFZLoRzeRlQf4mEemzL8XsO71YGahk/view)
  </Accordion>

  <Accordion title="Provide an overview of your Data Governance policy and its associated management system to monitor continuous compliance.(i.e. identification and location of sensitive data, protection from unauthorized use, access, loss, etc...)">
    Please click here to know more about data governance - [https://www.xoxoday.com/gdpr](https://www.xoxoday.com/gdpr)
  </Accordion>

  <Accordion title="Provide the documentation regarding your program in place to manage risk">
    Attached the Risk Management Procedure
  </Accordion>

  <Accordion title="Do you have a cyber insurance?">
    We have plan for having the cyber insurance. - In progress.
  </Accordion>

  <Accordion title="Describe how you provide training about Security and compliance to your staff, how often the awareness is performed, how you document their acknowledgment and the formal disciplinary or sanction policy established for employees who have violated security policies and procedures.">
    Each employee, when inducted, signs a confidentiality agreement and acceptable use policy, after which they undergo training in information security, privacy, and compliance. Furthermore, we evaluate their understanding through tests and quizzes to determine which topics they need further training in. We provide training on specific aspects of security that they may require based on their roles. We have implemented the Information security policy and Disciplinary policy.
  </Accordion>

  <Accordion title="Describe how firewalling and vulnerability assessments accommodating the virtualization technologies is performed (e.g. virtualization aware)?">
    As part of Web Application Firewall (WAF), rate limiters are installed to block multiple requests from specific IPs in order to prevent DDOS-type attacks. These are powered by intelligent daemons that detect other identifiers like URLs accessed or other client properties to automatically blacklist possible threats either temporarily or permanently.
  </Accordion>

  <Accordion title="What is your process to monitor that system performance continuously meets all requirements (contractual, business, regulatory) to provide proper service to your customers. Can the customer run his own performance measurement?">
    Please click here to know more about the Application SLA - [https://drive.google.com/file/d/1LatFZLoRzeRlQf4mEemzL8XsO71YGahk/view?usp=sharing](https://drive.google.com/file/d/1LatFZLoRzeRlQf4mEemzL8XsO71YGahk/view?usp=sharing)
  </Accordion>

  <Accordion title="How often do you perform revalidations of the policies of FW, IPS, WAF, etc. and document the business justification in the access control lists.">
    We review and get an approval from the management on annual basis as per the compliance requirements.
  </Accordion>

  <Accordion title="Describe the process to manage the Antivirus/antimalware and specify how frequently the patterns are updated and controlled.">
    We have installed End point security on all the computers and monitored and updated on regular basis.
  </Accordion>

  <Accordion title="Describe how your tenants can report Bugs and security vulnerabilities and the process in place to remedy reported defects. Are your customers informed of discovered defects and the relevant remediation plan?">
    Yes. Our tenants can report the Bugs and security vulnerabilities to [cs@xoxoday.com](mailto:cs@xoxoday.com) We also have Bug Bounty Program at Xoxoday and please click here to know more about - [https://www.xoxoday.com/bug-bounty](https://www.xoxoday.com/bug-bounty)
  </Accordion>

  <Accordion title="Describe how reversibility is addressed, and more specifically can virtual machine images be downloaded and ported to a new cloud provider or to on-site storage, how long the customer's data is available for his retrieval, under what format (e.g. OVF), etc.">
    Since application is a SaaS platform and deployed on AWS virtual platform cloud
  </Accordion>

  <Accordion title="If you are relying on supplier/subcontractors, provide a full list of those involved in providing the contracted service and specify if you will stand Accountable for any security breach originating from one of your suppliers/subcontractors">
    NA. We have the full time employees.
  </Accordion>

  <Accordion title="Provide an overview of the periodic reviews you perform to check the conformance and effectiveness of your policies, procedures and supporting measures and metrics. Specify how these reviews extend to all your partners upstream/downstream">
    We conduct the review and update the policies, procedures etc..and take an approval from the management on annual basis as per the compliance requirements. We also communicate all the policies and procesures to all the employees, contractors through HRMS platform.
  </Accordion>

  <Accordion title="If administrators are allowed to access the infrastructure hosting the proposed solution using mobile devices, provide an exhaustive overview of your centralized MDM solution and more specifically of how you control integrity and security level of the private device and how you guarantee that no customer data is locally cached on the personal device">
    We do not allow to access the infrastructure hosting.
  </Accordion>

  <Accordion title="Have the information security policy and standards been approved by senior management?">
    All the information security policy and standards been approved by senior management.
  </Accordion>

  <Accordion title="Is antivirus software installed on workstations?">
    We have installed the antivirus on all the workstations and servers.
  </Accordion>

  <Accordion title="Does the organisation have security measures in place for data protection?">
    Customer data security is an essential part of our product, processes, and team culture. Our facilities, processes and systems are reliable, robust, and tested by reputed quality control and data security organizations. We continuously look for opportunities to make improvements in the dynamic technology landscape and give you a highly secure, scalable system to provide a great experience. Attached the GDPR - Data security policy.
  </Accordion>

  <Accordion title="Are End User Devices (Servers, Desktops, Laptops, Tablets, Smartphones) used for transmitting, processing or storing Data has anti-malware, file integrity monitoring or application whitelisting deployed in the organisation?">
    We have installed Bidefender endpoint security and restricted the access of external hard drives, USB etc to have restriction on data transfer. we use file integrity and network intrusion detection (IDS) tools to help facilitate timely detection, investigation by root cause analysis, and response to incidents
  </Accordion>

  <Accordion title="Are non-company managed PCs used to connect to the company network?">
    We do not use.
  </Accordion>

  <Accordion title="What is the frequency of BC/DR plan Testing?">
    Annually
  </Accordion>

  <Accordion title="Have BC/DR drill been conducted at reguralar planed intervals?">
    We have conducted the BCP test on 6th Aug 2021. Attached the Business continuity policy.
  </Accordion>

  <Accordion title="Are computer rooms protected against fire and flood? (2)">
    We have installed Smoke detectors and Fire extinguishers for physical security.
  </Accordion>

  <Accordion title="Is there an established incident management program approved by management, communicated to appropriate constituents, maintain and revieweed?">
    Attached the incident management procedure. All our policies are reveiwed annuaaly and approved by the top level management.
  </Accordion>

  <Accordion title="Are security incidents reviewed to capture the root cause and act on key learnings? (2)">
    security incidents reviewed to capture the root cause.
  </Accordion>

  <Accordion title="Does the organisation have a formal Incident Response plan?">
    Attached the Security Incident Reporting and Response Procedure
  </Accordion>

  <Accordion title="Are all potential incidents assessed to determine appropriate classification, severity and impact?">
    Classification of Incidents are done. Attached the Incident Management Procedure
  </Accordion>

  <Accordion title="Has the organisation experienced an information security breach in the past three to five years?">
    No Security breaches till date.
  </Accordion>

  <Accordion title="Does the organisation receive an SSAE-16 SOC Report? (2)">
    We are SOC 2 compliant and we have engaged Laika Compliance LLC, an independent assessor firm, to conduct a SOC 2 Type 1 and SOC 2 Type 2 examination for the Xoxoday Platform against the Security and Confidentiality Trust Services Categories. Attached the engagement letter.
  </Accordion>

  <Accordion title="Does the organisationis been audited for ISO 27001 or for other security standards? (2)">
    Attached the ISO 27001:2013 certificate.
  </Accordion>

  <Accordion title="Do contracts with third party vendors that access or host your organization's information assets contain security requirements commensurate with your organization's security standards">
    We make sure that they have adequate controls in place and meet the security standard.
  </Accordion>

  <Accordion title="Is the Cloud Service Provider certified by an independent third party for compliance with domestic or international control standards (e.g., the National Institute of Standards and Technology - NIST, the International Organization for Standardization - ISO)? (2)">
    We are ISO 27001 certified and GDPR compliant. Attached the document.
  </Accordion>

  <Accordion title="Are Global Blocklist and Whitelist configurations (such as URL's/domains inaccessible/accessible through the organization's proxies) enabled and reveiwed annually">
    We review these to make sure the all the controls in place.
  </Accordion>

  <Accordion title="Users may have a legitimate business requirement to access blocked websites. If such a need arises, is there a process to request and obtain approval for the same?">
    We provide access only upon need and approval basis.
  </Accordion>

  <Accordion title="Are controls implemented to restrict sharing of files via conferencing/collaboration tools to the external parties (Microsoft Teams, Skype, Cisco WebEx etc.)? (2)">
    We use Google workspace and have secure mode of sharing the data.
  </Accordion>

  <Accordion title="Does the current DLP solution have the capability to monitor all the endpoints within the Organization? (2)">
    We can manage all the enpoints centrally.
  </Accordion>

  <Accordion title="Is there a formalized risk governance plan that defines the Enterprise Risk Management program requirements?">
    Attached the Risk Management Procedure
  </Accordion>

  <Accordion title="Is there a formalized Risk Assessment process that identifies, quantifies, and prioritizes risks based on the risk acceptance levels relevant to the organization? (2)">
    We have a formal risk assessment process and conduct the risk assessment annually.
  </Accordion>

  <Accordion title="Do contracts with all subcontractors include Non-Disclosure/Confidentiality Agreements, data breach notification, Indemnification/liability and termination/exit clause? (2)">
    All the contractors/vendors have signed the NDA and contracts All the necessary clauses has been included in the agreements with regards to Confidentiality, liabilities, termination etc
  </Accordion>

  <Accordion title="Is the Saas Solution deployed on public cloud or cloud hosted by Saas Vendor?">
    The SaaS solution is deployed on Public cloud.
  </Accordion>

  <Accordion title="Are hardening standards defined and followed for all infrastructure components (OS, Network Devices, Servers, Firewalls, DBs etc.)">
    Yes
  </Accordion>

  <Accordion title="Are you using Anti-Virus tool if yes, share the name of the tool.">
    Yes. We are using Bitdefender endpoint security.
  </Accordion>

  <Accordion title="Is VPN and VPC services used for transmitting data securely e.g. tunneling services?">
    Yes. We use for security reasons
  </Accordion>

  <Accordion title="What kind of access the vendor employees will have on the application and how access to the customer data in the application is restricted from being accessed by Vendor employees?">
    Our employees will not have access by default. The data will be accessed only upon need an approval basis. The access is controlled through the AWS Identity and Access Management system that also enforces two-factor authentication
  </Accordion>

  <Accordion title="What policies are configured for restricting PII leakage from the system?">
    We collect only 3 types of the personal Information such as Name, email ID, phone#. , personal data is to be transmitted using firmly approved encrypted systems. We have implemented the role based acccess control to make sure that the acccess has been granted to only authorised individual.
  </Accordion>

  <Accordion title="Is user access controlled and has limited access to the data and configuration settings on cloud?">
    Yes.
  </Accordion>

  <Accordion title="Vendor shall immediately inform the customer about any security incident.">
    Yes. We inform the client about any security incidents.
  </Accordion>

  <Accordion title="Do you have change and incient management process in place to record, response and resolve an incident within SLA and to control the changes in the system / application? If yes, please share.">
    Yes. Attached Incident management policy and SLA
  </Accordion>

  <Accordion title="Does the agreement contains right to audit the service provider Information System">
    Yes
  </Accordion>

  <Accordion title="Compliant with all regulatory requirements">
    Yes
  </Accordion>

  <Accordion title="Compliance to IT Act and other Acts applicable to data">
    We are compliant.
  </Accordion>

  <Accordion title="ISO 27001:2013 or any equivalent Information Secuirty Management System">
    Yes, We are ISO 27001:2013 certified. Attached the certificate.
  </Accordion>

  <Accordion title="Service Organization Control SOC type 2 or any equivalent compliance report">
    We are SOC 2 Type 1 compliant. The audit has been completed and auditor is working on the Draft audit report. We will be able to share once the report is finalized.
  </Accordion>

  <Accordion title="ISO 27018:2018 Code of Practice for Protection of PII in Public Cloud, if PII data is stored on the cloud.">
    NA. But AWS Virtual platform cloud is ISO 27017 and 27018 certified and attached the report.
  </Accordion>

  <Accordion title="PCI-DSS in case the CSP handles card holder data if card data is processed and stored.">
    NA. We do not handles the card holder data.
  </Accordion>

  <Accordion title="Which all processes Vendor is handling currently and how the customer is sharing the data with them?">
    the customer will be using the application product and all the information will be entered only through our application.
  </Accordion>

  <Accordion title="How data sharing between vendor and the customer will take place?">
    The data sharing between vendor and the customer will take place only through application product. There will be no manual data sharing or transfer.
  </Accordion>

  <Accordion title="Will any Personally Identifiable Information (PII) be stored with vendor? Please mention specific reports that are to be stored.">
    PII will be entered through application and stored it on AWS cloud virtual platform. We store Name, email ID and phone number of the users.
  </Accordion>

  <Accordion title="Sub-contractor responsibilities and dependencies are clarified, and risks of employment of subcontractors are fully managed. Subcontractor is subject to all requirements the Contractor is.">
    We do not have any sub-contractors. We have deployed our application on AWS Virtual platform cloud. And AWS is ISO 27001, SOC 2, ISO 27017, ISO 27018, ISO 27701, CSA Compliant etc..
  </Accordion>

  <Accordion title="Vendor has relevant encryption capabilities, and is able to apply encryption at the customer data at rest and in transit (when solution is to be hosted on the customer datacenter solution, it should be secured using a the customer approved digital certificate), whenever deemed necessary and required by the customer or relevant external regulation. The solution should provide secure and reliable ways to exchange data with the customer backend systems and SaaS applications as well.">
    We have deployed our application on AWS Virtual Platform cloud. application is a cloud based application. We have encrypted the data while in transit and at rest. We use TLS1.2 encryption for Data at transit and AES256 Data at rest for maximum security. All the confidential/PI data are encrypted at rest and in transit with a split key mechanism to ensure that every client's key is unique We do not decrypt the data until and unless if there any specific request from the customer.
  </Accordion>

  <Accordion title="Sufficient service uptime is guaranteed, meeting the customer expectations (on availability, RTO, RPO). Vendor has a BCP and DRP in place, ensuring service downtimes are kept as short as possible.">
    Xoxoday endeavours to provide 99.9% Uptime each month 24 hours a day 7 days a week ("Agreed Hours of Service"). Uptime is measured based on the monthly average of availability, rounded down to the nearest minute. Please click here to know about Xoxoday SLA - [https://drive.google.com/file/d/1LatFZLoRzeRlQf4mEemzL8XsO71YGahk/view](https://drive.google.com/file/d/1LatFZLoRzeRlQf4mEemzL8XsO71YGahk/view) Xoxoday has a formal Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP) defined and implemented to enable people and process support during any crisis or business interruptions. The BCP and DR Plan is tested and reviewed on a yearly basis as per the compliance requirements. The BCP and DR plan of Xoxoday is reviewed and audited as part of ISO 27001 standards and SOC 2 Audits by the independent auditor. Attached the Business Continuity Plans (BCP) and Disaster Recovery Plan (DRP) documents.
  </Accordion>

  <Accordion title="There is proper control in place for the usage of system utilities to circumvent application controls, and this possibility is disabled.">
    Since it's a SaaS platform, there are no process as such.
  </Accordion>

  <Accordion title="Contractor is certified under external security best practices and standards (e.g. ISO). Contract shall include an audit clause that gives the customer the right to obtain independent audit reports (ISAE 3402 type 2, SOC 2, SSAE 18, ISO27k, PCI-DSS Level 1, etc.), network/application penetration testing reports, and vulnerability scanning results. The results can be summarized (not containing confidential technical details), or detailed when limited to the systems used by the customer. Furthermore, the customer should be allowed to initiate independent vulnerability scanning / penetration testing on the services received by the Vendor.">
    Attached the below mentioned coompliance certifications - Attached the Audit reports. 1. ISO 27001 certificate 3. VAPT Certificates 4. VAPT Audit reports 5. SOC 2 Audit reports. 6. GDPR Data Privacy Impact assessment report 7. California Privacy Rights Act (CPRA) attestation report. 8. CSA STAR LEVEL 1 compliant - [https://cloudsecurityalliance.org/star/registry/nreach-online-services-pvt-ltd-xoxoday](https://cloudsecurityalliance.org/star/registry/nreach-online-services-pvt-ltd-xoxoday) We conduct these audit on annual basis and we will share it upon request.
  </Accordion>

  <Accordion title="Guarantees are offered to the customer on resolving security incidents / outages.">
    We always provide our best service to resolve security incidents / outages. Attached the Service Level Agreement (SLA)
  </Accordion>

  <Accordion title="Provide a general description of the information security measures applicable to the services you offer to the customer.">
    Xoxoday is committed to ensuring the integrity, confidentiality, availability, and security of its physical and information assets and maintaining privacy when serving the customers and organization's needs while meeting appropriate legal, statutory, and regulatory requirements. To provide adequate protection for information assets, Xoxoday has built the Information Security Management System (ISMS), enabling everyone to follow these policies diligently, consistently, and impartially. Xoxoday will implement procedures and controls at all levels to protect the confidentiality and integrity of information stored and processed on its systems and ensure that information is available only to authorized individuals as and when required. Please click here to know more about Xoxoday Security - [https://www.xoxoday.com/security](https://www.xoxoday.com/security)
  </Accordion>

  <Accordion title="the customer requires transfer outside of the EEA to have a valid legal basis. Please describe the legal basis for each of the countries that personal data is transferred to.">
    We have deployed our application on AWS Virtual platform cloud - Singapore region. We are GDPR compliant. And we have an agreement and Standard contractual clauses (SCC) as per GDPR Compliance requirements.
  </Accordion>

  <Accordion title="Are you, or have you been involved in any legal proceedings, civil or public, relating to processing of Personal Data in connection with the services that you offer to the customer, in the last five years? If so, please elaborate on the nature and document the outcome of these proceedings.">
    NO
  </Accordion>

  <Accordion title="Are you aware of any legal proceedings, civil or public, that any of your (sub) processors have been involved in, relating to processing of Personal Data in connection with the services that you offer to the customer, in the last five years? If so, please elaborate on the nature and outcome of these proceedings.">
    NO
  </Accordion>

  <Accordion title="Have you reported any Personal Data Breaches, as defined in art. 4 (12) of the GDPR, relating to your processing of personal data in connection with the services that is offered to the customer, to any of your Customers, any Data Protection Authorities or any Data Subjects, in the last five years? If so, please elaborate on the nature of the breach(es).">
    No. There were no Personal Data Breaches.
  </Accordion>

  <Accordion title="To the extent applicable: 1) Describe the certifications and audit scheme that you have or will put in place, to allow the customer to verify compliance with applicable law and the Data Processing Agreement during the contract period 2) Describe the regularity and scope of any third party audits with regard to information security, data protection compliance and to what extent (sub) contractors are covered by the audit schemes 3) Describe how the customer will obtain access to reports from audits for any transfer of Personal Data to countries outside the EEA.">
    Xoxoday is committed to ensuring the integrity, confidentiality, availability, and security of its physical and information assets and maintaining privacy when serving the customers and organization's needs while meeting appropriate legal, statutory, and regulatory requirements. To provide adequate protection for information assets, Xoxoday has built the Information Security Management System (ISMS), enabling everyone to follow these policies diligently, consistently, and impartially. Xoxoday will implement procedures and controls at all levels to protect the confidentiality and integrity of information stored and processed on its systems and ensure that information is available only to authorized individuals as and when required. Attached the below documents - 1. ISO 27001 Certificate 2. SOC 2 Audit report. 3. California Privacy Rights Act (CPRA) attestation report. 4. VAPT Certificates 5. GDPR DPIA Assessment report. 6. CSA START LEVEL 1 Compliant - [https://cloudsecurityalliance.org/star/registry/nreach-online-services-pvt-ltd-xoxoday](https://cloudsecurityalliance.org/star/registry/nreach-online-services-pvt-ltd-xoxoday) the customer can request the Xoxoday POC for these reports and we will provide the latest Audit reports upon request.
  </Accordion>

  <Accordion title="Through discussions with the vendor, try to obtain an overview of the value chain from the cloud vendor and backwards to subcontractors">
    We are storing all the customer data on AWS Virtual platform cloud – Singapore region and consider AWS as a Sub-Processor as per EU GDPR. AWS is ISO 27001, SOC 2, ISO 27017, ISO 27018, CSA STAR, ISO 27701 certified organization. Please click here to know about AWS Compliance offerings - [https://aws.amazon.com/compliance/programs/](https://aws.amazon.com/compliance/programs/)
  </Accordion>

  <Accordion title="Does the contract detail the scope and functionality of the online services?">
    Scope and functionalities are the part of the agreement.
  </Accordion>

  <Accordion title="Any written documentation for the SLA? Are SLA objectives measurable and have relevant penalties? Do they cover availability, response times or other? What does the SLA cover?">
    Please click here for SLA - [https://drive.google.com/file/d/1LatFZLoRzeRlQf4mEemzL8XsO71YGahk/view](https://drive.google.com/file/d/1LatFZLoRzeRlQf4mEemzL8XsO71YGahk/view) We do not offer any credits/ penalties.
  </Accordion>

  <Accordion title="Are there any technical and organisational measures that aim to remedy the risks entailed by lack of control and lack of information featuring in the cloud computing environment? E.g. measures aimed at ensuring availability, integrity, confidentiality, isolation, intervenability and portability.">
    We have implemented all the technical and organisational measures to ensure the integrity, confidentiality, availability, and security of its physical and information assets and maintain privacy when serving the customers and organization's needs while meeting appropriate legal, statutory, and regulatory requirements. To provide adequate protection for information assets, Xoxoday has built the Information Security Management System (ISMS), enabling everyone to follow these policies diligently, consistently, and impartially.
  </Accordion>

  <Accordion title="What kind of certifications does the cloud vendor have (ISO 2001, SOC report etc.)?">
    [ISO 27001 certificate VAPT Certificate SOC 2 Audit reports. California Privacy Rights Act (CPRA) attestation report. CSA STAR LEVEL 1 compliant - https://cloudsecurityalliance.org/star/registry/nreach-online-services-pvt-ltd-xoxoday We have shared these certifications and Audit reports.](https://cloudsecurityalliance.org/star/registry/nreach-online-services-pvt-ltd-xoxoday)
  </Accordion>

  <Accordion title="Is there a clause saying that no data shall be processed by Supplier or any subcontractors for other purposes than the one specified in the contract?">
    We do not process the data for other purposes than the one specified in the contract,
  </Accordion>

  <Accordion title="Does the contract specify that Supplier may not communicate the data to third parties, even for preservation purposes unless it is provided for in the contract that there will be subcontractors?">
    We do not share the data with third parties. But we store it on AWS Virtual platform cloud and we consider AWS as a Sub-processor. We do not disclose any of our customers personal information to any third parties. We reserve the right to disclose PI if required by law or if we reasonably believe that use or disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or comply with a law, court order, or legal process. We reject any non-legally binding requests for disclosure.
  </Accordion>

  <Accordion title="Does the data processing agreement specify the types of personal data processed by Supplier?">
    We process only the Name, phone# and Email ID as mandatory information.
  </Accordion>

  <Accordion title="Does the contract ensure a logging of processing operations on personal data performed by Supplier and its sub-contractors?">
    We process the information as per the terms of use - [https://www.xoxoday.com/terms-of-use](https://www.xoxoday.com/terms-of-use)
  </Accordion>

  <Accordion title="Does the Supplier ensure lawfulness of cross-border data transfers and do they have a list of locations in which the services may be provided from? May the customer limit the vendor's right to change or disregard such a list?">
    We are storing all the customer data on AWS Virtual platform cloud and we operate or provide services from Bangalore, India.
  </Accordion>

  <Accordion title="Does the contract include any clause specifying that Supplier must inform the customer of any intended changes in regards to changes in sub-processors? the customer shall retain at all times the possibility to object to such changes or to terminate the contract.">
    We inform the customer of any changes in regards to changes in sub-processors.
  </Accordion>

  <Accordion title="Any specific restrictions in the right to use? Acceptable use policy is one example that should be considered versus the customer's needs.">
    Xoxoday Terms & conditions - [https://www.xoxoday.com/terms-of-use](https://www.xoxoday.com/terms-of-use)
  </Accordion>

  <Accordion title="Does the cloud provider have right to suspend services for specific reasons? As an example, in a situation with non-payment? If yes, is there a notice period or other important conditions to be observed?">
    Yes, the cloud provider does have a right to suspend services for specific reasons; more detailed in Section 3.3 of the Master Services Agreement. Section 3.3(a) read along with Section 2 of the MSA
  </Accordion>

  <Accordion title="Which law is the contract subject to? What are the legal venue for disputes arising under the contract? What are the regulations around dispute resolution?">
    The Contract is subject to the laws of India. For disputes arising under this contract, courts of Delhi has an exclusive jurisdiction. Arbitration & Conciliation Act, 1996
  </Accordion>

  <Accordion title="Do you perform a regular information security risk assessment?">
    We conduct the periodical Risk assessment. and it has been audited during the internal and external audits.
  </Accordion>

  <Accordion title="Do you provide customers with ongoing visibility and reporting of your SLA performance?">
    We also provide SLA performance report to the customer on need basis.
  </Accordion>

  <Accordion title="Do you have the capability to respond to security alerts, and report security vulnerabilities and information security incidents within 24 hours of discovering them">
    we have the capability to respond to security alerts, and report security vulnerabilities and information security incidents within 24 hours of discovering them
  </Accordion>

  <Accordion title="Are there policies and procedures in place to triage and remedy reported bugs and security vulnerabilities for product and service offerings?">
    [We also have Bug Bounty program - https://www.xoxoday.com/bug-bounty](https://www.xoxoday.com/bug-bounty)
  </Accordion>

  <Accordion title="Do you specifically train your employees regarding their specific role and the information security controls they must fulfil?">
    We train our employees on their role and responsibilities and also comminicate before joining the organizatin
  </Accordion>

  <Accordion title="Name and description of the software/service.">
    application is an all-in-one employee engagement and motivation platform that offers Rewards & Recognition, Pulse Surveys, 1-on-1 Feedback, Social Intranet and People Analytics in one powerful solution.
  </Accordion>

  <Accordion title="Is there a respondent information security function responsible for security initiatives?">
    Information security department is responsible for security initiatives and the Head of the Information security reports to the Board of Director of the company.
  </Accordion>

  <Accordion title="Can the respondent do Creation, review and approve of information security policies?">
    The policies and procedures have been created, reviewed and approved by the Top level management of the company.
  </Accordion>

  <Accordion title="Is there an information security policy that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy? Kindly share the artefact">
    The information security policies have been uploaded on KEKA HRMS Application and communicated to all the employees. Attached the screenshot for your reference.
  </Accordion>

  <Accordion title="Is there a risk management framework pertaining to the information security and privacy program management? Kindly share the artefacts?">
    Attached the Risk Management Procedure.
  </Accordion>

  <Accordion title="Kindly share the recent internal audit report for information security and privacy program management">
    Attached the internal audit report.
  </Accordion>

  <Accordion title="What are your data leak prevention capabilities?">
    Your data is of the utmost importance. All the security mechanisms and policies are established and implemented in such ways that data leak can be prevented, in transit as well as at rest.
  </Accordion>

  <Accordion title="Do you have a policy that requires endpoints (laptops,desktops,etc) to have anti-malware software? What capabilities does the anti-malware solution has? (Signature based detections, NGAV, EDR, etc.)">
    We have installed Bitdefender endpoint security in all the endpoints. Bitdefender is based on a layered next-gen endpoint protection platform with the industry's best prevention, detection and blocking capabilities, using proven machine learning techniques, behavioural analysis and continuous monitoring of running processes.
  </Accordion>

  <Accordion title="Does your IT provide remote wipe or corporate data wipe for all endpoints (laptops,desktops,etc) and company-accepted BYOD devices?">
    We have the capability to wipe out the data remotely for all endpoints including BYOD devices.
  </Accordion>

  <Accordion title="Is the solution provided to Customer part of a valid ISO 27001 certification? If so, please provide a valid ISO/IEC 27001 certificate with corresponding SOA - Statement of Applicability">
    Attached the ISO 27001:2013 certificate and Statement of applicability.
  </Accordion>

  <Accordion title="Do you allow tenants to view your SOC2/ISO 27001 or similar third-party audit or certification reports? (2)">
    We provide tpliance certifications upon request.
  </Accordion>

  <Accordion title="Does the Company use Software Development Life Cycle (SDLC) process to ensure quality and correctness of the solution built?">
    We use the Software Development Life Cycle (SDLC) process. It is aligned with ISO 27001;2013 and SOC 2 frameworks.
  </Accordion>

  <Accordion title="Are security related requirements specially marked during development?">
    During the development and testing security related requirements are specially considered.
  </Accordion>

  <Accordion title="What is the strategy around application Secure Code Scanning & management?">
    We have SDLC Policy as per ISMS requirements and we follow General Coding Practice. For example - We Conduct data validation on a trusted system, All cryptographic functions used to protect secrets from the application user.
  </Accordion>

  <Accordion title="Is there a status page available for communication about the application's untime status, or any ongoing and past incidents?">
    We can also provide uptime status on a need basis.
  </Accordion>

  <Accordion title="Are the retained logs sufficient to permit forensic analysis on security events?">
    We have proper forensic procedures for data collection and analysis for incident responses
  </Accordion>

  <Accordion title="Does the provider's logging and monitoring framework allow isolation of an incident to specific tenants?">
    Yes, in case specific incidents arise for particular tenants, our logging and monitoring framework allows isolation of incidents.
  </Accordion>

  <Accordion title="What is your SLA - uptime and availability?">
    Xoxoday endeavours to provide 99.9% Uptime each month 24 hours a day 7 days a week. Uptime is measured based on the monthly average of availability.
  </Accordion>

  <Accordion title="What is the penalty offered to the customers for SLA violations?">
    We do not offer any penalty.
  </Accordion>

  <Accordion title="What level of support is provided to the clients? Mention the time slots where support is available">
    Attached the SLA
  </Accordion>

  <Accordion title="ISO certification for the APP and Security related documentation required to proceed with security reviews internally 1. Application Pentest results 2. Architecture Documentation to show the dataflow and data security in the hosting location 3. Hosting Vendor ceritification similaret to Microsoft MCST 4. SLA and Support Documentation">
    Attached the below documents - 1. ISO 27001:2013 certificate 2. VA/PT Certificate 3. VA/PT Executive report 4. application Architecture Diagram 5. We have deployed our aplication on AWS Virtual platform Cloud and attached AWS Compliance certificates - ISO 27001, ISO 27017 & ISO 27018. 5. application SLA
  </Accordion>

  <Accordion title="Please provide support covered under standard annual license and annual maintenance where applicable">
    Customer Support is available on all working days (Mon - Fri) between 3.30 AM GMT to 1:30 PM GMT.
  </Accordion>

  <Accordion title="Details of certifications Which includes for each certification: Certification Body First Certification Date Current Certification date">
    Xoxoday is – ISO 27001:2013 certified CPRA (California Privacy Rights Act) EU GDPR Compliant CSA STAR LEVEL 1 Compliant – Click here Vulnerability Assessment and Penetration Testing (VAPT) Attached these above certificates and Reports.
  </Accordion>

  <Accordion title="The vendor should detail how frequently backups of customer data are made, how long they are retained, and how soon customer data is purged following deletion by an end user">
    The backups are automated and taken on a daily basis. We delete the data upon receiving the request from the customer/end users/termination of the contract. Our data cleaning process goes through an organized purge. Once the data is purged, it's purged from all places.
  </Accordion>

  <Accordion title="Define Service monitoring.">
    We have an ELK setup in place to ensure data monitoring in the most optimal manner. The audit logs are reviewed and recorded on a regular basis automatically. These logs are integrated with security operations/SIEM solutions.
  </Accordion>

  <Accordion title="Does the role of Quality unit during product development and/or during service provision define?">
    As per the SDLC Policy we follow several distinct stages, including planning, design, building, testing, code review, deployment and maintenance etc. Our code reviews and analysis run through stringent eyes of automated technologies as well as manual source code overview to cover any security loopholes prior to the production phase.
  </Accordion>

  <Accordion title="When our company needs to access the logs of Vendor and our company or that of our company's users for case investigation, how long does it take Vendor to provide complete logs to our company? (1-24 hours is appropriate)">
    It would depend on the criticality of the investigation and the type of service subscribed. Our team will be able to provide the ETA as soon as they receive the request from you and start acting immediately.
  </Accordion>

  <Accordion title="In the admin console, is there an interactive interface to look up our company's user's detailed information?">
    Yes. You can check this information from the user management option available for Admin console.
  </Accordion>

  <Accordion title="What kind of permission request process do Vendor's O&M personnel, including DBAs, would go through if they want to refer to our company's data stored in the Vendor backend system?">
    You can reach out to us with the help of the help center or can write an email to customer support team
  </Accordion>

  <Accordion title="When the Vendor's operation and maintenance personnel, including the DBA, try to refer to our company's data stored in the Vendor backend system, is there an audit log record of the entire operation process?">
    Yes. We maintain and record the Audit logs and complying with various compliance requirements.
  </Accordion>

  <Accordion title="When the logs which described above are needed, whether or not can it be completely provided to our company when there is a need for case investigation?">
    Yes. You may reach out to our support team anytime for requesting these records and they would be able to help you out on this requirement.
  </Accordion>

  <Accordion title="When the logs which described above are needed, how long does it take Vendor to provide them to our company? (1-24 hours is appropriate)">
    It would depend on the criticality of the investigation and the type of service subscribed. Our team will be able to provide the ETA as soon as they receive the request from you and start acting immediately.
  </Accordion>

  <Accordion title="Is your system and related data is set to back up automatically on a regular basis?">
    Yes. We deployed our application on AWS and AWS provides the data backup service as well.
  </Accordion>

  <Accordion title="Are there any other compliance qualifications? If so, please list out in detail">
    Yes. We are ISO 27001:2013 certified and GDPR Compliant.
  </Accordion>

  <Accordion title="Summary of key risks based on risk assessment reports">
    We have implemented the risk assessment procedure and conduct the risk assessment annually as per the compliance requirements.Risk assessment is used to identify the risks encountered by the information-processing facilities (or individual system components). The aim is to estimate the impact and probability of a threat occurrence. The risk assessment procedure is having Risk, Likelihood and Impact. The risk ranking is done based on the Residual Risk Rating such as High, medium and low. Attached the Risk Management Procedure for your reference.
  </Accordion>

  <Accordion title="A risk management process shall be used to balance the benefits of cloud computing with the security risks associated before engaging with a Cloud Service provider.">
    Risk Management Procedure has been used to validate the security compliance of AWS. AWS Compliance certifications and attestations are assessed by a third-party independent auditor and result in a certification, audit report, or attestation of compliance. AWS is ISO 27001, SOC 2 Type II certified and complied with CSA start level 2. Please click here for more details about AWS Compliance Programs - [https://aws.amazon.com/compliance/programs/](https://aws.amazon.com/compliance/programs/)
  </Accordion>

  <Accordion title="The risk assessment framework adopted by NSE may be used for the cloud service risk assessment.">
    Yes. We can use the risk assessment framework adopted by NSE for cloud service risk assessment.. Please provide the same.
  </Accordion>

  <Accordion title="The outcome of the risk management process shall determine the model and controls that shall be adopted.">
    We comply with this requirement. The risk assessment procedure has defined the Risk Acceptance Criteria, Benefits, Components, Impact Rating, Risk Treatment, Risk Acceptance etc and all the controls identified in our risk assessment as per the industrial standard like ISO, SOC2, NIST, GDPR etc.
  </Accordion>

  <Accordion title="The Cloud Service Provider shall ensure that it will demonstrate compliance with NSE policy requirements and regulatory requirements.">
    Sure. We are ISO 27001;2013 and GDPR compliant. We have policies and procedures in place with all the required compliance controls.
  </Accordion>

  <Accordion title="The Cloud Service Provider shall conduct annual audit by an independent third-party auditor to check the design effectiveness as well as their operating effectiveness of their internal controls covering the principles of Security, Availability, Confidentiality, and Privacy.">
    We comply with this requirement. We conduct annual audit by the independent auditors to test the controls in place with regards to Information Security management system(ISMS) and also for testing the service organization controls(SOC)covering the principles of Security, Availability, Confidentiality, and Privacy. AWS is also SOC 2 certified.
  </Accordion>

  <Accordion title="NSE shall be provided access to these reports as and when required.">
    Sure. Attached the ISO certificate and we are in the Audit process for SOC 2. we will provide the same once the audit is completed.
  </Accordion>

  <Accordion title="The Cloud Service Provider shall provide complete visibility to ensure NSE's services are being processes and delivered in a secure manner.">
    We are ISO 27001;2013 certified, GDPR compliant and in the process of SOC 2 audit. We make sure that our customer data is safe and secure and meet all the compliance requirements and industry best practices. Xoxoday has built the Information Security Management System (ISMS) which includes the respective policies to be followed in a diligent, consistent, and impartial manner.
  </Accordion>

  <Accordion title="NSE shall have all the Service Level arrangements documented in the agreement/ contract with the Cloud Service provider guided by NSE's Outsourcing Policy.">
    Our legal team would review and agree the terms and conditions.
  </Accordion>

  <Accordion title="NSE shall review the Service Level Agreements (SLA) for amendments, annually or as when required.">
    We agree. NSE can review.
  </Accordion>

  <Accordion title="Cloud Service Provider shall provide regular reports on the SLA achieved and compliance to the agreement/contract to NSE. The frequency of reporting shall be mandated in the agreement / contract.">
    Our legal team would review and agree the terms and conditions.
  </Accordion>

  <Accordion title="Any breach in the SLA by Cloud Service provider shall be reported as mandated by NSE.">
    We will inform NSE if there is any breach.
  </Accordion>

  <Accordion title="In a multi-tenant cloud architecture, the Cloud Service Provider shall ensure that NSE's data shall be isolated and inaccessible to any other tenants.">
    The data isolated between customers. We use logical data isolation with the help of company specific encryption keys.We use TLS1.2 encryption for Data in transit and AES256 for Data at rest
  </Accordion>

  <Accordion title="Any access by other tenants to NSE's data shall be considered as a breach and the Cloud Service Provider shall ensure the breach notification process is followed.">
    We agree. We have implemented the data breach notification procedure.
  </Accordion>

  <Accordion title="Cloud Service provider shall notify NSE of any potential breach incident or any actual breach as mandated by NSE.">
    We agree. We will notify NSE.
  </Accordion>

  <Accordion title="NSE shall ensure that the cloud computing services can be ported to any other Cloud Service Provider or to other data centres with least impact to business.">
    We agree.Currently, we do not have any plans as such.
  </Accordion>

  <Accordion title="The Cloud Service Provider shall ensure all the information related to NSE is handed over to NSE in a useable format.">
    All the data will be stored on AWS cloud We have the disposal policy in place and implemented mechanisms for secure disposal and removal of data.
  </Accordion>

  <Accordion title="On completion of the transfer, the Cloud Service Provider shall delete all the data and information from its infrastructure and provide a certificate to NSE that the data has been securely deleted and the same cannot be recovered by any means.">
    We agree. We will delete the data upon termination of the contract or request and confirm. Our data cleaning process goes through an organized purge. Once the data is purged, it's purged from all places.
  </Accordion>

  <Accordion title="Wherever applicable, NSE shall maintain an up to date inventory of hardware, software and virtual assets hosting NSE's applications and data.">
    We have implemented Asset Management Procedure in place and maintain all the records of IT Assets like, hardware, software, licenses, accessories etc.
  </Accordion>

  <Accordion title="The inventory shall be reviewed and updated as per the Asset Management Policy of NSE.">
    We review and update the inventory as per the Asset management policy.
  </Accordion>

  <Accordion title="Cloud Service Provider shall ensure that no database server, application server or storage devices hosting NSE's data & information be made publicly available over the internet.">
    The database server, application server or storage devices hosting NSE's data & information is not made available publicly. We isolate our machines, network and storage with respect to the AWS Standards in order to keep it safe and secure
  </Accordion>

  <Accordion title="When is live (standard service) phone technical support available? Is backup (phone or email) available for off-hours?">
    Yes, one can write to us at our 24\*7 support team at [cs@xoxoday.com](mailto:cs@xoxoday.com)
  </Accordion>

  <Accordion title="Describe the training that is available with the initial system installation.">
    We help the clinets in setting up from both admin and end user side, and traiing is also provided on how application can be used for hasslefree awards distribution
  </Accordion>

  <Accordion title="What type of training does your company recommend, require, and offer?">
    We provide trainging over internet , if possible we provide telephonic assistance also.
  </Accordion>

  <Accordion title="Do you provide on-demand training over the Internet? If so, what training is available to users? Is there an associated cost?">
    Yes we provide "on demand training" , this incur no additional cost to the company
  </Accordion>

  <Accordion title="What is your escalation process for support issues? Describe in detail.">
    We have a 24\*7 available support team, once a ticket is generated , It is assigned to one of the cs team executive and we intent to solve the issue within next 24hrs.
  </Accordion>

  <Accordion title="Who will have access to UP data? (Just Supplier employees? Contractors? Employees and contingent employees?)">
    Xoxoday employees and third party would have an access. We provide acess on case to case basis as per the Information security and access control policy. We also have role based access system to meet the compliance requirements of the data security . The data is hosted on Amazon Web Services (AWS)
  </Accordion>

  <Accordion title="Describe your employee and contractor background checks">
    We do conduct employees and contractors background verification as per the compliance requirements before onboarding process. We will onboard them only after passing the background verification. We are ISO 27001:2013 certified organization.
  </Accordion>

  <Accordion title="How do you monitor third parties that have access to UP data?">
    We conduct periodical review of the access provided and make the necessary chages as per the Role based access management and access control policy. We also conduct Internal and external audits in a timely manner.
  </Accordion>

  <Accordion title="Does the cloud service provider require the use of two-factor authentication for the administrative control of servers, routers, switches and firewalls?">
    Our Information security compliance policies and procedures are established and implemented to enforce two-factor authentication
  </Accordion>

  <Accordion title="How is user access monitored and documented?">
    We are ISO 27001:2013 certified organization The User access are monitored and recorded internally as per the compliance requirement and Access Control Procedures.
  </Accordion>

  <Accordion title="Network IDS?">
    Yes we have implemented intrusion detection tools, we ensure timely detection and investigation in a prompt manner.
  </Accordion>

  <Accordion title="Host IDS?">
    Yes. file integrity (host) and network intrusion detection (IDS) tools implemented to help facilitate timely detection, investigation.
  </Accordion>

  <Accordion title="SIEM?">
    Yes. Implemented SIEM
  </Accordion>

  <Accordion title="Are security controls audited on an annual basis?">
    Yes. All the controls are audited annually.
  </Accordion>

  <Accordion title="Can documentation be provided that can show how UP data cannot be compromised by other customers or non-customers of the Supplier?">
    Yes, We will share the Data protection policy. Access control policy and Information security policies
  </Accordion>

  <Accordion title="What is the size and relevant experience (in years) of the security and incident response teams?">
    Size of the team is 5 and all are having 5+ years of experience
  </Accordion>

  <Accordion title="What data is required to be shared and stored by the Supplier?">
    personal data is stored are registered databases that comply to all necessary inputs of a standard inventory repository and its transit scrambled for maximum security.
  </Accordion>

  <Accordion title="How is the data stored?">
    We use AWS Platform for storing the data. Our data is stored in secured databases and there is no window to alter any data without it being logged into the system records. Our data is stored in secured databases and there is no window to alter any data without it being logged into the system records.
  </Accordion>

  <Accordion title="How are users authorized to access data through provided service?">
    As per the Information security policy and Data protection policy only the authorised individual have an access to the data through internal approving and ticketing system.
  </Accordion>

  <Accordion title="Is planned/scheduled maintenance included in the calculated uptime? Will it count against the SLA?">
    No. Planned downtime will not be calculated uptime
  </Accordion>

  <Accordion title="Does planned/scheduled maintenance count against the SLA?">
    No. Planned downtime will not count against the SLA
  </Accordion>

  <Accordion title="What is your resiliency, reliability, back-up and disaster recovery strategy?">
    We have Business Continuity Policy and Business Continuity Management Procedure in place and effectivly working.
  </Accordion>

  <Accordion title="How often are these processes tested?">
    We test it annually once as per the compliance requirements.
  </Accordion>

  <Accordion title="Describe your established maintenance window.">
    Xoxoday's architecture goes through constant upliftment and experiences no downtime during upgrades and maintenance windows.
  </Accordion>

  <Accordion title="Describe in detail your service or mitigation plans to continue to make the service available to customers during a denial of service attack.">
    We have Business Continuity Policy and Business Continuity Management Procedure in place and tested periodically. And also our Policies has been reviwed and Audited annually.
  </Accordion>

  <Accordion title="Does the architecture of the provided service include redundancy of security systems, including firewalls, IDS/IPS, any other critical security service?">
    Yes. We have implemented IDS/IPS, Firewall and our security information and event management (SIEM) system merge data sources (app logs, firewall logs, IDS logs, physical access logs, etc.) for granular analysis and alerting
  </Accordion>

  <Accordion title="Does Supplier have established procedures for cooperating with local government and law enforcement requesting customer data?">
    Yes. We have procedures in place to support Government
  </Accordion>

  <Accordion title="Describe your established procedures for cooperating with local government and law enforcement requesting customer data.">
    We have the clauses for suppporting local government and law enforcement requesting customer data in data protection policy. We will share the copy of it.
  </Accordion>

  <Accordion title="Which cloud providers do you rely on?">
    We have deployed our application on Amaon web services (AWS) AWS is designed to help us build secure, high-performing, resilient, and efficient infrastructure for our applications. AWS is also ISO 27001:2013 and SOC 2 type II Certified and provide all applicable security to the data center.
  </Accordion>

  <Accordion title="Does the penetration test follow an industry approved methodology, please describe">
    Yes. We have industry approved vendor called Appknox for Vulnerability assessment anf Penetration Testing. Appknox performs Static, Dynamic, API, and as well as Behavioral Analysis. And they helps to detect and address security vulnerabilities.
  </Accordion>

  <Accordion title="Please describe the company/user data you require to provide your service: personal information, financial data, confidential/sensitive data, government data">
    We collect only personal information through our application. We collect name, email ID and mobile numbers.
  </Accordion>

  <Accordion title="Do you have capabilities to anonymize data?">
    Yes. We have capabilities to anonymize data. By Anonymization users are able to make use of sensitive information without having access to the identifiable data items. And its used within a secure environment with employee access on a need to know basis.
  </Accordion>

  <Accordion title="Do you keep sensitive data (as defined by your data classification matrix) in hard copy (e.g. paper copies)? If so, please describe.">
    No. we do not have it in hard copy
  </Accordion>

  <Accordion title="How do you regularly audit your critical vendors?">
    Yes. We conduct vendor Risk assessment and also external Auditor validate the critical vendor documentations during the annual and Internal Audit.
  </Accordion>

  <Accordion title="Do you have a formal Information Security Program (InfoSec SP) in place?">
    Yes. We have Information Security Program
  </Accordion>

  <Accordion title="Do you review your Information Security Policies at least once a year?">
    Yes. We review Information Security Policies every year.
  </Accordion>

  <Accordion title="Do you have a Information security risk management program (InfoSec RMP)?">
    Yes. We have Information security risk management program
  </Accordion>

  <Accordion title="Do you have management support or a security management forum to evaluate and take action on security risks?">
    Yes. Our management is supportive and evaluate, Recommend and take action on security risks
  </Accordion>

  <Accordion title="Do you have a dedicated information security team? If so, what is the composition and reporting structure?">
    Yes, we have Information security team and the Infosec head is reporting to Chief Operating Officer of Xoxoday.
  </Accordion>

  <Accordion title="Do you publish a path for responisble disclosure of security vulnerabilities (ie security@ or /security)?">
    Yes
  </Accordion>

  <Accordion title="Do you have an established bug bounty program?">
    Yes. Please visit here for more details - [https://www.xoxoday.com/bug-bounty](https://www.xoxoday.com/bug-bounty)
  </Accordion>

  <Accordion title="Are all endpoint laptops that connect directly to production networks centrally managed?">
    Yes. All the endpoint laptops that connect directly to production networks centrally managed
  </Accordion>

  <Accordion title="Describe standard employee issued device security configuration/features. (Login Password, antimalware, Full Disk Encryption, Administrative Privileges, Firewall, Auto-lock, etc.)">
    All the employees laptop is secured with Bitdefender end point security software. We use a cloud hosted VPN with strict access controls to allow our employees to access the official network. This VPN is managed by our IT team and is linked with the SSO/Active Directory.
  </Accordion>

  <Accordion title="Does sensitive or private data ever reside on endpoint devices? How is this policy enforced?">
    No. sensitive or private data never reside on endpoint devices. This is enforced throgh access control policy.
  </Accordion>

  <Accordion title="How do you keep aware of potential security vulnerabilities and threats that may affect your service?">
    We use Bitdefender End point security software to prevent from malware and protect the data. In addition to that we also have AWS Guard Duty threat detection service that continuously monitors for malicious activity and unauthorized behaviour.
  </Accordion>

  <Accordion title="How is your Incident Response Plan tested? Include how often.">
    Yes. Our incient response plan is tested every year as per the ISMS requirements.
  </Accordion>

  <Accordion title="Describe how threat modelling is incorporated in the design phase of development?">
    We follow SDLC policy during the design phase of devolopment. See SDLC procedure attached
  </Accordion>

  <Accordion title="How do you train developers in SSDLC / Secure Coding Practices?">
    We have SDLC procedure and Information System Acquisition Development and Maintenance Procedure. Devolopers are trained on the Secure Coding Practices as soon as they joined our organization
  </Accordion>

  <Accordion title="How do you monitor vulnerabilities in dependencies?">
    We conduct vendor risk assessment and collect all the required security policies, procedures, VAPT reports, ISO 27001, SOC 2 reports. And also our internal and exteranal auditors validate the security controls of our crtical vendors during the Audit.
  </Accordion>

  <Accordion title="Do you outsource development? (contracted with a 3rd party? open source project inclusion?)">
    NO
  </Accordion>

  <Accordion title="What types of security reviews do you perform on custom-built software?">
    NA. We do not have custom-built software
  </Accordion>

  <Accordion title="Does application support IP whitelisting for API access?">
    Yes
  </Accordion>

  <Accordion title="How do you conduct internal audits (audits lead by your personnel) of the service? please describe the scope, remediation process and frequency of audits.">
    Internal Audit has been conducted by the inhouse Infosec and ISMS Lead Auditor. All the projects, business processes and ISMS controls has been included in the scope and opportunity of improvements has been communicated to all the respective teams with the remideiation plan. And the frequency of the Internal audit is annually.
  </Accordion>

  <Accordion title="How do you conduct external (third-party) audits of the service? please describe the scope and frequency of audits.">
    We have the external Auditor for ISMS Audit. All the projects, business processes and ISMS controls has been included in the scope and opportunity of improvements has been communicated to all the respective teams with the remideiation plan. And the frequency of the external audit is annually.
  </Accordion>

  <Accordion title="Please provide a copy of the most recent report.">
    See ISOIEC 270012013 Certificate and Internal Audit report attached.
  </Accordion>

  <Accordion title="Do you seek a right to use or own customer derived data for your own purposes?">
    NA. We do not use for own purposes
  </Accordion>

  <Accordion title="Do your information security and privacy policies align with industry standards (ISO-27001, NIST Cyber Security Framework, ISO-22307, CoBIT, etc.)?">
    Yes
  </Accordion>

  <Accordion title="Are all personnel required to sign Confidentiality Agreements to protect customer information, as a condition of employment?">
    Yes. All the employees and third party service providers are required to sign Confidentiality Agreements to protect customer information as per ISMS compliance requirements.
  </Accordion>

  <Accordion title="Hardware security">
    We have dedicated IT Team and Admin team who looks after the hardware security and, we have implemented the security controls as per the ISO 27001:2013 and SOC 2 Compliance requirements. We are hosting our application on AWS, and they are providing physical security to our data centre. We have Asset Management Procedure in place to identify, classify, label, and handle the Information and Information assets according to their criticality and sensitivity. We have Media protection procedure to handle the locally stored data as per the Information security compliance requirements.
  </Accordion>

  <Accordion title="Paper Document Security">
    As per the Physical and Environmental Security policy we have security guards and CCTV Camera's to safeguard the office building and also to provide an access to the building only for the authorized individuals. We also have Media protection policy which also defines on how to handle the Paper documents as per the compliance requirements. Physical documents are handled with at most care and followed the policies and procedures of an organisation to make sure that the data is protected.
  </Accordion>

  <Accordion title="Physical access control">
    We have Physical and Environmental Security policy and Vendor management guidelines in place and working effectively. We have implemented controls on Physical entry, Securing offices, rooms, facilities, Working in secure areas, Delivery and Loading areas etc. Only the authorised individuals will get an access upon verification. And we also conduct periodical verification of the effectiveness of these controls periodically through internal and external Audit. We provide access to the outsiders or suppliers on approval and escorting mechanism of vendor management guidelines by issuing the access cards.
  </Accordion>

  <Accordion title="Maintenance - Describe here how physical maintenance of hardware is managed">
    All our assets are classified, labelled, and maintained in the register by our IT Team. Access granted only to, authorized individuals. We have locked environment for our hardware's which would store the data. We also have implemented the Media protection procedure to protect the data which are stored physically.
  </Accordion>

  <Accordion title="Backups - Indicate here how backups are managed. Clarify whether they are stored in safe place">
    Yes. Backups are stored in a safe place. We have backup Recovery Procedure and implemented the controls to protect the organization information asset from the damages that may be caused due to failure of hardware system, corruption of software, breaches leading to data destruction and or not being able to retrieve and use. We predominantly work on cloud-based infrastructure and the teams may consider adoption of Amazon Web Services which provides the Backup and Restore services to build scalable, durable and secure data-protection solutions. AWS claims the following benefits and the teams may evaluate the benefits to the respective context that may lead to realize the following outcomes: 1. Data Type and Durability 2. Flexibility and Scalability 3. Security and Compliance The following AWS based offering for the following use cases offered by AWS may be considered based on the contractual needs of the subject under consideration: 1. Hybrid Cloud Backup 2. Data Lifecycle Management 3. Tape Replacement 4. Global Data Resiliency 5. Data Backup 6. Archive & Compliance
  </Accordion>

  <Accordion title="Governance - Describe the documentary base setting out data protection objectives and rules">
    We are ISO 27001:2013 certified and GDPR compliant organization. We have Information security policy and Data security policies in place with regards to data protection. We make sure that the below principle of data security has been followed as per the compliance requirements. 1. Fairness and lawfulness When personal data processed by us, we make sure that the individual rights of the data subjects must be protected. We will ensure that the personal data is collected and processed in a legal and fair manner. 2. Confidentiality - Restriction to a specific purpose We make sure that the any processing of personal data should be lawful, fair, and transparent. Personal data will be processed only for the purpose that was defined before the data was collected. Subsequent changes to the purpose are only possible to a limited extent and require substantiation. 3. Transparency We make sure that we maintain the transparency with regards to the data collected, stored and disposed. We also provide rights to data subjects as per the GDPR compliance requirements. For ex - Right to Rectification, Right to Portability and Right to be Forgotten. 4. Integrity and data security Personal data is subjected to the data secrecy. We have controls on confidentiality, Integrity and data security. We follow secured suitable organizational and technical measures to make sure that the data is protected from an unauthorized access, illegal processing or distribution, as well as accidental loss, modification or destruction etc. Sensitive data - We do Inform involved parties about how we will process their data Inform involved parties about who has access to their information Have provisions in cases of lost, corrupted, or compromised data Allow involved parties to request that we modify, erase, reduce or correct data contained in our databases. Sensitive data - We do not Communicated informally. Stored for more than a specified amount of time. Distribute to any party other than the ones agreed upon by the data's owner (exempting legitimate requests from law enforcement authorities. In addition to ways of handling the data the company has direct obligations towards people to whom the data belongs.
  </Accordion>

  <Accordion title="Managing Privacy Risk - Describe processes to control the risks that processing operations performed by the organisation">
    We have controls in place to protect the information or to maintain privacy. We conduct Data Privacy impact assessment and Audits periodically as per the compliance requirements. We have Personally Identifiable Information Policy, Data Security policy, Data Subject Access Rights Procedure, Data Retention and Disposal Policy as per GDPR compliance.
  </Accordion>

  <Accordion title="If the customer data will be held by a subcontractor to your organisation, how will you ensure that their Information Security meets required standards?">
    We conduct periodic vendor risk assessment. Information security documents are validated by theiInternal and external auditors during the assessments.
  </Accordion>

  <Accordion title="Will an asset register be completed to log all assets holding the customer data and who is responsible for updating it?">
    Yes.
  </Accordion>

  <Accordion title="How will you decide which of your staff (support, development etc.) need access to the the customer system and data? How will you manage that access and what controls are in place, to ensure that privileged access rights will be restricted and controlled?">
    We have an access control policy. The policy is attached for reference. Only authorised employees will have access to the data.
  </Accordion>

  <Accordion title="Is your organisation ISO/IEC 27001 or similarly certified or compliant? Please provide details. If yes please provide evidence and skip section 5.">
    Yes. Xoxoday is ISO/IEC 27001:2013 certified organization. See certificate attached.
  </Accordion>

  <Accordion title="Have all information security responsibilities within your organisation been defined and allocated including: maintaining appropriate contacts with relevant authorities and groups ensuring information security is addressed in project management ensuring that conflicting duties and areas of responsibility are segregated">
    Yes. We have a well-defined policy for roles and responsibilities. We have communicated each employee about their responsibilities across the organization. We do maintain appropriate contracts with relevant authorities and ensure that applicable regulations are complied with
  </Accordion>

  <Accordion title="When a person working with the customer data no longer performs that role, are their permissions to the customer data revoked?">
    Yes. We provide these rights to the data subject as per GDPR
  </Accordion>

  <Accordion title="Is your organisation's Information Security Management System (i.e. control objectives, controls, policies, processes and procedures for information security) reviewed, internally and independently audited for compliance at planned intervals or when significant changes to the security implementation occurs?">
    Yes. We conduct internal and external audits and all the applicable controls have been validated as per the compliance requirements.
  </Accordion>

  <Accordion title="Have all relevant statutory, regulatory, contractual requirements, (including: intellectual property rights, protection of records, protection of personally identifiable information and cryptographic controls) and the organisation's approach to meet these requirements, been explicitly identified, documented and kept up to date, for the/each the customer information system?">
    Yes
  </Accordion>

  <Accordion title="Describe how and when media containing the customer data would be securely destroyed and how you would evidence this?">
    We have a media handling procedure. See attached for reference.
  </Accordion>

  <Accordion title="Will any physical media containing the customer data, be transferred outside your organisation and if so, what procedures will be in place to protect the media from compromise?">
    No. We do not transfer the data outside our organization.
  </Accordion>

  <Accordion title="Is there a documented standard procedure followed for building and hardening host machines? If so please attach a copy.">
    Yes. See Infrastructure Change Control Procedure attached.
  </Accordion>

  <Accordion title="Are these procedures periodically reviewed and kept in line with current best practice?">
    Yes.
  </Accordion>

  <Accordion title="How will security incidents relating to the customer data be reported to the customer?">
    Security inceidents will be reported by our Information security team or customer support team within 48 hours.
  </Accordion>

  <Accordion title="What physical measures (e.g. CCTV, Coded Locks, Guards) will be in place to protect the customer data that is stored: At your offices/location At the data centre How will these controls be managed and monitored?">
    We have implemented physical security controls as per the compliance requirements. We have CCTV, access cards, security guards for monitoring and only authorised individual have access.
  </Accordion>

  <Accordion title="Emergency, temporary or test accounts should be documented, have a specified period of validity and terminated immediately after validity period expires.">
    Segregation is done for production and non-production or Testing environments. We maintain the test accounts seperately and delete or terminate the accounts immediately once the testing is completed. Only Admins have an access to create these tests accounts on need and approval basis.
  </Accordion>

  <Accordion title="Responsibilities and duties for system users shall be segregated based on the defined roles.">
    We have implemented the Roles and Resposibilities policy and defined the Duties of all the system users and segragated based on the defined roles. Only authorised individual will have an access to the Information system on need and approval basis.
  </Accordion>

  <Accordion title="There should be a minimum three types of user groups for systems and applications (e.g. operator, supervisor, engineer, domain administrator, etc.) where technically feasible.">
    We maintain these records for Audit purposes.
  </Accordion>

  <Accordion title="Role based user accounts shall be implemented for operation users (operators, supervisors, shift controller, engineer, etc.) with specific and defined privileges based on the principle of least privilege for each role.">
    We have controls in place to monitor the user access system. We have implemented Role based access management system through access control policy. Our application also supports Role based access control system to make sure that only authorised individual will have an access to the Information system on need and approval basis.
  </Accordion>

  <Accordion title="Privileges for all accounts used with the customer assets shall be identified and documented.">
    We maintain these records for Audit purposes.
  </Accordion>

  <Accordion title="All the customer system accounts shall be secured utilising the following mechanisms: - Default credentials shall be removed, disabled and/or changed (e.g. guest, administrator, factory configured user, etc.). - Authorised service accounts shall have mitigating controls in place. (e.g. no interactive login, etc.) and be configured to never expire nor auto-disable. - Interactive logon for service accounts shall be disabled and wherever feasible, managed service accounts shall be used). - Both successful and failed login attempts shall be logged. - Multi-factor authentication shall be used wherever possible for all privileged access. - Ensure that privileged accounts are used only for system administration activities. - Enable account lockout for invalid login attempts wherever feasible; when this feature cannot be enabled, ensure alternate compensating controls are in place. - Ensure password history shall not allow reuse of last ten (10) passwords.">
    We are Compliant. We monitor these controls on a periodical basis and also during the internal and external Audits. Successful and failed login attempts will be logged, we use privileged accounts are used only for system administration activities,we remove default credentials and use the new credentials for all our systems.
  </Accordion>

  <Accordion title="Where strong authentication and identity verification is required, authentication methods alternative, or additional, to passwords, such as cryptographic means, smart cards, tokens or biometric means, shall be used.">
    We use Multifactor authentication menthods to make sure that only authenticated individual have an access to the Information system wherever strong authentication is required. We use Biomentric verification and access cards methods for physical security purposes.
  </Accordion>

  <Accordion title="When an asset cannot support the use of automated mechanisms to enforce access restrictions, alternate security controls shall be used. The justification and details for those controls should be documented to support subsequent audits, including: Restricting physical access. Monitoring and recording physical access. Ensuring authorised individuals are trustworthy and reliable. Conducting post-maintenance audits to validate that changes are implemented correctly.">
    We have these controls in place. We have a restriction for Physical access, monitor these access periodically and validate to make sure that only the authorised individual have an access.
  </Accordion>

  <Accordion title="Temporary account user name and passwords shall be communicated in a secure manner following these practices: When users are required to change the passwords, they should initially be provided with secure temporary authentication information, which they are immediately forced to change. Verify the identity of a user prior to providing a new, replacement or temporary password. Temporary authentication information shall be unique to a user. Users shall acknowledge the receipt of temporary passwords.">
    The credentilas has been comminocated via secured mode to make sure that confidentiality is maintained.
  </Accordion>

  <Accordion title="All access to the customer networks and services, local or remote, shall be specifically authorised through processes prior to allowing such connections. Processes shall ensure that all entity networks and services information security requirements are met before approvals.">
    We are Compliant.These controls are audited during the internal and external Audits.
  </Accordion>

  <Accordion title="All users and access to the customer networks and services shall be documented.">
    We are Compliant.Only authorised individual will have an access.
  </Accordion>

  <Accordion title="Where technically feasible, ensure all authentication attempts (successful and unsuccessful) are logged up to the capabilities of the authentication system.">
    We are cothe customerant. We maintain the records of Audit logs.
  </Accordion>

  <Accordion title="Only protocol ports and services required for proper functioning of the system or application shall be allowed on each system.">
    We have restricted the access of external harddrives, USB etc for all the systems through Active directory and End point security.
  </Accordion>

  <Accordion title="All network filtering mechanisms (e.g. firewalls) shall apply an opt-in principle with a fail-safe mechanism (i.e. default deny rule that drops all traffic, except that which is explicitly allowed and if an error/failure occurs the system should fail in a secure manner: security controls and settings remain in effect and are enforced).">
    We have the security controls in place. We have installed the firewalls to monitor and control the incoming and outgoing network traffic based on predetermined security rules. It helps us to establishes a barrier between a trusted network and an untrusted network.
  </Accordion>

  <Accordion title="All equipment connected to the customer networks shall be identified and classified based on the defined classification scheme. All equipment connected to the customer networks should have appropriate technical and/or business justifications supporting the need for that connection.">
    We have implemented the asset management procedure to identify, classify, label and handle the Information and Information assets according to their criticality and sensitivity.
  </Accordion>

  <Accordion title="Unique identifiers shall be developed in, or attached to, the equipment to indicate whether the asset is permitted to connect to the network.">
    We have labeled the aseets in order to identify and make sure that the access control permissions are maintained.
  </Accordion>

  <Accordion title="Where technically feasible, implement network-based technical controls that detect and prevent connections and/or attempts to connect equipment to the customer networks.">
    we have implemented intrusion detection and prevention tools, we ensure timely detection and investigation in a prompt manner.
  </Accordion>

  <Accordion title="Detection capabilities should be augmented with event correlation (e.g. SIEM) used to correlate approved and expected connections of equipment to the customer networks.">
    These are integrated with security operations/SIEM solutions.
  </Accordion>

  <Accordion title="All routing equipment shall be specifically authorised through processes prior to allowing equipment or routing connections. Processes shall ensure that approvals are based on clearly defined technical and business justifications for those communications.">
    We take an approval from the concerned authority before procuring the equipment or routing connections and test the same before installing it.
  </Accordion>

  <Accordion title="Network devices shall be securely configured taking following measures into consideration: Source and address violation rules. Router protection (e.g. hardening). Specific sub-netting for publicly accessible systems. Boundary protection device for external connections. Monitoring for suspicious traffic.">
    All the network devices are securely configured and we always make sure that we monitor the same on regular basis and take appropriate action on any detections.
  </Accordion>

  <Accordion title="Wherever feasible, vendor-supplied software packages shall be used without any changes.">
    We use vendor supplied softwares without any changes wherever feasible, if all the security controls are in place.
  </Accordion>

  <Accordion title="When changes to software packages are required, the following shall be considered: Responsibility for future maintenance of the software. Compatibility with existing application software. Risks of existing application controls being altered or compromised.">
    We consider these factors before making these changes to the softwares.
  </Accordion>

  <Accordion title="Where technically feasible, any changes to software shall be tested in a non-production/test environment before moving it to a production environment.">
    Yes, we test the changes made on testing environment before moving it to a production environment.
  </Accordion>

  <Accordion title="Based on the information asset's classification, controls shall be applied to restrict access to information and applications.">
    Only authorised individual have an acces to the approved information assets.
  </Accordion>

  <Accordion title="Service account passwords or application hard-coded passwords that cannot be changed shall be documented and additional compensating controls shall be identified to protect and monitor such systems.">
    we are compliant. We document or have a track of all the changes made to protect the information system.
  </Accordion>

  <Accordion title="Security requirements shall consider: The level of confidence required towards the claimed identity of users, to derive user authentication requirements. Access provisioning and authorisation processes, for business users as well as for privileged or technical users. Users and operator's duties and responsibilities. Requirements derived from business processes, such as transaction logging and monitoring, nonrepudiation requirements. Requirements mandated by other security controls, e.g. interfaces to logging and monitoring or data leakage detection system.">
    We are compliant and have these controls in place.
  </Accordion>

  <Accordion title="Contracts with vendors shall include the requirements for secure design, coding, testing practices and a warranty clause that the software/system is free from security vulnerabilities.">
    We have the appropriate clauses in the agreements wherever necessary.
  </Accordion>

  <Accordion title="Document/guide for secure use or operation of the supplied system or component shall be provided">
    We provide guidance for using our products appropriately and take all the possible benefits.
  </Accordion>

  <Accordion title="Patch management policy and process is in place to cover patch qualification, patch distribution, update and auditing process">
    We have the controls in place. All the Critical patches will be deployed immediately
  </Accordion>

  <Accordion title="Third parties shall address security vulnerabilities brought to its attention by the customer in a timely manner.">
    We inform our customers on the vulnerabilities wherever is required from the compliance perspective.
  </Accordion>

  <Accordion title="For any hardware, software or firmware, supplied, a quality certificate (QC) ensuring that all provided hardware, software or firmware is free from any dormant malicious programmes should be provided.">
    Our product is free from dormant malicious programmes
  </Accordion>

  <Accordion title="All systems shall be tested prior to acquisition and prior to accepting new systems into operational environment based on predefined criteria.">
    We test the systems before deploying into operational environment.
  </Accordion>

  <Accordion title="Identify and document criteria for testing new features or enhancements to existing systems or assets.">
    We have implemented the System Devolopment Life Cycle procedures and all the testing of new features are documented.
  </Accordion>

  <Accordion title="Define criteria for accepting products (e.g. in terms of their functionality), to ensure identified security requirements are met.">
    We conduct security assessments before accepting the products and take appropriate approval to make sure that all the security requirements are met.
  </Accordion>

  <Accordion title="Ensure tests are performed and results are documented.">
    All the test results are documented.
  </Accordion>

  <Accordion title="Where the functionality in a proposed product does not satisfy the specified requirement, the risk introduced, and associated controls should be documented and reconsidered prior to purchasing the product.">
    We record these in the Risk register and documented before purchasing the product.
  </Accordion>

  <Accordion title="All system vendors and third parties shall follow security test processes outlined in the system and services acquisition process document (e.g. FAT, SAT, unit testing, integration testing and UAT)">
    We make sure that these are met before acquiring and products.
  </Accordion>

  <Accordion title="the customer responsible staff shall sign-off and certify that all relevant security requirements have been tested satisfactorily before turn-over to operations.">
    The customer responsible staff can confirm upon validation of the security requirements.
  </Accordion>

  <Accordion title="Any variation between system design and system implementation shall be recorded and security risk assessment shall be conducted to determine mitigation strategies.">
    All the design and implemetation has been documented. We conduct the security Risk assessment in order to identify and mitigate the risks.
  </Accordion>

  <Accordion title="Transfer and use of production data in development and test environments is prohibited and where and when technically not feasible shall be authorised, protected (encryption, access control etc.), logged and only for a determined period.">
    We have kept Testing and production environment seperately. We do not use any data from our production environment for testing purposes.
  </Accordion>

  <Accordion title="All software and hardware acquisition contracts shall include identified rules and requirements and require compliance and the possibility to audit the development processes.">
    All our contracts or agreeements are having appropriate clauses with regards to security compliance, privacy, Audit requirements etc.
  </Accordion>

  <Accordion title="Only licensed third-party libraries and components shall be used.">
    we use only licensed softwares or assets
  </Accordion>

  <Accordion title="Formal change control processes shall be used to manage changes to software code, taking into account that: Impacts of changes to software are understood using risk assessment methodologies. Changes do not compromise exiting security and control measures. Existing documentation is updated. Acceptance testing is performed to validate if system behaves only as expected.">
    We are compliant. We maintain these records for Audit purposes.
  </Accordion>

  <Accordion title="When software or application development is outsourced, the following security requirements shall be controlled: Licensing arrangements, code ownership and intellectual property rights related to the outsourced content. Contractual requirements for secure design, coding and testing practices. Provision of the approved threat model to the outsourced developer. Acceptance testing for the quality and accuracy of the deliverables. Provision of evidence/certification that security thresholds were used to establish minimum acceptable levels of security and privacy quality. Rights of access for audit of the quality and accuracy of work.">
    We have not outsourced.
  </Accordion>

  <Accordion title="Vendors and third parties shall provide documented artefacts to ensure that security controls as requested within this manual are instituted in the system.">
    Attached the Information Security Manual. It prescribes the policies that govern the management and administration of the Information Security Management System (ISMS) for application.It specifies the scope and the requirements for establishing, implementing, operating, monitoring, reviewing, maintaining and improving the information security controls.
  </Accordion>

  <Accordion title="All supply chain requirements are also applicable to work subcontracted by vendors and third parties to develop, test or integrate systems for the customer.">
    We have not subcontracted or outsourced any of services with regards to the product.
  </Accordion>

  <Accordion title="All conditions under which the transfer of information/data must be protected shall be documented and maintained.">
    We have documented the Transfer of Information and it's a part of our Information security policy
  </Accordion>

  <Accordion title="Actions to be taken when issues arise regarding the transfer of information/data must be identified and documented.">
    We do not transfer the data. But if its necessary it will be done only upon the approval of the management.
  </Accordion>

  <Accordion title="To ensure information is adequately protected during transfer, specific controls and procedures shall be identified. Security controls shall be appropriate to the strictest classification level of the information/data to be handled. Such countermeasures may include encryption and/or cryptographic signatures, physical restriction to assets and/or access control mechanisms.">
    We have documented the Transfer of Information and it's a part of our Information security policy
  </Accordion>

  <Accordion title="An exchange of information agreement with each external party outlining clear roles and responsibilities of each party must be established. Consider security conditions such as: Ensuring traceability and non-repudiation. Responsibilities for tracking message transmission, dispatch, and receipt. Licensing and escrow agreements. Ownership and responsibilities for data protection, copyright, license compliance, etc. Responsibilities and liabilities in the event of security incidents, such as loss or disclosure of data. Selection and audit criteria for couriers or escrow agents. Maintaining chains of custody for information being stored or transferred, including documentation and management of access control levels.">
    We do not transfer the data. But we follow these compliance requirements if there are any data transfers. We have implemented the Information security and Data security policies in order to make sure that we secure our organizational and customers information.
  </Accordion>

  <Accordion title="Records of media transfer shall be kept.">
    We maintain these records for Audit purposes.
  </Accordion>

  <Accordion title="Monitor and audit the log records to ensure requirements are being met.">
    We monitor and audit the logs.
  </Accordion>

  <Accordion title="Document and maintain up-to-date all points of interconnection between information/data systems and the types of information/data to be protected regarding the identified interconnections.">
    We are complied. We have controls in place to make sure that Information system is protected.
  </Accordion>

  <Accordion title="A security risk assessment shall be conducted to determine which message's authenticities and integrities are critical to prevent unacceptable impacts to the customer.">
    We conduct the Risk assessment to identify and mitigate the risks involved.
  </Accordion>

  <Accordion title="Monitor message tampering and source spoofing for messages for which authenticity and/or integrity need to be ensured.">
    We use Google workspace as email solution and adequate security features has been enabled to make sure that Information system is protected.
  </Accordion>

  <Accordion title="Large Screen Displays (LSD) connected through Video Controllers/Ethernet cards shall not be shared with any the customer corporate network. However, sharing direct LSD ports with any other network without connecting through Video Controller can be allowed.">
    We do not connect.NA
  </Accordion>

  <Accordion title="Appropriate compensating controls shall be in place to protect against security threats to weak protocols (e.g. protocols lacking encryption or authentication mechanisms).">
    We make sure that all the controls and compensatory controls are in place in order to protect against the Security threats.
  </Accordion>

  <Accordion title="Any traffic between OT/IT networks shall to be officially approved after a security risk assessment on the suggested traffic, and documented with business justification, the risk it represents and the controls that will be used to reduce the risk to an acceptable level.">
    We have implemeted the risk management procedure and defined the Risk Treatment, Risk Treatment, Risk Mitigation, and Risk transfer etc
  </Accordion>

  <Accordion title="Serial Interfaces shall be secured based on security risk taking in consideration the following: Employ protection and detection capabilities where applicable and subject to vendor's confirmation of proven performance. Compensating/alternate security controls shall be employed where mitigation measures cannot be applied due to technical or operational infeasibility.">
    We have implemeted the risk management procedure and defined the Risk Treatment, Risk Treatment, Risk Mitigation, and Risk transfer etc We implement the Compensating security controls wherever measures cannot be applied due to technical or operational infeasibility.
  </Accordion>

  <Accordion title="Ensure security requirements and service outages are captured in service level agreements for network services. Include auditable security requirements.">
    We maintain these records for Audit purposes.
  </Accordion>

  <Accordion title="Audit network services provider as defined in the service agreement.">
    It's a part of our Internal and external Audits.
  </Accordion>

  <Accordion title="All systems and equipment shall be maintained to assure that security has not been degraded below the accepted level. Preventive maintenance shall be performed at least once a year.">
    We make sure that these controls are in place and security has not been degraded below the accepted level. We also validate these controls during our internal and external Audits.
  </Accordion>

  <Accordion title="Temporary override of security controls such as application whitelisting, DLP, HIPS, etc. shall be allowed only for legitimate job requirements by authorised personnel with approval after a security risk assessment and compensating controls are implemented.">
    We have implemented the role based access system and change management policy in order to make sure that we provide an access to an individual only upon need and approval basis. All the changes has been tracked and maintained the records for audit purposes.
  </Accordion>

  <Accordion title="Identify all products and components (e.g. physical and logical) used within the entity that are programmable/configurable (this may be acquired through, and documented within, the asset inventory).">
    We have a up to date records of all the assets used.
  </Accordion>

  <Accordion title="Define and document mandatory products and components configuration baselines based on security best practices and the customer defined standards.">
    We make sure that we follow the Industry best practices and security standard to make sure that we secure the information asset.
  </Accordion>

  <Accordion title="Any deviations to the the customer defined configuration baseline (e.g. application/system incompatibility, lack of vendor approval, etc.) should be recorded and appropriate compensating controls shall be implemented.">
    We make sure that we follow the existing security controls and implement the compensatory controls to make sure that the information system is secure.
  </Accordion>

  <Accordion title="Passwords protecting the BIOS/initial logon from unauthorised change shall be implemented. For systems where it is not technically feasible to password protect the bios, alternative measures shall be implemented.">
    We have implemented the control.
  </Accordion>

  <Accordion title="Potential adverse impacts to the customer environment associated with the use of troubleshooting and other tools shall be evaluated through security risk assessment before approving the use of these tools.">
    We conduct the Risk assessment to identify and mitigate the risks involved.
  </Accordion>

  <Accordion title="Security health checks shall also be carried out and documented during each maintenance cycle. Include topics such as: Inventory register check for any inconsistencies. Inter-communication architecture. Open ports and services. System hardening. Protection from malicious code. Up-to-date security patches. Equipment backup. Performance and capacity monitoring. Renewal of subscription licenses.">
    Compliant.We review and validate these controls on a periodical basis and These are part of an Internal and external Audits.
  </Accordion>

  <Accordion title="If during security health checks changes to approved baselines are discovered a report shall be generated and reviewed.">
    Compliant.We review and validate these controls on a periodical basis.
  </Accordion>

  <Accordion title="Records shall be maintained, for a period of five years or as legal, regulatory or operationally required, of all suspected and actual faults, and all preventive and corrective maintenance activities.">
    We maintain these records for Audit purposes.
  </Accordion>

  <Accordion title="All test and development environments shall be required to meet specifically defined security requirements designed to support the integrity of these environments and prevent introduction of threats to the production environment.">
    We have the required security controls in place.
  </Accordion>

  <Accordion title="Obsolete systems shall not be used and plans to replace/refresh must be established to reach an acceptable risk level and support.">
    We do not use outdated computer hardware, software, technology, services or practices
  </Accordion>

  <Accordion title="Upgrade plan for OS obsolescence, HW/SW obsolescence etc. for all systems, assets and components shall be based on the criteria that it is obsolete and/or resulting high maintenance costs and no system vendor support is available.">
    We upgrade the systems make sure that do not use outdated computer hardware, software, technology, services or practices
  </Accordion>

  <Accordion title="Where technically feasible, employ anti-malicious code protection mechanisms for the network devices as well as servers, workstations, laptops and other devices connected to the the customer environment.">
    We have installed the end point security software on all the computers and servers to keep the computer and personal information protected.
  </Accordion>

  <Accordion title="Anti-malicious code protection (including supported anti-malware products, configuration settings, etc.) for IT\OT assets shall be endorsed by the vendor.">
    We have installed the end point security software on all the computers and servers to keep the computer and personal information protected.
  </Accordion>

  <Accordion title="Any deviations to the entity-defined anti-malicious code requirements (e.g. application/system incompatibility, lack of vendor approval, etc.) shall be recorded. Risks due to deviations shall be managed to entity acceptable levels through compensating controls.">
    We are compliant.
  </Accordion>

  <Accordion title="Anti-malicious code protection tools shall be monitored for detection events and alerts.">
    We have enabled these features.
  </Accordion>

  <Accordion title="Anti-malicious code shall be deployed with defined scanning, update, and monitoring requirements across OT/IT assets.">
    We have installed end point security softwares to safeguard from attack scripts, viruses, worms, Trojan horses, backdoors and malicious active content. We also conduct periodical scanning in order to make sure that all the information assets are safe. These are centrally managed and have control on all the end points.
  </Accordion>

  <Accordion title="All documentation related to Technical Vulnerability Management shall be classified as Sensitive, protected accordingly and shall be made available only on a need-to-know basis.">
    It is available on need to know basis
  </Accordion>

  <Accordion title="All new system/asset shall not be considered in production until a vulnerability assessment has been conducted and vulnerabilities addressed.">
    We make sure the Vulnerability assessment has been conducted for our products as per the compliance requirements.
  </Accordion>

  <Accordion title="In the absence of an approved entity-specific retention schedule, data backup shall be retained as per defined logging standard, after which tapes or another storage backup media may be overwritten.">
    We are compliant.
  </Accordion>

  <Accordion title="Periodically verification if the customer sensitive information is exposed to the general public and/or exposed to internal network shall be conducted.">
    the customer Sensitive information will not be exposed to the general public.
  </Accordion>

  <Accordion title="Information regarding potential security issues shall be collected, analysed and reported in a timely manner.">
    We document and maintain all the security issues.
  </Accordion>

  <Accordion title="Time distribution/clock synchronization shall be implemented in all environments from a secure and accurate source that uses an accepted secure standard protocol (e.g. IEEE 1588-2008/IEC 61588:2009).">
    We are complaint.
  </Accordion>

  <Accordion title="Requirements for monitoring shall be identified: Types of systems and assets. Outline which aspects must be monitored. How monitoring is to be performed. Account for instances where automated monitoring is not technically feasible. Logs and realtime traffic shall be monitored and analysed.">
    We are compliant. We have clasified, labeled our assets and periodically monitored. All the logs and realtime trafic is monitored.
  </Accordion>

  <Accordion title="A Security Incident and Event Management (SIEM) solution, or equivalent, shall be implemented.">
    Implemented. We are compliant.
  </Accordion>

  <Accordion title="Does the CSP agreement include security requirements that address the following security controls? 1. Data ownership 2. Data protection and storage 3. Information security incidents handling 4. Change, Recovery and Restoration 5. Data handling and storing location 6. Portability and continuity 7. Compliance and monitoring rights and methods">
    These are all part of CSP agreement.
  </Accordion>

  <Accordion title="Supporting Utilities: Short-term UPS to facilitate an orderly shutdown of critical in the event of primary power source loss. Long-term alternate power supply capable of maintaining minimum operational capability in case of long term power loss. Primary and alternate telecommunications equipment to support reliable operations.">
    We have these controls in place as a part of our Business continuity plan.
  </Accordion>

  <Accordion title="Cabling Security: Power, system and communication cables shall be secured. Based on information security risk, communication cables might need to be monitored against network tap attempts and network tampering, specifically when protective technical controls are not technically feasible.">
    We have these controls in place as a part of our Business continuity plan. It has been tested periodically and part of our internal and external Audit.
  </Accordion>

  <Accordion title="Risk Assessment shall be conducted to identify potential risks to the customer Information assets as a result of third party access or engagement with the customer. The analysis of risks related to external party access must consider: The classification of the information assets. Possible impacts to the controls of the information assets and processing facilities involved. Processes for identifying, authorising, authenticating and reviewing access rights of the external party. Security controls to be used by the external party when storing, processing, communicating, sharing or exchanging the customer information.">
    We have conducted the risk assessment as per the industrial standard.
  </Accordion>

  <Accordion title="Third party compliance to the customer security policies and procedures shall be ensured and addressed by formal contract and signed Non-Disclosure Agreement (NDA) between the customer and the third party">
    Agreed. We will sign the NDA
  </Accordion>

  <Accordion title="Service Level Agreements shall be documented and agreed upon by all parties to ensure there is no possibility for misunderstanding between the customer and the third party regarding each party's obligations to fulfil relevant information security requirements set forth by the customer security policies and procedures.">
    SLA can be documented and agreed by the both the party.
  </Accordion>

  <Accordion title="Prior to authorizing access of third parties to information resources, Head of Department working with third party, Information Owners and Information Custodians must confirm that: The terms and conditions of access are documented (e.g. Service Level Agreement (SLA), Contracts, Non-Disclosure Agreements, Memoranda of Understanding, etc.). Responsibilities for managing and monitoring the external party access have been assigned and documented. Security Controls have been implemented and tested against identified risks.">
    Only authorised individual have an acces to the approved information assets.
  </Accordion>

  <Accordion title="External Parties shall be responsible for ensuring its personnel uphold and upkeep the customer Security Policies. All software/hardware used by the External Parties personnel inside/outside the customer premises for accessing the customer information shall be declared and may be subjected to an audit. The External Parties shall co-operate with the customer and its entities in ensuring the same.">
    We allow our customer to audit but atlease 30 days prior notice with the scope of the audit needs to be communicated
  </Accordion>

  <Accordion title="Any exceptions to the entity defined Supplier Service Delivery requirements shall be recorded. Risks due to exceptions shall be managed to acceptable levels through application of compensating controls.">
    Its documented as per the Risk management procedure.
  </Accordion>

  <Accordion title="Service agreements shall include a methodology for communicating change management issues between the customer and the external/third party.">
    We have all the details in SLA
  </Accordion>

  <Accordion title="the customer shall conduct audits of external/third parties in conjunction with review of independent auditor's reports, if available, and follow-up on issues identified.">
    We can make our audit reports available
  </Accordion>

  <Accordion title="Entities shall maintain appropriate reports and records, to monitor and measure the compliance with the security requirements as documented in the agreements with the third-parties.">
    We maintain appropriate reports and records, to monitor and measure the compliance with the security requirements.
  </Accordion>

  <Accordion title="Changes to the provision of services provided by third parties shall be managed through risk assessment taking into consideration the criticality of business process, systems and security requirements. The following aspects should be taken into considerations: Changes to third-party agreements; Changes to the third parity organisational structure; Sub-contracting; Modifications or updates of the third party's policies and procedures; Changes to the third-party risk profile.">
    We make sure that we follow the risk management procedure and take these factors into consideration.
  </Accordion>

  <Accordion title="Disaster Recovery plans and procedures shall be in place to prevent and recover from any major breakdown or disaster.">
    We have these in place and tested annually.
  </Accordion>

  <Accordion title="Disaster recovery plans and procedures shall take into account information security requirements applicable to adverse situations.">
    We have these in place and tested annually.
  </Accordion>

  <Accordion title="Disaster recovery plan shall include a full recovery and reconstitution of the customer assets.">
    Our BCP/DR plan supports this.
  </Accordion>

  <Accordion title="Recovery procedures shall be reviewed on a yearly basis.">
    We review these on annual basis
  </Accordion>

  <Accordion title="Disaster recovery plan and procedures shall be communicated to all stakeholders internal and external to the organisation (employees, third parties).">
    We have cmmunicated to all the internal and external parties.
  </Accordion>

  <Accordion title="Contingency roles, responsibilities shall be documented with contact information, and activities associated with restoring the system after a disruption or failure, in the disaster recovery plans.">
    It's a part of Business continuity documents and attached the same for your reference.
  </Accordion>

  <Accordion title="Continuity plans shall be tested periodically, and the lessons learned documented.">
    The BCP Test and lessons learned has been documented.
  </Accordion>

  <Accordion title="When changes occur, disaster recovery plans shall be reviewed and updated, such as: Acquisition of new equipment or upgrading of systems, assets or components; Personnel; Addresses or telephone numbers; Business strategy; Location, facilities and resources; Legislation; Contractors, suppliers and key customers; Processes, or new or withdrawn ones; Risk (HSE, operational and financial, etc.).">
    It's a part of BCP documents and we review and update when changes takes place.
  </Accordion>

  <Accordion title="Technical compliance validation shall be performed by an authorised subject matter expert to determine whether security controls have been properly implemented within the the customer environment.">
    These are part of internal and external audits
  </Accordion>

  <Accordion title="Following corrective action shall be taken when non-compliance is identified: Identify the immediate and underlying causes of the non-compliance. Assess and document the risks introduced by non-compliance. Evaluate actions to be taken to attain compliance. Implement the proper corrective action.">
    We have implemented the Corrective Action Procedure.
  </Accordion>

  <Accordion title="Review whether the corrective action taken is effective shall be conducted: Document results generated from reviews and corrective actions. Observe those results over time in order to identify trends and implement further corrective action.">
    We have implemented the Corrective Action Procedure. We review rhe corrective action taken.
  </Accordion>

  <Accordion title="Security assessments shall be conducted only by resources identified by the relevant the customer department/role and shall be carefully planned and agreed upon when performed against operational environment.">
    We conduc the security assessments by the Internal and external auditors
  </Accordion>

  <Accordion title="Necessary data or equipment can be shared with the members of internal or external assessment team subject to management approval.">
    We share the data with our Internal and external auditors
  </Accordion>

  <Accordion title="Measures taken to ensure assessment activities minimise the risk of disruptions to the environment and business processes shall be documented and communicated. In particular, assessment activities shall not include network scanning or penetration testing on OT systems, as it may degrade the performance and impact the plant operations.">
    We make sure the Assessments and Audits will be conducted and reported independently.
  </Accordion>

  <Accordion title="Sensitive information shall be verified or assessed in-site and shall not be handed out or distributed.">
    All the Sensitive information shall be handled as per Policies and procedures implemented.
  </Accordion>

  <Accordion title="An action plan that describes how the identified non-conformities will be addressed shall be developed and maintained on regular basis.">
    We have defined it in our compliance policy and Corrective Action Procedure
  </Accordion>

  <Accordion title="the customer shall plan and conduct assessments of the information security controls in place through an established assurance process which will be continuously identifying technical and non-technical gaps.">
    We allow our customer to audit or assess but atlease 30 days prior notice with the scope of the audit needs to be communicated
  </Accordion>

  <Accordion title="Performance improvement plans shall consider and develop strategies to identify the suitability, adequacy and effectiveness of information security controls in place.">
    We continuously monitor and improve Information security framework to make sure that we safegurd the Information and all the controls are in place.
  </Accordion>

  <Accordion title="Performance improvement plan shall leverage and document security metrics and measurements from incident reports, and audits for future improvement.">
    We make sure that we brings these improvements to Information security systems from the incidents reported and audit observations etc
  </Accordion>

  <Accordion title="The implementation of performance improvement plan shall be monitored on a regular basis: Document and maintain corrective and/or continuous improvement actions taken. Review and report the effectiveness of corrective and/or continuous improvement actions.">
    We have implemented the corrective action plan procedure and review the policies and procedures on annual basis.
  </Accordion>

  <Accordion title="Service shall have acceptable clause regarding data ownership and intellectual property rights as per UAE regulations and the customer policies">
    It can be included in the agreement and our legal team will review and confirm
  </Accordion>

  <Accordion title="Contract / statement of work / order form clearly details the services to be provided.">
    Statement of work will have a details of product/service to be provided
  </Accordion>

  <Accordion title="Contract includes service levels or a separate SLA has been signed (with uptime and support response at the minimum) and consequences if service levels are not met (e.g. rebates; liquidated damages).">
    We can include the service levels in the agreement. We are not currently having an options for service credits/liquidated damages, if SLA are not met.
  </Accordion>

  <Accordion title="Service provider shall have clear and secure controls associated with approving access to the customer data or systems by service provider staff for support and/or troubleshooting purposes.">
    We make sure that we have all the controls in place.
  </Accordion>

  <Accordion title="Service provider should have cyber insurance covering security breaches.">
    We will do this as part of the agreement
  </Accordion>

  <Accordion title="Detailed access and audit logs shall be available for the customer to obtain via an API or other means, which should align with the customer security monitoring requirements">
    We are a multi tenant SAAS system and all our logs will contain data of all customers. We will have our own log monitoring and security analysis.
  </Accordion>

  <Accordion title="Service Provider shall have solid DR and Business continuity plan in line with the customer requirements">
    Attached the BCP/DR documents
  </Accordion>

  <Accordion title="Service Provider shall have solid endpoint security controls such as AV, EDR, exploitation protection, HIPS, App whitelisting IDS, DDOS, malware sandboxing, etc.">
    We end point security in place
  </Accordion>

  <Accordion title="Service Provider should allow the customer to preform technical and compliance audits on provider infrastructure that host the customer systems">
    We allow our customer to audit, but atlease 30 days prior notice with the scope of the audit needs to be communicated
  </Accordion>

  <Accordion title="Describe your security model, including network, data, and application security; data center security; application and system support; upgrades and maintenance; and personnel access rights.">
    We have deployed our application on Amazon web services (AWS) Virtual platform cloud. AWS provides data center security to our application. AWS is ISO 27001;2013, ISO 27017, ISO 27018, SOC 2 certified organization. Xoxoday is also ISO 27001:2013 and GDPR compliant organization. Only the authorised individual have an access as per Access control policy. We use TLS1.2 encryption for Data in transit and AES256 for Data at rest. As part of Web Application Firewall (WAF), rate limiters are installed to block multiple requests from specific IPs in order to prevent DDOS-type attacks. Additionally, we have an intrusion detection/monitoring application that alerts on unauthorized access. Xoxoday's architecture goes through constant upliftment and experiences no downtime during upgrades and maintenance windows.
  </Accordion>

  <Accordion title="How often is the platform scheduled for software patches and updates?">
    Since our services are delivered via. Web, the upgrades and updates to the services are seamless and usually do not involve any actions from the end-users. We try to release our product hotfixes once every week & major features once every month.
  </Accordion>

  <Accordion title="Does the vendor allow security audits by the customer or by agents of the customer (e.g. an appointed Audit firm)?">
    Yes. Annually once.
  </Accordion>

  <Accordion title="Is there security accreditation in place such as SAS70/SSAE 16 Type II, ISO 27002 etc?">
    Yes. We are ISO 27001:2013 and GDPR Compliant. We are also compliant with SOC 2 type 1 and on the last phase of Audit. We will share the report once we have it from the Auditor. Attached the ISO 27001 certificate and engagement letter that we have for SOC 2 Audit.
  </Accordion>

  <Accordion title="What processes does the vendor have to detect and prevent viruses and other malicious software from damaging the service and the customer's data?">
    We use Bitdefender End point security software to prevent from malware and protect the data. In addition to that we also have AWS Guard Duty threat detection service that continuously monitors for malicious activity and unauthorized behaviour. We use a cloud hosted VPN with strict access controls to allow our employees to access the official network. This VPN is managed by our IT team and it's linked with the SSO/Active Directory
  </Accordion>

  <Accordion title="What are the security and malpractice escalation processes?">
    All the employees initially inform the IT Support team through ticketing systemb the Infosec manager and Final level will be DPO and the management.
  </Accordion>

  <Accordion title="What are the controls over interruption to the service? (SLA). What is the RPO (recovery point objective) and RTO (recovery time objective) for the service?">
    The time of support ranges depends on the level of service. RTO and RPO is - 6 mins
  </Accordion>

  <Accordion title="What security standards are used for application development?">
    our products comply with all the industrial benchmarks and standards when it comes to the Software Development Life-cycle (SDLC). All software development procedures are supervised and monitored by Xoxoday so that they include: security requirements independent security review of the environment by a certified individual code reviews Quality monitoring, evaluation, and acceptance criteria for information systems, upgrades, and new versions shall be established and documented for the clients' reference.
  </Accordion>

  <Accordion title="Describe the network topology.">
    The data centers are hosted completely in isolation so that the access is limited and controlled. Load balancer allows shifting incremental load and can auto scale based on data load experienced by application. Each instance (EC2 Instance) under fortified VPC network is further conglomeration of Docker Container Web Services and APIs and application layer running on top of it. This helps in managing various aspects and features of application without affecting the functioning of each other and achieving a modular architecture to work as plug and play model. Amazon Cloud Watch is implemented to enable monitoring of the functioning of the application. The data is encrypted using 256-encryption based SSL certificate. To manage security of data Xoxoday plans a quarterly VAPT based security audit of application.
  </Accordion>

  <Accordion title="Describe your approach to ensuring data security in the SaaS environment.">
    We have implemented policies and procedures as per ISMS and GDPR requirements. We also conduct periodical Internal and external Audit by the third party Auditor. We have deployed our application on Cloud Virtual platform for maximum security. We use Bitdefender End point security software to prevent from malware and protect the data. In addition to that we also have AWS Guard Duty threat detection service that continuously monitors for malicious activity and unauthorized behaviour. We conduct periodical Vulnerability assessment and Penetration Testing from the Inductry approved authorized vendor to make sure that all the vulnerabilities are closed and having secured applications. We use logical data isolation with the help of company specific encryption keys. Data in non production environment is not updated with the production data. We generate separate test data Data at transit - TLS1.2 encryption, Data at rest - AES256 As per the Information security policy and Data protection policy only the authorised individual have an access to the data through internal approving and ticketing system.
  </Accordion>

  <Accordion title="TSL IT Security Compliance?">
    We comply with Information security compliance - ISO 27001;2013, SOC 2 and GDPR
  </Accordion>

  <Accordion title="Data Governance & Management features?">
    Our product is ISO 27001 and GDPR compliant and have the features.
  </Accordion>

  <Accordion title="Intelligence to predict failures and auto-corrections? Failures can be Infrastructure / Process transaction with validations as per TSL business rules">
    We have health checks along with Self healing mechanisms in place
  </Accordion>

  <Accordion title="What is the percentage that the SLA guarantees (in case the platform provides the services in a Saas Model)?">
    99.99%
  </Accordion>

  <Accordion title="Can evidence be provided of the processes that are implemented to guarantee the confidentiality of information, including a description of how our data is separated from other customer's data, and what controls are in place to prevent other customers from viewing our data?">
    We use logical data isolation with the help of company specific encryption keys. We generate separate test data Data at transit - TLS1.2 encryption, Data at rest - AES256. We have the ability to logically segment or encrypt customer data such that data may be produced for a single tenant only, without inadvertently accessing another tenant's data. our network environment is designed and configured to restrict any communication and connection between the tenant's environment.
  </Accordion>

  <Accordion title="Are there controls in place to prevent administrators and other staff from the Vendor's organisation from downloading customer data to removable storage (USB memory sticks, CD ROM etc)?">
    Yes. We have the controls in place. We have blocked connecting Hard disk, USB, CD ROM etc to computers and all the devices are centrally managed.
  </Accordion>

  <Accordion title="Which databases are used in the backend? Which database optimization approaches are taken?">
    The data is only stored on our application and its deployed on AWS Cloud. Our data is stored in secured databases and there is no window to alter any data without it being logged into the system records
  </Accordion>

  <Accordion title="Describe the hosting infrastructure.">
    We are a SAAS solution. We are cloud hosted.
  </Accordion>

  <Accordion title="How is system usage and performance monitored?">
    We use a variety of tools and plugins integrated with Prometheus & Cloudwatch along with health checks for facilitating our uptime/service availability
  </Accordion>

  <Accordion title="Can customers control the timing of software upgrades? What support do you provide during the upgrade process?">
    Xoxoday's architecture goes through constant upliftment and experiences no downtime during upgrades and maintenance windows.
  </Accordion>

  <Accordion title="Is your DR plan based on active-active or active-passive?">
    active-passive
  </Accordion>

  <Accordion title="Does the application provides users a notification and choice to accept or deny cookies?">
    Yes. we have implemented the cookies policy
  </Accordion>

  <Accordion title="Does the application or solution have Access Control Mechanism to ensure restricted/controlled access to PII (as per business requirement)?">
    Yes, we have the access controls
  </Accordion>

  <Accordion title="Are logs being maintained for processing activities performed on PII?">
    Yes
  </Accordion>

  <Accordion title="Is there an Access Control Mechanism to ensure restricted/controlled Third Party access to the application?">
    Yes, we have the access controls
  </Accordion>

  <Accordion title="Does the application allow PII to be updated in case there is a requirement for the same?">
    Yes. Users can updated their information
  </Accordion>

  <Accordion title="What is the services you are going to provide to Darwinbox">
    Xoxoday - application platform has been integrated with Darwinbox with the objective of creating a reward system for employees. Organizations that are using DarwinBox will not only be able to automate their HR processes but can also reward employees to keep them motivated and engaged. Xoxoday application offers a unified rewarding platform that helps organizations build a winning organizational culture through reward and recognition programs that have a global catalog consisting of products and experiences from more than 700+ brands. Please click here to know more - [https://xoxoday.gitbook.io/application/developer-resources/integrations/darwinbox-+-application](https://xoxoday.gitbook.io/application/developer-resources/integrations/darwinbox-+-application)
  </Accordion>

  <Accordion title="Has your organization formally appointed a central point of contact for security coordination? If so, whom, and what is their position within the organization? Are responsibilities clearly documented? i.e. job descriptions, information security policy">
    Yes. Xoxoday's primary security focus is to safeguard our customers or users' data. This is the reason that Xoxoday has invested in the appropriate resources and controls to protect and service our customers. We have an Infosec Manager who is responsible for Information security and reports to the Board of Directors of the company. All the job descriptions, role and responsibilities has been documented as per the compliance requirements.
  </Accordion>

  <Accordion title="Have your employees been provided formal information security training? Have policies been communicated to your employees? Are periodic security reminders provided? i.e. New employee orientation, annual training, posters in public areas, email reminders, etc.">
    Xoxoday has developed a comprehensive set of security policies covering a range of topics. These policies are shared with and made available to all employees and contractors with access to Xoxoday information assets. Each employee, when inducted, signs a confidentiality agreement and acceptable use policy, after which they undergo training in information security, privacy, and compliance. Furthermore, we evaluate their understanding through tests and quizzes to determine which topics they need further training in. We provide training on specific aspects of security that they may require based on their roles. We spread awareness about the Information security among the employees through posters in public areas, emails, training and orientations etc..
  </Accordion>

  <Accordion title="Are your employees required to sign a non-disclosure agreement? If so, are employees required to sign the non-disclosure agreement annually? Non-disclosure and/or confidentiality form at initial employment">
    Yes. All new hires are required to sign Non-Disclosure and Confidentiality agreements. The Employee expressly agrees that he/she shall not use Confidential Information provided by the Company in the development or delivery or for personal gain from providing any products or services for his/her own account or for the account of any third party. The NDA signed will be valid till the termination from an employement.
  </Accordion>

  <Accordion title="Do you have a formal process to manage the termination and or transfer of employees? i.e. All equipment is returned, user ID's disabled in systems, Windows, badges and/or keys returned. On Transfer is existing access reviewed for relevance?">
    Yes, We have implemented the process for termination from an employement. Once the employee is terminated all the access will be revoked, IDs are disabled, assets are returned and recorded as a part of the exit clearance. We have implemented the access control procedure and all the access will be revoked upon termination or transfer of an emplyees as per the compliance requirements.
  </Accordion>

  <Accordion title="Has antivirus software been deployed and installed on your computers and supporting systems (e.g., desktops, servers and gateways)? 1) Product installed? Centrally managed? Updated daily? Reviewed for being current?">
    Anti-Virus is deployed in all systems and servers for protection against virus and malware. We use Bitdefender end point security for protecting the systems from virus and this has been updated on daily basis and centrally managed.
  </Accordion>

  <Accordion title="Whom do we contact if we identify a security issue or breach involving or impacting your product? Please provide an email address and/or full contact information b) What is their expected SLA to respond to initial contact? c) What is the definition of issue priority (ex: minor vs. major, 0-4 scale)? d) What is their expected SLA to implement changes needed to fix issues according to priority?">
    1. Reach out to us at [cs@xoxoday.com](mailto:cs@xoxoday.com) to raise a ticket, if you happen to notice any potential security issue whilst meeting all the required criteria in our policy. 2. The validation of the reported issue in terms of severity & authenticity will be done by our security team in around 90 days. 3. Post validation, steps will be taken to fix the security issues in accordance with our security policies. 4. The owner of the ticket will be informed once the issue is resolved. Security Severity has been categorized as High, Medium and Low. Once the reported vulnerability is closed we will conform the same.
  </Accordion>

  <Accordion title="If vendor shares reports/data with the customer over emails, is that email ID blocked for sharing any data over other public domains? Please confirm the same by sending a test email to -Information.Security@the customerinsurance.com Please share the screenshot of the blocked email for confirmation.">
    Reports can be generated by the admins through the application. If there are any additional support needed, our customer support team would be able to help and guide on generating report.
  </Accordion>

  <Accordion title="Which all in-house or third party applications Vendor will use for the customer operations?">
    We do not use any in-house devoloped applications. We have deployed our application on AWS cloud virtual platform. And AWS is SOC 2, ISO 27001, ISO 27017 and ISO 27701 certified organization. Shared the certificates.
  </Accordion>

  <Accordion title="Does the application support any APIs? And how are they consumed internally and externally? What controls are implemented for sharing such APIs externally?">
    [Please click here to know more about API Documentation - https://xoxoday.gitbook.io/application/user-guide/for-admins-1/xoxo-links/xoxo-link-apis https://xoxoday.gitbook.io/application/developer-resources/storefront-integration/api-endpoints](https://xoxoday.gitbook.io/plum/user-guide/for-admins-1/xoxo-links/xoxo-link-apis)
  </Accordion>

  <Accordion title="How the security of the exposed APIs is managed?">
    We have implemented the Web application firewall, IDs/IPs and amazon guard duty etc for maximum security. OAuth2 is used to authorize all API requests. We also conduct code review to make sure that the APIs are secure.
  </Accordion>

  <Accordion title="Are your admins are cloud certified?">
    Yes. Our employees are having required education and certifications to perform the job.
  </Accordion>

  <Accordion title="Do you have a setup of processes for regular internal audit for data protection compliance?">
    We do conduct Internal and external Audit very year
  </Accordion>

  <Accordion title="Have you conducted training and awareness program related to data breach for your employees?">
    Yes, It's a part og our ISMS training. Attached the training calender as an advace.
  </Accordion>

  <Accordion title="A copy of the third-party information security program validation performed on the product/ environment, such as: SOC 2 Type II report and/or ISO 27001 certificate.">
    Xoxoday is compliant with - ISO 27001:2013, CPRA (California Privacy Rights Act), SOC 2 Type I, CSA STAR Level 1 and GDPR(General Data Protection Regulation). Attached the below mentioned documents. 1. Xoxoday ISOIEC 270012013 Certificate 2. Xoxoday SOC 2 Type 1 Report 2021 3. Xoxoday VAPT Certificate (Conducted by 3rd party vendor) 4. Xoxoday application VAPT Report (Conducted by 3rd party vendor) 5. Xoxoday CPRA Attestation Report 6. CSA STAR LEVEL 1 Compliant - [https://cloudsecurityalliance.org/star/registry/nreach-online-services-pvt-ltd-xoxoday](https://cloudsecurityalliance.org/star/registry/nreach-online-services-pvt-ltd-xoxoday)
  </Accordion>

  <Accordion title="A copy of audit reports from the data center where the production instance of your product is hosted (SOC1, SOC2, bridge Letters, ISO27001, other security certifications, etc.).">
    We have deployed our application on AWS Virtual platform cloud. The AWS Compliance Program helps to understand the robust controls in place at AWS to maintain security and compliance in the cloud. Attached the below compliance certificates and Audit reports – 1. Amazon Web Services ISO 27001 Certificate 2. AWS ISO 27017\_certification 3. AWS ISO 27018\_certification 4. AWS SOC 2 Report 5. AWS SOC 2 Type I Privacy Report 6. AWS CSA STAR Certificate
  </Accordion>

  <Accordion title="Do you follow any particular internationally accepted best practices or standards?">
    Yes. We follow ISO 27001:2013, SOC-2 and GDPR We are ISO 27001:2013 certified and GDPR Compliant.
  </Accordion>

  <Accordion title="Does the system have an international certification/award in System Security?">
    Yes. We are ISO 27001:2013 certified and GDPR Compliant. We are also complied with Cloud Security Alliance (CSA) STAR level 1.
  </Accordion>

  <Accordion title="Can a user login be prevented during non-office hours (e.g., off-shift, on leaves)?">
    Its SAAS Solution and available 24\*7
  </Accordion>

  <Accordion title="Does solution provide/support remote procedure calls?">
    It's a web application. And it can be presented over the calls like MS Teams, Zoom, Google meet etc.
  </Accordion>

  <Accordion title="Does solution provide/support message-oriented middleware?">
    Yes. We have an integration with other applications and provide secure communications.
  </Accordion>

  <Accordion title="Does solution use SSL (If use web service)?">
    Yes
  </Accordion>

  <Accordion title="Does solution support SFTP (both sending and receiving file)?">
    Yes. Files will be transferred securely.
  </Accordion>

  <Accordion title="Does solution support Data encryption/decryption?">
    Yes.
  </Accordion>

  <Accordion title="Can the security module be integrated with Middleware to provide the security services? If yes, describe the mechanism?">
    The solutions integrated with other solutions like Zoho CRM, HubSpot, Darwin box, SurveyMonkey, Freshdesk etc
  </Accordion>

  <Accordion title="Does your solution provide the CheckSum as data validation module?">
    NA. It's a SAAS Solution and does not require.
  </Accordion>

  <Accordion title="CLIENT must have the ability to govern the data stored in cloud.">
    The data will be in our control. And AWS Cloud provide service for deploying our application. AWS is also ISO 27001 and SOC 2 certified organization and adhered to the data governance.
  </Accordion>

  <Accordion title="Related division must do risk assessment to uphold Cloud Infrastructure Administration including CIA (Confidentiality, Integrity and Availability) for any system and/or data that want to be put in cloud.">
    It's a part of our Risk assessment and we validate the compliance requirements of AWS cloud virtual platform annually.
  </Accordion>

  <Accordion title="CLOUD SERVICE PROVIDER (CSP) must have security policy, standard and procedure/guideline, which at least on the same level as CLIENT ISMS and must be uphold to protect CLIENT data from any security threats.">
    We have implemented all the required Infosec Policies and procedures as per ISO 27001:2013, GDPR and SOC-2
  </Accordion>

  <Accordion title="Are independent IT security testing programs, assurance, audit and/or assessments performed? How frequently? Are results communicated to clients? How often?">
    We perform Internal Audit and external Audits annually. We also conduct Security assessments and testing like Vulnerability assessment and Penetration testing every six months. Yes. We communicate these assessment results to clients on a yearly basis.
  </Accordion>

  <Accordion title="What arrangements are in place for return of data to customer upon contract conclusion or termination?">
    We have the arrangements in place. Storage Period would be as per regulatory conditions. Personal data can be deleted based on a formal written request. Xoxoday would delete the data within 30 days of receiving the request. We will delete the data of the customers upon the termination of the contract and Our data cleansing process goes through an organized purge. Once the data is purged, it's purged from all places
  </Accordion>

  <Accordion title="Can the service provider provide the latest copy of SOC 2 Type II report or equivalent?">
    We have implemented all the SOC controls and in the last phase of Audit. We would be able to provide SOC 2 Type I report in next 2-3 weeks
  </Accordion>

  <Accordion title="Provide information on your solutions/services BCP/DR.">
    We have BCP/DR Policy as per the Infosec compliance requirements and we conduct the BCP test annually. See Business Continuity Management Procedure attached.
  </Accordion>

  <Accordion title="Please provide a copy of the incident management standard and procedures?">
    See attached Incident Management Procedure attached
  </Accordion>

  <Accordion title="Has an independent security third party audit been completed on you? (If so, please name the auditing firm and last audit date in the comment box)">
    Yes. An independent security third party audit been completed by "TUV NORD". The last last day of Audit was 29th June 2021
  </Accordion>

  <Accordion title="Does the organization is having an Information security organization is in place? If yes please explain and share evidence?">
    We have establised the Information security management systemIt specifies the scope and the requirements for establishing, implementing, operating, monitoring, reviewing, maintaining and improving the information security management system (ISMS) at Xoxoday. Xoxoday is committed to ensure Integrity, Confidentiality, Availability and Security of its Physical and Information Assets and also maintaining privacy for serving the needs of the customers and organization while meeting appropriate legal, statutory and regulatory requirements. Attached the Information Security Management System Manual.
  </Accordion>

  <Accordion title="What are your process and procedures for maintaining client data security? please explain and share evidence?">
    We have the Data security Controls in place. We have implemented IDS/IPS, Firewall and our security information and event management (SIEM) system merge data sources (app logs, firewall logs, IDS logs, physical access logs, etc.) for granular analysis and alerting. We have Cloudflare web application firewall for maximum security of data. We have implemented the role based access control system to make sure that the data os available only to an authorised individual. Nreach Online Services Pvt ltd, respects the individual right to their personal information and is committed to use minimum personal data with transparency, accuracy & protection of confidentiality, integrity, availability, privacy, authenticity & trustworthiness, nonrepudiation, accountability and auditability of the data received, stored, processed and destroyed for business purposes. Atatched the Xoxoday GDPR Data Security Policy
  </Accordion>

  <Accordion title="Do you take special measures to make sure the customer data is secure during the collection process? If so, describe the measures briefly.">
    We are compliant. We collect the data only throigh our application. We have role based access system to make sure that only the authorised individual have an access to the required information All the devices and emails are having adequate security controls. We use a cloud hosted VPN with strict access controls to allow our employees to access the official network. We have installed the firewalls to monitor and control the incoming and outgoing network traffic based on predetermined security rules. It helps us to establishes a barrier between a trusted network and an untrusted network. We use a cloud hosted VPN with strict access controls to allow our employees to access the official network. This VPN is managed by our IT team and is linked with the SSO/Active Directory for more security. We use TLS1.2 encryption for Data in transit and AES256 for Data at rest. Additionally, we have an intrusion detection/monitoring application that alerts on unauthorized access.We have SDLC Policy as per ISMS requirements and we follow General Coding Practice. For example - We Conduct data validation on a trusted system, All cryptographic functions used to protect secrets from the application user.We also have Implemented least privilege; restrict users to only the functionality, data and system information that is required to perform their tasks.
  </Accordion>

  <Accordion title="Have we implemented Email Gateway solution to block the SPAM emails? Have we implemented SPF/ DKIM/ DMARC effectively?">
    Yes. We have Implemented the SPF/ DKIM/ DMARC effectively.
  </Accordion>

  <Accordion title="What is the password standard for the applications users, administrators, network users, etc. please describe in details. How are initial passwords communicated to users? Are all new users issued random initial passwords? Are users forced to change their password upon first logon? How is user's identity verified prior to resetting a password? What is the minimum password length? After how many days does a password expire? How many passwords are stored in the password history? What is the number of invalid password attempts prior to lockout? Can PINs or secret questions be used as a stand-alone method of authentication?">
    We are compliant. We have implemented the Password Management Policy We store password hashed. We have SHA512 hash with unique salt for every password. The password needs to be minimum 8 characters long and should contain at least one capital letter, special characters among '# \$ % \* &' and 1 digit. Maximum Password Age is 45 days. User IDs and passwords transmit through stringent checks in an encrypted format that complies with the current Technical Security Baseline Standards. All the user can set their own password from the very first login attempt. Passwords once used cannot be reused with the password history technique in order to disallow the reuse of old passwords.
  </Accordion>

  <Accordion title="CSP ISO/IEC 27001/27002:2013 independent attestation, CSP ISO/IEC 27018:2014 independent attestation, CSP SOC 2 Type 2 independent attestation">
    [AWS is ISO 27001, ISO 27017, ISO 27701, SOC 2, PCI DSS Level 1 certified organization. Please click here for more information about AWS Audit and certification - https://aws.amazon.com/compliance/programs/](https://aws.amazon.com/compliance/programs/)
  </Accordion>

  <Accordion title="Will you notify FINCARE in case of any request to provide information, in the form of a subpoena, a warrant, or court order in which access to the FINCARE data is requested?">
    We inform Fincare if these regulatory authories agreed to inform.
  </Accordion>

  <Accordion title="Do you include right to audit by consumer to your environment?">
    Yes. 30 days prior notice and scope of the Audit needs to communicated.
  </Accordion>

  <Accordion title="Will you make necessary audit logs and activity monitoring available when requested?">
    We are a multi tenant SAAS system and all our logs will contain data of all customers. We will have our own log monitoring and security analysis.
  </Accordion>

  <Accordion title="Do you encrypt sensitive data in PaaS applications and storage and sensitive volumes in IaaS">
    Its a SAAS product and we use We use TLS1.2 encryption for Data in transit and AES256 for Data at rest.
  </Accordion>

  <Accordion title="Do you have controls in place to prevent data leakage or intentional/accidental compromise between tenants in a multitenant environment?">
    Yes
  </Accordion>

  <Accordion title="Does your data management policies and procedures address tenant and service level conflicts of interests?">
    Yes
  </Accordion>

  <Accordion title="Can you demonstrate the data sovereignty and residency issues and provide details of jurisdiction of data storage and the local laws applicable?">
    [We store data on AWS Singapore.AWS is ISO 27001, ISO 27017, ISO 27701, SOC 2, PCI DSS Level 1 certified organization. Please click here for more information about AWS Audit and certification - https://aws.amazon.com/compliance/programs/](https://aws.amazon.com/compliance/programs/)
  </Accordion>

  <Accordion title="Are these datacenters are owned by you? If not, provide the details of the datacenter service provider">
    We do not own the data centers. We deploy our application on AWS cloud virtual platform.
  </Accordion>

  <Accordion title="Datacenter security standard and procedure">
    [We store data on AWS Singapore.AWS is ISO 27001, ISO 27017, ISO 27701, SOC 2, PCI DSS Level 1 certified organization. Please click here for more information about AWS Audit and certification - https://aws.amazon.com/compliance/programs/](https://aws.amazon.com/compliance/programs/)
  </Accordion>

  <Accordion title="Third party assessment reports and attestations - ISO 27001, PCI DSS, etc">
    Attached the ISO27001:2013 certificate. We do not collect and store any Payment card details. PCI DSS is not applicable for us.
  </Accordion>

  <Accordion title="Any change to the design that impacts security posture of the system must be reviewed and approved by EIS Architecture Team, before a new component (e.g., custom built modules, 3rd party components, vendor supplied components) is released.">
    We inform the client if there is any changes of the design that impacts security posture of the system.
  </Accordion>

  <Accordion title="Minimum security standards and latest vendor security updates must be applied to all components. Wherever it is not supported or cannnot be applied, compensating controls must be evaluated with ISRA and implemented to reduce the risk.">
    We take steps to securely develop and test against security threats to ensure the safety of our customer data. We maintain a Secure development Lifecycle, in which training our developers and performing design and code reviews takes a primary role. In addition, Xoxoday employs third-party security experts to perform detailed penetration tests on different applications. application is ISO 27001, GDPR, CPRA/CCPA, CSA STAR certified.
  </Accordion>

  <Accordion title="Project teams must maintain: Accurate (Create/Update/Delete) inventories of project components that are required for application to be up & running (including Production & Non-Production).">
    Our technical team maintains these records.
  </Accordion>

  <Accordion title="Implement version control practices (for Source code, binaries, container images) to govern development and provide auditing. Ensure versions are stored in a centralized repository, the change can be reversed/ rolled back during a security incident.">
    We consuct the code review as per the compliance requirements and maintain the code repository. Attached the SDLC Proedures.
  </Accordion>

  <Accordion title="Applications should be architected with a minimum of three separate tiers: web, application, and storage/database.">
    Compliant.
  </Accordion>

  <Accordion title="All remote system administrative functionality and remote access to an operating system (e.g., RDP, SSH, etc.) must be disabled and not directly accessible from the Internet, and only PSJH Information Security-approved remote access technologies are allowed.">
    Since application is a SaaS Platform this would be not applicable.
  </Accordion>

  <Accordion title="All public IP addresses must be removed from the subscription, except those that were coordinated with and approved by PSJH Cloud Engineering and Information Security Architecture.">
    Since application is a SaaS Platform this would be not applicable.
  </Accordion>

  <Accordion title="Access to the PaaS must be provisioned using PSJH IAM team, privileged access should be determined by business justification, and granted by IAM.">
    Since application is a SaaS Platform this would be not applicable.
  </Accordion>

  <Accordion title="Ensure that all encryption and hashing methods comply with policies and organizational requirements for protection of information.">
    We are compliant with the requiremenrts.
  </Accordion>

  <Accordion title="If Cryptographic keys have to be tranferred manually, then encrypted channels to be used Eg., use Secure Email of O365, ProofPoint Secure Email.">
    We do not transfer manually. NA And we use Google workspace for emailing solution.
  </Accordion>

  <Accordion title="Ensure that the integrity of cryptographic key is protected while they are stored. Eg., use Hashing SHA256, Digital Signatures">
    cryptographic keys are protected. Compliant.
  </Accordion>

  <Accordion title="PHI, PII, and regulated or confidential data must use a minimum protocol of TLS 1.2, and an encryption algorithm and strength of AES-256 while in transit.">
    We do not store any PHI. The PII(name, email ID, phone#) are encrypted. We use TLS1.2 encryption for Data at transit and AES256 Data at rest for maximum security.
  </Accordion>

  <Accordion title="Application that handles PHI, PCI, PII (and other regulated data) must comply with applicable federal laws, Executive Orders, directives, policies, regulations.">
    We store only the PII(name, email ID, phone#) and does not store/process PHI & PCI. We are compliant with ISO 27001, CCPA/CPRA, EU GDPR, CSA etc. Attached these compliance certificates/audit reports.
  </Accordion>

  <Accordion title="File-integrity monitoring tools should be in place to monitor modifications to critical system files, configuration files, and content files (leverage Crowdstrike as applicable).">
    Yes, all the mechanisms related to security and policies are implemented to facilitate timely decision and investigation by root-cause analysis. These incidences are analyzed with network intrusion detection (IDS) tools.
  </Accordion>

  <Accordion title="Application must ensure that the information used for authentication must be securely stored and transmitted in an encrypted form using algorithms in accordance to the Providence's information security policy.">
    The information used for authentication is securely stored and transmitted. We store password hashed. We have SHA512 hash with unique salt for every password
  </Accordion>

  <Accordion title="The application must be partitioned into public and restricted areas using separate folders for authenticated and non-authenticated users.">
    Not applicable since application is a SaaS platform.
  </Accordion>

  <Accordion title="Mobile applications that are homegrown/ procured shall be released to caregivers via MDM & MAM solutions (such as Microsoft InTune).">
    At Xoxoday we use Google workspace and activated the MDM features. application also has iOS and Androind mobile applications.
  </Accordion>

  <Accordion title="The mobile application must time out after 15 or fewer minutes of inactivity, requiring a user to re-enter a password, PIN, or re-initiate a biometric authentication mechanism before application content can be viewed again.">
    This feature can be configured with the help of the MDM Solution that the customer use.
  </Accordion>

  <Accordion title="Code obfuscation is applied to native apps">
    At Xoxoday we use Google workspace and activated the MDM features.
  </Accordion>

  <Accordion title="Roles must be assigned to manage updates on the server, resources, and/or other supporting assets.">
    Compliant. We have segreated the roles and assign the responsibilities to our employees.
  </Accordion>

  <Accordion title="PSJH-managed EDR (running real-time scanning on a continuous basis) on the solution's servers, workstations, and/or other applicable devices is required.">
    Since its a Cloud hosted SaaS platform deploying of the application on cloud and server scannings are under the scope of Xoxoday.
  </Accordion>

  <Accordion title="PSJH-managed host-based firewall client is required on the solution's servers, workstations, and/or other applicable devices.">
    We use Web application firewall (WAF) and pfSense firewall for security reasons. 1. The Cloudflare Web Application Firewall (Cloudflare WAF) checks incoming web requests and filters undesired traffic based on the set of rules. 2. pfSense helps to monitors incoming and outgoing network traffic and decides whether to allow or block specific traffic based on a defined set of security rules.
  </Accordion>

  <Accordion title="Ensure the user session is invalidated on the server-side when the user logs out.">
    At xoxoday we monitor and maintain the logs. The Infrastructure logs are collected using the AWS Audit Trail, meanwhile the application related logs are collected in our Elastic Search server and retained in the long term cloud storage.
  </Accordion>

  <Accordion title="Implement REST and web services using session based authentication.">
    At Xoxoday we have implemented the Active directory and the system will get locked if its inactive for more than 15 mins and re-autentication would require.
  </Accordion>

  <Accordion title="Require a standardized approach to structured exception and error handling across all layers.">
    We have the process in place for standardized approach to structured exception and error handling across all layers.
  </Accordion>

  <Accordion title="All input validation failures must result in input rejection and must be logged.">
    At Xoxoday the validation has been done during the development and testing and we are compliant with the requirements.
  </Accordion>

  <Accordion title="Product Owners must integrate compliance of security requirements in corresponding criteria in Definition of Done (DoD). Any requirement & recommendations provided by EIS that are not met by the application will need to have a security exception through ISRA">
    At Xoxoday Security and compliance requirements are considered during the development stage and we are ISO 27001, CPRA, CSA STAR level 1, GDPR compliant.
  </Accordion>

  <Accordion title="Implement generic error or notification messages in applications to limit information useful for attacks.">
    We have implemented the controls to monitor the application and safegurd from the attacks. We use Amazon CloudWatch and Grafana polemique which allows us to monitor instances and alerts us through emails.
  </Accordion>

  <Accordion title="Manual input of file names and file paths must be avoided where possible.">
    Since application is SaaS Platform it would be not applicable.
  </Accordion>

  <Accordion title="Vulnerabilities are to be identified, reported, and remediated through the software-development life cycle. Effective utilization of enterprise SAST, DAST, OSA, IaC Security, Penetration Testing etc., to be adopted throughout the lifecycle of system development (and periodically).">
    We have implemented the Software Development Life Cycle (SDLC) procedure and attached the same for your reference. Vulnerability scanning gives us deep insight for quick identification of out-of-compliance or potentially vulnerable systems. In addition to our extensive internal scanning and testing program, Xoxoday employs third-party security experts to perform a vulnerability assessment and penetration testing. We remidiate or fixes the issues identified during the VA/PT assessment and make sure that the application is free from the vulnerabilities.
  </Accordion>

  <Accordion title="How do you handle data from Russia and China?">
    Since it's a SaaS platform and deployed on AWS cloud virtual platform Singapore region. All the data will be stored on AWS VPC.
  </Accordion>

  <Accordion title="Description of your general Security concept including on how you handle Confidentiality, Integrity and Availability.">
    Xoxoday is ISO 27001:2013 certified. An ISMS is a framework of policies and procedures that includes all legal, physical and technical controls involved in an organisation's information risk management processes with the aim of keeping information secure. With ISO's robust information security management system (ISMS) in place, you gain the additional reassurance that a full spectrum of security best practices is implemented across the organization Our Goal is to protect three aspects of information - Confidentiality: only the authorized persons have the right to access information. Integrity: only the authorized persons can change the information. Availability: the information must be accessible to authorized persons whenever it is needed.
  </Accordion>

  <Accordion title="What are the security controls and restrictions implemented to control the upload, download, viewing and modification of Infosys data (including structured and unstructured data e.g. emails, databases etc.) by users within your organization, including admin users?">
    We have implemented the Access control policy to control the upload, download, viewing and modification
  </Accordion>

  <Accordion title="Specify the frequency of AV scans and list down the events/scenarios that triggers the scans">
    AV Scans takes place every week and users also can scan it whenever they can scan the machine. We have prescheduled the scanning once in a week.
  </Accordion>

  <Accordion title="In a multi tenant model, please explain what controls are present to prevent infections spreading across to Infosys specific applications/infra from other tenants/customers sharing the same infrastructure?">
    We are using linux operating system which is inherently secure along with security practices like web application firewall etc We make sure that the customer data is well segregated and compartmantalized
  </Accordion>

  <Accordion title="Have there been any information security breaches within the organization in the last 1 year (even if they did not impact Infosys)? If yes, please detail out the corrective and preventive actions taken by the organization to strengthen the information security program.">
    No Breaches taken place.
  </Accordion>

  <Accordion title="Provide details about the Information security framework and controls that are deployed within your organization to safeguard Infosys data and ensure compliance to applicable industry standards">
    We are having Robust Information security compliance framework and we are ISO 27001:2013 and GDPR complied. We follow all the applicable infosec compliance requirements to comply with the regulations
  </Accordion>

  <Accordion title="Is cyber security compliance review of application and risk assesement conducted atleast annually?">
    We conduct the Risk assessment and compliance review on annual basis as per the compliance requirements.
  </Accordion>

  <Accordion title="Are cyber security compliance review findings mitigated? Please highlight any open points.">
    Yes. All the compliance and audit findings has been mitigated.
  </Accordion>

  <Accordion title="Are detected vulnerabilities patched timely?">
    All the vulnerabilities identified during the assessment has been fixed.
  </Accordion>

  <Accordion title="Is anti-malware and anti-virus installed on servers and development machines?">
    We use Bitdefender end point security and installed on servers and development machines.
  </Accordion>

  <Accordion title="Is anti-malware and anti-virus updated regularly?">
    Its updated on regular basis.
  </Accordion>

  <Accordion title="Are the duties for application access and environment segregated and supported with a documented authorization matrix?">
    Our roles and job duties are segregated through role-based access to ensure maximum security. Access to data and systems are based on the principles of least privilege for access. A strong identification and authentication system and logging systems are deployed and provides a centralized control to administer, monitor and review all critical access events.
  </Accordion>

  <Accordion title="Is the code restricted from publicly available?">
    Its restricted and not available to the public.
  </Accordion>

  <Accordion title="Is the application server are hardened for security and maintained?">
    We follow the best practices ans servers are hardened for security reasons.
  </Accordion>

  <Accordion title="Is the database server comply with identity and access control policy?">
    We have implemented the Identity access management (IAM) and follow the Access control policy.
  </Accordion>

  <Accordion title="Is the database server comply with password policy?">
    At Xoxoday we follow the password policy.
  </Accordion>

  <Accordion title="Is the database server have latest operating system, licensed and supported?">
    We have deployed our application on AWS Virtual platform cloud - Singapore region.
  </Accordion>

  <Accordion title="Is application server configuration is backed-up and can be restored within RPO and RTO?">
    RTO and RPO is 60 Minutes.
  </Accordion>

  <Accordion title="Is incidents are logged, investigated and reported timely?">
    We have implemented the Incident Management Procedure and attached the same for your reference.
  </Accordion>

  <Accordion title="Explain the limitations to how the customer can use the service as outlined in the provider's acceptable usage policies, licensing rights or other providers usage restrictions.">
    Since application is a SaaS product and the customer can use the product and services as soon as subscribed for application product usage. the customer will have the legal rights to use the Product.
  </Accordion>

  <Accordion title="What advance notice will be provided by the provider for any change of terms?">
    We do not change the terms frequently. We will provide 30 days' notice period for any changes of terms.
  </Accordion>

  <Accordion title="Does the contract/terms of service outline meaningful liability for the provider in the event that the the customer environment/data is breached?">
    We notify Client in case of any unauthorized disclosure of or breach of any confidentiality obligation of Xoxoday with respect to Confidential Information, data or information of Client and Xoxoday shall take all necessary and required steps and measures to mitigate such unauthorized disclosure or breach and shall co-operate with Client , at Xoxoday 's cost, to mitigate or control the loss or liability arising out of such disclosure or breach and to retrieve such data or information.
  </Accordion>

  <Accordion title="Does the provider have an active SLA in place that identifies minimum performance (e.g., uptime, etc.)?">
    Yes. have an active SLA in place that identifies minimum performance of the Product.
  </Accordion>

  <Accordion title="Describe the SLA">
    We have the SLA in place. application endeavours to provide 99.9% Uptime each month 24 hours a day 7 days a week. Uptime is measured based on the monthly average of availability.
  </Accordion>

  <Accordion title="Does the provider provide regular service management reports (e.g., SLA performance)? If so, state the frequency of such reporting.">
    We would be able to provide a report on need basis.
  </Accordion>

  <Accordion title="Describe penalties associated with SLA non-compliance.">
    No penalties are associated with SLA.
  </Accordion>

  <Accordion title="Does the provider monitor service continuity with upstream providers in the event of provider failure?">
    We monitor the service continuously and make sure that the product and service is available to use all the time. We have a documented Business Continuity and Disaster Recovery Plan defined and implemented to enable people and process support during any crisis or business interruptions.
  </Accordion>

  <Accordion title="Do we have the planed downtime scheduled (e.g., service, upgrade, patch, etc.)?">
    Since our services are delivered via. Web, the upgrades and updates to the services are seamless and usually do not involve any actions from the end-users.
  </Accordion>

  <Accordion title="Are the same security controls implemented at the failover site as that of primary site?">
    Yes.
  </Accordion>

  <Accordion title="Are the provider's routine maintenance windows manageable for the customer?">
    Our architecture goes through constant upliftment and experiences no downtime during upgrades and maintenance windows. If there is any major activity and the service will be unavailable, the Maintenance hours were communicated well in advance at least 3-4 day by application.
  </Accordion>

  <Accordion title="Describe the process to terminate the service">
    Termination clause will be the part of Master Service agreement and both the parties can review and agree during entering into an agreement.
  </Accordion>

  <Accordion title="Can the customer data and the service be moved/transferred to another provider at any time?">
    Since it's a SaaS product, this is not applicable.
  </Accordion>

  <Accordion title="Does the customer have the right to terminate if the provider introduces material modifications to service terms?">
    Termination clause will be the part of Master Service agreement and both the parties can review and agree before entering into an agreement.
  </Accordion>

  <Accordion title="What standards does the provider follow for application development? Do these include rigorous testing and acceptance protocols?">
    Yes. changes to the production environment or development are documented, tested, and approved prior to implementation or any new releases. We conduct internal reviews and audited by the external auditors for our security standard certification. We conduct periodical Vulnerability assessment and Penetration Testing from the Industry approved authorized vendor to make sure that all the vulnerabilities are closed and having secured applications.
  </Accordion>

  <Accordion title="Where and how will the customer data be stored? Are there impacts on security in light of the differences in legal/regulatory compliance requirements depending on storage location?">
    the customer data will stored on AWS virtual platform cloud Singapore. There is no impact on security.
  </Accordion>

  <Accordion title="Does the provider have a cyber plan in place? If so, please provide details.">
    At Xoxoday we have implemented the Cyber Crisis Management Plan to provide and support capability for reporting and responding to cyber security incidents, to eliminate or minimize impacts of such incidents
  </Accordion>

  <Accordion title="Have there been any major security incident(s) reported with the provider in the last two years? If so, detail the incident(s) and resolution(s)">
    No.
  </Accordion>

  <Accordion title="What activities are logged by the provider? Consider: Network traffic, file and server access, Security systems">
    We monitor the logs on regular basis with regards to network, file and server, and security system. To provide more information, the infrastructure logs are collected using AWS Audit Trail and Application related logs are collected in our Elastic Search server and retained in long term cloud storage.
  </Accordion>

  <Accordion title="Does the provider's logging and monitoring framework allow isolation of an incident to specific tenants? (2)">
    No. Since we are a multi-tenant system, our logs contain information of all the tenants. We cannot isolate a single customer's information from our logs.
  </Accordion>

  <Accordion title="Who can set up activities to be logged?">
    At Xoxoday the Audit logs reviewed on a regular basis for security events. audit logs are set up, reviewed by our Technical team and logs are recorded on a regular basis automatically. These logs are integrated with security operations/SIEM solutions.
  </Accordion>

  <Accordion title="What is the provider's incident response procedure for handling a security or data breach?">
    We are GDPR Compliant. Our information security team and Customer support team will inform the POC of Client via email communication with Preliminary Incident Synopsis and Root Cause Analysis report (RCA) including the details of Business Impact, Issue Description, Root Cause, and Corrective Actions.
  </Accordion>

  <Accordion title="Does the provider's incident response plan comply with industry standards for legally admissible chain-of-custody management processes and controls?">
    Yes. We have implemented the incident response plan and it complies with industry standards ISO 27001:2013, SOC-2, GDPR.
  </Accordion>

  <Accordion title="When are audits conducted (i.e., frequency)? What standard/certification is used to conduct audits (e.g., ISO 27001, SSAE 16 SOC 2, etc.)? Will the customer receive a copy of the audit report when finalized? Is this requirement outlined in the contract with the service provider?">
    We are ISO 27001:2013 certified and attached the certificate.
  </Accordion>
</AccordionGroup>


# HR Compliance
Source: https://help-plum.xoxoday.com/faq/security-compliance/hr-compliance

Find answers to frequently asked questions about Plum's HR compliance practices and internal employment-related policies.

<AccordionGroup>
  <Accordion title="Do you perform background screenings for applicants, including criminal, credit, professional/academic, references and drug screening? Are they applicable to all employees, contractors, vendors, and others who may have access to your systems, applications, and devices? Are there any exceptions?">
    Each employee undergoes a process of background verification. We hire reputed external agencies to perform this check on our behalf. We do this to verify their criminal records, previous employment records, if any, and educational background. Until this check is performed, the employee is not assigned tasks that may pose risks to users. There will be exception and it applies to all the employees, contractors, vendors, and others who may have access to your systems.
  </Accordion>

  <Accordion title="Does the organization perform appropriate background verification for employees related to the customer scope of work?">
    Yes, we conduct background verification of all the employees
  </Accordion>

  <Accordion title="Does the organization require background verification and criminal history checks for all candidates for employment, contractors and third party vendors?">
    Yes. We conduct Background verification criminal history checks for all candidates for employment, contractors and third party vendors
  </Accordion>

  <Accordion title="Is there a structured process with defined responsibilities for removal of access rights & revoking of assets when person leaves the customer scope of work?">
    Yes. We have the procedure for exit clearance and we will remove all the access provided and take all the assets back from the employees.
  </Accordion>

  <Accordion title="Are all employees, contractors and agency staff subject to background checks prior to employment?">
    We do conduct employees and contractors background verification as per the compliance requirements
  </Accordion>

  <Accordion title="Are employees mandated to sign a non-disclosure or confidentiality agreement/NDA/Code of conduct?">
    As a part of onboarding process all the employees are mandated to sign a non-disclosure agreement
  </Accordion>

  <Accordion title="Do you have an information security awareness program mandatory for all staff (employees and contractors)? Are all staff required to take the information security awareness trainings and sessions?">
    As part of the employee on-boarding process, all new joinees are provided with awareness training on information security and privacy requirements at Freshworks. Annually a refresher training is conducted for all the employees. In addition, on a need basis, role-based information security and data privacy training are provided to different teams.
  </Accordion>

  <Accordion title="Has disciplinary process been defined as part of Security policy or HR policy for employees who have committed a security breach? Are the employees aware of the fact that in case they breach security there could be a disciplinary action taken against them?">
    The disciplinary process has been documented and communicated to the employees. As a part of on boarding process we also have taken Information security declaration form from all the employees and made it mandatory. All the employees are aware that in case of any breach the desciplinary action will be taken against them,
  </Accordion>

  <Accordion title="Is there a formal user registration and de-registration process implemented to enable assignment of access rights?">
    User registration and de-registration process is a part of Onboarding and Offboarding.
  </Accordion>

  <Accordion title="Are efforts being made to decrease spread of respiratory infections by improving hygiene practices at work and educating employees on the importance controlling infections at work by adopting correct hygiene practices">
    We have provided WFH option to all our employees and also we follow hygiene practices at work and educating employees on the importance controlling infections at work by adopting correct hygiene practices
  </Accordion>

  <Accordion title="Is the Organisation restricting travel into affected geographic areas. Issue guidance for employees working in or near an affected area when an outbreak begins. Also issue guidance for employees returning from affected areas.">
    We have taken a approriate measures and stopped travelling due to an outbreak. All the employees are working from home and issued guidelines to get protected from the current situation.
  </Accordion>

  <Accordion title="Is the Organisation providing sufficient and accessible infection control supplies, such as alcohol-based hand gel, tissues and disposable masks if recommended, as well as instructional signs that display correct infection control procedures.">
    We are compliant.
  </Accordion>

  <Accordion title="Does the organisation ensure that building maintenance and cleaning services incorporate recommended infection control procedures.">
    We are compliant.
  </Accordion>

  <Accordion title="What hiring criteria used for employing or contracting Supplier personnel (background check)?">
    YES. We conduct the mandatory background verification.
  </Accordion>

  <Accordion title="Provide an overview of your on-boarding and off-boarding process, describing the NDA your employees are required to sign upon employment, the agreed delay to disable an account upon contract termination, etc...">
    Each employee undergoes a process of background verification. We hire reputed external agencies to perform this check on our behalf. We do this to verify their criminal records, previous employment records if any, and educational background. Until this check is performed, the employee is not assigned tasks that may pose risks to users. All new hires are required to sign Non-Disclosure and Confidentiality agreements. The Employee expressly agrees that he/she shall not use Confidential Information provided by the Company in the development or delivery or for personal gain from providing any products or services for his/her own account or for the account of any third party.
  </Accordion>

  <Accordion title="Confirm if there is any background verification of your employment candidates">
    Yes. We conduct the background verification of all our employees.
  </Accordion>

  <Accordion title="Does the background check for all the employees accessing and handling the organisation's information?">
    We performs background checks for all the employees in accordance with law. The background check includes criminal, education, and employment verification etc.
  </Accordion>

  <Accordion title="Are there awareness training sessions on remote working guidelines, social engineering, etc. conducted? What is the periodicity of training?">
    We conduct ISMS training for all the employees. The frequency of the training will be annually.
  </Accordion>

  <Accordion title="Does the process of employyes background verification check in place?">
    Yes. We conduct the background verification of all the employees.
  </Accordion>

  <Accordion title="What kind of cloud security awareness you provide to your administrators?">
    We provide mandatory security and awareness training to all our employees and spread awareness about the information security accrross the organization.
  </Accordion>

  <Accordion title="Are your admins are cloud certified?">
    Yes. Our employees are having required education and certifications to perform the job.
  </Accordion>

  <Accordion title="Except information security governance being in place, the Vendor has competent and security aware people as a part of the information security program used in protecting the service.">
    Each employee, when inducted, signs a confidentiality agreement and acceptable use policy, after which they undergo training in information security, privacy, and compliance. Furthermore, we evaluate their understanding through tests and quizzes to determine which topics they need further training in. We provide training on specific aspects of security that they may require based on their roles. All our engineers and other employees who suports application service are having appropriate education and skillset to perform the job.Each employee undergoes a process of background verification. We hire reputed external agencies to perform this check on our behalf. We do this to verify their criminal records, previous employment records, if any, and educational background. Until this check is performed, the employee is not assigned tasks that may pose risks to users.
  </Accordion>

  <Accordion title="Are all employment candidates, contractors and involved third parties subject to background verification (as allowed by local laws, regulations, ethics and contractual constraints)?">
    Yes
  </Accordion>

  <Accordion title="Are all personnel required to sign Confidentiality Agreements to protect customer information, as a condition of employment?">
    Yes. All the employees and third party service providers are required to sign Confidentiality Agreements to protect customer information as per ISMS compliance requirements.
  </Accordion>

  <Accordion title="Supplier Security Relationship – Indicate for processors requiring access to data, the security controls and arrangements carried out as regards such access">
    We conduct Background verification of the vendors before onboarding. We have implemented Supplier Management Procedure, and this is applicable to all suppliers delivering various products and services with respect to delivery functions and support functions including Finance, Legal, Human Resources, IT Infrastructure. We are having contracts or agreements and non-disclosure agreements with all our suppliers Xoxoday monitors supplier services and compliance requirements and review each supplier annually with respect to the services delivered by the supplier. The review frequency could be changed based on the criticality of the services provided. Validation of suppliers related documentations are also part of our internal and external Audits.
  </Accordion>

  <Accordion title="Service provider shall perform criminal record check, security clearance and other background screening for all his staff who may handle or come in contact with the customer data or systems. Only staffs that pass these checks should be allowed to interact with the customer data or systems">
    It's a part of our recruitment process. Attached the Background Verification Procedure
  </Accordion>

  <Accordion title="Does your organization perform background checks to examine and assess an employee's or contractor's work and criminal history? Are particular sensitive positions subject to periodic follow-up background checks? i.e. Credential verification, criminal history, credit history and references">
    Each employee undergoes a process of background verification. We hire reputed external agencies to perform this check on our behalf. We do this to verify their criminal records, previous employment records if any, and educational background. Until this check is performed, the employee is not assigned tasks that may pose risks to users.
  </Accordion>

  <Accordion title="Do you have formal staff vetting policy?">
    Yes. We have a Recruitment policy.
  </Accordion>

  <Accordion title="Have all staff undergone State and/or National Police Checks?">
    Yes. We conduct background verification of all the employees before onboarding.
  </Accordion>

  <Accordion title="Each individual working on the application shall undergo security awareness training (including but not limited to: Developers, Business Analysts, Testers, Managers, Hosting, Network, Infra teams, senior executives, and contractors). Role-based security training to personnel with assigned security roles and responsibilities, Before authorizing access to the information system or performing assigned duties; a. As part of initial training for new users; b. When required by information system changes; and c. Before authorizing access to the information system or performing assigned duties d. Annually thereafter.">
    Each employee, when inducted, signs a confidentiality agreement and acceptable use policy, after which they undergo training in information security, privacy, and compliance. Furthermore, we evaluate their understanding through tests and quizzes to determine which topics they need further training in. We provide training on specific aspects of security that they may require based on their roles. We also conduct the annual training for all the employees thereafter.
  </Accordion>

  <Accordion title="Has management actively informed employees of their responsibility, to report incidents or suspected incidents involving Personal Data?">
    Yes. We have communicated to all the employees and conducting periodical Awareness training to spread awareness and the employees are well aware of Incident reporting system.
  </Accordion>
</AccordionGroup>


# Identity and Access Management
Source: https://help-plum.xoxoday.com/faq/security-compliance/identity-and-access-management

Find answers to frequently asked questions about Plum's identity and access management practices and internal security controls.

<AccordionGroup>
  <Accordion title="Do you enforce two-factor authentication for privileged account management/authentication while accessing tenant data/systems?">
    Yes, our policies and procedures are established and implemented to enforce two-factor authentication for privileged account management/authentication while accessing tenant data/systems.
  </Accordion>

  <Accordion title="Do you retain logs for all login attempts for a given time period or as required by the tenant?">
    Yes, systems must be configured to log all successful and unsuccessful login attempts by accounts with privileged access. These authentication logs must be retained for a minimum of 180 days and in accordance with the Company's records retention guidelines.
  </Accordion>

  <Accordion title="Does the solution provide re-authentication at the time of an attempted change to authentication information?">
    Yes, users can re-authenticate a change in credentials and we comply to any attempted change in authentication information.
  </Accordion>

  <Accordion title="Can you provide the capability to present with a login notice to the intended users before being given the opportunity to log onto a system?">
    No, we do not present login notices to users before they log in as the users are redirected through SAP SuccessFactors.
  </Accordion>

  <Accordion title="Do you have controls in place to restrict any information beyond notification of an unsuccessful login attempt prior to successful login?">
    Yes, there is a protocol in place to ensure that no information beyond an unsuccessful login attempt goes through prior to a successful login.
  </Accordion>

  <Accordion title="Do you support use of, or integration with, existing customer-based Single Sign On (SSO) solutions to your service?">
    Yes, our partnerships with a wide array of integration partners ensure existing customer based Single Sign On (SSO) capability for all users to seamlessly use Xoxoday's products. With an easy DIY setup, your SSO solution would be plugged in and ready to go. Please refer to our list of integrations to know more.
  </Accordion>

  <Accordion title="Do you support identity federation standards (SAML 2.0, SPML, WS-Federation, etc.) as a means of authenticating/authorizing users?">
    Yes, our identity federation standards include SAML 2.0, SPML, WS-Federation and more as means of authenticating and authorizing users with airtight security protocol.
  </Accordion>

  <Accordion title="What levels of isolation are used for virtual machines, physical machines, network, storage (e.g., storage area networks), management networks and management support systems, etc.?">
    We isolate our machines, network and storage with respect to the AWS Standards in order to keep it safe and secure.
  </Accordion>

  <Accordion title="Do you allow tenants to use third-party identity assurance services?">
    No, tenants are only allowed to use our secure protocols and procedures to prevent cracks and folds in data handling.
  </Accordion>

  <Accordion title="Do you support tenant's access review policy?">
    Yes, we do support our clients' and tenants' access review policies.
  </Accordion>

  <Accordion title="Do you support password (minimum length, age, history, complexity, and expiration) and account lockout (lockout threshold, lockout duration) policy enforcement?">
    Our password setting requirements comply with all factors to ensure that strong passwords are created. Passwords should be of a minimum length and contain special characters, capitalized letters, and alpha-numeric combinations.
  </Accordion>

  <Accordion title="Do you allow tenants/customers to define password and account lockout policies for their accounts?">
    No, customers/tenants must comply with Xoxoday's account lockout and password polices that have been incorporated for maximum security.
  </Accordion>

  <Accordion title="Do you support the ability to force password changes upon first login?">
    No, the user can set their own password from the very first login attempt.
  </Accordion>

  <Accordion title="Do you have mechanisms in place for unlocking accounts that have been locked out (e.g., self-service via email, defined challenge questions, manual unlock)?">
    No. As Xoxoday's products use single sign on (SSO), the users can login via their suite email and credentials.
  </Accordion>

  <Accordion title="Are audit logs reviewed on a regular basis for security events (e.g., with automated tools)?">
    Yes, audit logs are reviewed and recorded on a regular basis automatically. These logs are integrated with security operations/SIEM solutions.
  </Accordion>

  <Accordion title="Is the option of physical and logical user audit log access restricted to authorized personnel only?">
    Yes, to ensure the maximum safety and authority of data in right hands, the physical and logical adult log access of users can only be accessed by authorized personnel.
  </Accordion>

  <Accordion title="Do you support the integration of audit logs with tenant Security Operations/SIEM (Security Information and Event Management) solution?">
    No, logs are automatically audited, but are not integrated with tenant's security ops. In case the tenant requests for logs, they can shared when asked for by the clients.
  </Accordion>

  <Accordion title="Are audit logs centrally stored and retained?">
    Yes, regular audit logs are stored with Xoxoday and retained for future references.
  </Accordion>

  <Accordion title="Describe how event logs are protected from alteration including how access to these logs is controlled.">
    The event logs are stores in a bucket wherein nobody can access them without an approval from the high authorities i.e. the Chief Technical Officer.
  </Accordion>

  <Accordion title="Are file integrity (host) and network intrusion detection (IDS) tools implemented to help facilitate timely detection, investigation by root cause analysis, and response to incidents?">
    Yes, all the mechanisms related to security and policies are implemented to facilitate timely decision and investigation by root-cause analysis. These incidences are analyzed with network intrusion detection (IDS) tools.
  </Accordion>

  <Accordion title="Describe the process for investigating all data breaches and security violation events. Describe the process for informing TCCC of the breach, root cause analysis, and remediation.">
    Please refer to: "Threat & Vulnerabilities Management Procedures".
  </Accordion>

  <Accordion title="Does your logging and monitoring framework allow isolation of an incident to specific tenants?">
    Yes, in case specific incidents arise for particular tenants, our logging and monitoring framework allows isolation of incidents.
  </Accordion>

  <Accordion title="Are policies and procedures established and measures implemented to strictly limit access to your sensitive data and tenant data from portable and mobile devices (e.g., laptops, cell phones, and personal digital assistants (PDAs)), which are generally higher-risk than non-portable devices (e.g., desktop computers at the provider organization's facilities)?">
    Yes, there are measures to limit the access of tenant's data from non-authorized devices. Please refer to "Access Control Procedures".
  </Accordion>

  <Accordion title="Does the solution support disabling of dormant accounts (User accounts that have not been used within a minimum of 90 days)?">
    No. In case the accounts are deactivated or dormant, they would still be in the Xoxoday's domain. The admin would have to manually reach out and disable the accounts that they wish to declare dormant or inactive.
  </Accordion>

  <Accordion title="Does the solution maintain a password history technique in order to disallow use of any cyclic passwords?">
    Yes. Passwords once used cannot be reused with the password history technique in order to disallow the reuse of old passwords. Please refer to "Password Management Policy".
  </Accordion>

  <Accordion title="Is there an approval process for access requests to systems handling personal data?">
    Yes, with access control limit, super admins and admins can give out access to authorized individuals as per requests raised by them in order to handle their platform as well as the personal data accordingly.
  </Accordion>

  <Accordion title="Is access to systems containing personal data granted using a role-based criteria?">
    Yes, the role of "admin" and "super admin" holds the high regards and these roles can process the personal data of users as per their choice with the access control limit capability.
  </Accordion>

  <Accordion title="Is all Personal Data registered in a standard repository?">
    Yes, personal data is stored are registered databases that comply to all necessary inputs of a standard inventory repository.
  </Accordion>

  <Accordion title="Are credentials stored in a centralized system that is TCCC approved?">
    Yes, all the given credentials are safely stored in a TCCC-approved centralized system in order to securely process the personal data.
  </Accordion>

  <Accordion title="Do you design and implement controls to mitigate and contain data security risks through proper separation of duties, role-based access, and least-privileged access for all personnel within your supply chain?">
    Yes, our roles and job duties are segregated through role-based access to ensure maximum security of tenants' databases.
  </Accordion>

  <Accordion title="Will you share user entitlement remediation and certification reports with your tenants, if inappropriate access may have been allowed to tenant data?">
    Yes, in case an incident occurs with respect to inappropriate access of data, we shall share the reports.
  </Accordion>

  <Accordion title="Do you support tenant's multifactor authentication (e.g., RSA Secure ID, PKI Certificates, out of band pin comprised of at least 6 digits, etc.)?">
    Yes, we do support measures to enforce strong multifactor authentication when it comes to accessing highly restricted data.
  </Accordion>

  <Accordion title="Do you support access to tenant-sensitive data by only tenant's managed devices?">
    No, the data can be accessed by Xoxoday's authorized personnel to serve you better with maximum security.
  </Accordion>

  <Accordion title="What controls are in place to prevent unauthorized access to your application, program, or object source code, and assure it is restricted to authorized personnel only?">
    We have AWS Identity and Access Management (IAM). Access to data and systems is based on the principles of least privilege for access. Accordingly, all information systems and data are classified and further segregated to support role-based access requirements. A strong identification and authentication system and logging systems are deployed and provide centralized control to administer, monitor, and review all critical access events.
  </Accordion>

  <Accordion title="Provide a description of the physical security of your Datacenter both inside (security mechanisms and redundancies implemented to protect equipment from utility service outages like for example, power failures, network disruptions, etc.) and outside the DataCenter itself (fences, security guards or patrols, reception desk, authentication mechanisms, etc.) as well as the procedure applied to authorize personnel to enter the premises and how often the authorizations are reviewed?">
    AWS is responsible for providing physical security to the data center as we have deployed our application on AWS. AWS provides physical data center access only to approved employees. All employees who need data center access must first apply for access and provide a valid business justification. These requests are granted based on the principle of least privilege, where requests must specify to which layer of the data center the individual needs access and are time-bound. Requests are reviewed and approved by authorized personnel, and access is revoked after the requested time expires. Once granted admittance, individuals are restricted to areas specified in their permissions. Third-party access - Third-party access is requested by approved AWS employees, who must apply for third-party access and provide a valid business justification. These requests are granted based on the principle of least privilege, where requests must specify to which layer of the data center the individual needs access, and are time-bound. These requests are approved by authorized personnel, and access is revoked after request time expires.
  </Accordion>

  <Accordion title="Do you have a formal process to manage the termination and or transfer of employees? i.e. All equipment is returned, user ID's disabled in systems, Windows, badges, and/or keys returned. On Transfer is existing access reviewed for relevance?">
    Yes, we have implemented the process for termination from employment. Once the employee is terminated all the access will be revoked, IDs are disabled, assets are returned and recorded as a part of the exit clearance. We have implemented the access control procedure and all the access will be revoked upon termination or transfer of an employee as per the compliance requirements.
  </Accordion>

  <Accordion title="Are employees required to use a VPN when accessing the organization's systems from all remote locations?">
    Yes. We use a cloud-hosted VPN with strict access controls to allow our employees to access the official network.
  </Accordion>

  <Accordion title="Is a security operations center implemented to monitor the software solution?">
    Yes, We have implemented the security operations center to monitor, prevent, detect, investigate, and respond to cyber threats around the clock.
  </Accordion>

  <Accordion title="What controls are in place to prevent unauthorized access to your application, program, or object source code, and assure it is restricted to authorized personnel only? (2)">
    We have AWS Identity and Access Management (IAM). Access to data and systems is based on the principles of least privilege for access. Accordingly, all information systems and data are classified and further segregated to support role-based access requirements. Furthermore, while defining job roles and designing access roles, privileges leading to conflicts of interests are to be avoided. A strong identification and authentication system and logging systems are deployed and provides a centralized control to administer, monitor and review all critical access events.
  </Accordion>

  <Accordion title="Do you support identity federation standards (e.g., SAML, SPML, WS-Federation, etc.) as a means of authenticating/authorizing users? (2)">
    our identity federation standards include SAML 2.0, SPML, WS-Federation and more as means of authenticating and authorizing users with airtight security protocol
  </Accordion>

  <Accordion title="Are employees required to use a VPN when accessing the organisation's systems from all remote locations? (2)">
    We use a cloud hosted VPN with strict access controls to allow our employees to access the official network.
  </Accordion>

  <Accordion title="Is wireless access allowed in your organisation?">
    Wireless access is allowed and handled with high quality routers, password protection and restriction on internet usage etc.
  </Accordion>

  <Accordion title="Is there a role based access control & structured process for creation of new user account for the customer operations? Are all users identified to the system by a unique User ID?">
    All our employees are having a unique email IDs and we have implemented the role based access control. Our product team will create an account for the admin users and the password can be changed immediately.
  </Accordion>

  <Accordion title="Is there a well-defined process for removing the user account and access rights at the time of an employee leaving the vendors the customer processing facility?">
    Yes, we have the exit procedure and all the access provided to an employee will be removed or deleted.
  </Accordion>

  <Accordion title="Is there a periodic audit of the user access profile by the SPOC / system administrator?">
    Yes. We review the access provided every month and the SPOC will be our system administrator.
  </Accordion>

  <Accordion title="Is there an automatic lockout for predefined number of unsuccessful attempts?">
    Yes. We have defined the number of unsuccessful attempts. After 3 unsuccessful logins the account will get locked.
  </Accordion>

  <Accordion title="Are different accounts used for applications and OS level access?">
    Yes, we have the different levels of access. For Ex - Admin, users.
  </Accordion>

  <Accordion title="Does the system prompt the change of user passwords at predefined intervals?">
    Yes. Every 90 days
  </Accordion>

  <Accordion title="How does the password reset process work? Is a secure password distribution mechanism in place?">
    We will get an email for resetting the password. Once we click on it it will take us to a different window and provide an option to change or reset the password.
  </Accordion>

  <Accordion title="Is there a defined process for installing & encrypting wireless access points, if any used by vendor?">
    We use only internet connection through wifi and only after the approval process IT Team will provide an access.
  </Accordion>

  <Accordion title="Are following actions performed on all systems used for the customer operations - Restricted access to shared folders, Restricted USB/CD access, Internet access on need basis, admin privileges restricted">
    Yes. We have all these controls. We have restricted access to shared folders, USB or external drives, Internet access and privileges access.
  </Accordion>

  <Accordion title="Is an inventory of all information assets (e.g. documents, USB devices, passwords etc) provided to employees tracked? Is the return of assets tracked?">
    Yes. We have a track of all these information and we will remove the access once the empoyee left the organization.
  </Accordion>

  <Accordion title="Is there a mechanism for different levels of administrator privileges for system access on the customer specific servers? Is it configured in a secure manner?">
    Yes, we have different level of access like Admin and users and its configured in a secured manner.
  </Accordion>

  <Accordion title="Is inactivity timeout period specified for the customer applications?">
    It's an application and it supports SSO and Active directory. Time our period that we configure in SSO/AD would apply.
  </Accordion>

  <Accordion title="Is development area segregated from work area? Are proper access controls implemented for development areas?">
    Yes. We have segregated the areas. We have implemented the controls for having the access only to an authorised individuals for production area.
  </Accordion>

  <Accordion title="Are all production hardware, including, but not limited to, network devices, storage, database servers, and application equipment, located in a restricted area with physical access controls?">
    Yes, we have the controls.
  </Accordion>

  <Accordion title="Groups of information services, users and information systems shall be segregated on networks.">
    Yes. We have segregated the users.
  </Accordion>

  <Accordion title="a) Whether Desktop/ Laptop sharing is allowed? b) Whether data card is accessible on desktop/ laptop? c) Whether software installation permissions present on desktop/ laptop?">
    Sharing device is not allowed. All the permisson needs to be taken from the IT Team. Not provided these access to the employees.
  </Accordion>

  <Accordion title="What controls are in place to provide logical segregation of duties at CSP end in shared environment?">
    We have different levels of users and only upon approval and need basis will get access.
  </Accordion>

  <Accordion title="How vendor is performing logging and monitoring of privilege access (if any) at Cloud environment?">
    At Xoxoday for all the critical applications the 2FA has been enabled.
  </Accordion>

  <Accordion title="By any mean, does the vendor/ CSP having access to the customer data? For what purpose?">
    only Xoxoday authorised individual will have an access
  </Accordion>

  <Accordion title="Are external drives such as CDs and USB drives disabled on all desktops and laptops, servers containing personal data, customer data, business data?">
    All the computer machines are restricted with Access to CDs, USB or any other hard drives. We do not grant access for security reasons.
  </Accordion>

  <Accordion title="Are photographic, video, audio or other recording equipment, such as cameras in mobile restricted to be carried inside secure areas/ work areas/ information processing facilities? Are vacant secure areas physically locked and periodically reviewed?">
    The secured areas are restricted and does not have access with electronic devices or mobiles. These areas are physically locked and periodically reviewed as a part of internal and external audits. Also these restricted area are secured with CCTV cameras and monitored 24\*7 for security reasons.
  </Accordion>

  <Accordion title="Are procedures defined and followed for employees for removal of all access rights (Logical Access and Physical Access) provided to them during course of employment?">
    We have implemented the access control procedure and we revoke the access rights of the employees when not needed or termination from the employment. Access granted and revoked will be reviewed regularly and validated during the internal and external audits.
  </Accordion>

  <Accordion title="Are the system utility programs that could be used to override system and application controls strictly controlled and their use restricted and that admin privileges are not assigned to all users?">
    Access to the systems are based on the principles of least privilege for access. All the users have restrictions on installing and uninstalling the application/softwares, they are not provided with Admin access. Admin access will be with the the IT support head and will not be available for the normal users.
  </Accordion>

  <Accordion title="Are there documented procedures in place regarding steps to be followed for voluntary and involuntary employee terminations (unnecessary user entitlements) including access revocations? Are cases of voluntary or involuntary terminations addressed immediately and access is revoked immediately? Do you agree to inform BSLI incase of any involuntary termination of an employee working on client account immediately or within a reasonable timeframe incase of voluntary termination or reassignment of staff member?">
    We remove the access immediately after termination of an employees as a part of exit procedures. We inform the BSLI incase of any involuntary termination of an employee working on client account within a reasonable timeframe
  </Accordion>

  <Accordion title="Are user access provisions monitored and reviewed on an ongoing basis (Access reconciliation review) to ensure additions, deletions and changes to the accounts and access rights are properly tracked?">
    We have implemented the role based access control policy. We regularly monitor the user access controls and make neccessary reconciliation for security reasons.
  </Accordion>

  <Accordion title="Are Users Handling BSLI data given access to Corporate / Public Mails? If Yes, Are there any restrictions on domains to which the mails can be sent?">
    Our employees are provided access for corporate emails. But we have restricted for accessing other email service provider, sending the PII on emails, sending an email to personal email Ids etc for maximum security.
  </Accordion>

  <Accordion title="Are users handling BSLI data provided access to Internet? Is there a Proxy / Content Filtering Solution in place for cotrolled access to Internet? Are Proxy / Content Filtering Solution logs monitored and reviewed?">
    All our employees are not provided with access to the client data. Only authorised individual will have access on need and approval basis. The approvers are either the Product Heads or CTO. Content Filtering Solution in place for cotrolled access to Internet and all the logs are monitored.
  </Accordion>

  <Accordion title="Do you have a documented procedure in place for user access management? Whether access to system and data is granted exclusively on a need to know/access and Principle of Least privilege and that the approvals are documented by accountable party?">
    We have the documented procedure in place for user access management. Attached the Access Control Procedure. An Identity and Access Management (IAM) solution has been defined to manage user access through role-based access profiles that support the implementation of accesses based on the principles of need to know basis and support segregation of duties. Access to data and systems are based on the principles of least privilege for access and need to know basis. Accordingly, all information systems and data are classified and further segregated to support role-based access requirements. Only authorised individual will have access on need and approval basis. The approvers are either the Product Heads or CTO.
  </Accordion>

  <Accordion title="Do you maintain a policy, operational plan and procedures for teleworking activities? And whether teleworking activity is authorized and controlled by management and does it ensure that suitable arrangements are in place for this way of working. (Teleworking refers to all forms of work outside of the office, including non-traditional work environments, such as those referred to as telecommuting, flexible workplace, remote work and virtual work environments)">
    We provide option of work from home/remotely to our employees. We use a cloud hosted VPN with strict access controls to allow our employees to access the official network. This VPN is managed by our IT team and is linked with the SSO/Active Directory.
  </Accordion>

  <Accordion title="Does patch management process ensure all system are installed with latest security patches (OS layer, Application layer, Data base layer, Network layer)? Do you have a formal vulnerability assessment and penetration testing (VAPT) process / procedure / policy / manual is documented and operational? Do you have security hardening (technical specification, minimum baseline security MBSS guidelines for all infrastructure elements such as Application, OS, Network and Database)? Are external drives such as CDs and USB drives disabled on all desktops and laptops, servers containing personal data, customer data, business data?">
    All the computer machines are restricted with Access to CDs, USB or any other hard drives. We do not grant access for security reasons. We have Changed default credentials and turned off services that are not needed. MFA has been enabled to make sure that only authorised individuals have access. We have implemented Cloudflare web application firewall, IDS, Guard Duty etc in order to prevent DDOS-type attacks. (Attached the evidence of Cloudflare web application firewall, IDS, VA/PT reports, guard Duty etc) We have implemented the role-based access control system and Only authorized users have access to the servers. logs are collected using the AWS Audit Trail, meanwhile the application related logs are collected in our ElasticSearch server and retained in the long-term cloud storage. mechanisms are implemented to detect, address, and stabilize vulnerabilities We also have implemented the backup plan. We use TLS1.2 encryption for Data at transit and AES256 Data at rest for maximum security. Data backups are done daily and in a secured way in AWS.
  </Accordion>

  <Accordion title="Have you deployed controls to protect computer systems against virus and spywares, malwares, Trojans, malicious codes, etc.? Do you log the Anti-Virus compliance status of all systems?">
    All the systems are secured with Bitdefender end point security, VPN, Active directory, Firewall etc for maximum security.
  </Accordion>

  <Accordion title="Is access to sensitive areas (server location, tape library, computer room, etc.) physically restricted to authorized personnel? If Yes, does the physical access system log the access capturing the data, time, door access, employee coordinates during logging physical access? Are all physical access control logs periodically reviewed and retained per retention requirements? Are visitors signed into the building by an employee who accepts responsibility for the visitors during the course of their visit?">
    All the sensitive areas are restricted and authorized personnel only can have access. Our facility is having Biometric access system and all the logs are maintained and periodically reviewed. We also have visitors management guidelines and All visitors and contractors are required to present identification and are signed in and continually escorted by authorized staff.
  </Accordion>

  <Accordion title="Does the Vendor support on-premise / in the Cloud Third Party Cloud Access Security Broker (CASB) services">
    AWS Identity and Access Management (IAM) enables us to manage access to AWS services and resources securely
  </Accordion>

  <Accordion title="If application is Internet exposed and contains Informaation related to Customers, Finance or employee should implement mandatory 2FA">
    we don't provide multi-factor authentication. As of now, there's oAuth2.0 and SAML-based tokens. JSON-based token is available for maximum security direct-email logins.
  </Accordion>

  <Accordion title="Ability to have clearly defined roles with fine grained accesses to be created as per Functional roles and maintain SoD when creating the same">
    We have 3 types of roles - User, Admin and Super Admin. Based on the roles and responsibility these access can be provided on need and and approval basis.
  </Accordion>

  <Accordion title="Ability to rename / disable default IDs within application">
    [Manage accounts - Manage Super Admin/Admins - https://xoxoday.gitbook.io/application/user-guide/for-admins-1/getting-started/settings/manage-super-admin-admins#can-the-super-admin-disable-his-her-own-account-if-no-how-is-the-scenario-of-the-exit-of-a-super-admin-handled](https://xoxoday.gitbook.io/plum/user-guide/for-admins-1/getting-started/settings/manage-super-admin-admins#can-the-super-admin-disable-his-her-own-account-if-no-how-is-the-scenario-of-the-exit-of-a-super-admin-handled)
  </Accordion>

  <Accordion title="Data Confidentiality is compromised (Misuse of the customer Policyholder / Employee information, leakage of critical customer personal / policy details resulting in financial or reputational loss for the customer)">
    Xoxoday application platform collects PII like Name, email ID and Phone number of the employees those who will be using this platform. Xoxoday is ISO 27001:2013 certified, GDPR compliant and SOC 2 type I certified organization and have all the required technical and organizational controls in place and auditred during the internal and external audits. We have implemented the role-based access control system and Only authorized users have access to the servers. We use Amazon IAM for Identity access management. logs are collected using the AWS Audit Trail, meanwhile the application related logs are collected in our ElasticSearch server and retained in the long-term cloud storage. mechanisms are implemented to detect, address, and stabilize vulnerabilities We also have implemented the backup plan. We use TLS1.2 encryption for Data at transit and AES256 Data at rest for maximum security. Data backups are done daily and in a secured way in AWS.
  </Accordion>

  <Accordion title="Describe the mechanisms in place (processes, tools, etc.) to check for vulnerabilities at the application, Operating System, middleware and the network layers both internally and externally and how frequently these controls are performed.">
    Our network is protected through the use of key cloud security services, integration with our Cloudflare edge protection networks, regular audits, and network intelligence technologies, which monitor and/or block known malicious traffic and network attacks. Vulnerability scanning gives us deep insight for quick identification of out-of-compliance or potentially vulnerable systems. In addition to our extensive internal scanning and testing program, Xoxoday employs third-party security experts to perform a Vulnerability assessment and penetration testing.
  </Accordion>

  <Accordion title="Describe the Access management process in place at the provider's end pointing out how you ensure timely removal of accesses that are no longer required and how you control the adequacy of the privileges to the job role. Also describe the revalidation processes and the frequency of its execution.">
    Access to data and systems are based on the principles of least privilege for access. Accordingly, all information systems and data are classified and further segregated to support role based access requirements. Furthermore, while defining job roles and designing access roles, privileges leading to conflicts of interests are to be avoided. A strong identification and authentication system and logging systems are deployed and provides a centralized control to administer, monitor and review all critical access. We conduct the access control review on frequent basis and revoke all the access provided for exit employees.
  </Accordion>

  <Accordion title="Provide the procedure implemented at your end to manage your Shared Ids (e.g. root, Sys, System, etc.), Group IDs (generic accounts used by several individual belonging to a same team for example) and Local accounts. Describe how you restrict, log and monitor privileged accounts usage and access to security devices (E.g., hypervisors, firewalls, vulnerability scanners, network sniffers, APIs, etc.), how you ensure users changing team or leaving can no longer access the Group ID and what is the level of traceability of such IDs">
    We have unique user IDs for all and does not use generic user IDs.Access to data and systems are based on the principles of least privilege for access. We conduct the access control review on frequent basis and revoke all the access provided for exit employees. An Identity and Access Management (IAM) solution has been defined to manage user access through role-based access profiles that support the implementation of accesses based on the principles of need to know basis and support segregation of duties. Privileges relating to Administration of user access privileges and role configurations are different from the authorized approver that approves access requests. The approvers are either the Product Heads or respective function Heads are their authorized delegates. Attached the Access control procedure.
  </Accordion>

  <Accordion title="Describe the process to ensure and monitor that Segregation of Duties is respected and how frequently it is controlled">
    An Identity and Access Management (IAM) solution has been defined to manage user access through role-based access profiles that support the implementation of accesses based on the principles of need to know basis and support segregation of duties.
  </Accordion>

  <Accordion title="Do employees have a unique log-in ID when accessing data?">
    All our employees are having the unique log in IDs.
  </Accordion>

  <Accordion title="Are employees required to use a VPN when accessing the organisation's systems from all remote locations? (3)">
    We use a cloud hosted VPN with strict access controls to allow our employees to access the official network.
  </Accordion>

  <Accordion title="Does your organisation provide any web applications used by the customer or containing the customer data?">
    We provide application web application.
  </Accordion>

  <Accordion title="Is there an Internet-accessible self-service portal available that allows clients to configure security settings and view access logs, security events and alerts?">
    Admins can control the application and will have an access to alerts and security events.
  </Accordion>

  <Accordion title="If an employee no longer requires remote access to the customer network, is there a process to inform the the customer in a timely manner to revoke access?">
    We inform the the customer to revoke access.
  </Accordion>

  <Accordion title="In case of any exceptions due to which anti-malware activities fail (e.g. antivirus scans cannot be conducted or patches cannot not be applied), are alternative controls implemented to reduce the exposure on remote endpoints?">
    We have the alerting system in place and we perfom the scaning immediately in order to reduce the risk.
  </Accordion>

  <Accordion title="Do fourth-parties, (e.g., subcontractors, sub-processors, sub-service organizations) have access to or process client scoped data?">
    They do not have access.
  </Accordion>

  <Accordion title="Is proper access control implemented for secure access to the customer data?">
    Yes. We have role-based access system through access control policy to make sure that only the authorised individual has access to the required information. All the Access to data and systems are based on the principles of least privilege for access. An Identity and Access Management (IAM) solution has been defined to manage user access through role-based access profiles that support the implementation of accesses based on the principles of need-to-know basis and support segregation of duties. The approvers are either the Product Heads or respective function Heads are their authorized delegates.
  </Accordion>

  <Accordion title="Are there necessary controls for securing sensitive information according to the data classification (like Identity access management, access rights)?">
    Yes, We have the necessary controls in place in order to protec the information according to the data classification. For ex - Identity access management (IAM)
  </Accordion>

  <Accordion title="Do you have a SIEM for monitoring and maintaining logs over security incidents from various components (e.g. IDS, IPS, firewall logs)?">
    Yes. We have a SIEM in pance for monitoring and maintaining logs over security incidents from various components.
  </Accordion>

  <Accordion title="What kind of identity and access management services are provided by cloud: 1- Independent IDM Stack - all information related to user account is managed by SAAS vendor 2: Using credentials provided by enterprise - user account creation done at tenant within the enterprise boundary used by SAAS vendor to provide Sign On services 3: Federated IDM: User account details are managed by enterprise /tenant. SAAS vendor uses federated idnetity details on demand basis to allow sign on and access control">
    [Please click here to know more about admin acceess, Login, SSO Logins - https://xoxoday.gitbook.io/application/user-guide/for-admins-1/getting-started](https://xoxoday.gitbook.io/plum/user-guide/for-admins-1/getting-started)
  </Accordion>

  <Accordion title="Share the privilege account reconciliation policy.">
    Access to data and systems are based on the principles of least privilege for access. Accordingly, all information systems and data are classified and further segregated to support role-based access requirements. A strong identification and authentication system and logging systems are deployed and provides a centralized control to administer, monitor and review all critical access. We have role-based access system through access control policy to make sure that only the authorised individual has access to the required information. An Identity and Access Management (IAM) solution has been defined to manage user access through role-based access profiles that support the implementation of accesses based on the principles
  </Accordion>

  <Accordion title="Will vendor employees be accessing any the customer application? How access to those applications is managed? (e.g. through SSO).">
    Only authorised individual would access on need and approval basis. We also use SSO.
  </Accordion>

  <Accordion title="Are vendor Employees who are associated with the customer process are using their official email IDs for communication with the customer?">
    All our employees are using official email IDs
  </Accordion>

  <Accordion title="Who will have access to the customer users / customers data in your organization and if any Access Control (Role Base Access Control or any other) is imposed on server / database where the customer users / customers data will be stored?">
    We have implemented Role based Access control policy and only authorised individual will have access upon need and approval basis.
  </Accordion>

  <Accordion title="Supplier applies security controls and measures on remote access.">
    Access to data and systems are based on the principles of least privilege for access. Accordingly, all information systems and data are classified and further segregated to support role based access requirements. Furthermore, while defining job roles and designing access roles, privileges leading to conflicts of interests are to be avoided. We use a cloud hosted VPN with strict access controls to allow our employees to access the official network. This VPN is managed by our IT team and it's linked with the SSO/Active Directory.
  </Accordion>

  <Accordion title="Supplier has a security monitoring process in place.">
    We monitor and review these privileged access provided and do the necessary reconciliation as per the Access control policy implemented.
  </Accordion>

  <Accordion title="The solution provides possibilities for identity integration with the customer Microsoft Azure AD, and supports Single Sign On (SSO). SSO may be achieved either through a SAML 2.0 federated trust setup or through Microsoft Azure SaaS integration. Additional factors may be used in authentication as well (MFA).">
    1. Xoxoday application has a rich set of integrations with HRMS, HRIS, CRM, Survey, Marketing automation, SSO, SAML tools like SAP SuccessFactors, Zoho People, Darwin Box, Hubspot, Freshworks, Zapier, Hubspot, Type Form, Survey Monkey, Survey Gizmo, SAML 2.0, etc 2. SSO SSO Redirection - The client has to generate temporary token for SSO and redirect the user to Xoxoday with this temporary token. Please click here - [https://xoxoday.gitbook.io/application/developer-resources/storefront-integration/api-endpoints/sso-redirection#sso-token-from-company-session](https://xoxoday.gitbook.io/application/developer-resources/storefront-integration/api-endpoints/sso-redirection#sso-token-from-company-session)
  </Accordion>

  <Accordion title="Vendor has privileged identity and access management policies in place, by ensuring that there are multiple access layers and requiring multi-factor authentication for superuser/administrator access.">
    Access to our production environment is allowed only via Xoxoday corporate network and access is allowed only to authorized individuals of the infrastructure and engineering team. Given the pandemic/WFH situation, VPN access has been enabled with 2FA For such authorized individuals, for ensuring business continuity. All our admins accounts has been sealed with MFA. and also we use AWS IAM for managing privileged identities.
  </Accordion>

  <Accordion title="Privileged accounts are terminated when not required for use, and this process ensures that the change is propagated throughout the services provided to the customer.">
    We revoke the access once the tasks is performed or terminated from the organization as per the access control policy and part of the HR Exit clearance. Yes. access revocation process synchronized throughout all the systems. Attached the Access control policy.
  </Accordion>

  <Accordion title="Whenever user access to the customer data is to be maintained by the vendor, access to the customer services is provided on a need-to-have basis and according to users' roles (RBAC) and by notifying the customer in advance. Access rights are continuously reviewed.">
    We have implemented the Role-Based Access Control (RBAC) An Identity and Access Management (IAM) solution has been defined to manage user access through role-based access profiles that support the implementation of accesses based on the principles of need to know basis and support segregation of duties. Privileges relating to Administration of user access privileges and role configurations are different from the authorized approver that approves access requests. The approvers are either the Product Heads or respective function Heads are their authorized delegates. We review the access rights on monthly basis. Attached the access control policy.
  </Accordion>

  <Accordion title="Roles and responsibilities of the customer as a customer are clearly specified in the incident handling process.">
    We have implemented the incident management procedure and attached the same. We communicate with Preliminary Incident Synopsis and Root Cause Analysis report (RCA) including the details of Business Impact, Issue Description, Root Cause, and Corrective Actions.
  </Accordion>

  <Accordion title="The customer data integrity is protected from incidents or unauthorized changes occurring in other tenants sharing the same infrastructure.">
    We use logical data isolation with the help of company specific encryption keys. We have encrypted the data while in transit and at rest. We use TLS1.2 encryption for Data at transit and AES256 Data at rest for maximum security. The incidents in other tenants would have no effect on the customer's services.
  </Accordion>

  <Accordion title="Which security protocols and standards do the cloud vendor adhere to?">
    We are adhered to ISO 27001:2013, GDPR, CPRA, SOC 2, CSA STAR and VA/PT - Shared these certifications and Audit reports. We have implemented the Access control policy and shared the same for your reference. All our admins' accounts have been sealed with MFA. and also, we use AWS IAM for managing privileged identities. All our Infrastructure logs are collected using the AWS Audit Trail, meanwhile the application related logs are collected in our Elastic Search server and retained in the long-term cloud storage. The audit logs are reviewed and recorded on a regular basis automatically. These logs are integrated with security operations/SIEM solutions.
  </Accordion>

  <Accordion title="Do you support the use of single sign on (SSO) and federation where we leverage our identity provider for authentication and authorisation services">
    application support many SSO options such as - Google workspace. Azure AD, OKTA SSO, Onelogin, Ping Identity, Centrify etc..
  </Accordion>

  <Accordion title="Does the solution supports role based access control to enable separation of duties">
    There are four access roles: Super Admin, General Admin, Manager and Employee. Manage the level of access for each role through the access controls page
  </Accordion>

  <Accordion title="Is there a Web UI available? What browsers are supported?">
    application is a web application and also supports Android and iOS apps. application is supported by a comprehensive web application that can be accessed via desktop and mobile browsers on all compatible devices. For ex -Google chrome, Internet explorer, Microsoft edge etc..
  </Accordion>

  <Accordion title="Access Control - Is there an access control mechanism like RBAC built in the application?">
    The access control mechanism like RBAC is built in the application. We have a Super Admin, Admin, and user's account.
  </Accordion>

  <Accordion title="Does the application support for SCIM based automated User Provisioning and Deprovisioning?">
    Please click here to know more about SSO integration - [https://www.application.io/integrations](https://www.application.io/integrations) It supports Azure AD, Google workspace, Okta SSO, One login, Ping identity SSO, Centrify etc..
  </Accordion>

  <Accordion title="Does the application support AD Integration?">
    Its supports Azure AD integration.
  </Accordion>

  <Accordion title="Does the application allow users to set/reset password and login with password even when SSO is enabled?">
    No. it does not. Once SSO is enabled, the users are not presented with any password options.
  </Accordion>

  <Accordion title="Access to data by your employees:">
    Access to data and systems are based on the principles of least privilege for access. Accordingly, all information systems and data are classified and further segregated to support role-based access requirements. A strong identification and authentication system and logging systems are deployed and provide a centralized control to administer, monitor and review all critical access. We have a role-based access system through access control policy to make sure that only the authorised individual has access to the required information. An Identity and Access Management (IAM) solution has been defined to manage user access through role-based access profiles that support the implementation of accesses based on the principles of need-to-know basis and support segregation of duties. The approvers are either the Product Heads or respective function Heads are their authorized delegates.
  </Accordion>

  <Accordion title="What is the set of security configuration / features implemented for standard employee issued device? (full disk encryption, firewall, etc.)">
    We use a cloud hosted VPN with strict access controls to allow our employees to access the official network. This VPN is managed by our IT team, and it's linked with the SSO/Active Directory In addition to that we also use Encryption, Firewall, Bitdefender end point security etc.
  </Accordion>

  <Accordion title="Does the company allow its employees to work remotely? If so:">
    We use a cloud hosted VPN with strict access controls to allow our employees to access the official network. This VPN is managed by our IT team, and it's linked with the SSO/Active Directory
  </Accordion>

  <Accordion title="How do you secure your APIs? Which methodology is followed for API security and its testing?">
    We have implemented the Web application firewall, IDs/IPs and amazon guard duty etc for maximum security. OAuth2 is used to authorize all API requests. We also conduct code review to make sure that the APIs are secure.
  </Accordion>

  <Accordion title="Does the platform support SSO with PwC Indentity">
    Yes. application supports SSO like Okta SSO, Onelogin SSO, Ping Identity SSO, Centrify etc.. Please click here to know more about application SSO - [https://www.application.io/integrations?tab=tab-sso](https://www.application.io/integrations?tab=tab-sso)
  </Accordion>

  <Accordion title="Authentication requirements - what is the software. PwC uses SAML 2.0, OpenAm authentication">
    Our identity federation standards include SAML 2.0, SPML, WS-Federation
  </Accordion>

  <Accordion title="Products should support user directory integration via LDAP or Microsoft Active Directory to simplify the user provisioning process">
    It Supports MS Azure active directory.
  </Accordion>

  <Accordion title="Is Multi-Factor Authentication supported?">
    No.
  </Accordion>

  <Accordion title="Does this mean they do not store passwords hashed?">
    We store password hashed. We have SHA512 hash with unique salt for every password
  </Accordion>

  <Accordion title="Is 2FA required when logging in? If required, which types of 2FA are supported? (E.g. Google Authenticator?)">
    No. 2FA is not required for logging into the application. We only support SSO with the help of SAML2.0 protocol.
  </Accordion>

  <Accordion title="Is SSO and OKTA integration supported?">
    Yes. It supports SSO and OKTA Integration
  </Accordion>

  <Accordion title="Is there detection for concurrent logins? When there is multiple logins using the same username, do account holders have awareness of this?">
    Yes. The account owner will receive an email notification and all the activities are logged.
  </Accordion>

  <Accordion title="How long will the account be invalid when it is deleted? After how long will the user be kicked off when logged in, if his/her account has been deleted?">
    The account owner will receive an email notification and immediately and user can act on it.
  </Accordion>

  <Accordion title="For customer support, what is the process for password reset? Could you identify correctly if the requestor is from our company? How?">
    We have enabled password reset process. It identifies from the domain name of the email ID. We can Change the password of the application account by navigate to Setting in the Quick Access menu.
  </Accordion>

  <Accordion title="For customer support, what is the process for 2FA reset? Could you identify correctly if the requestor is from our company? How?">
    2FA is not supported.
  </Accordion>

  <Accordion title="Does the account management system support role-based permissions and access control?">
    Yes. We have defined accessibility features, role-based permissions, access control and can Manage user access to various account functionality based on organizational needs.
  </Accordion>

  <Accordion title="When Okta/SSO is enabled, whether the login method for the original system is technically prohibited?">
    When SSO (via SAML2.0) is enabled login via password will be technically prohibited
  </Accordion>

  <Accordion title="When only enabling username and password login, is it possible to customize password complexity requirements (upper case, lower case, special character)? Also, is it possible to force users to change their password at regular intervals - every 90 days for example.">
    Yes. Users can provide complex password to make sure that the account is secure.
  </Accordion>

  <Accordion title="Multi factor authentication shall be implemented for all access to NSE's data.">
    Yes. We have enabled Multi factor authentication. Our application also support multi factor authentication.
  </Accordion>

  <Accordion title="All access to NSE's data, managed by NSE shall be as per the Access Control policy of NSE.">
    We have implemented the access control policy to make sure that only the authorised individual have an access to the data. You may suggest if anything needs to be added as per NSE access control policy.
  </Accordion>

  <Accordion title="Administrative activities required to be done by NSE shall be carried out by NSE employees or NSE authorised staff only.">
    Super admin have complete control of the platform and can configure everything.
  </Accordion>

  <Accordion title="NSE shall ensure all web applications are accessible only via Web Application Firewall (WAF) to the internet with appropriate policies.">
    We have the controls in place. As part of Web Application Firewall (WAF), rate limiters are installed to block multiple requests from specific IPs in order to prevent DDOS-type attacks.
  </Accordion>

  <Accordion title="Describe the controls in place that monitor and record user access to systems that store or support UP data.">
    We have controls in place to monitor the user access system. We have implemented Role based access management system through access control policy. We also conduct internal review, Audit and external Audit from the third party auditors to make sure that we are complying with the requirements.
  </Accordion>

  <Accordion title="Does the Supplier support SAML 2 (Browser POST profile) to enable Single Sign-On for Union Pacific users?">
    Yes, our identity federation standards include SAML 2.0, SPML, WS-Federation and more as means of authenticating and authorizing users with airtight security protocol.
  </Accordion>

  <Accordion title="What technology enforces the authorization?">
    We use Freshdesk and Jira for Authorizing access.
  </Accordion>

  <Accordion title="Describe how your organization decides who does and does not have access to sensitive data">
    We have role based access system to make sure that only the authorised individual have an access to the required information. We also have Access Control Procedure as per the compliance requirements.
  </Accordion>

  <Accordion title="Do employees/contractors have ability to remotely connect to your production systems? (i.e. VPN)">
    Yes. We use a cloud hosted VPN with strict access controls to allow our employees to access the official network. This VPN is managed by our IT team and is linked with the SSO/Active Directory.
  </Accordion>

  <Accordion title="Is MFA required for employees/contractors to log in to production systems?">
    Yes. We have enabled MFA for maximum security
  </Accordion>

  <Accordion title="Do internal applications leverage SSO for authentication?">
    Yes
  </Accordion>

  <Accordion title="Are documented procedures followed to govern change in employment and/or termination including for timely revocation of access and return of assets?">
    Yes. We have access control policy and change manangement policy in place. Our IT team periodically review the access granted to all the users and take necessary actions. Revocation of access and Asset submission is part of our exit procedure upon termination from the employment.
  </Accordion>

  <Accordion title="Is all network traffic over public networks to the production infrastructure sent over cryptographically sound encrypted connections? (TLS, VPN, IPSEC, etc). If there are plaintext connections, what is sent unencrypted?">
    We use a cloud hosted VPN with strict access controls to allow our employees to access the official network. This VPN is managed by our IT team and is linked with the SSO/Active Directory.
  </Accordion>

  <Accordion title="What cryptographic frameworks are used to secure data at rest?">
    We use AES 256-bit encryption for data at rest for securing digital identities
  </Accordion>

  <Accordion title="What cryptographic frameworks are used to store passwords?">
    We store password hashed. We have SHA512 hash with unique salt for every password
  </Accordion>

  <Accordion title="How are crytographic keys(key management system, etc) managed within your system?">
    The cryptographic keys, including data encryption and SSL certificates are managed by Xoxoday for optimal security of sensitive data. Each tenant data is uniquely encrypted using client specific key. We use AES 256 bit encryption for data at rest to ensure maximum security measures.
  </Accordion>

  <Accordion title="Does application allow user MFA to be enforced by admins?">
    Yes
  </Accordion>

  <Accordion title="Does application support IP whitelisting for user authentication?">
    Yes
  </Accordion>

  <Accordion title="Does your application support standardized roles and permissions for users (ie admin, user)?">
    Yes
  </Accordion>

  <Accordion title="Does your application enable custom granular permissions and roles to be created?">
    Yes
  </Accordion>

  <Accordion title="How does your application store API keys?">
    API Keys are stored in high availability ephemeral storage and not in any disc.
  </Accordion>

  <Accordion title="Are your confidential data acess controls in line with your data classification matrix?">
    Yes
  </Accordion>

  <Accordion title="Are user/ privileged access rights for your staff regularly reviewed?">
    Yes
  </Accordion>

  <Accordion title="Will the customer staff be able to manage the customer system access and data? If so what controls are in place to restrict and control privileged access rights?">
    Yes. We follow role-based access system. We have implemented an access control policy and it will restrict access of the authorised individuals only.
  </Accordion>

  <Accordion title="Please state what system enforced password settings are active for: Password Minimum Length/Complexity, Password Change Interval, Lockout (after incorrect password entries), Password aging/history">
    At least 8 characters

    45 days

    5 attempts
  </Accordion>

  <Accordion title="Have all default passwords been changed in regard to hardware identified in the architectural details section in 3.5?">
    Yes
  </Accordion>

  <Accordion title="How long will logs be retained?">
    Infrastructure logs are collected using the AWS Audit Trail, meanwhile the application related logs are collected in our Elastic Search server and retained in long-term cloud storage
  </Accordion>

  <Accordion title="All users shall be assigned a unique ID (user account) for access to system components, information or network files or sensitive data following clear user naming convention standards.">
    All users have benn assigned a unique user account. We have implemeted the Access control Policy and all the system components, network files, sensitive data will be accessed my the unique user accounts.
  </Accordion>

  <Accordion title="User accounts shall keep historical uniqueness and will not be reused by other people in the future.">
    All users have benn assigned a unique user account. And will not be reused by other people in the future.
  </Accordion>

  <Accordion title="Centralised directory services shall be provided for the customer systems, where applicable, to effectively manage the users and computers.">
    Admins will have a Centralised directory and can manage the users. For ex - Creation and deletion of the users.
  </Accordion>

  <Accordion title="AAA services shall be provided, where applicable, for network equipment (switch, firewall, etc.) authentication, authorisation and accounting.">
    We are Compliant. We have implemented the Network Access Control and Security Procedure. We are diligently controlling access to computer resources, enforcing policies, Firewall, Switches etc
  </Accordion>

  <Accordion title="Privileged access to assets shall be managed through formal processes for the allocation of defined privileges that should: Address the full lifecycle, including requirements for expiry. Ensure the competencies of users are in line with the privileges to be approved. Allocate privileges to users on a need-to-use basis and on an event-by-event basis for a fixed period of time in line with the access control policy. Not grant privileges until the authorisation process is complete.">
    We review the access controls on periodical basis and make sure that only authorised individual will have an access to the Information system. We grant privileges only upon the need and approval basis as per the access control policy.
  </Accordion>

  <Accordion title="Ensure that all privileged access is logged and periodically audited">
    We review the access controls on periodical basis and make sure that only authorised individual will have an access to the Information system
  </Accordion>

  <Accordion title="Where technically feasible implement network and/or host-based technical controls that detect access and/or attempt to use diagnostic and configuration ports and services.">
    We have the monitoring system in place. Unauthorised access or attempts will be detected and prevented
  </Accordion>

  <Accordion title="Where technically feasible, implement network (e.g. network gateways using traffic inspection to limit the capabilities of users) and/or host-based (e.g. Application Control) technical controls that control shared networks and resources access to specifically approved users and business applications.">
    We have implemented the role based access control system. Only approved users will have an access to the Business application.
  </Accordion>

  <Accordion title="Role-based user accounts shall be implemented for users (operators, supervisors, shift controller, engineer, domain administrator etc.) with specific and defined privileges based on the principle of least privilege for each role.">
    We have controls in place to monitor the user access system. We have implemented Role based access management system through access control policy.
  </Accordion>

  <Accordion title="Access to programming source code shall be granted on need to know basis.">
    We are compliant. Only authorised individual have an acces.
  </Accordion>

  <Accordion title="Remote access shall be granted based on business need and approved by Information owner.">
    We are compliant
  </Accordion>

  <Accordion title="Multi factor authentication should be used, where technically feasible, for all remote access (network-level access originating from internet) by employees, Administrators and third parties.">
    We use 2FA wherever is required to safeguard the information system.
  </Accordion>

  <Accordion title="Access for vendors for remote maintenance or support must only be enabled during a limited time period and should be discontinued immediately after the task is completed. Vendors' access shall be auditable.">
    We grant an access to the vendor whenever is necessary on approval basis and access will be revoked upon the tasks completion.
  </Accordion>

  <Accordion title="Remote access activities shall be logged, monitored and analysed.">
    We use a cloud hosted VPN with strict access controls to allow our employees to access the official network. This VPN is managed by our IT team and is linked with the SSO/Active Directory for more security.
  </Accordion>

  <Accordion title="Third Parties are only granted logical access after verification that any contract or agreement with third parties addresses all aspects of the the customer information security requirements regarding accessing, processing, communicating or managing the the customer information or information systems, or adding products or services to information systems.">
    We have granted the logical access to the third parties upon approval and Agreement in place.
  </Accordion>

  <Accordion title="All unnecessary ports, services and applications that are not required for normal operations have been disabled or uninstalled, following the least functionality principle.">
    We have disabled all the access for security purposes. The access will be provided only on need and approval basis for a specific period of time.
  </Accordion>

  <Accordion title="Security measures listed below shall be undertaken to safeguard the development and testing environment: Development, test and integration environments are restricted to authorised personnel. Configuration management process is in place for development, test and integration environments. Sensitive information such as new account or password information delivery process is secure and protected by encryption and authentication mechanisms. All mobile devices (of vendors and third parties) used to access the customer confidential data, including emails, shall have strong security controls enforced. Any wireless access to development, test or integration environments shall be protected using strong authentication and encryption protocols. Malware protection mechanisms are in place on all development, test or integration systems. Appropriate backup and restore processes to maintain continuity of its development processes.">
    We are compliant. We have role based access system to make sure that only the authorised individual have an access to the required information All the devices and emails are having adequate security controls. We use a cloud hosted VPN with strict access controls to allow our employees to access the official network We use TLS1.2 encryption for Data in transit and AES256 for Data at rest. Additionally, we have an intrusion detection/monitoring application that alerts on unauthorized access.We have SDLC Policy as per ISMS requirements and we follow General Coding Practice. For example - We Conduct data validation on a trusted system, All cryptographic functions used to protect secrets from the application user.We also have Implemented least privilege; restrict users to only the functionality, data and system information that is required to perform their tasks.
  </Accordion>

  <Accordion title="Prevention strategies for information leakage shall be established. Consider topics such as: Periodically determine whether sensitive data is present on assets in clear text. Searching for patterns that indicate the presence of sensitive information can help identify if a business or technical process is leaving behind, or otherwise leaking, sensitive information. Regular monitoring of employees, third parties and system activities, where permitted under existing legislation or regulation. Monitoring resource usage in computer systems and shares. Denying all unapproved traffic. Monitoring outbound media and communications for hidden information/data, covert channels or unauthorised use of encryption.">
    We have installed the firewalls to monitor and control the incoming and outgoing network traffic based on predetermined security rules. It helps us to establishes a barrier between a trusted network and an untrusted network. We use a cloud hosted VPN with strict access controls to allow our employees to access the official network. This VPN is managed by our IT team and is linked with the SSO/Active Directory for more security.
  </Accordion>

  <Accordion title="If additional security controls are required within a security zone, a sub-security zone should be created (e.g. different vendors or systems might require limited data access between production areas).">
    we can provide limited access to different vendors or systems.
  </Accordion>

  <Accordion title="Information assets shall not be shared in dual networks where technically feasible and where not, compensating controls shall be implemented based on a security risk assessment.">
    We are compliant. We use a cloud hosted VPN with strict access controls to allow our employees to access the official network.
  </Accordion>

  <Accordion title="Document network services (e.g. provision of optical fibre connections between sites), whether these services are provided in-house or outsourced, management requirements, service levels, and needed security mechanisms.">
    We have implemented the Network Access Control and Security Procedure. Network services are provided in house. We maintain the records for the service levels and reviewed during the internal and external Audits.
  </Accordion>

  <Accordion title="Configuration baselines should ensure that components are configured to the most restrictive mode consistent with technical and entity operational requirements.">
    We always make sure that components are configured to the most restrictive mode.
  </Accordion>

  <Accordion title="All software and functionality not required for the intended functional purpose of the system shall be disabled or uninstalled.">
    We provide access to our employees to only required amount of functionalities for any software applications.We uninstall the softwares or disable the features wherever is not required.
  </Accordion>

  <Accordion title="Auto-play of audio CD/DVD and USB drives shall be disabled on all systems.">
    We have disabled all the access for security purposes.
  </Accordion>

  <Accordion title="All activities related to administrator and operator privileges shall be a logged and audited on a regular basis.">
    We review these access frequently.
  </Accordion>

  <Accordion title="Securing facilities: Restrict access to only the necessary and authorised personnel. Physical locations, internal telephone directories or any other information identifying locations of confidential information processing facilities shall be accessible to personnel on a need to know basis and shall not be readily available to anyone publicly.">
    We are compliant.
  </Accordion>

  <Accordion title="Equipment Siting and Protection: Physical access to equipment shall be restricted to only necessary and authorised personnel. Systems handling sensitive data shall be positioned carefully to reduce the risk of information being viewed by unauthorised persons during their use. Information assets shall be configured to fail in a state (fail safe) that ensures safety related and important-to-safety functions, security functions, and emergency preparedness functions, including offsite communications, are not adversely impacted by the asset failure.">
    We are compliant. Physical access to equipment has been restricted to only necessary and authorised personnel
  </Accordion>

  <Accordion title="As a minimum, contracts with third parties for provision of third parties with access to the customer information assets shall include (but not be limited to) confidentiality, non-disclosure and the customer security policies compliance clauses. Following requirements must be consider: The level of physical and logical security controls that shall be provided to maintain the confidentiality, integrity and availability of the customer information assets. Provision for confidentiality, non-disclosure and acceptable use relating to the customer information assets managed by the outsourced function or service. The customer rights to review, monitor and audit compliance with the security terms of contract">
    We are compliant.
  </Accordion>

  <Accordion title="All third-party access to the customer information assets and infrastructure shall be formally authorized by the information owner and other relevant parties">
    Only authorised individual have an acces to the approved information assets.
  </Accordion>

  <Accordion title="Access to restricted areas shall be provided to the authorised and approved assessors for assessment purposes.">
    We provide access to authorised individual on approval basis
  </Accordion>

  <Accordion title="Service Provider shall use two-factor authentication for administrative activities.">
    Our application doesn't have a 2FA for admin functions.
  </Accordion>

  <Accordion title="Infrastructure components such as network devices, servers, workstations should be hardened based on least functionality and least privilege perspective">
    We have role based access system to make sure that only the authorised individual have an access to the required information.
  </Accordion>

  <Accordion title="Is the communication between client and server encrypted in order to prevent eavesdropping, man in the middle or similar attacks?">
    Yes. We use TLS1.2 encryption for Data in transit and AES256 for Data at rest.
  </Accordion>

  <Accordion title="Does the infrastructure provide mechanisms for access control lists or capabilities?">
    As per the access control policy our application controls the access of an unauthorised individual through diference levels of users like Admin, super admin and users.
  </Accordion>

  <Accordion title="Are the Authorisation and Access Control procedures for both end users and administrators compliant with ISO27002 generally and with our password policy specifics?">
    Yes. We are complied. We have the access control policy and password policies.
  </Accordion>

  <Accordion title="How does the vendor control and monitor access to customer's data by their administrators?">
    We have access control polic and only the authorosed individual have an access to the PII on need and approval basis. We also review these access granted on monthly basis.
  </Accordion>

  <Accordion title="Describe the system's security methodology to ensure that only authorized users can access information.">
    We have access control system in place and only the authorised individual have an access. Attached the procedure for your reference.
  </Accordion>

  <Accordion title="Is SSO provided out of box?">
    application supports SSO.
  </Accordion>

  <Accordion title="What type of SSO options are available? SAML, HTTP-Fed etc.">
    our identity federation standards include SAML 2.0, SPML, WS-Federation,Google SSO Login and more as means of authenticating and authorizing users with airtight security protocol
  </Accordion>

  <Accordion title="What other type of user authentication options do you provide?">
    The application have robust authentication methods. We are integrated SAML 2.0 with SAP SuccessFactors, we also support OAuth 2.0 for seamless authentication.
  </Accordion>

  <Accordion title="Integration to TSL It Systems">
    Yes -SSO
  </Accordion>

  <Accordion title="Will any detected security violations and incidents be reported to the X Company Information Security Manager?">
    Yes. We also fix the issues identified and conduct the test once again for confirmation of fixes.
  </Accordion>

  <Accordion title="Explain how the system supports single sign-on and an external roles based access control system.">
    Our partnerships with a wide array of integration partners ensure existing customer based Single Sign On (SSO) capability for all users to seamlessly use Xoxoday's products. With an easy DIY setup, your SSO solution would be plugged in and ready to go.
  </Accordion>

  <Accordion title="Do you have effective physical access controls (e.g., door locks, badge / electronic key ID and access controls) in place that prevent unauthorised access to facilities and a facility security plan?">
    Yes. We have physical access controls in place and only authorised individuals will have access. We have provided the access cards to all the employees and installed biometric machines at all the entry and exit areas. We have also installed the CCTV cameras in our building and will be monitored 24\*7 for maximum security.
  </Accordion>

  <Accordion title="How are systems and applications configured to restrict access only to authorized individuals?">
    We have implemented the access control policy and only authorised individual will have access to the systems/application. An Identity and Access Management (IAM) solution has been defined to manage user access through role-based access profiles that support the implementation of accesses based on the principles of need to know basis and support segregation of duties Access to the production environment is restricted to a limited set of authorized users based on their job responsibilities. Users from the development and testing or QA teams do not have access to the production environment. Access to migrate changes is limited to designated and authorized individuals. Access to the production environment is approved by the Product Owner and the systems of the authorized users are registered and authenticated during login. The access is controlled through the AWS Identity and Access Management system that also enforces two-factor authentication.
  </Accordion>

  <Accordion title="Is there a list maintained of authorized users with access (administrative access) to operating systems? i.e. Active Directory user lists, within sensitive application, Excel spreadsheet of users, HR file?">
    Yes. The list of users who have admin access have been maintained through AD, IAM, HRMS etc..and reviewed periodically and during the internal and external audits.
  </Accordion>

  <Accordion title="Does a list of accepted mobile devices (e.g., smart phones, cell phones) exist based on testing? Are accepted mobile devices tested prior to production use?">
    Mobile devices are not allowed for production use.
  </Accordion>

  <Accordion title="Is sensitive information (e.g., opportunities and sales contracts) removed from, or encrypted within, documents and or websites before it is distributed? i.e. de-identifying of sensitive information prior to being distributed.">
    Yes. All the sensitive information has been encrypted. All the data at rest also has been encrypted for maximum security.
  </Accordion>

  <Accordion title="Is software installation restricted for desktops, laptops and servers? i.e. Restricted User access to workstations, Group Policy enforcement, AD privileges on servers">
    Yes. All the software installation restricted for desktops, laptops and servers. Users does not have permission to install any software or make any changes.
  </Accordion>

  <Accordion title="Is access to source application code restricted? If so, how? Is a list of authorized users maintained?">
    Yes. Access to source application code restricted. Application code has been stored in the code repository and have access only to the authorised individuals. We have implemented SDLC Policy as per ISMS requirements and we follow General Coding Practice. For example - We Conduct data validation on a trusted system, All cryptographic functions used to protect secrets from the application user. We also have Implemented least privilege; restrict users to only the functionality, data and system information that is required to perform their tasks we follow all the technical guidelines for development of our code and applications that come under the Open Web Application Security Project.
  </Accordion>

  <Accordion title="Are user IDs for your system uniquely identifiable? Any shared accounts at all? i.e. hard coded into applications, someone is sick, emergency access to sensitive information?">
    Yes. All our users uses unique IDs. There are no shared accounts.
  </Accordion>

  <Accordion title="Do you have a process to review user accounts and related access? i.e. manual process of reviewing system accounts to user accounts in AD for both users and privileged access (E.g. Admins and Developers)?">
    Yes. We have implemented the access control policy and we review the use accounts on frequent basis for both admin and normal users.
  </Accordion>

  <Accordion title="Will vendor employees be accessing any the customer application? How access to those applications is managed? (e.g. through SSO). (2)">
    Only authorised individual would access on need and approval basis. We also use SSO.
  </Accordion>

  <Accordion title="Are vendor Employees who are associated with the customer process are using their official email IDs for communication with the customer? (2)">
    All our employees are using official email IDs
  </Accordion>

  <Accordion title="Who will have access to the customer users / customers data in your organization and if any Access Control (Role Base Access Control or any other) is imposed on server / database where the customer users / customers data will be stored? (2)">
    We have implemented Role based Access control policy and only authorised individual will have access upon need and approval basis.
  </Accordion>

  <Accordion title="Is proper access control implemented for secure access to the customer data? (2)">
    Yes. We have role-based access system through access control policy to make sure that only the authorised individual has access to the required information. All the Access to data and systems are based on the principles of least privilege for access. An Identity and Access Management (IAM) solution has been defined to manage user access through role-based access profiles that support the implementation of accesses based on the principles of need-to-know basis and support segregation of duties. The approvers are either the Product Heads or respective function Heads are their authorized delegates.
  </Accordion>

  <Accordion title="What kind of access the vendor employees will have on the application and how access to the customer data in the application is restricted from being accessed by Vendor employees?">
    Our employees will not have access by default. The data will be accessed only upon need an approval basis. The access is controlled through the AWS Identity and Access Management system that also enforces two-factor authentication
  </Accordion>

  <Accordion title="Is user access controlled and has limited access to the data and configuration settings on cloud?">
    Yes.
  </Accordion>

  <Accordion title="Does the SAAS support MFA such as OTP or security tokens or biometrics?">
    No, we don't provide multi-factor authentication. As of now, there's oAuth2.0 and SAML-based tokens. JSON-based token is available for maximum security direct-email logins.
  </Accordion>

  <Accordion title="Are there necessary controls for securing sensitive information according to the data classification (like Identity access management, access rights)? (2)">
    Yes, We have the necessary controls in place in order to protec the information according to the data classification. For ex - Identity access management (IAM)
  </Accordion>

  <Accordion title="Does access provided to users and administrators are based on Need to Know basis?">
    Yes.
  </Accordion>

  <Accordion title="Does access to privilege users / admin has MFA enabled?">
    Yes.
  </Accordion>

  <Accordion title="Have you implemented Physical and Logical access controls to protect Personal Data?">
    We have implemented the physical access control and logical access control to protect the personal data. We have security guards, CCTV cameras, access cards etc for monitoring purposes. We use logical data isolation with the help of company specific encryption keys. We generate separate test data Data at transit - TLS1.2 encryption, Data at rest - AES256
  </Accordion>

  <Accordion title="Is product/service application/solution provided protected against unauthorized access to personal information?">
    Only authorised individual will have an access.
  </Accordion>

  <Accordion title="Is there any way for the system administrator to terminate an active user who is suspected performing malicious action? Please describe the mechanism">
    Yes. The administrator has the privileged access and can add or terminate the users. Admins have complete control of the platform and can configure the addition and deletion of the users through the admin console.
  </Accordion>

  <Accordion title="Is the security services provided by the system integrate ready and able to be integrated to Active Directory or LDAP system?">
    Yes. application comes with a full set of integration with various platforms like AD.
  </Accordion>

  <Accordion title="Does the solution use open source 3rd party application framework? If yes, does it uses latest/stable patch? Please describe the libraries and its patch version.">
    No. We do not use 3rd party application framework
  </Accordion>

  <Accordion title="Is there a Single User ID/ Password access to all the systems?">
    It's a SAAS Solution and can login in the multiple system by using the Single user ID/Password.
  </Accordion>

  <Accordion title="The number of unsuccessful attempts">
    Yes, there is a protocol in place to ensure that no information beyond an unsuccessful login attempt goes through prior to a successful login.
  </Accordion>

  <Accordion title="Can the system check for over-simplified passwords (e.g., inclusion of UserID into the password itself) or force passwords to use more than just plain text, and numbers? Dictionary searches etc?">
    Yes. We have this mechanism.
  </Accordion>

  <Accordion title="Can the solution disable the User ID automatically if the unsuccessful attempts exceeds the maximum of trial?">
    Yes. solution disable the User ID automatically if the unsuccessful attempts exceeds the maximum of trial
  </Accordion>

  <Accordion title="Do passwords have an expiry date?">
    Yes
  </Accordion>

  <Accordion title="Are passwords always stored in an encrypted form?">
    Yes.
  </Accordion>

  <Accordion title="Are passwords never shown in the clear on screen, or sent via e-mails?">
    Its not shown in the screen or sent via email.
  </Accordion>

  <Accordion title="Describe the recommended mechanism/process for resetting passwords (should a supervisor forgets his/her password) and the mechanism/process of setting the initial password">
    Password will be reset upon the email confirmation through password reset link. Once we click on the reset my password.it will redirected to the platform and ask us to Set a new password for our account.
  </Accordion>

  <Accordion title="Describe the recommended mechanism/process for resetting passwords (should a user forgets his/her password) and setting the initial password">
    Password will be reset upon the email confirmation through password reset link. Once we click on the reset my password.it will redirected to the platform and ask us to Set a new password for our account
  </Accordion>

  <Accordion title="Describe the role-based security mechanism provided!">
    We have enabled the role-based access system to provide an access to only authorized individuals.
  </Accordion>

  <Accordion title="Does the solution provide the centralized access control management tool?">
    Yes. It can be managed centrally.
  </Accordion>

  <Accordion title="Can the solution logged-off a terminal automatically; i.e. time-out feature during idle state?">
    The platform will get locked out as configured in AD or SSO ect
  </Accordion>

  <Accordion title="Can the security module support to create the same user with different roles but validating the dual control rule (e.g. transaction imitator should not be the same as transaction approver)? If yes, please describe the mechanism?">
    No. Its linked with the Email IDs
  </Accordion>

  <Accordion title="Does solution have the capability to set up a user based on another user's profile?">
    Yes. We can set up an account with the help of unique email IDs
  </Accordion>

  <Accordion title="Does the solution provide the centralized access control management tool? (2)">
    Yes
  </Accordion>

  <Accordion title="Does your solution support multiple choices of authentication? What are they?">
    It supports Email and Mobile phone Authentication.
  </Accordion>

  <Accordion title="Does your solution provide Token authentication? Please provide detail">
    JSON-based token is available for maximum security direct-email logins.
  </Accordion>

  <Accordion title="CLOUD SERVICE PROVIDER (CSP) must have and use least privilege concept for its security regulation regarding access management such as authentication, authorization and audit log.">
    We have implemented the role-based access system to make sure that only the authorized individual have access to the required information.
  </Accordion>

  <Accordion title="What is the FTE allocation for Information and IT security functions and roles?">
    We have more than 100 employees for the application product including support functions. Few important positions those who are involved in Infosec and IT Security Functions Chief Operating Officer Vice president - application DevOps Head - application Product Head - application Infosec Manager IT Head
  </Accordion>

  <Accordion title="What are the access management policies, procedures and processes?">
    We have Access Control Procedure and role based access system to make sure that only the authorised individual has access to the required information.
  </Accordion>

  <Accordion title="How is user data provided to the system? (AAD integration/data loads/manually created)">
    application collaborated with the tools like MS Teams, Slack and HRMS tools like Gusto, Keka, SAP Successfactor, BambooHr, Ramco HRMS, people strong, Zohopeople and darwinbox. Users can also login via G Suite, Azure AD, Okta SSO, One login SSO, Ping identity SSO and Centrify.
  </Accordion>

  <Accordion title="How are user roles provisioned?">
    We have 4 user access roles - Super admin, General Admin, Manager and Employee.
  </Accordion>

  <Accordion title="Does the product support modern web-based integration methods? Please provide details.">
    application collaborated with the tools like MS Teams, Slack and HRMS tools like Gusto, Keka, SAP Successfactor, BambooHr, Ramco HRMS, people strong, Zohopeople and darwinbox. Users can also login via G Suite, Azure AD, Okta SSO, One login SSO, Ping identity SSO and Centrify.
  </Accordion>

  <Accordion title="Does the organization is having physical security (facilities containing and/ or used to process Fincare data) in place? If yes please share and explain?">
    Yes. we have the Physical security controls in place. Attached the Physical and Environmental Security Procedure. All the Fincare data will be stored on AWS Cloud virtual platform and will not store anything locally. The purpose of this procedure is to prevent unauthorized physical access, damage, interference, theft or compromise to assets owned or controlled by Nreach Online Services Private Limited.
  </Accordion>

  <Accordion title="Do you have an access control policy? If yes please explain and share evidence?">
    Yes. We have the Access control policy to make sure that the data os available only to an authorised individual.. Attached the Access control policy.
  </Accordion>

  <Accordion title="Does CSP provide Identity and Access Management (IAM) with extensive Role Based Access Control (RBAC) support (who, what, when, where, how, etc.) for all provided services and What is your key management process for encryption">
    Yes.
  </Accordion>

  <Accordion title="User and User access provisioning, de-provisioning process">
    Attached the Access control policy
  </Accordion>

  <Accordion title="Does the application allow users to set/reset password and login with password even when SSO is enabled? (2)">
    No.. it does not. Once SSO is enabled, the users are not presented with any password options.
  </Accordion>

  <Accordion title="How many key custodians are there?">
    Super Admin (CTO) and Devops team are the custodians of the key.
  </Accordion>

  <Accordion title="If SSO is not technically feasible, every case of not using SSO shall be reviewed & approved by EIS Security Architecture, ISRA. Access is to be provisioned and tracked to all users via unique usernames and passwords. Follow standard password protection guidelines of Providence. IAM team shall be consulted.">
    [application supports Single Sign-On (SSO). Please click here to know more - https://www.application.io/integrations?tab=tab-sso](https://www.empuls.io/integrations?tab=tab-sso)
  </Accordion>

  <Accordion title="Inactive logon sessions are to be locked and require the user to re-authenticate after 15 minutes of inactivity.">
    Since empluls is SaaS platform this can be configured with the help of the Active directory so that the users who are inactive for more than 15 mins can re-login.
  </Accordion>

  <Accordion title="Default accounts must be removed or (disabled/ renamed and passwords reset).">
    Yes. Account can be created, disabled and password can be reset.
  </Accordion>

  <Accordion title="Passwords must be masked during entry rendering contents in the password field unreadable. Passwords must be hashed with salt by using Providence approved algorithm.">
    Password is masked during the entry. We store password hashed. We have SHA512 hash with unique salt for every password.
  </Accordion>

  <Accordion title="The least amount of privilege necessary for user to perform their required functions will be provided to users. Access to be provisioned based on user roles (RBAC) and align with job function.">
    [application has four different user access levels, namely Super Admin, General Admin, Manager, User. Please click here to know more - https://help.application.io/platform-management/platform-settings/access-controls](https://help.empuls.io/platform-management/platform-settings/access-controls)
  </Accordion>

  <Accordion title="The application in context shall display to users a notification message on acceptable use of the system before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance, and for publicly accessible systems display system use information, references to monitoring, and a description of authorized uses.">
    [application has four different user access levels, namely Super Admin, General Admin, Manager, User. Please click here to know more - https://help.application.io/platform-management/platform-settings/access-controls Xoxoday is ISO 27001:2013, GDPR, CCPA/CPRA and CSA STAR Level 1 compliant organization. We take appropriate consent for collecting the PII (Name, Email ID, Phone#) as per the privacy laws. Xoxoday GDPR - https://www.xoxoday.com/gdpr Xoxoday Privacy - https://www.xoxoday.com/privacy-policy](https://help.empuls.io/platform-management/platform-settings/access-controls)
  </Accordion>

  <Accordion title="Following 6 failed login attempts, the system or service shall be configured to either disable an account for 15 minutes or lock users out for at least 30 minutes.">
    Since empluls is SaaS platform this can be configured with the help of the Active directory.
  </Accordion>

  <Accordion title="Initial/ default password must be changed upon first login.">
    Yes. This can be configured and users can reset the password.
  </Accordion>

  <Accordion title="Any user-defined routes must be requested and approved by PSJH Cloud Engineering. Subscription owners/ contributors must never add their own Routes.">
    Admins will have a centralised controls on the platform and will have access for creation/deletion of the users as per the requirements. Please click here to know more - [https://help.application.io/platform-management/platform-settings/access-controls](https://help.application.io/platform-management/platform-settings/access-controls)
  </Accordion>

  <Accordion title="Access to the subscription is coordinated by IAM team, privileged access should be determined by business justification, and granted by IAM.">
    Admins will have a centralised controls on the platform and will have access for creation/deletion of the users as per the requirements. Please click here to know more - [https://help.application.io/platform-management/platform-settings/access-controls](https://help.application.io/platform-management/platform-settings/access-controls)
  </Accordion>

  <Accordion title="Application/ System of interest must restrict access to confidential information to authorized personnel of PSJH.">
    application has four different user access levels, namely Super Admin, General Admin, Manager, User. Please click here to know more - [https://help.application.io/platform-management/platform-settings/access-controls](https://help.application.io/platform-management/platform-settings/access-controls) Application can be used only by the authorised individuals.
  </Accordion>

  <Accordion title="Implement authenticated session tokens with secure settings.">
    We have implemented the oAuth2.0 and SAML-based tokens. JSON-based token is available for maximum security direct-email logins.
  </Accordion>

  <Accordion title="Non-interactive identities (eg. service accounts) used to authenticate with any upstream/downstream systems (e.g. database) must be identified by the design. The design must adopt a policy of using least-privileged accounts. This needs to be reviewed by Security Architecture on a case to case basis.">
    At Xoxoday, the access to data and systems are based on the principles of least privilege for access. Accordingly, all information systems and data are classified and further segregated to support role based access requirements. A strong identification and authentication system(AWS IAM) and logging systems are deployed and provides a centralized control to administer, monitor and review all critical access events.
  </Accordion>

  <Accordion title="The application must ensure all requests submitted via application URLs are checked against known authorization/access controls of the user to prevent privilege escalation attacks. The application must mandate users and devices to re-authenticate during the execution of privileged functions.">
    Yes the application have robust authentication methods. The users can re-authenticate a change in credentials and we comply to any attempted change in authentication information. our identity federation standards include SAML 2.0, SPML, WS-Federation and more as means of authenticating and authorizing users with airtight security protocol.
  </Accordion>

  <Accordion title="Periodic review of access to be performed, to monitor priviliges.">
    At Xoxoday we review the access controls on frequent basis.
  </Accordion>

  <Accordion title="Remove/disable inactive user accounts according to organizational defined frequency. eg., disables information system access within defined hours of termination and within defined hours of adverse circumstances termination. Terminates/revokes any authenticators/credentials associated with the individual;">
    We remove/revoke the access of the users upon termination or the access is not required and maintain these records for Audit purposes.
  </Accordion>

  <Accordion title="On-demand access reviews to be performed whenever there is a change to the existing RBAC, eg., when a caregiver moves from one department to other, or takes more responsibilities, or assuming reduced responsibilities that may warrent limiting existing access to sensitive systems.">
    At Xoxoday we review the access controls on frequent basis. Compliant. Attached the Access control policy.
  </Accordion>

  <Accordion title="If application is exposed to internet (upon review and approval from Security Architecture). The application's admin console must only be allowed to be accessed from a PSJH managed endpoint by a enabling conditional remote access policy.">
    Yes. The customer will have control on the Application as they will be having the Super admin access.
  </Accordion>

  <Accordion title="The mobile application must require users to enter a password, PIN, and/or biometric authentication mechanism in order to access mobile application content.">
    Yes. The users can access the mobile application only upon successful login.
  </Accordion>

  <Accordion title="If external, non-PSJH support is required and the vendor must agree to conduct remote support using a PSJH-provided remote access tools rather than vendor tools. Support activites shall be carried out under supervison of Providence's representative and sessions to be recorded.">
    We provide remote support using the client remote access tools.
  </Accordion>

  <Accordion title="The solution must be configured so that end users do not need local administrative privileges on workstations or systems running the application.">
    [application has four different user access levels, namely Super Admin, General Admin, Manager, User. Please click here to know more - https://help.application.io/platform-management/platform-settings/access-controls](https://help.empuls.io/platform-management/platform-settings/access-controls)
  </Accordion>

  <Accordion title="Implement controls to restrict export of data based on role and the availability and implementation of controls to protect the information once exported.">
    We have implemented the Role based access control machanism. Attached the Access control policy. We have the controls in place on who access the information and what level of access needs to be provided etc..
  </Accordion>

  <Accordion title="Web Services must be authenticated using a service account/ managed identity principal.">
    At Xoxoday we have implemented the Identity access management and all the applications are authenticated before login.
  </Accordion>

  <Accordion title="Implement controls to ensure that service response script code is not directly executable.">
    We conduct the code review and get an approval from the CTO before releasing any new versions or updates.
  </Accordion>

  <Accordion title="Implement controls to provide notice of direct changes to user authorizations.">
    At Xoxoday we have implemented the Identity access management and all the applications are authenticated before login.
  </Accordion>

  <Accordion title="Prevent resources from being exposed or directly accessible by authorized (or unauthorized) users, to prevent direct object referencing attacks.">
    Compliant. Only authorised individuals can have access to the application with the help of the valid credentials.
  </Accordion>

  <Accordion title="Is the system accessed via a direct Internet connection, VPN, or dedicated network circuit?">
    No. Its not accessed via direct internet connection. Access to our production environment is allowed only via our corporate network and access is allowed only to authorized individuals. We use a cloud hosted VPN with strict access controls. VPN access has been enabled with 2FA For such authorized individuals.
  </Accordion>

  <Accordion title="Detail out the different roles configured and the privileges associated with each role. Also, please specify how user access management (access provisioning and de-provisioning) is being performed">
    We have Role-based access control (RBAC) system and make sure that only the autorized individual have an access to the data. And we review these access provisoining regularly and deactive the users access as per the change management policy.
  </Accordion>

  <Accordion title="Are there any shared or Generic IDs being used to access Infosys data? If yes, please provide details of the same and the security controls in place for managing the resulting security risk.">
    No. We do not use generic IDs to access data
  </Accordion>

  <Accordion title="Are admin or privilege accounts are separate from user accounts in application?">
    application application has four different user access levels, namely Super Admin, General Admin, Manager, User.
  </Accordion>

  <Accordion title="Do access rights follow need-to-know, need-to-use and least privilege concepts?">
    Super Admins are the default admins of application. They are also the Group Admins of Townhall. Super Admins can view what access permissions are available to various user access levels using Access Control settings. Super Admins can also delegate access for various features and tasks to General Admin, Manager & User. Within Xoxoday, Access to data and systems are based on the principles of least privilege for access. A strong identification and authentication system and logging systems are deployed and provides a centralized control to administer, monitor and review all critical access events.
  </Accordion>

  <Accordion title="Are the roles and access rights are reviewed atleast annually?">
    We have implimeneted the Access Control policy and follow the role based access control system. And all the access has been reviewed and make the necessary adjustments. The roles and access rights are reviewed during the internal and external Audits as well.
  </Accordion>

  <Accordion title="Is the account authenticated before access?">
    Our partnerships with a wide array of integration partners ensure existing customer based Single Sign On (SSO) capability for all users to seamlessly use Xoxoday's products. With an easy DIY setup, your SSO solution would be plugged in and ready to go. our identity federation standards include SAML 2.0
  </Accordion>

  <Accordion title="Are critical roles and privilege accounts login enforced by 2-FA?">
    At Xoxoday we have enabled MFA for all the critical roles and privilege accounts for maximum security.
  </Accordion>

  <Accordion title="Are users accounts locked after a successive failure login attempts?">
    At Xoxoday user accounts will lockout after 5 unsuccessful failure login attempts.
  </Accordion>

  <Accordion title="Are users enforced to change password periodically?">
    At Xoxoday all the users enforced to change the password for every 90 days.
  </Accordion>

  <Accordion title="Are the password are hashed and not mentioned as clear text in code?">
    We store password hashed. We have SHA512 hash with unique salt for every password.
  </Accordion>

  <Accordion title="Is the application server comply with identity and access control policy?">
    We have implemented the Identity access management and follow the Access control policy.
  </Accordion>

  <Accordion title="Is the application server comply with password policy?">
    At Xoxoday we follow the password policy.
  </Accordion>

  <Accordion title="Is the database comply with identity & access control policy?">
    We have implemented the Identity access management and follow the Access control policy.
  </Accordion>

  <Accordion title="Is the database comply with password policy?">
    At Xoxoday we follow the password policy. Attached the same for your reference.
  </Accordion>

  <Accordion title="Who all have access to the hosted environment and/ or data? (Include the third party access if applicable)">
    Access to data and systems are based on the principles of least privilege for access. Accordingly, all information systems and data are classified and further segregated to support role-based access requirements. A strong identification and authentication system and logging systems are deployed and provides a centralized control to administer, monitor and review all critical access.
  </Accordion>

  <Accordion title="How is their access controlled?">
    We have role-based access system through access control policy to make sure that only the authorised individual has access to the required information. An Identity and Access Management (IAM) solution has been defined to manage user access through role-based access profiles that support the implementation of accesses based on the principles of need-to-know basis and support segregation of duties. The approvers are either the Product Heads or respective function Heads are their authorized delegates.
  </Accordion>

  <Accordion title="How does the provider segregate the the customer environment from other tenants?">
    We logically segregate the the customer environment from other clients, each customer is uniquely identified by a tenant ID. It is segregated with a client-specific key for proper handling and security reasons. The application is engineered and verified to ensure that it always fetches data only for the logged-in tenant. Per this design, no customer has access to another customer's data.
  </Accordion>

  <Accordion title="How is data integrity assured? What controls exist over internal processing?">
    An Identity and Access Management (IAM) solution has been defined to manage user access through role-based access profiles that support the implementation of accesses based on the principles of need-to-know basis and support segregation of duties. Privileges relating to Administration of user access privileges and role configurations are different from the authorized approver that approves access requests. The approvers are either the Product Heads or respective function Heads are their authorized delegates. Developers do not have access to the production environment. Access to the production environment is restricted to a limited set of authorized users based on their job responsibilities
  </Accordion>

  <Accordion title="Authorization: Explain in detail how roles are managed.">
    Within Xoxoday Access to data and systems are based on the principles of least privilege for access. Accordingly, all information systems and data are classified and further segregated to support role-based access requirements. Furthermore, while defining job roles and designing access roles, privileges leading to conflicts of interests are to be avoided. A strong identification and authentication system and logging systems are deployed and provides a centralized control to administer, monitor and review all critical access. We use Active directory and SSO for authentication purposes.
  </Accordion>

  <Accordion title="Does the application support multi-factor authentication (MFA / 2FA)? If yes, please elaborate.">
    [No, we don't provide multi-factor authentication. As of now, there's oAuth2.0 and SAML-based tokens Please click here to know more about Single Sign-On - https://www.application.io/integrations?tab=tab-sso](https://www.empuls.io/integrations?tab=tab-sso)
  </Accordion>

  <Accordion title="Does the provider have access to the customer data, and if so, what restrictions are there over this level of access?">
    Within Xoxoday Access to data and systems are based on the principles of least privilege for access. Management (IAM) solution has been defined to manage user access through role-based access profiles that support the implementation of accesses based on the principles of need-to-know basis and support segregation of duties. Privileges relating to Administration of user access privileges and role configurations are different from the authorized approver that approves access requests. The approvers are either the department heads or the management.
  </Accordion>

  <Accordion title="Who has access to these logs?">
    At Xoxoday only authorised personnel from our technical team will have access. For Ex – CTO/production head, Devops Lead etc.. The event logs are stores in a bucket wherein nobody can access them without an approval from the high authorities i.e. the Chief Technical Officer.
  </Accordion>
</AccordionGroup>


# Information Security
Source: https://help-plum.xoxoday.com/faq/security-compliance/information-security

Find answers to frequently asked questions about the information security practices and standards Plum follows.

<AccordionGroup>
  <Accordion title="1. Terms and Definition">
    [Open document](https://drive.google.com/file/d/1l23BTr1RStFZq_QmF-5V2vpS06cBJnHb/view?usp=sharing)
  </Accordion>

  <Accordion title="2. Acceptable Usage Policy">
    [Open document](https://drive.google.com/file/d/1oww6vB7PxwXGafO33h0jG-T1VlD0Wm8q/view?usp=sharing)
  </Accordion>

  <Accordion title="3. Cloud Computing Security Policy">
    [Open document](https://drive.google.com/file/d/1WxUI_BnLLbeNzQHtWgkgLFqzhuZxIwax/view?usp=sharing)
  </Accordion>

  <Accordion title="4. Mobile device Management Policy">
    [Open document](https://drive.google.com/file/d/1P_7-nKbRI8AIWUgm66Q9aUsYr83nN85r/view?usp=sharing)
  </Accordion>

  <Accordion title="5. Encryption Policy">
    [Open document](https://drive.google.com/file/d/10UXddHd9CxaCO6OLyqEM5PC1iGS2vFEz/view?usp=sharing)
  </Accordion>

  <Accordion title="6. Clear Screen and Clear Disk Policy">
    [Open document](https://drive.google.com/file/d/1bRjJvB4gDqvkp-WY_NlwTNL35K-Y6_YS/view?usp=sharing)
  </Accordion>

  <Accordion title="7. Virtual Private Network Policy">
    [Open document](https://drive.google.com/file/d/1LQsURIqAmb8waKgI5DJac2D5hUVDNjua/view?usp=sharing)
  </Accordion>

  <Accordion title="8. Password Management Policy">
    [Open document](https://drive.google.com/file/d/10JIrklIh9EzHWYQYLUvw-oDoTd3THwY2/view?usp=sharing)
  </Accordion>

  <Accordion title="9. Business Continuity Policy">
    [Open document](https://drive.google.com/file/d/1PpWRocTmV2CKzZPvVf-9b60qi0Pe3Gx3/view?usp=sharing)
  </Accordion>

  <Accordion title="10. Email Security Policy">
    [Open document](https://drive.google.com/file/d/1pzfi-zYodRujjPR5RzktjqyE4LME2jT_/view?usp=sharing)
  </Accordion>

  <Accordion title="11. Information Technology Policy">
    [Open document](https://drive.google.com/file/d/18qj9Cu55TuMileF7ppUJTNqfklabZFAX/view?usp=sharing)
  </Accordion>

  <Accordion title="12. Compliance Procedure">
    [Open document](https://drive.google.com/file/d/1FLNuR6I5uy3DHyuH6joR6v5KvlP-_aI-/view?usp=sharing)
  </Accordion>

  <Accordion title="13. Threat and Vulnerability Management">
    [Open document](https://drive.google.com/file/d/17eIpv1sBhYTS8mqLPlf1OuZYAkvGmBxo/view?usp=sharing)
  </Accordion>

  <Accordion title="14. Risk Management Procedure">
    [Open document](https://drive.google.com/file/d/1BgY8w7K2gaxg2zlVcYaIc32VbdclBuCz/view?usp=sharing)
  </Accordion>

  <Accordion title="15. Cyber Crisis Management Plan">
    [Open document](https://drive.google.com/file/d/1ajHzFdqttTek0APJhj9Z5bWr9QS6q6N_/view?usp=sharing)
  </Accordion>

  <Accordion title="16. Backup Recovery Procedure">
    [Open document](https://drive.google.com/file/d/1d25BY9fxNhLUb6GmoDtrQ8WDPYtRf3Lh/view?usp=sharing)
  </Accordion>

  <Accordion title="17. Procedure for Control of Documents and Records">
    [Open document](https://drive.google.com/file/d/1ZFnMWlz_RtvrbYQbXxnQV4N7HNmT-MKn/view?usp=sharing)
  </Accordion>

  <Accordion title="18. Virus Management Procedure">
    [Open document](https://drive.google.com/drive/u/0/folders/1q1hVwUQ0fEYzFZFXMatHn3UIeIOXM7tU/)
  </Accordion>

  <Accordion title="19. Patch Management Procedure">
    [Open document](https://drive.google.com/file/d/1n02SoROiB1L3V27dFGd4G1vszZneoAr0/view?usp=sharing)
  </Accordion>

  <Accordion title="20. Access Control Procedure">
    [Open document](https://drive.google.com/file/d/1OZcypu7cVjHjwVFLnI5XY9zYKqjklMcq/view?usp=sharing)
  </Accordion>

  <Accordion title="21. Network Control Access and Security Procedure">
    [Open document](https://drive.google.com/file/d/1FlyOOf8Nf6_eNgXFnnII8KZzyzVarCmc/view?usp=sharing)
  </Accordion>

  <Accordion title="22. Information System Acquisition Development and Maintenance Procedure">
    [Open document](https://drive.google.com/file/d/1FSl84TJ1kd-LWSQgs62609I5Xwz9KSyj/view?usp=sharing)
  </Accordion>
</AccordionGroup>


# Others
Source: https://help-plum.xoxoday.com/faq/security-compliance/others

Find answers to additional security and compliance questions about the Plum platform that aren't covered elsewhere in this FAQ.

<AccordionGroup>
  <Accordion title="Does Plum follow GDPR?">
    Plum is GDPR compliant. At Xoxoday, we ensure that the data is gathered, stored, and handled with respect to individual rights. We have raised awareness among our employees and other stakeholders on how to handle the data appropriately. Our employees understand the importance of GDPR and information security.
  </Accordion>

  <Accordion title="Does Xoxoday have an information security policy and is it communicated and published to all employees, suppliers, and other relevant external parties?">
    Xoxoday has an information security policy that is published and communicated to all suppliers and employees (including contractors and other relevant external parties).

    Xoxoday has ensured that the Information security policies have established the direction of the organization and align to best leading practices (e.g., ISO-27001, ISO-22307, CoBIT), regulatory, federal/state, and international laws where applicable.
  </Accordion>

  <Accordion title="Does Xoxoday have a formal established disciplinary or sanction policy for its employees who have violated security policies and controls?">
    Yes, at Xoxoday, we have a formal disciplinary or sanction policy established for employees who have violated security policies and controls. Employees are made aware of what action might be taken in the event of a violation and stated as such in the policies and controls. A detailed disciplinary process and policy are also in place.
  </Accordion>

  <Accordion title="Does Xoxoday ensure that all projects go through some form of information security assessment?">
    At Xoxoday, we use JIRA for Project Management, and abiding by the Information security policy is mandatory and has been followed in all the projects.

    Every code change is reviewed by the tech lead or architect responsible for the project.

    During the review process, the reviewer is responsible for identifying possible security issues.
  </Accordion>

  <Accordion title="Does Xoxoday have a mobile device policy?">
    Yes, Xoxoday has a Mobile device policy. At Xoxoday, the mobile device policy takes into account the risks of working with mobile devices in unprotected environments and the controls to be implemented for preventing data transmitted/stored in the mobile device, and much more.
  </Accordion>

  <Accordion title="Does Xoxoday have a policy governing information classification and is there a process by which all information can be appropriately classified?">
    Yes at Xoxoday, we do have an 'Information Security Policy' in place.

    Information Classification is included in the organization's processes, and be consistent and coherent across the organization. Results of classification indicate the value of assets depending on their sensitivity and criticality to the organization, e.g. in terms of confidentiality, integrity, and availability. Results of classification are updated in accordance with changes in their value, sensitivity, and criticality through their life-cycle.

    Formal procedures for the secure disposal of media are also established to minimize the risk of confidential information leakage to unauthorized persons. The procedures for the secure disposal of media containing confidential information are proportional to the sensitivity of that information.
  </Accordion>

  <Accordion title="Does Xoxoday have a formal procedure governing how removable media is disposed of?">
    Yes, we do have an 'Information Security Policy' in place and formal procedures for the secure disposal of media are established to minimize the risk of confidential information leakage to unauthorized persons. The procedures for the secure disposal of media containing confidential information are proportional to the sensitivity of that information.
  </Accordion>

  <Accordion title="Does Xoxoday have a process to access the information and application system functions restricted in line with the access control policy?">
    Our application has role-based access controls and the menu's screens are made accessible accordingly.
  </Accordion>

  <Accordion title="What kind of Encryption and Hashing is used at Xoxoday?">
    AES 256 bit encryption for PI data. SHA256 with unique salt for Hashing passwords.
  </Accordion>

  <Accordion title="Does Xoxoday have a documented and tested Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP) available? If Yes, kindly mention the location where the data would be stored?">
    Yes, Xoxoday does have tested Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP), the data would be stored at AWS Singapore.
  </Accordion>

  <Accordion title="Is there a process for reporting identified information security weaknesses at Xoxoday and Is this process widely communicated?">
    During security audit/VAPT review, these incidents are identified.

    Yes, this process is widely communicated to all the employees and stakeholders.
  </Accordion>

  <Accordion title="Where systems or applications are developed, are they security tested as part of the development process?">
    Yes, on Xoxoday, we do conduct Quarterly VAPT.
  </Accordion>

  <Accordion title="Are there policies mandating the implementation and assessment of security controls at Xoxoday?">
    Yes, at Xoxoday, we perform quarterly VAPT and have static code analysis via SonarQube
  </Accordion>

  <Accordion title="Do contracts with external parties and agreements within the organization detail the requirements for securing business information in a transfer?">
    Policies, procedures, and standards have been established and maintained to protect information and physical media in transit, and are referenced in such transfer agreements.

    Also, there is a clause on securing business information and protection of confidential information in the NDA's signed by the external parties.
  </Accordion>

  <Accordion title="Are IS Systems subject to audit at Xoxoday and does the audit process ensure business disruption is minimized?">
    As part of the ISO audit, IS Systems audit is also covered and yes the audit process ensures business disruption is minimized.
  </Accordion>

  <Accordion title="Is there a process to risk assess and react to any new vulnerabilities as they are discovered at Xoxoday?">
    We have a quarterly VAPT performed on the entire application by a third-party security auditor.
  </Accordion>

  <Accordion title="How secure is Plum?">
    At Xoxoday, we ensure that the data is gathered, stored, and handled with respect to individual rights. We have raised awareness among our employees and other stakeholders on how to handle the data appropriately. Our employees understand the importance of GDPR and information security. Our controls are placed based on the data protection impact assessment (DIPA). All personal data is encrypted on Xoxoday.

    We take data and security very seriously. We are ISO 27001, GDPR, and SOC compliant. More details about our [security](https://www.xoxoday.com/security) and [privacy policy](https://www.xoxoday.com/privacy-policy) in the links aforementioned. You can also know more about our compliance [**here**](/faqs/security-compliance/privacy-and-security).
  </Accordion>

  <Accordion title="How does Plum use my information?">
    We may use the information we collect from you when you register, make a purchase, sign up for our newsletter, respond to a survey or marketing communication, surf the website, or use certain other site features in the following ways:

    * To personalize your experience and to allow us to deliver the type of content and product offerings in which you are most interested.
    * To improve our website in order to better serve you.
    * To allow us to better service you in responding to your customer service requests.
    * To ask for ratings and reviews of services or products.
    * To follow up with them after correspondence (live chat, email, or phone inquiries).
  </Accordion>

  <Accordion title="Data security and ownership?">
    We take data and security very seriously. We are ISO 27001, GDPR and SOC compliant. More details about our [security](https://www.xoxoday.com/security) and [privacy policy](https://www.xoxoday.com/privacy-policy) are [here](/faqs/security-compliance/privacy-and-security).
  </Accordion>

  <Accordion title="Do you have procedures in place to ensure production data shall not be replicated or used in non-production environments?">
    We ensure that ensure production data shall not be replicated or used in non-production environments. Physical segregation is done for production and non-production environments.
  </Accordion>

  <Accordion title="A formal privacy management framework is in place">
    Yes. We are compliant with CPRA (California Privacy Rights Act), GDPR (General Data Protection Regulation) and HIPAA (Health Insurance Portability and Accountability Act)
  </Accordion>

  <Accordion title="Are there documented privacy policies and procedures that address choice and consent based on the statutory, regulatory, or contractual obligations to provide privacy protection for client-scoped privacy data?">
    Implemented the data security Policy and Data Subject Access Rights Procedure.
  </Accordion>

  <Accordion title="Does the Vendor allow Audits by the customer or any Third Paties appointed by the customer of the below given nature:">
    In accordance with Data Protection Laws, we make available to Controller on request in a timely manner such information as is necessary to demonstrate compliance by Processor with its obligations under Data Protection Laws. Upon Controller's written request and subject to the confidentiality obligations set forth in the Agreement, we will make available to Controller a copy of Nreach the most recent third-party audits or certifications, as applicable.
  </Accordion>

  <Accordion title="Provide a copy of all privacy-related policies and procedures that may apply to the Supplier's handling of Personal Data.">
    Privacy Policy - [https://www.xoxoday.com/privacy-policy](https://www.xoxoday.com/privacy-policy) Attached the - Data Protection Policy, Data Security policy, Data Subject Access Rights Procedure, Data Breach Notification Procedure.
  </Accordion>

  <Accordion title="Are there documented privacy policies and procedures that address choice and consent based on the statutory, regulatory, or contractual obligations to provide privacy protection for client-scoped privacy data? (2)">
    Attached the data security Policy and Data Subject Access Rights Procedure. Please visit here for Privacy policy - [https://www.xoxoday.com/privacy-policy](https://www.xoxoday.com/privacy-policy)
  </Accordion>

  <Accordion title="Is your Privacy Notice/ Privacy Policy externally available? Please provide us with the URL.">
    Yes. Please visit - [https://www.xoxoday.com/privacy-policy](https://www.xoxoday.com/privacy-policy)
  </Accordion>

  <Accordion title="Are duties separated, where appropriate, to reduce the opportunity for unauthorized modification, unintentional modification or misuse of the organization's IT assets? i.e. front desk duties separated from accounting. Data analysts access from IT support etc.">
    Yes, the policy, process, and procedure is implemented to ensure proper segregation of duties. our roles and job duties are segregated through role-based access to ensure maximum security of tenants' databases
  </Accordion>

  <Accordion title="A copy of your privacy policy and external privacy statement, if they are separate documents.">
    Attached the Xoxoday Privacy Policy. Please click here for the external privacy statement - [https://www.xoxoday.com/privacy-policy](https://www.xoxoday.com/privacy-policy).
  </Accordion>

  <Accordion title="Is Records of Processing or an inventory is maintained on what personal data is collected/stored/processed/managed on behalf of Infosys?">
    Yes. We do maintain the records as per the Data privacy compliance requirements.
  </Accordion>

  <Accordion title="Do you maintain a list of all individuals having access to Personal Data and do you regularly review (whether it is electronic data, hard copy data, etc.)">
    Yes. we maintain the list as per the Privacy laws and review it. We provide access only to authorised individual as per Role based access and access control policy.
  </Accordion>

  <Accordion title="Do you follow privacy guidance when collecting, storing, or processing Personal Data via electronic, audio, visual or print media?">
    Yes. we follow the privacy gidelines when collecting, storing, or processing Personal Data via electronic, audio, visual or print media. We are complied with this requirements.
  </Accordion>

  <Accordion title="Do you routinely access/review/monitor your organization's measures to meet the objectives of privacy commitment, when Personal Data of Infosys is collected/stored/processed as part of service engagement?">
    We have review and monitor machanism to make sure that only the authorised individual have an access and the objectives of the privacy commitments are met.
  </Accordion>

  <Accordion title="Are your employees and subcontractors given regular and formal privacy training? If Yes, what is the frequency of Training?">
    Yes. we provide them a Information security and Privacy training. The frequency of the training is once in a year or as soon as they onboarded.
  </Accordion>

  <Accordion title="Do you confirm compliance with applicable data privacy clauses in your contract executed with Infosys?">
    Yes. We have applicable data privacy clauses in the contracts.
  </Accordion>

  <Accordion title="Do you develop and maintain an agreed upon audit plan (e.g., scope, objective, frequency, resources, etc.) for reviewing the efficiency and effectiveness of implemented security controls?">
    We continuosly monitor the efficiency and effectiveness of implemented security controls frequently during the internal and external audits.
  </Accordion>
</AccordionGroup>


# Policies & Procedures
Source: https://help-plum.xoxoday.com/faq/security-compliance/policies-procedures

Find answers to frequently asked questions about the internal security policies and procedures that govern Plum's operations.

<AccordionGroup>
  <Accordion title="Do you have a disciplinary process for non-compliance with information security policy, and are employees made aware of the consequences for non-compliance?">
    We have the disciplinary process in place for Non-compliance with Information security Policy and we have communicated and made aware of the consequences for non-compliance.
  </Accordion>

  <Accordion title="Do you have an employee termination or change of status process?">
    We have the employee termination process in place.
  </Accordion>

  <Accordion title="Do you have documented information security baselines for component of your infrastructure (e.g., hypervisors, operating systems, routers, DNS servers, etc.)?">
    We have implemented the information security policy and Hardening Guidelines.
  </Accordion>

  <Accordion title="Do you have documented policies and procedures demonstrating adherence to data retention periods as per legal, statutory or regulatory compliance requirements?">
    We have implemented the Data Retention and Disposal Policy and attached the same for your referrence. • Storage Period would be as per regulatory conditions. • Personal data can be deleted based on a formal written request, with justification. • Xoxoday would delete the data within 30 days of receiving the request.
  </Accordion>

  <Accordion title="Do you perform, at minimum, annual reviews to your privacy and security policies?">
    All our Privacy and security policies are reviewed every year and approved by the management.
  </Accordion>

  <Accordion title="Are formal risk assessments aligned with the enterprise-wide framework and performed at least annually, or at planned intervals, determining the likelihood and impact of all identified risks, using qualitative and quantitative methods?">
    At Xoxoday we have developed a Risk Management Framework as part of the Information Security Management System (ISMS) in accordance with ISO/IEC 27001:2013 standard and SOC II attestation. The information security team assesses security risks annually and on an ongoing basis when major changes occur or when industry changes occur.
  </Accordion>

  <Accordion title="Do you have documentation establishing and defining your encryption management policies, procedures, and guidelines?">
    Yes. We have implemented the Data Encryption policy
  </Accordion>

  <Accordion title="Are policies and procedures established, and supporting business processes and technical measures implemented, for maintaining complete, accurate, and relevant agreements (e.g., SLAs) between providers and customers?">
    Yes. We have the policies and procesures in place as per the compliane requirements.
  </Accordion>

  <Accordion title="Is classification inclusive of all media types (electronic, hard copy)?">
    Yes. classification inclusive of all media types.
  </Accordion>

  <Accordion title="Does your organization have policies and standards in place for the handling of Media?">
    Yes. we have implemented the Media handling procedures.
  </Accordion>

  <Accordion title="Is there capability to support client media handling policies and standards?">
    We follow Xoxoday media handling procedure.
  </Accordion>

  <Accordion title="Are there policies and standard in place for the secure storage of hard copy media? Internal repository? Third-party contractor?">
    Yes. It's a part of Media handling procedure and Information security policy implemented.
  </Accordion>

  <Accordion title="Are there policies and standards in place for the secure destruction of media?">
    Yes. we have implemented the Data Retention and Disposal Policy.
  </Accordion>

  <Accordion title="Does the organisation have written information security policies?">
    Yes. We have a written Information security policy.
  </Accordion>

  <Accordion title="How often the policy are been reviewed?">
    These policies are reviewed anually or whenever changes made to it and approved by the management as per the compliance requirements.
  </Accordion>

  <Accordion title="Does the organisation have a written password policy that details the required structure of passwords?">
    Yes. We have implemented the Password Management Policy
  </Accordion>

  <Accordion title="Have the information security policy and standards been approved by senior management?">
    All the information security policy and standards been approved by senior management.
  </Accordion>

  <Accordion title="Has the organisation implemented an IT Governance framework such as ITIL, ISO 27001/22301, SSAE18 (SOC) and others?">
    Yes. Xoxoday is ISO 27001:2013, SOC 2, CCPA/CPRA, HIPAA, CSA START, GDPR certified organization.
  </Accordion>

  <Accordion title="Is access restricted to systems that contain sensitive data?">
    We have implemented the access control policy and access will be provided only upon need and approval basis. Attached the access control policy.
  </Accordion>

  <Accordion title="Does the software development lifecycle in the organisation specifically focus on security?">
    We focus on the security while producting the softwares.
  </Accordion>

  <Accordion title="Is code review performed on all changes to the source code with an emphasis on secure coding principles?">
    It's a part of our system devolopment life cycle.
  </Accordion>

  <Accordion title="As per the customer policy, personal devices (BYOD) are restricted. If BYOD is permitted to process/access/storethe customer scoped data, are there appropriate approval obtained from the customer for the same?">
    We have implemented the BYOD policy and all our employees follow the Xoxoday Information security and IT Policies.
  </Accordion>

  <Accordion title="Is there a process to perform modify / change the access review process for additional focus on remote access connections to client (the customer) network?">
    Yes. we have implemented the access control policy.
  </Accordion>

  <Accordion title="Is there a documented third-party risk management program in place for the selection, oversight and risk assessment of Subcontractors (e.g. service providers, dependent service providers, sub-processors)?">
    We have implemented the Risk Management Procedure
  </Accordion>

  <Accordion title="Is there a Documented Information Security Policy approved by management? If yes, is the same communicated to all employees?">
    Yes. Its approved by the management and communicated to all the employees.
  </Accordion>

  <Accordion title="Are the key roles and responsibilities of the organizations Information Security Processes covered as a part of IS policy for the customer activities?">
    Yes. Aattached the Information security policy, Roles and responsibilities policies.
  </Accordion>

  <Accordion title="Is the Information Security Policy reviewed at regular intervals & on changes in the customer scope of work?">
    Yes. All the policies have been reviewed at regular intervals.
  </Accordion>

  <Accordion title="Is there a role based access control for accessing critical facilities used for the customer operations?">
    Yes. We have implemented the role based access control mechanism and only authorised individual will get access.
  </Accordion>

  <Accordion title="Has the vendor documented detailed procedure for identifying of changes to be notified to the customer, sending an approval request & communication process?">
    Yes, we have the policies and procedures in place and we will notify the customer if there is any changes took place in terms of security and privacy.
  </Accordion>

  <Accordion title="Does the vendor provider have a management approved change management process for activities of the customer?">
    Yes. We have a Change Management process and approved by the management.
  </Accordion>

  <Accordion title="Does the vendor's change management / change control process include some of the following: Request, review and approval of proposed changes; Review for potential security impact; Security approval; Review for potential operational impact; Approval from the customer (when applicable); Documentation of changes; Pre-implementation testing; Post-implementation testing; Rollback procedures">
    Yes. We have implemented the change management procedure.
  </Accordion>

  <Accordion title="Has provider documented a process for handling emergency changes in the customer operations to ensure that these types of changes are carried out in controlled & timely manner?">
    Yes. We implemented the the change management procedure.
  </Accordion>

  <Accordion title="Does the organization has a mechanism to classify & protect the customer data?">
    Yes. We have implemented the Data clasification policy.
  </Accordion>

  <Accordion title="Does the vendor follow a defined retention period for the customer data? Does it follow a structured mechanism to remove the customer data once retention period is expired?">
    Yes. We have the data retension and disposal policy. We will have the data till you use our platform and will be deleted upon termnination of the contracts and will confirm.
  </Accordion>

  <Accordion title="What is your retention policy for retaining these logs? (30 days, 60 days, 1 year, etc)">
    1 year
  </Accordion>

  <Accordion title="Does the organization have controls implemented for monitoring the use of all information processing facilities handling sensitive data?">
    Yes. We have implemented data security policy and have controls in place to monitor the processing of personal information. Since we have deployed our application of AWS cloud only authorised individual have an access.
  </Accordion>

  <Accordion title="Are roles & responsibilities defined clearly for reporting suspected security incidents to the customer? Is root cause analysis performed?">
    Yes. We have the incident management response team and roles and responsibilities has been clearly defined. As per our policies and procedure we condut Root Cause Analysis report (RCA) including the details of Business Impact, Issue Description, Root Cause, and Corrective Actions.
  </Accordion>

  <Accordion title="Is a list of Emergency contact names and phone numbers of your company, client and Vendor clearly defined and readily accessible to allow prompt escalation?">
    Yes. We have communicated on this to a concerned parties.
  </Accordion>

  <Accordion title="Is there adequate segregation of duties to protect the the customer operations network where appropriate?">
    Yes, we segregated the duties.
  </Accordion>

  <Accordion title="Is 2-factor authentication used for very critical applications?">
    Yes, our policies and procedures are established and implemented to enforce two-factor authentication for privileged account management/authentication while accessing tenant data/systems.
  </Accordion>

  <Accordion title="Does the development team have access to production environment?">
    We have segregated the teams according to their roles and responsibilites.
  </Accordion>

  <Accordion title="Please explain your Software Development Lifecycle. Do you have a process for the review of applications source code for security flaws and backdoors? Describe who performs this process. Describe when in the software development life cycle is it performed">
    We have the SDLC Procedure and attached the same for your reference. We have defined rules and guidelines for secure development of software and systems.
  </Accordion>

  <Accordion title="Is a media labelling procedure in place, with sufficient information?">
    Yes. We have implemented the media protection procedure.
  </Accordion>

  <Accordion title="Is there BCP plan / policy covering people, process & systems related to the customer operations? Is it communicated to concerned employees?">
    Yes. We have BCP policy and procedures in place and test it every year.
  </Accordion>

  <Accordion title="Do you have a documented password management policy? Have you deployed password security controls within the environment on application, OS, database and network layers?">
    At Xoxoday we have implemented the password management policy. Attached the same for your referrence. We have deployed password security controls accross the organization for maximum security.
  </Accordion>

  <Accordion title="Do you have a policy/procedure on change management? Are all changes to production environment recorded and follows the change management procedure?">
    Attached the Change Management Procedure. All the chnages to production environment is recorded and followed the change management procedure.
  </Accordion>

  <Accordion title="Do you maintain an asset classification schema at par with BSLI Information classification policy and maintain a mapping of the same?">
    We have implemented the Asset classification policy. Attached the policy for your referrence.
  </Accordion>

  <Accordion title="Has a formal policy been developed that addresses the risks of working with mobile computing facilities, including requirements for physical protection, access controls, cryptographic techniques, back-up, and virus protection?">
    We have the policies in place and audited during the internal and external audits. We have the policies with regards to Access control, Ceyptography, Anti virus protection, Back up and recovery etc..
  </Accordion>

  <Accordion title="Is the acceptable use of assets policy documented?">
    Yes. We have implemented the Acceptable Usage Policy
  </Accordion>

  <Accordion title="Is there a clear desk and clear screen policy in force in the organization?">
    Yes. We have implemented Clear Screen and Clear Desk Policy
  </Accordion>

  <Accordion title="Whether the Information Security Policy is reviewed at planned intervals, or if significant changes occur to ensure its continuing suitability, adequacy and effectiveness? Whether the management review of the information security policy documentation is recorded?">
    All the information security policies has been reviewed annually or upon any changes to the policies. All the management review and approvals has been recorded.
  </Accordion>

  <Accordion title="Has your organisation identified employees and resources (e.g., suppliers, subcontractors, products, and logistics) that are critical for business continuity in the event of a pandemic.">
    Attached the Business continuity documents.
  </Accordion>

  <Accordion title="Describe the backup and retention policy proposed, including the possible capacity to restore a VM to a previous state in time. Also detail how frequently backup/restore tests are performed.">
    Data backups are done daily and in a secured way in AWS. Attached the Backup Recovery Procedure.
  </Accordion>

  <Accordion title="Provide your IS Security Policy (or Information Security Management Program) as well as Data Security and Privacy Program and describe the associated magement system (review, monitoring, method to share this information with tenants, etc.).">
    Attache the Information Security Policy and Data Security policy.
  </Accordion>

  <Accordion title="Provide your Endpoint Security Policy">
    Attached the policies with regards to - IT, Virtual Private Network, Threat and vulnerabilities, Virus management, patch management, access control, logging and monitoring etc.
  </Accordion>

  <Accordion title="Provide the technical security policies implemented on all components of your infrastructure (microcode vulnerabilities, HSM management, Management of the virtualization, Hypervisors, OS, network elements, etc…) inclusive of custom changes or solution-specific modifications of these elements (especially hypervisors). Also describe the management system in place to monitor continuous compliance to these policies.">
    Attached the below mentioned policies - 1. Cloud Computing Security Policy 2. Encryption Policy 3. Password Management Policy 4. Threat and Vulnerability Management 5. Infrastructure Change Control Procedure 6. Virtual Private Network Policy 7. Information Classification Policy 8. Cyber Crisis Management Plan 9. Network Access Control and Security Procedure 10. Information System Acquisition Development and Maintenance Procedure
  </Accordion>

  <Accordion title="Describe how you implement Segregation of Duties and monitor potential conflict of interests">
    The policy, process, and procedure is implemented to ensure proper segregation of duties.
  </Accordion>

  <Accordion title="Provide the standard contractual RACI between your teams and the tenants'.">
    Attached the Roles Responsibilities\_Authorities Policy.
  </Accordion>

  <Accordion title="What file integrity (host) and network intrusion detection (IDS/IPS/WAF) systems using signatures, lists or behavioural patterns have you implemented to help facilitate timely detection, investigation by root cause analysis and response to incidents. Provide an overview of how these tools are updated and controled.">
    Yes, all the mechanisms related to security and policies are implemented to facilitate timely decision and investigation by root-cause analysis. These incidences are analyzed with network intrusion detection (IDS) tools.
  </Accordion>

  <Accordion title="Describe the change management in place and how changes performed on the infrastructure (virtual or physical) are monitored and logged">
    We have implemented the change management procedure. Attached the Change Management Procedure
  </Accordion>

  <Accordion title="Provide an overview of your security incident response plan, showing your contacts with local authorities, the possibility to integrate customer's requirements, roles and responsibilities between the provider and the customer during a security incident, how you manage responses to litigation hold or legal subpoenas for a specific customer. The overview should mention how frequently the plan is tested, and what type of information is made available to customers (statistical information, information to affected customers only, etc..) in case an incident occur.">
    Attached the Security Incident Reporting \_ Response Procedure
  </Accordion>

  <Accordion title="Does the organisation have written information security policies? (2)">
    Yes. We have a written Information security policy. Attached the same for your reference.
  </Accordion>

  <Accordion title="How often the policy are been reviewed? (2)">
    These policies are reviewed anually or whenever changes made to it and approved by the management as per the compliance requirements.
  </Accordion>

  <Accordion title="Does the organisation have a formal change control process for IT changes?">
    We have implemented the change management Procedure. All the IT changes takes place as per the Change management procedure. Attached the same for your reference.
  </Accordion>

  <Accordion title="Are all systems security configuration standards documented and based on external industry or vendor guidance?">
    Attached the IT policy. We also have communicated these to all the employees to spread awareness among them.
  </Accordion>

  <Accordion title="Is there formal control of access to System Administrator privileges?">
    We have implemented the access control policy and access will be provided only upon need and approval basis. Attached the access control policy.
  </Accordion>

  <Accordion title="Does the organisation have have a established business continuity / Disaster recovery management framework?">
    Attached the Business continuity policy.
  </Accordion>

  <Accordion title="Does the oragnisation has Business Continuity / DR Plans?">
    Attached the Business continuity plan
  </Accordion>

  <Accordion title="Is code review performed on all changes to the source code with an emphasis on secure coding principles? (2)">
    It's a part of our system devolopment life cycle. Attached the policy.
  </Accordion>

  <Accordion title="Is there a formal change control policy or process within your organisation supported by source code and release management tools?">
    Attached the Change management process.
  </Accordion>

  <Accordion title="Does your organisation have a formal vendor management program that evaluates information security for your suppliers? (for example attestation reports / SOC 2 Type 2 reports review, site assessments)">
    Attached the Supplier Management Procedure
  </Accordion>

  <Accordion title="As per the customer policy, personal devices (BYOD) are restricted. If BYOD is permitted to process/access/storethe customer scoped data, are there appropriate approval obtained from the customer for the same? (2)">
    We have implemented the BYOD policy. Attached the same for your reference.
  </Accordion>

  <Accordion title="Is there a process to perform modify / change the access review process for additional focus on remote access connections to client (the customer) network? (2)">
    Attached the Change management process.
  </Accordion>

  <Accordion title="Is there collection of, access to, processing of, or retention of any client scoped Data that includes any classification of non-public personal information or personal data of individuals?">
    Please find attached Data Protection Policy and Data Retention and Disposal Policy
  </Accordion>

  <Accordion title="Is a Training and Awareness Program maintained that addresses data privacy and data protection obligations based on role?">
    Data privay and Data protection is a part of our Infoarmation security awareness training.
  </Accordion>

  <Accordion title="Is there a mechanism to classify data as per the criticality and requirement?">
    Yes. Attached the Information Classification Policy
  </Accordion>

  <Accordion title="What backup and disaster recovery plans are in place to avoid data loss / service loss in the time of contingency">
    We have Business Continuity Policy and Business Continuity Management Procedure in place and tested periodically. And also, our Policies has been reviewed and Audited annually. Attached the Business continuity policy, plan and procedures. We have test the BCP every 12 months and this has been reviewed as a part of Internal and external Audits.
  </Accordion>

  <Accordion title="Share the security policy you have to protect your environment.">
    Attached the Information security Policy
  </Accordion>

  <Accordion title="Share the business continuity and disaster recovery plan including DR diagram, RTO & RPO">
    Attached the business continuity documents.
  </Accordion>

  <Accordion title="Cloud supplier has a written information security program that contains appropriate administrative, physical and technical safeguards, consistent with best practices, to protect personal information against unauthorized loss, use, disclosure, alteration or destruction. Program includes regular risk assessments and updating of security measures in view of changing threat profile.">
    Attached the Information Security Policy and Risk Management Procedure
  </Accordion>

  <Accordion title="There is a proper change management process in place to protect the customer data integrity, for addressing changes to the common environment, and that all tenants are notified about in advance.">
    Yes, We have implemented the change management procedure and atatched the same for your referrence. The changes to the production environment are documented, tested, and approved prior to implementation. Production software and hardware changes may include applications, systems, databases, and network devices requiring patches, service packs, and other updates and modifications.
  </Accordion>

  <Accordion title="There is a Software Development LifeCycle (SDLC) process in place for the development of the software providing services to the customer, where security is incorporated in each phase.">
    1. We have implimented the systems development life cycle (SDLC) and atatched the same for your referrence. 2. Our code reviews and analysis run through stringent eyes of automated technologies as well as manual source code overview to cover any security loopholes prior to the production phase. 3. We also conduct vulnerability and penetration testing and fix the identified observations. 4. Upon passing all the security and quality checks the new version of the product will be released.
  </Accordion>

  <Accordion title="Does the cloud provider have a disaster recovery plan? Does the plan say what triggers a recovery, how long does it take to recover or restore data from backup?">
    Xoxoday has a formal Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP) defined and implemented to enable people and process support during any crisis or business interruptions. The BCP and DR Plan is tested and reviewed on a yearly basis as per the compliance requirements.
  </Accordion>

  <Accordion title="Does the contract empower the customer to audit processing operations on personal data performed by Supplier and its sub-contractors?">
    We provide applicable compliance Policies/Procedures, Audit/attestation reports, certifications etc.. on need basis.
  </Accordion>

  <Accordion title="Is there a change management procedure in place pertaining to the information security management? Kindly share the artefacts?">
    Attached the Change Management Procedure
  </Accordion>

  <Accordion title="How are incidents identified, managed, communicated and contained? Is there an incident management framework in place? If Yes, kindly share the artefact">
    Attached the Security Incident Reporting & Response Procedure.
  </Accordion>

  <Accordion title="Describe procedures used for business continuity and disaster recovery that would include your applications and all data, as well as evidence that you have tested those procedures during the past 12 months.">
    We have Business Continuity Policy and Business Continuity Management Procedure in place and tested periodically. And also, our Policies have been reviewed and Audited annually. Attached the Business continuity policy, plan and procedures. We have tested the BCP every 12 months and this has been reviewed as a part of Internal and external Audits.
  </Accordion>

  <Accordion title="Are business continuity plans subject to testing at planned intervals or upon significant organizational or environmental changes to ensure continuing effectiveness?">
    As per the compliance requirement and Business continuity policy we test the BCP plan every 12 months or upon significant organizational or environmental changes.
  </Accordion>

  <Accordion title="The vendor should detail their HA and DR plans, including recovery point objective (RPO) and recovery time objective (RTO) targets, geographic diversity in their hosting arrangements, and any periodic testing that takes place.">
    We conduct the BCP/DR Test on an annual basis as per the compliance requirements and audited during the internal and external audits. Our RTO & RPO is 60 minutes, Attached to the BCP/DR Policy.
  </Accordion>

  <Accordion title="If the answer for #6 is yes, then how often is it? Also, do you make testing backups a routine task to ensure that the data is valid and accessible as intended?">
    Data backups are done daily and in a secured way in AWS. We also do test to comply with the business continuity plan.
  </Accordion>

  <Accordion title="Do you have a Business Continuity Plan to ensure service availability under extreme situations such as power outages/natural disasters?">
    Yes. We have Business continuity plan.
  </Accordion>

  <Accordion title="How is a planned and unplanned service disruption communicated?">
    We communicate as per the BCP or the agreements or contracts
  </Accordion>

  <Accordion title="Do you have a procedure for securely destroying hard copy sensitive data?">
    Yes. We have Media handling procedure.
  </Accordion>

  <Accordion title="Please ensure your documented information security policy has been uploaded in section in 'Service Overview'">
    Sure. We will provide the same.
  </Accordion>

  <Accordion title="Do your information security and privacy policies align with industry standards (ISO-27001, NIST Cyber Security Framework, ISO-22307, CoBIT, etc.)?">
    Yes
  </Accordion>

  <Accordion title="Do you have a policy exception process?">
    We adhere to all the policies and procedures of the organization.
  </Accordion>

  <Accordion title="Is a formal disciplinary or sanction policy established for employees who have violated security policies and procedures?">
    Yes. We have disciplinary policy
  </Accordion>

  <Accordion title="Are all personnel required to sign an Acceptable Use Policy? Please attach">
    Yes. See Acceptable Use Policy attached.
  </Accordion>

  <Accordion title="Do you have a policy exception process? (2)">
    We adhere to all the policies and procedures of the organization.
  </Accordion>

  <Accordion title="Is a formal disciplinary or sanction policy established for employees who have violated security policies and procedures? (2)">
    Yes. We have disciplinary policy
  </Accordion>

  <Accordion title="Protecting against non-human sources of risks">
    We are ISO 27001:2013 and GDPR Compliant organization. We have policies and procedures in place to comply with all the requirements and working effectively. We have Information security policy, Mobile Device Management Policy, Encryption Policy, Password Management Policy, Risk Management Procedure, Email Security Policy, Access control policy etc as per the compliance requirements. We also have implemented end point security in all our computers and servers to make sure that the data stored are safe, secure, and Protecting against non-human sources of risks.
  </Accordion>

  <Accordion title="Have all information security responsibilities within your organisation been defined and allocated including: maintaining appropriate contacts with relevant authorities and groups ensuring information security is addressed in project management ensuring that conflicting duties and areas of responsibility are segregated">
    Yes. We have a well-defined policy for roles and responsibilities. We have communicated each employee about their responsibilities across the organization. We do maintain appropriate contracts with relevant authorities and ensure that applicable regulations are complied with
  </Accordion>

  <Accordion title="Are these policies, approved by the senior management within your organisation, regularly reviewed and communicated to all your staff?">
    Yes.
  </Accordion>

  <Accordion title="How will you decide which of your staff (support, development etc.) need access to the the customer system and data? How will you manage that access and what controls are in place, to ensure that privileged access rights will be restricted and controlled?">
    We have an access control policy. The policy is attached for reference. Only authorised employees will have access to the data.
  </Accordion>

  <Accordion title="Who will have access to log files and how is access controlled?">
    Authorised Xoxoday employees only will have access controlled per the relevant policies attached
  </Accordion>

  <Accordion title="Do you have an information security incident response plan in place to ensure effective response and management of information security incidents?">
    Yes
  </Accordion>

  <Accordion title="Will password hashing be used within the system? If so to what standard and will any salting be used?">
    Yes

    We store password hashed. We have SHA512 hash with unique salt for every password
  </Accordion>

  <Accordion title="User identity shall be always verified before performing passwords resets and it shall be conducted only by authorized personnel. Resetting passwords on behalf of somebody else is forbidden. Any exception of this rule should be documented and approved accordingly.">
    We have implemented the Password Management Policy. Only verified or authorised users can reset the password. No one can reset the password on behalf of somebody. We also follow the best practices for Password Protection and incorporated the same in the Password Management Policy.
  </Accordion>

  <Accordion title="Ensure that change control procedures are in place to maintain program source code and associated items.">
    All the changes takes place as per the change management procedure.
  </Accordion>

  <Accordion title="Security shall be considered at all stages of the life cycle of an information asset (i.e. feasibility, planning, development, implementation, maintenance, and retirement) in order to: ensure conformance with all appropriate security requirements, protect sensitive information throughout its life cycle, facilitate efficient implementation of security controls, prevent introduction of new risks associated with systems modifications, ensure proper removal of the customer data when the system is retired or disposed.">
    We have implemented the SDLC policy and made applicable to all the development and maintenance services, architecture, software and systems that are part of the Information Security Management System.
  </Accordion>

  <Accordion title="Information security requirements for Systems and Assets shall be identified and documented.">
    Implemeted the asset management policy
  </Accordion>

  <Accordion title="Systems and application development ether performed internally or by third party shall: Follow a Secure Software Development Life Cycle (S-SDLC). Perform Threat Modelling throughout Secure Software Development Life Cycle. Include Quality Assurance (QA) process. Include thorough and rigorous testing and verification of security functionality during the development processes for new and updated systems. Detailed schedule of activities and test inputs and expected outputs under a range of conditions, in proportion to the importance and nature of the system shall be included. Ensure that secure coding (code reviews, static/dynamic code analysis, vulnerability scans, industry certifications etc.) and development practices are utilized. Ensure it has the capability to perform security risk assessment of software and hardware components and shall be able to support the customer when security information is needed. Provide a list of third-party components and libraries used in system or application and ensure no inherited risk is been introduced by this use. Ensure control and document changes within the development lifecycle: Through the use of a formal change control process. Maintaining an audit trail of all change requests. Mandating a risk assessment, analysis of the impacts of changes and specification of security controls needed. Ensuring that any change does not compromise existing security and control measures. Ensuring that existing documentation is updated as needed to remain appropriate. Ensuring that testing is performed in an environment segregated from both the production and development environments and results are documented. Considering, based on change perceived risk, an extra independent acceptance testing to validate if the system behaves only as expected.">
    We are compliant. Attached the SDLC procedure. We folow General Coding Practice, test the information security features, Vulnerability scanning, Penetration Testing etc and mitigate all the risks identified.
  </Accordion>

  <Accordion title="Protection of physical media and any device in transit carrying information/data must be according to the highest level of information sensitivity it will contain. This may include physical locking mechanisms, digital encryption and/or packaging sufficient to prevent harm from environmental (e.g. extreme heat/cold, moisture), electromagnetic, or radiation exposure.">
    We have implemented the Media protection procedures in order to make surer that the data is protected if we store it in any external drives.
  </Accordion>

  <Accordion title="Physical media carrying Secret information shall be documented.">
    We have implemented the Media protection procedures in order to make surer that the data is protected.
  </Accordion>

  <Accordion title="Receipt notifications or other tracking mechanisms shall be implemented.">
    We have asset management policy and Media protection procedure to track the customer maintain the records.
  </Accordion>

  <Accordion title="For each asset, document the entity's required maintenance designed to support the availability and integrity of the equipment.">
    It's a part of of Asset management policy.
  </Accordion>

  <Accordion title="Any hardware/software change in the systems, assets and networks shall follow the Management of Change (MoC)/Change Request.">
    We have implemented the change management procedure
  </Accordion>

  <Accordion title="Security aspects shall be taken in consideration for reviewing of all major software changes and upgrades to the systems.">
    We have implemented the change management procedure
  </Accordion>

  <Accordion title="System capacity requirements shall be identified and aligned with business goals, objectives and criticality.">
    Capacity management has been well defined in our IT Policy
  </Accordion>

  <Accordion title="For updates such as OS and application patches, firmware, drivers, fixes, security updates, etc. as part of maintenance/service activities, necessary internal approval shall be obtained and performed by authorised personnel.">
    It's a part of our change management and IT Policy.
  </Accordion>

  <Accordion title="Physical Access Controls: Allow access on a need-to-access basis; Adopt single or double authentication; Adopt alarms.">
    We have Implemented the Physical security Policy and allowed access to only an authorised individual.
  </Accordion>

  <Accordion title="Physical security level associated with information asset's location shall be identified based on information asset's criticality, vulnerabilities, and threats to that particular information asset.">
    We have protected all the area as per the physical security Policy and allowed access to only an authorised individual.
  </Accordion>

  <Accordion title="Monitoring and review of third parties' services shall ensure that the security terms and conditions of the agreements are being adhered to and that information security incidents and problems are managed properly.">
    We have implemented the Security Incident Reporting & Response Procedure
  </Accordion>

  <Accordion title="All changes communicated by the external/third party to the customer shall be performed in accordance with the customer Change Management processes.">
    Attached the application Change management procedure
  </Accordion>

  <Accordion title="Each critical system shall have a recovery procedure with defined RTO/RPO. This shall be decided based on business impact analysis (HSE, financial, operational or reputational impacts to the business and customers).">
    Our RPO/RTO is 6 mins. Attached the Business continuity documents
  </Accordion>

  <Accordion title="Any changes or updates to the Disaster Recovery Plans shall be communicated to all concerned stakeholders internal and external to organisation.">
    The BCP Test and lessons learned has been documented.
  </Accordion>

  <Accordion title="The management of information security incidents in the customer shall follow an established process: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-incident Activity.">
    We have implemented the Incident Management Procedure and attached the same for your reference
  </Accordion>

  <Accordion title="Information security incident documentation shall include: All information security events identified and their characterisation (entry points, spread methods, services/data/assets impacted, etc.). Lessons learned from real incidents and from the training exercises. Collection and preservation of forensics analysis data, to serve as evidence.">
    Its part of our Incident Management Procedure
  </Accordion>

  <Accordion title="Employees and third parties shall note and report any observed or suspected information security event or weaknesses in the customer environment.">
    We report the incidents
  </Accordion>

  <Accordion title="Service Provider shall have solid security incident management process, including a computer security incident response team (CSIRT) that has been trained to handle security incidents. This process should in line with the customer security incident management requirements">
    Attached our Incident management procedure.
  </Accordion>

  <Accordion title="Are the processes for User Administration (including user identification and adding / removing user accounts) compliant with ISO27002?">
    Yes. We have Policies and procedures in place. Our application also support for adding and removing users.
  </Accordion>

  <Accordion title="What type of DR options do your provide for my data within your offering?">
    We have implemented policies and procedure with regards to DR. Since we have deployed our application on AWS cloud they only provide DR Services.
  </Accordion>

  <Accordion title="Are the processes for User Administration (including user identification and adding / removing user accounts) compliant with ISO27002? (2)">
    Yes. We have Policies and procedures in place. Our application also support for adding and removing users.
  </Accordion>

  <Accordion title="Do you have a formal information classification procedure? Please describe it. In particular, how would sensitive data be categorised? For example, critical, essential, and normal.">
    Yes. We have an Information Classification Policy and attached the same for your referrence. Information classification policy is primarily concerned with the management of information to ensure that sensitive information is handled well with respect to the threat it poses to an organization. It also demonstrates how gathered data is being used and structured within an organization to allow authorized personnel to get the right pieces of information at the right time, while also ensuring that only those who are authorized can view or access information. Sensitive data has been categorised as Confidential, Restricted, Internal, Public etc..
  </Accordion>

  <Accordion title="Have formal acceptable use rules been established for assets? Example assets include data assets, computer equipment, communications equipment, etc. Do you have formal processes in place for security policy maintenance and deviation?">
    Yes. We have implemented the Acceptable Usage Policy and attached the same for your referrence. The policy outline the usage of Email, Computer Resources, Internet, Clean Desk and Clean Screen, Punitive actions, General guidelines etc.. We have a formal processess in place for security policies review and approval by the top level management as per the compliance requirements.
  </Accordion>

  <Accordion title="Do you have a process that addresses: the identification and measurement of potential risks, mitigating controls (measures taken to reduce risk), and the acceptance or transfer (Insurance policies, warranties for example) of the remaining (residual) risk after mitigation steps have been applied?">
    Yes. Xoxoday has developed a Risk Management Framework as part of the Information Security Management System (ISMS) in accordance with ISO/IEC 27001:2013 standard and SOC II compliance. The information security team assesses security risks annually and on an ongoing basis when major changes occur or when industry changes occur. Xoxoday Risk management process includes Risk Treatment, Mitigating Actions, Action Owners, Action Due Dates, Risk Acceptance, Risk Mitigation, Risk Avoiding, Risk Transfer, exceptins etc.. We also conduct the Risk assessment on annual basis and this has been audited as a part of an internal and external Audits.
  </Accordion>

  <Accordion title="Is there a facility security plan?">
    Yes. Attached the Physical and Environmental Security Procedure.
  </Accordion>

  <Accordion title="Are there policies and procedures require to documenting repairs and modifications to physical components of the facility that are related to security?">
    Yes. All the repair/modification or installation will be as per the change management procedure upon appropriate approvals. Whenever there is a requirement for additions or changes impacting security of the site, approval shall be taken from the site, Physical Security team prior to implementation. Attached the Physical and Environmental Security Procedure
  </Accordion>

  <Accordion title="Do you have a mechanism to back up critical IT systems and sensitive data? i.e. nightly, weekly, quarterly backups? Taken offsite? Have you had to restore files after a systems outage? Does a Disaster Recovery plan exist for the organization and does it consider interruption to, or failure of, critical IT systems? Are disaster recovery plans updated at least annually? If not, has the backup and restoration process been tested?">
    Yes. Data backups are done daily and in a secured way in AWS. All the data backup will be stored on AWS virtual platform cloud. We also have implemented the Business Continuity Policy and Business Continuity Management Procedure in place and effectivly working. Out DR/BCP plans are reviewed and approved by the management and tested on annual basis as per the compliance requirements. DR/BCP controls are validated during the internal and external audits.
  </Accordion>

  <Accordion title="Data purging policy for the customer related process.">
    We have Data Retention and Disposal Policy. Our data cleaning process goes through an organized purge. Once the data is purged, it's purged from all places.
  </Accordion>

  <Accordion title="Please share details of Data Backup Procedures.">
    Data backups are done on daily and in a secured way in AWS. Attached the Backup Recovery Procedure.
  </Accordion>

  <Accordion title="Is the data classified top secret/ confidential /PII stored separately from public data / data of other organizations residing on same cloud?">
    Yes
  </Accordion>

  <Accordion title="Share the privilege account reconciliation policy.">
    Access to data and systems are based on the principles of least privilege for access. Accordingly, all information systems and data are classified and further segregated to support role-based access requirements. A strong identification and authentication system and logging systems are deployed and provides a centralized control to administer, monitor and review all critical access. We have role-based access system through access control policy to make sure that only the authorised individual has access to the required information. An Identity and Access Management (IAM) solution has been defined to manage user access through role-based access profiles that support the implementation of accesses based on the principles
  </Accordion>

  <Accordion title="Share the security policy you have to protect your environment. (2)">
    Attached the Information security Policy
  </Accordion>

  <Accordion title="Is there a managed process in place for developing and maintaining business continuity & Disaster Recovery? If yes please explain and share evidence?">
    Yes. we have implemented the Business Continuity Plan to ensure that the data is managed during the conduct of business in a safe and secure manner in delivering the business values to the interested parties. Attached the BCP/DR policies and procedures.
  </Accordion>

  <Accordion title="Do you have an Acceptable usage policy? If yes please explain and share evidence?">
    Yes. we have Acceptable usage policy to outline the acceptable use of Information Security at Xoxoday.This policy applies to all employees – part time or full time, temporary or permanent, service providers with in-house engineers or consultants, contractors, and other workers at Xoxoday, including all personnel affiliated with third parties. This policy applies to all Information Security that is owned or leased by Xoxoday. Attached the Acceptable Usage Policy
  </Accordion>

  <Accordion title="Incident management policy and procedure">
    Attached the Security Incident Reporting & Response Procedure and ncident Management Procedure
  </Accordion>

  <Accordion title="Follow change control processes and procedures for all changes to system components, applies information system security engineering principles in the specification, design, development, implementation, and modification of the information system.">
    We adhered to the change management procedure and all the changes to the production systems will be upon review and approval of Chief Technology Officer (CTO) Attached change management procedures.
  </Accordion>

  <Accordion title="Formally define and approve process controls for implementing minimum security requirements.">
    We have implemented the change management policy and all the changes to the platform takes palce as per the compliance process.
  </Accordion>

  <Accordion title="Application in context shall develop a contingency plan for the information system that: Identifies essential missions and business functions and associated contingency requirements. Provides recovery objectives, restoration priorities, and metrics. Addresses contingency roles, responsibilities, assigned individuals with contact information. Addresses maintaining essential missions and business functions despite an information system disruption, compromise, or failure; Addresses eventual, full information system restoration without deterioration of the security safeguards originally planned and implemented; Periodic & surprise execution of Contingency plan to conducted/ tested, results are to be documented, retrospected to update/ upgrade the Contingency plan Application teams to ensure that the contingency plan Is reviewed and approved by the authorized personnel of PSJH periodically.">
    At Xoxoday we have a documented Business Continuity and Disaster Recovery Plan defined and implemented to enable people and process support during any crisis or business interruptions. Appropriate roles and responsibilities have been defined and documented as part of the BC plan. At Xoxoday the BCP and DR Plan is tested and reviewed on a yearly basis. The BCP and DR plan of Xoxoday is reviewed and audited as part of internal and external audits.
  </Accordion>

  <Accordion title="Enforce controls over external file sharing.">
    We have implemente the Software Development Life Cycle (SDLC) procedures and attached the same for your reference. We have controls on external file sharing.
  </Accordion>

  <Accordion title="Detail out the process in place within the organization for a) identifying and reporting information security incidents b) responding to information security incidents (e.g., escalation investigation, containment and eradication of the cause of the information security incident) c) recovering from information security incidents d) following up information security incidents (e.g., post-incident activities such as root cause analysis, forensic investigation, reporting to the business and notifying relevant authorities of a security breach) e) SLA's in place for closure of security incidents as per severity">
    Sure. We will provide our Incident Management Procedure
  </Accordion>

  <Accordion title="Is a cybersecurity policy & standard defined, approved and implemented?">
    Attached the Cyber Crisis Management Plan
  </Accordion>

  <Accordion title="Is application development follow change management process?">
    We adhered to the change management procedure and all the changes to the production systems will be upon review and approval of Chief Technology Officer (CTO)
  </Accordion>

  <Accordion title="Is the data is classified within database as per data classification Policy?">
    Attached the data classificaiton policy.
  </Accordion>

  <Accordion title="Do you have a disaster recovery plan?">
    Yes. A formal Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP) defined and implemented to enable people and process support during any crisis or business interruptions.
  </Accordion>

  <Accordion title="Does the provider have a rigorous physical access protocol? Consider: All secure areas use card swipe technology / biometric scanners / other technology to control access; A sign-in process exists for third-party individuals (visitors, providers, couriers, etc.); Visitors to secure areas are escorted by authorized personnel at all times; All employees/contractors / etc. must display security ID badges at all times; All secure and perimeter areas are monitored 24x7x365 by CCTV.">
    Yes. At Xoxoday we have implemented the Physical and Environmental Security Procedure. Physical entries have been restricted based on the role of the personnel within the organization. The restriction will be enforced using electronic locks with access through access cards and biometric machines. Third-party Access - The entrance premise of Xoxoday has been manned by security guards on a 24-hour basis. The guards shall verify all the visitors and direct them to the reception and provide temporary access cards. At the reception, the concerned employee shall be intimated, and he/she will escort the visitor on premises always. CCTVs has been placed at strategic points inside the facility Reception lobby, Entry and exit doors of the Xoxoday office, Entry and exit to parking areas, delivery, and dispatch areas etc. and monitored 24x7x365.
  </Accordion>

  <Accordion title="Describe the provider's process to report an incident involving the customer environment/data to the customer">
    Our information security team and Customer support team will inform the POC of Client via email communication with Preliminary Incident Synopsis and Root Cause Analysis report (RCA) including the details of Business Impact, Issue Description, Root Cause, and Corrective Actions
  </Accordion>

  <Accordion title="Describe the provider's reporting mechanism for security and/or other incidents. In what format do notifications go out, and what information do they contain?">
    Attached the Incident Management Procedure
  </Accordion>

  <Accordion title="Will the area be developing a business continuity plan for when the solution/service or data is not available? If so, by when? If not, why not?">
    We have implemented the Business Continuity Policy and Business Continuity Management Procedure and BCP controls has been tested annually as per the compliance requirements and reviewed during the internal and external audits.
  </Accordion>

  <Accordion title="Is the database comply with identity & access control policy?">
    We have implemented the Identity access management and follow the Access control policy.
  </Accordion>
</AccordionGroup>


# Privacy Compliance
Source: https://help-plum.xoxoday.com/faq/security-compliance/privacy-compliance

Find answers to frequently asked questions about Plum's privacy compliance practices and how customer data is protected.

## GDPR

<AccordionGroup>
  <Accordion title="Appropriate technical and organisational measures are in place to protect PII">
    We have implemented all the technical and organisational measures (TOM)
  </Accordion>

  <Accordion title="Documented processes are in place to manage subject requests">
    Yes. we have implemented the Data Subject Access Rights Procedure
  </Accordion>

  <Accordion title="Data Processing Agreements are in place with all your sub-processors">
    Yes. The Data Processing Agreements is in place.
  </Accordion>

  <Accordion title="Documented process is in place for the deletion/redaction/anonymisation of PII. Describe/attach your deletion policy.">
    Yes. The Data Processing Agreements is in place.
  </Accordion>

  <Accordion title="Data Privacy Impact Assessments are undertaken where a risk to PII is identified">
    Yes. we conduct the Data Privacy Impact Assessments on annual basis and there are no high risk involved in handling the PII
  </Accordion>

  <Accordion title="A formal data breach notification process is in place">
    formal data breach notification process is in place.
  </Accordion>

  <Accordion title="Does the organisation have security measures in place for data protection?">
    Customer data security is an essential part of our product, processes, and team culture. Our facilities, processes and systems are reliable, robust, and tested by reputed quality control and data security organizations. We continuously look for opportunities to make improvements in the dynamic technology landscape and give you a highly secure, scalable system to provide a great experience. We have implemented many technical controls to safeguard the customer data. For example - Cloudflare Web application firewall (WAF), AWS Guard Duty threat detection services, Amazon CloudWatch, IDS/IPS etc.
  </Accordion>

  <Accordion title="Is client scoped data collected, accessed, transmitted, processed, or retained that can be classified under any international privacy jurisdictions?">
    We are GDPR compliant. Implemented the Data security and Personally Identifiable Information Policy
  </Accordion>

  <Accordion title="Are there policies and processes in place to address privacy inquiries, complaints and disputes?">
    We have implemented the Data Subject Access Rights Procedure.
  </Accordion>

  <Accordion title="If Yes, Does the Vendor also support Surprise Audits by the customer or any Third Paties appointed by the customer">
    In accordance with Data Protection Laws, we make available to Controller on request in a timely manner such information as is necessary to demonstrate compliance by Processor with its obligations under Data Protection Laws. Upon Controller's written request and subject to the confidentiality obligations set forth in the Agreement, we will make available to Controller a copy of Nreach the most recent third-party audits or certifications, as applicable. We do not agree for the Surprise audits.
  </Accordion>

  <Accordion title="Does Supplier in its written agreements with Suprocessors prohibit Sub Processors from Processing Personal Data for any purpose except to provide services to Supplier?">
    Yes. It's a part of the agreement.
  </Accordion>

  <Accordion title="How will the Personal Data be accessed? By the customer BY Supplier">
    We have implemented the GDPR Xoxoday is the data processor.
  </Accordion>

  <Accordion title="What are Supplier's procedures for responding to a data subject request that involves a customer's Personal Data?">
    Xoxoday is GDPR Compliant. We have implemented the Data Subject Access Rights Procedure as per the GDPR and make all the data subject rights available as per the data protection laws. This procedure sets out the key features regarding handling or responding to requests for access to personal data made by data subjects, their representatives or other interested parties.
  </Accordion>

  <Accordion title="Confirm how Supplier performs audits on its Sub-processors to demonstrate their compliance.">
    We validate the compliance requirements of the Sub-processor and obtain the Compliance certificates and audit reports such as – ISO 27001:2013, SOC 2 Type II, ISO 27017, ISO 27701, ISO 27018, Cloud Security Alliance Controls etc..
  </Accordion>

  <Accordion title="Describe the process in place for the customers to gain access to their personal data as required by the EU regulations">
    We have implemented the Data Subject Access Rights Procedure to make sure that all the data subjects will have the opportunities to exercise their rights as per the privacy laws. Attached the Xoxoday Data Subject Access Rights Procedure.
  </Accordion>

  <Accordion title="Does the Cloud Hosting Provider provide independent audit reports (e.g., Service Operational Control - SOC) for their cloud hosting services?">
    We provide Software as a Service.(SAAS). We are ISO 27001 certified and GDPR compliant. Attached the document.
  </Accordion>

  <Accordion title="Is client scoped data collected, accessed, transmitted, processed, or retained that can be classified under any international privacy jurisdictions? (2)">
    We are GDPR compliant. And atatched the Data security and Personally Identifiable Information Policy
  </Accordion>

  <Accordion title="Are there policies and processes in place to address privacy inquiries, complaints and disputes? (2)">
    Attached the Data Subject Access Rights Procedure. Please visit here for Privacy policy - [https://www.xoxoday.com/privacy-policy](https://www.xoxoday.com/privacy-policy)
  </Accordion>

  <Accordion title="Share the process of secure data disposal at various stages, e.g., once data is archived / not require further, end of the contract.">
    We are GDPR Complaint and respect the data subjet access rights. We erase or delete the data upon request of the data subject or on the request of the customer upon termination of the contract. We have Data Retention and Disposal Policy. Our data cleaning process goes through an organized purge. Once the data is purged, it's purged from all places. Attached the Data Retention and Disposal Policy.
  </Accordion>

  <Accordion title="Data purging policy for the customer related process.">
    We have Data Retention and Disposal Policy. Our data cleaning process goes through an organized purge. Once the data is purged, it's purged from all places.
  </Accordion>

  <Accordion title="Contract shall require supplier to comply with all applicable privacy and data security laws, e.g. EU Data privacy directive, (future GDPR) and preferrably have a specialized resource assigned with clear responsibilities to safeguard data protection and privacy. The solution should address data soverignty issues providing solutions to the customer been compliant with local regulations and laws for all countries the customer has operations.">
    Xoxoday is Compliant with EU GDPR.
  </Accordion>

  <Accordion title="Contract requires an immediate notification to the customer of circumstances that might suggest a breach has occurred, along with cooperation in investigation and remediation.">
    We are compliant with GDPR. We inform the customer within 48 hours, if there are any data breach as per the compliance requirements.
  </Accordion>

  <Accordion title="1) Are you subject to the requirement of appointing a DPO under GDPR art. 37? 2) If yes, have you appointed such a Data Protection Officer, with the qualifications, tasks and position that follows from GDPR art. 37 – art. 39?">
    At Xoxoday we have appointed the DPO. Please click here to know more about Xoxoday GDPR - [https://www.xoxoday.com/gdpr](https://www.xoxoday.com/gdpr)
  </Accordion>

  <Accordion title="Describe how the principles of Data Protection by Design and Default, as described in GDPR art. 25, have been or may be implemented in the services that you offer to the customer.">
    Over 2 millions of customers across the globe trust us with their data security. We back ourselves up with robust data security and privacy practices that form an integral part of our product engineering and service delivery principles. Our comprehensive GDPR program is supported by key privacy principles -- Accountability, Privacy by Design and Default, Data Minimization, Subject Access Rights, among others. Technology and operations related to the business are subject to regular sensitization programs. Please click here to know more about Xoxoday GDPR - [https://www.xoxoday.com/gdpr](https://www.xoxoday.com/gdpr)
  </Accordion>

  <Accordion title="Describe how you will be able to delete or fully anonymize Personal Data elements or Personal Data relating to specific individuals from the information systems that will be used to deliver the services to the customer, both during the engagement and upon termination. In addition, please describe how deletion or anonymization will cover Personal Data held in any back-up copies or by any (sub) processors.">
    We have implemented the Data Subject Access Rights procedure (DSAR) 1. Personal data can be deleted based on a formal written request, with justification. 2. Xoxoday would delete the data within 30 days of receiving the request Our data cleaning process goes through an organized purge. Once the data is purged, it's purged from all places. Attahed the Data Subject Access Rights procedure (DSAR)
  </Accordion>

  <Accordion title="Does the cloud vendor allow reports from security audits to be submitted to regulatory authorities (i.e. the Data Protection authority)?">
    Xoxoday is GDPR Compliant and shared the Data Protection Impact Assessment (DPIA) We are not required to submit the report to the Data Protection authority.
  </Accordion>

  <Accordion title="Does the cloud provider comply with the data privacy regulations incl. GDPR?">
    Xoxoday is compliant with GDPR
  </Accordion>

  <Accordion title="Does the Cloud provider offer any regulatory compliant data processor agreement? EU Standard Contractual Clauses for the transfer or availability of data outside the EU is regulatory compliant if used correctly. Please note, access to data from abroad is normally considered transfer of data even if the data is stored in country.">
    We offer EU Standard Contractual Clauses.
  </Accordion>

  <Accordion title="Does the contract ensure that Supplier is obliged to support the customer in facilitating exercise of data subjects' rights such as access/correct/erase their data, and (where applicable) notify the customer of any data breaches affecting the customer's data?">
    We support end users to Exercise their Rights as per the GDPR compliance requirements.
  </Accordion>

  <Accordion title="Does the contract clarify Supplier's responsibilities to notify the customer in the event of any data breach which affects the customer's data?">
    We are compliant with GDPR. We inform the customer within 48 hours, if there are any data breaches as per the compliance requirements.
  </Accordion>

  <Accordion title="Does the contract ensure that Supplier is obliged to co-operate with regard to the customer's right to monitor / audit processing operations?">
    In accordance with Data Protection Laws, we make necessary documents, Audit reports and certifications available to Controllers on request in a timely manner such information as is necessary to demonstrate compliance by Processor with its obligations under Data Protection Laws. Upon Controller's written request and subject to the confidentiality obligations set forth in the Agreement, Xoxoday will make available to Controller a copy of Nreach then most recent third-party audits or certifications, as applicable.
  </Accordion>

  <Accordion title="Does the contract specify the conditions for returning the personal data and destroying the data once the service is concluded?">
    We adhere to Data Retention and Disposal Policy and make sure that the personal information of the data subject will be deleted upon requests or termination of the contract. Our data cleaning process goes through an organized purge. Once the data is purged, it's purged from all places.
  </Accordion>

  <Accordion title="Does the contract include specific safeguards like Privacy Shield arrangement, standard contractual clauses (SCC) or binding corporate rules to regulate transfers of data to non-adequate third countries?">
    We offer standard contractual clauses (SCC) or binding corporate rules to regulate transfers of data to non-adequate third countries.
  </Accordion>

  <Accordion title="How does the cloud provider provide customer data at end of term? (Data portability and methodology to be followed). Transfer technology, file formats, protocols, metadata etc.">
    We adhere to Data Retention and Disposal Policy and make sure that the personal information of the data subject will be deleted upon requests or termination of the contract. Our data cleaning process goes through an organized purge. Once the data is purged, it's purged from all places.
  </Accordion>

  <Accordion title="Are you complaint with Data Privacy standards like GDPR?">
    Attached the GDPR Data Protection Policy and Data Security Policy
  </Accordion>

  <Accordion title="Link to GDPR Compliance Page or Privacy Policy page">
    [GDPR compliance - https://www.xoxoday.com/gdpr Privacy policy - https://www.xoxoday.com/privacy-policy](https://www.xoxoday.com/gdpr)
  </Accordion>

  <Accordion title="Is Data Processing Agreement (DPA) available publically? If available, provide the link.">
    [Link - https://www.xoxoday.com/gdpr Note - if you are using Xoxoday products and have agreed to our terms of service, you do not need to sign an additional Data Processing Addendum.](https://www.xoxoday.com/gdpr)
  </Accordion>

  <Accordion title="List of subprocessors">
    AWS - We have deployed our application on AWS Virtual platform cloud. And AWS is GDPR, ISO 27001, SOC 2 certified organization.
  </Accordion>

  <Accordion title="What are the Personal Information collected? Also mention the mandatory and optional fields.">
    We collect names, email IDs and Phone numbers. These are the mandatory information required to use the application platform.
  </Accordion>

  <Accordion title="If it involves data of the users in the EU region, does it comply with the GDPR regulations? For example, user data should not leave the EU physical geography?">
    Yes. We are GDPR Compliant
  </Accordion>

  <Accordion title="Information hosted and processed">
    The application is deployed on AWS virtual platform cloud. We are a data processor as per GDPR and all the information is collected only throgh our application. We use TLS1.2 encryption for Data in transit and AES256 for Data at rest. Additionally, we have an intrusion detection/monitoring application that alerts on unauthorized access.
  </Accordion>

  <Accordion title="When would UP be notified?">
    Notify data controllers within 48 hours of the breach or within stipulated time as agreed with the data controller
  </Accordion>

  <Accordion title="Do your sub-processors (vendors) access your customer's information? If YES, please complete our PII Data Sub-processor Template">
    Yes
  </Accordion>

  <Accordion title="Do these sub-processors (vendors) contractually comply with your security standards for data processing?">
    Yes
  </Accordion>

  <Accordion title="(Only applicable if your company/data centers are based in the US) For the provision of services, do you process EU citizens' personal data?">
    Yes
  </Accordion>

  <Accordion title="Have you appointed a Data Protection Officer (DPO)?">
    Yes. We have appointed DPO
  </Accordion>

  <Accordion title="Do you plan on being Privacy Shield certified withing the next 12 months?">
    No. The EU-U.S. Privacy Shield Framework is no longer a valid mechanism to comply with EU data protection requirements when transferring personal data from the European Union to the United States. Please visit here for more details - [https://www.privacyshield.gov/Program-Overview](https://www.privacyshield.gov/Program-Overview)
  </Accordion>

  <Accordion title="Describe or attach your Security Incident Response Program?">
    See Security Incident Reporting & Response Procedure attached We are GDPR Compliant. Our information security team and Customer support team will inform the POC of the customer via email communication with Preliminary Incident Synopsis and Root Cause Analysis report (RCA) including the details of Business Impact, Issue Description, Root Cause, and Corrective Actions.
  </Accordion>

  <Accordion title="Do you have formally defined criteria for notifying a client during an incident that might impact the security of their data or systems? What are your SLAs for notification?">
    Yes. We have formally defined criteria for notifying a client during an incident that might impact the security of their data or systems. We notify within 72 hours as per EU-GDPR
  </Accordion>

  <Accordion title="Data Protection Training and Awareness – Indicate what awareness-raising controls are carried out with regards to colleagues">
    Data Protection Training and Awareness – Indicate what awareness-raising controls are carried out with regards to colleagues We conduct Information security and Data protection awareness training as soon as new employees joined the organization and annually once for the old employees. The training material includes the below concepts – Information Security Objective How to handle and protect PII What is ISO 27001:2013 Confidentiality, Integrity, Availability and Privacy. Business and cyber security PDCA – Continual improvement General guidelines for security Visitor management Security guidelines Guidelines while using Xoxoday provided devices Password guidelines Email related guidelines Social media related guidelines Phishing attack and its types Information storage related guidelines Incident Management Business continuity management
  </Accordion>

  <Accordion title="Managing personal data breaches - Indicate whether IT incidents are subject to a documented and tested management procedure">
    We have implemented Security Incident Reporting & Response Procedure and tested annually. We also have Data Breach Notification Procedure as per the GDPR compliance requirements. We will share the supporting documents with regards to data breach notification and Incident management procedures.
  </Accordion>

  <Accordion title="When a person working with the customer data no longer performs that role, are their permissions to the customer data revoked?">
    Yes. We provide these rights to the data subject as per GDPR
  </Accordion>

  <Accordion title="Service provider shall include commitment for response time in the event of security incident in line with the customer requirements">
    We inform our customer in 48 hours if in case any security breaches as per the GDPR regulation.
  </Accordion>

  <Accordion title="Describe your security model, including network, data, and application security; data center security; application and system support; upgrades and maintenance; and personnel access rights.">
    We have implemented policies and procedures as per ISMS and GDPR requirements. We also conduct periodical Internal and external Audit by the third party Auditor. We have deployed our application on Cloud Virtual platform for maximum security. We use Bitdefender End point security software to prevent from malware and protect the data. In addition to that we also have AWS Guard Duty threat detection service that continuously monitors for malicious activity and unauthorized behaviour. We conduct periodical Vulnerability assessment and Penetration Testing from the Inductry approved authorized vendor to make sure that all the vulnerabilities are closed and having secured applications. We use logical data isolation with the help of company specific encryption keys. Data in non production environment is not updated with the production data. We generate separate test data Data at transit - TLS1.2 encryption, Data at rest - AES256 As per the Information security policy and Data protection policy only the authorised individual have an access to the data through internal approving and ticketing system.
  </Accordion>

  <Accordion title="Has the retention period of the collected PII data decided?">
    Yes. Attached the data retension and disposal policy.
  </Accordion>

  <Accordion title="Does the application have the feasibility to cater to data subject access requests for erasure, restriction and data portability?">
    Yes. we are GDPR compliant. We have procedure in place to provide services to data subject.
  </Accordion>

  <Accordion title="Does PII shared with any third party vendor? If yes, Are the contracts with the third parties incorporated with the required privacy clauses?">
    We do not share the PII with any third parties.
  </Accordion>

  <Accordion title="Share the process of secure data disposal at various stages, e.g., once data is archived / not require further, end of the contract. (2)">
    We are GDPR Complaint and respect the data subjet access rights. We erase or delete the data upon request of the data subject or on the request of the customer upon termination of the contract. We have Data Retention and Disposal Policy. Our data cleaning process goes through an organized purge. Once the data is purged, it's purged from all places. Attached the Data Retention and Disposal Policy.
  </Accordion>

  <Accordion title="Do you ensure that the data processing is restricted to as required by the signed TCS contract?">
    We restrict the processing of data as per the contract signed.
  </Accordion>

  <Accordion title="Do you have personal data breach management process defined and followed?">
    We are GDPR compliant. we have implemented the Data Breach Notification Procedure. Our information security team and Customer support team will inform the customer via email communication with Preliminary Incident Synopsis and Root Cause Analysis report (RCA) including the details of Business Impact, Issue Description, Root Cause, and Corrective Actions.
  </Accordion>

  <Accordion title="Do you have processes to identify data subject requests and direct them to TCS where TCS is the Data Controller and support TCS in the execution of these requests?">
    We have provided the features to withdraw consent or exercise the right for the end users. Attached the Data subject access rights procedures
  </Accordion>

  <Accordion title="Does this application have any personal data touch points? (Collect / Store / Process / Transfer)">
    Yes. We collect the data through our application application. As per the GDPR we are the data processor.
  </Accordion>

  <Accordion title="Does this application have personal information of EU citizens as well?">
    No. Since it's a SAAS product we are having EU customers who are using our application application.
  </Accordion>

  <Accordion title="Whose personal information is being collected? (ex. Customer, Vendor, Employee, Visitor etc.)">
    Employees.
  </Accordion>

  <Accordion title="Does the application perform any automatic decision making (arriving at a decision solely on the basis of processing of PII automatically) or profiling on the PII captured?">
    No. We collect the data through this application and store it. We do not use or transfer or share the PII
  </Accordion>

  <Accordion title="Is a privacy notice displayed to the Data Subject?">
    Yes. Its posted on our website and they can exercise their rights as per the law.
  </Accordion>

  <Accordion title="Is consent taken and recorded from the Data Subject?">
    Yes. We do take consent from the data subjects.
  </Accordion>

  <Accordion title="Do you have a defined retention period for personal data categories selected above? Please mention the agreed retention period.">
    We Dispose the data Upon the expiry of the data retention as per the agreements, or when the data subject exercises their right to have their personal data erased, the personal data shall be deleted.
  </Accordion>

  <Accordion title="Q10: Is explicit consent taken for sending communication related to Marketing / Advertisement?">
    We do not use personal information for Marketing or Advertisement.
  </Accordion>

  <Accordion title="If Yes, do you provide the Data Subject the option to Opt-out or Unsubscribe?">
    NA. We do not use personal information for Marketing or Advertisement.
  </Accordion>

  <Accordion title="Is the application managed or maintained by any external third-party? (Third party having access to the personal data elements selected above)">
    No. But we have deployed our application on AWS cloud virtual platform for maximum security.
  </Accordion>

  <Accordion title="Do you consider yourself the data owner or data processor?">
    we are the data processor.
  </Accordion>

  <Accordion title="Do you meet international privacy requirements? (GDPR, NDB Scheme, PDPA)">
    We are GDPR compliant.
  </Accordion>

  <Accordion title="How long will our data be retained for? Does the service provider have a data retention and disposal policy?">
    Yes. We are GDPR Compliant and we have a data retention and disposal policy. We assure secure data disposal when storage is decommissioned or when the contract comes to an end. We also provide rights to the users to request for data deletion. GDPR Policy - [https://www.xoxoday.com/gdpr](https://www.xoxoday.com/gdpr)
  </Accordion>

  <Accordion title="What arrangements are in place for return of data to corporate upon contract conclusion or termination?">
    We will be deleting the customer data upon termination of the contracts.
  </Accordion>

  <Accordion title="What arrangements are in place for deletion of data upon contract conclusion or termination?">
    Our data cleansing process goes through an organized purge. Once the data is purged, it's purged from all places or completely wiped out.
  </Accordion>

  <Accordion title="Please reconfirm or confirm the following: The company will notify Nova Professional Services of an incident or data breach within 24 hours. The company agrees to keep Nova Professional Services fully informed of incident response and investigation.">
    We are GDPR Compliant. And we would be notifying Nova Professional Services of an incident or data breach within 72 hours. We will make sure that we will be fully informed of incident response and investigation.
  </Accordion>

  <Accordion title="Have you identified all legal/regulatory requirements that your company is supposed to adhere to? Please list the key ones. How do you ensure compliance to the same? Please describe">
    We are ISo 27001;2013 certified and GDPR compliant. We also conduct internal review, Audit and external Audit from the third party auditors to make sure that we are complying with the requirements.
  </Accordion>

  <Accordion title="What are the communication channels and SLAs defined for notifying Infosys of any information security breach directly related to Infosys data or that may have a potential impact on Infosys?">
    we Notify data controllers within 48 hours of the breach or within stipulated time as agreed with the data controller throgh email.
  </Accordion>

  <Accordion title="Do you have a process to manage any request arising from Infosys end on data subject rights, towards access, rectify, erase or restrict processing, to the extent such request extends to processing of personal data as part of your service.">
    Yes. We provide service to the data subject as per the GDP Compliance requirements. They can rectify, erase or restrict processing of their personal data.
  </Accordion>

  <Accordion title="Is only required data is displayed and transmitted by the application?">
    Xooxday is GDPR Compliant. We collect the data which are only required. We collect the PII - Name, Email ID and Phone/
  </Accordion>
</AccordionGroup>

## CCPA/CPRA

<AccordionGroup>
  <Accordion title="What are the regulations around indemnity/liability for data privacy breaches?">
    We are compliant with EU GDPR and CPRA (California Privacy Rights Act)
  </Accordion>

  <Accordion title="The PII protection standards met by the cloud service provider.">
    We are EU GDPR Compliant and CPRA Certified.
  </Accordion>

  <Accordion title="Does a process exist to identify new laws and regulations with IT security implications? (e.g., new state breach notification requirements)? i.e. Monitoring newsletters, Webinars, security or regulatory forums etc">
    Yes. We comply with all the applicable new laws and regulations. We also have a service provider who helps us with regards to Information security, compliance and certifications etc.. We have identified the upcoming CPRA and implemented the controls and achieved the CPRA Attestation with the help of the external auditor..
  </Accordion>
</AccordionGroup>


# Security Operations
Source: https://help-plum.xoxoday.com/faq/security-compliance/security-operations

Find answers to frequently asked questions about Plum's security operations, monitoring, and incident response practices.

Our security systems are airtight and so far we haven't suffered any security breaches.

<AccordionGroup>
  <Accordion title="Do you make security incident information available to all affected customers and providers periodically through electronic methods (e.g., portals)?">
    Yes, we have a repository of security incident information if needed for all the affected customers. This information can be accessed electronically.
  </Accordion>

  <Accordion title="What data monitoring tools are available and is there support for using external monitoring tools?">
    We have an ELK setup in place to ensure data monitoring in the most optimal manner.
  </Accordion>

  <Accordion title="Do you use content monitoring and filtering to detect inappropriate data flows?">
    No, content monitoring and filtration is not done to detect inappropriate data flows.
  </Accordion>

  <Accordion title="Are ingress and egress points, such as service areas and other points where unauthorized personnel may enter the premises, monitored, controlled and isolated from data storage and process?">
    Yes, only the authorized personnel are allowed in points of ingress and egress in order to isolate access of data storage and process.
  </Accordion>

  <Accordion title="What are the data backup and data archiving procedures? Is it secured?">
    Data backups are done daily and in a secured way in AWS
  </Accordion>

  <Accordion title="Is there a provision for customer definable backup and Retention Periods of data?">
    No, the backup and retention of data lies in the hands of Xoxoday. Data is stored in the event that a future need arises for looking into the database.
  </Accordion>

  <Accordion title="Is the data stored in the database and is transit scrambled?">
    Yes, the data is stored in our secure database and is transit scrambled for maximum security.
  </Accordion>

  <Accordion title="Is the client data used for testing purposes?">
    Our tenants' data is excruciatingly confidential and is never used for testing or staging purposes.
  </Accordion>

  <Accordion title="In the case of confirmed security incidents targeted at TCCC, do you provide immediate notification to KO-CIRT?">
    Yes, we promptly notify the KO-CIRT for immediate counter-actions and defense mechanisms in case of confirmed security incidents.
  </Accordion>

  <Accordion title="Do you provide tenants with documentation describing your Information Security Management Program (ISMP)?">
    Yes, please go through our "Information Security Management System Manual" for a complete understanding.
  </Accordion>

  <Accordion title="Do you review your Information Security Management Program (ISMP) at least once a year?">
    Our ISMP is annually reviewed and updated if required.
  </Accordion>

  <Accordion title="Please provide your Information Security Policy and Privacy Policy.">
    Please go through the links below to access our policies:

    Information Security Policy Privacy Policy

    Privacy Policy
  </Accordion>

  <Accordion title="Do you ensure your providers adhere to your information security and privacy policies?">
    Yes, it's crucial for our providers to adhere with the Information Security & Privacy Policy of the organization.
  </Accordion>

  <Accordion title="Do you follow OWASP (Open Web Application Security Project) guidelines for application development?">
    Yes, we follow all the technical guidelines for development of our code and applications that come under the Open Web Application Security Project.
  </Accordion>

  <Accordion title="Are all identified security, contractual, and regulatory requirements for customer access contractually addressed and remediated prior to granting customers access to data, assets, and information systems?">
    Yes, we remediate and address all requirements with respect to security, contracts, and regulative purposes for customer access to data and information systems.
  </Accordion>

  <Accordion title="Is MFA (Multi-Factor Authentication) provided as an option?">
    No, we don't provide multi-factor authentication. As of now, there's oAuth2.0 and SAML-based tokens. JSON-based token is available for maximum security direct-email logins.
  </Accordion>

  <Accordion title="Does the product's architecture support continuous operation during upgrades and maintenance windows?">
    Yes, Xoxoday's architecture goes through constant upliftment and experiences no downtime during upgrades and maintenance windows.
  </Accordion>

  <Accordion title="Does your security information and event management (SIEM) system merge data sources (app logs, firewall logs, IDS logs, physical access logs, etc.) for granular analysis and alerting?">
    Yes, our event management systems merge the data sources to maintain a log data within the SIEM. This helps in proper analysis and driving out alerts if need be in case of contingency.
  </Accordion>

  <Accordion title="Do you have a documented security incident response plan?">
    Yes, our documented security incident response plan logs, monitors, and collects relevant security event data for the purpose of investigation.
  </Accordion>

  <Accordion title="Do you monitor and quantify the types, volumes, and impacts on all information security incidents?">
    Yes, information security incidents, if any, shall be quantified in type, volume, and impact of such incidents.
  </Accordion>

  <Accordion title="Does your incident response plan comply with industry standards for legally admissible chain-of-custody management processes and controls?">
    Yes, systems must be configured to log all successful and unsuccessful login attempts by accounts with privileged access. These authentication logs must be retained for a minimum of 180 days and in accordance with the Company's records retention guidelines.
  </Accordion>

  <Accordion title="Do you use file integrity (host) and network intrusion detection (IDS) tools for you SaaS solution to help facilitate timely detection, an investigation by root cause analysis, and response to incidents?">
    Yes, with host and network intrusion detection tools, we ensure timely detection and investigation in a prompt manner.
  </Accordion>

  <Accordion title="Do you route entire outbound internet traffic through a centralized proxy server?">
    No, all of Xoxoday's servers are with Amazon Web Services, Singapore and that is where the outbound traffic is routed through.
  </Accordion>

  <Accordion title="Do you monitor cyber threats internally or have taken services from any third party?">
    Cyber threats, if any, are managed internally by the tech team.
  </Accordion>

  <Accordion title="Do you assess identified threat for applicability and exposure to your environment?">
    Yes we have a regular audit on threats for applicability and exposure to our environment.
  </Accordion>

  <Accordion title="Do you update your cyber security program based on proactive or reactive threat intelligence feeds?">
    Yes we update your cyber security program based on proactive or reactive threat intelligence feeds
  </Accordion>

  <Accordion title="Does your threat feed rely on input from multiple sources?">
    Xoxoday's holistic presence keeps our tech team updated with the latest news from multiple sources when it comes to any technological developments or threats.
  </Accordion>

  <Accordion title="Does your incident response plan comply with industry standards for legally admissible chain-of-custody management processes and controls? (2)">
    Yes, physical segregation is done for production and non-production environments.
  </Accordion>
</AccordionGroup>


# Security Operations & Technical Capabilities and Support
Source: https://help-plum.xoxoday.com/faq/security-compliance/security-operations-technical-capabilities-and-support

Find answers to frequently asked questions about the technical capabilities and support behind Plum's security operations.

<AccordionGroup>
  <Accordion title="Does your incident response plan comply with industry standards for legally admissible chain-of-custody management processes and controls?">
    Yes, we have proper forensic procedures in place that includes chain-of-custody management processes and controls.
  </Accordion>

  <Accordion title="What controls are used to mitigate DDoS (distributed denial–of-service) attacks?">
    As part of Web Application Firewall (WAF), rate limiters are installed to block multiple requests from specific IPs in order to prevent DDOS-type attacks. These are powered by intelligent daemons that detect other identifiers like URLs accessed or other client properties to automatically blacklist possible threats either temporarily or permanently.
  </Accordion>

  <Accordion title="Is there a cloud audit program to address the client's audit and assessment requirements?">
    Yes, in our cloud audit program, we analyze and address all the requirements put forth by the tenant to ensure maximum satisfaction.
  </Accordion>

  <Accordion title="Does your incident response capability include the use of legally admissible forensic data collection and analysis techniques?">
    Yes, we have proper forensic procedures for data collection and analysis for incident responses.
  </Accordion>

  <Accordion title="Are you capable of supporting litigation holds (freeze of data from a specific point in time) for a specific tenant without freezing other tenant data?">
    Yes, we can freeze data from a specific time without freezing other data if need be.
  </Accordion>

  <Accordion title="Do you enforce and attest to tenant data separation when producing data in response to legal subpoenas?">
    Yes. Tenant data is enforced and attested in case it comes to light in legal subpoenas.
  </Accordion>

  <Accordion title="Give details of platform on which the application is developed.">
    The Xoxoday Platform is developed on microservices architecture because the independent applications and deployed on the AWS virtual platform cloud.
  </Accordion>

  <Accordion title="Does your product provide/support mobility through native mobile apps etc.?">
    No, our product is supported by a comprehensive web application that can be accessed via desktop and mobile browsers on all compatible devices.
  </Accordion>

  <Accordion title="Do you offer reconfigurability in your SaaS solution? Give the options if available">
    Our platform can be white-listed to match the look and feel of the tenant's platform. The emails are also customizable for a personal touch.
  </Accordion>

  <Accordion title="What customization options are available to cater to tenant's requirements? E.g. Customized reports etc.">
    Reports with respect to rewarding and beyond can be accessed through the platform.
  </Accordion>

  <Accordion title="If customization is possible, what are the development tools and APIs available?">
    The customization is done on the platform level, manually by the super admin.
  </Accordion>

  <Accordion title="Do you support out-of-the-box integration with on-premise applications such as SAP, Active Directory etc.?">
    Yes, Xoxoday Plum comes with a full set of integration with various platforms for enriched utility and maximum output from the platform.
  </Accordion>

  <Accordion title="Do you support movement of applications and data from one cloud service provider to another cloud service provider or back to in-house data center whenever required?">
    Yes, Xoxoday Plum comes with a full set of integration with various platforms for enriched utility and maximum output from the platform.

    No, we keep it with one data center for maximum safety, privacy, and security of database of our tenants.
  </Accordion>

  <Accordion title="What are the available management reporting capabilities?">
    Reports and analysis can be extracted from the platform. These reports give detailed insights with respect to what's being the reward and recognition input and output throughout the concerned period.
  </Accordion>

  <Accordion title="Can the reports be customizable based on the tenant's needs?">
    In case reports are needed apart from the predefined ones, they can be shared with the tenants in a spreadsheet.
  </Accordion>

  <Accordion title="What types of Advisory and technical support are provided?">
    Xoxoday's customer support team is available at all times to address any queries and support with respect to advisory and technical operations.
  </Accordion>

  <Accordion title="How does the Cloud Service Provider protect keys, and what security controls are in place to effect that?">
    Each tenant data is uniquely encrypted using client specific key. We use AES 256 bit encryption for data at rest to ensure maximum security measures.
  </Accordion>

  <Accordion title="Are hardware security modules used to protect such keys? Who has access to such keys?">
    Yes, hardware security modules are used to protect these keys, and the key access lies with the Chief Technical Office.
  </Accordion>

  <Accordion title="What procedures are in place to manage and recover from the compromise of keys?">
    We use the Key Management Service by AWS to manage all the keys. In the event that keys get compromised, they can be recovered through the Key Management Service.
  </Accordion>

  <Accordion title="If an advanced warning is given for service interruption will it count as downtime?">
    Yes, in the event of service interruption, the prior notification will count for downtime.
  </Accordion>

  <Accordion title="What is the SLA (Time) for different levels of support different incidents and change requests? Standard example: Critical - 2 hrs. or less, Moderate - 4 hrs. or less, Minimum - 8 hrs. or less">
    The time of support ranges between six to forty-eight hours. This depends on the level of service and the gravity of incidents.
  </Accordion>

  <Accordion title="Do you have penalty clauses in the event of performance failure?">
    No, there is no penalty clause attached in the event of a performance failure.
  </Accordion>

  <Accordion title="What are the inbuilt APIs for third-party tools available? Can you integrate with SailPoint, ForgeRock, Splunk, OneCert, EDM?">
    We are a SAAS company hence we do not have in built APIs, we maintain quarterly/yearly audit logs. No we do not integrate with the above third party tools
  </Accordion>

  <Accordion title="How is the overall Application logging operation managed? - Does the solution support monitoring for security events and can event notifications/incident response be integrated with bank system?">
    We maintain the logging of applications and alerts by ourselves. We cannot be integrated with the bank system, According to our company policy we do not share the logs with any third party.
  </Accordion>

  <Accordion title="Does the application have robust authentication methods (e.g. SSO, multi-factor authentication, One-time password, secure token, etc.) for administrative access to this service?">
    Yes the application have robust authentication methods. We are integrated SAML 2.0 with SAP SuccessFactors, we also support OAuth 2.0 for seamless authentication.
  </Accordion>

  <Accordion title="Do you report PEN test, SOC findings?">
    Yes we do report pen test and SOC findings
  </Accordion>

  <Accordion title="How is the compatibility of the application with Desktop(Mac/OS); Tablet; Mobile (Android/iPhone)? Any additional components required to download in user's computer in order to access the application?">
    Our applications are compatible with desktops, tablets and Mobiles, No additional components are required.
  </Accordion>

  <Accordion title="Does the application have a robust Backup and Restore procedures? Is the duration configurable? Can you share your DR strategy and tests results? Is it Active-active?">
    Since we are SAAS product, we maintain backup and restore all the customer data by ourselves. We use AES 256 encryption for data at rest. We have a multi AZ deployment with periodic backup for our DR. DR is active-active.
  </Accordion>

  <Accordion title="How is data isolated between customers? Is the data in the non-prod instance refreshed with Prod data and masked? If data masking is performed, then how configurable are the masking scripts? What protection is used for Prod data at rest and at transit?">
    We use logical data isolation with the help of company-specific encryption keys. Data in non production environment is not updated with the production data. We generate separate test data Data at transit - TLS1.2 encryption, Data at rest - AES256
  </Accordion>

  <Accordion title="How many instances to be provided and supported? How seamless is the Product upgrade release? What is the hosting model - public, private, hybrid, etc.">
    We are a SAAS solution, and hosting is handled by us. No instances needed from the client. We use Public cloud for hosting (AWS Singapore)
  </Accordion>

  <Accordion title="What is the RTO and RPO? Can you share the latest DR strategy test results?">
    6 Hours RTO and 6 Hours RPO, Yes upon request we can share latest DR strategy test results.
  </Accordion>

  <Accordion title="Are there any FLASH component installed in your web app. If yes, can it be disabled without any detrimental impact to the application itself?">
    No there aren't any FLASH component installed in our web app.
  </Accordion>

  <Accordion title="How mature is the technical capabilities of the product to be able to integrate seamlessly and securely with the Bank's tools and applications?">
    This solution doesn't require any such API integration. The solution is seamlessly integrated with the SAP SuccessFactors solution already.
  </Accordion>

  <Accordion title="Does the Vendor and/or Business User have controls over elevated/privileged or operational access? Does this mean SCB admin staff will have control and will be able to perform any administrative or operational activities? How are the roles Admin and Super Admin defined?">
    We only have 2 roles. Super admin and user. Super admin have complete control of the platform and can configure everything. SCB Admin staff will become the super admins.
  </Accordion>

  <Accordion title="How is the overall Application logging operation managed? - Does the solution support monitoring for security events and can event notifications/incident response be integrated with bank system? (2)">
    Xoxoday will not be sharing logs with SCB as we have multi-tenant information in the logs. If there is a significant downtime or disruption of service, we will provide an alert notification to SCB
  </Accordion>

  <Accordion title="What are WCAG Guidelines?">
    Web Content Accessibility Guidelines (WCAG) defines how to make Web content more accessible to people with disabilities. Accessibility involves a wide range of disabilities, including visual, auditory, physical, speech, cognitive, language, learning, and neurological disabilities.
  </Accordion>

  <Accordion title="Do you comply with WCAG Guidelines?">
    Yes. We always give our best to make sure that our applications are developed as per WCAG guidelines and helping differently-abled people across the globe.
  </Accordion>

  <Accordion title="Can people with disabilities use your website and application without barriers?">
    Yes. We ensure that people with disabilities can use our websites and applications without any difficulties. Our website and products are having very simple options with very good visibility of the content.
  </Accordion>

  <Accordion title="Do you consider WCAG guidelines during product development?">
    Yes. We always consider the WCAG guidelines for helping differently-abled people.
  </Accordion>

  <Accordion title="Do you conduct any periodic review and improve the website or applications?">
    Yes. We periodically review and do all the necessary changes to our website and applications as per the guidelines.
  </Accordion>
</AccordionGroup>


# Solution Development
Source: https://help-plum.xoxoday.com/faq/security-compliance/solution-development

Find answers to frequently asked questions about the secure solution development lifecycle Plum follows for its products.

<AccordionGroup>
  <Accordion title="Do you have the ability to logically segment or encrypt customer data such that data may be produced for a single tenant only, without inadvertently accessing another tenant's data?">
    Yes, our network environment is designed and configured to restrict any communication and connection between the tenant's environment and our corporate network.
  </Accordion>

  <Accordion title="Do you logically and/or physically separate tenant systems from corporate systems?">
    Yes, our logic to physically separate tenant systems is made possible by assigning each tenant's data a client-specific key that is uniquely encrypted for maximum security.
  </Accordion>

  <Accordion title="Are information system documents (e.g., administrator and User guides, architecture diagrams, etc.) made available to authorized personnel to ensure configuration, installation, and operation of the information system?">
    Yes, all the resources that are needed for the configuration, installation, and operation of information systems are made available to the authorized personnel for their perusal.
  </Accordion>

  <Accordion title="Can you a provide dedicated computing environment for the tenant?">
    No, we have a holistic computing environment which uses logical methods of isolation to keep the tenant's data secure.
  </Accordion>

  <Accordion title="Do you provide the logical segregation of tenant data and the application?">
    Yes, we logically segregate the tenant's data and the application.
  </Accordion>

  <Accordion title="Do you logically and physically segregate production and non-production environments?">
    Yes, physical segregation is done for production and non-production environments.
  </Accordion>

  <Accordion title="Are there any coding standards in place?">
    As per the SDLC process, we have defined General Coding Practice and some salient points are -

    * We use parameterized queries.
    * All PI data need will be encrypted
    * All our communications will be over secure channels only and many more.
  </Accordion>

  <Accordion title="Are there any teams that can deploy code into production environments without it passing through the QA process?">
    No. All the deployments will take place only upon QA Process.
  </Accordion>

  <Accordion title="How regularly are backups tested - has the recovery process ever been tested?">
    Backups are automated and tested/reviewed on a weekly basis. Recovery process has been tested during the annual BCP test to make sure that implemented controls are working effectively. All the customer data backup has been stored on AWS/MS Azure Virtual platform cloud and all the data at rest has been encrypted.
  </Accordion>

  <Accordion title="Describe your incident escalation process?">
    Information security and Technology Team will be responsible for evaluating the incident and appropriately initiating the escalation process and holds the overall responsibility to monitor the activity and facilitate any action. If the problem requires further investigation, IT will assign the ticket to the appropriate Support Groups and escalate it CTO.
  </Accordion>

  <Accordion title="Describe your key management processes.">
    We use a split key mechanism to ensure that every client's key is unique.

    * We perform annual key rotations.
    * Keys are generated using the KMS service whenever needed.
    * We store keys in KMS.
  </Accordion>

  <Accordion title="How is product security considered during the development process?">
    We have implemented the systems development life cycle (SDLC) Procedure. Our code reviews and analysis run through stringent eyes of automated technologies as well as manual source code overview to cover any security loopholes prior to the production phase. We also conduct vulnerability and penetration testing and fix the identified observations. Upon passing all the security and quality checks the new version of the product will be released.
  </Accordion>
</AccordionGroup>


# Tax Compliance
Source: https://help-plum.xoxoday.com/faq/security-compliance/tax-compliance

Find answers to frequently asked questions about Plum's tax compliance practices and the documentation it maintains.

Disclaimer: This is for informative purposes only and should not be construed as professional, financial, or legal advice. The information does not constitute or form part of, and should not be construed as, a direct indication from the designated countries' tax authorities. For updated information, please visit the official tax website of your country's government/tax authority.

## USA

<AccordionGroup>
  <Accordion title="What is the amount exempted from tax in the name of small benefits for employees?">
    In the United States, every person is allowed a tax-free benefit of up to \$25 per year. This is valid for every employee irrespective of the federal, local, or state laws.
  </Accordion>

  <Accordion title="How is the taxation done if the small benefit exemption limit is crossed?">
    A Federal Income Tax (22%) + Social Security (7.65%) + Local/State Tax (if applicable) is applied on the amount above \$25.
  </Accordion>

  <Accordion title="How does the small benefit exemption work in the USA?">
    The employer can either record a high value of benefits and withhold the tax, or trim it from the amount being given to the employee.
  </Accordion>

  <Accordion title="Where can I contact the tax authorities of the USA?">
    The Internal Revenue Service USA
  </Accordion>
</AccordionGroup>

## UK

<AccordionGroup>
  <Accordion title="What is the amount exempted from tax in the name of small benefits for employees?">
    In the United Kingdom, an amount of £50 goes tax-free in the name of small benefits for every person through the year.
  </Accordion>

  <Accordion title="How is the taxation done if the small benefit exemption limit is crossed?">
    If the amount goes over the exemption limit or is issued as a voucher exchangeable for cash, it will be taxed on the employee's end under "Other Earnings".
  </Accordion>

  <Accordion title="How does the small benefit exemption work in the UK?">
    There are certain exemptions, the list of which can be checked out here ([https://www.gov.uk/hmrc-internal-manuals/national-insurance-manual/nim02416](https://www.gov.uk/hmrc-internal-manuals/national-insurance-manual/nim02416)). Trivial benefits are non-taxable, provided that:

    * it costs the employer £50 or less to provide

    * it isn't cash or a cash voucher

    * it isn't a reward for employees' work or performance

    * it isn't in terms of their contract
  </Accordion>

  <Accordion title="Where can I contact the tax authorities of the UK?">
    [https://www.gov.uk/expenses-and-benefits-trivial-benefits](https://www.gov.uk/expenses-and-benefits-trivial-benefits)
  </Accordion>
</AccordionGroup>

## Ireland

<AccordionGroup>
  <Accordion title="What is the amount exempted from tax in the name of small benefits for employees?">
    The Irish tax authorities exempt a handsome total of €500 per person through the year in the name of small benefits.
  </Accordion>

  <Accordion title="How is the taxation done if the small benefit exemption limit is crossed?">
    If the SBE limits are crossed, the taxation would be according to the rules and regulations of the Irish tax authority.
  </Accordion>

  <Accordion title="How does the small benefit exemption work in Ireland?">
    The amount is only deemed to be tax-free in case it is gifted in terms of vouchers and benefits. Long Service Awards are not taxable at all as much as €50 per every year of service.
  </Accordion>

  <Accordion title="Where can I contact the tax authorities of Ireland?">
    The Revenue Commissioners, Ireland>> [https://www.revenue.ie/en/employing-people/benefit-in-kind-for-employers/other-benefits/service-and-performance-schemes-and-awards.aspx](https://www.revenue.ie/en/employing-people/benefit-in-kind-for-employers/other-benefits/service-and-performance-schemes-and-awards.aspx)
  </Accordion>
</AccordionGroup>

## India

<AccordionGroup>
  <Accordion title="What is the amount exempted from tax in the name of small benefits for employees?">
    Gifts up to Rs. 5,000 in the aggregate per financial year would be tax-exempt in the hands of the employees.
  </Accordion>

  <Accordion title="How is the taxation done if the small benefit exemption limit is crossed?">
    The excess value of gifts over and above Rs. 5000/- would be taxed as a perquisite in the hands of the employees.
  </Accordion>

  <Accordion title="How does the small benefit exemption work in India?">
    The Gift value is added to the CTC (Cost to the Company) of the employee for calculation of Income-tax.
  </Accordion>

  <Accordion title="Where can I contact the tax authorities of India?">
    Income Tax
  </Accordion>
</AccordionGroup>

## Poland

<AccordionGroup>
  <Accordion title="What is the amount exempted from tax in the name of small benefits for employees?">
    In Poland, any purchase of gifts that ZFŚS aka the National Revenue Administration of Poland finances is tax-free.
  </Accordion>

  <Accordion title="How is the taxation done if the small benefit exemption limit is crossed?">
    The amount would be wholesomely taxed. Purchase gifts partly from the ZFŚS and partly from current assets won't make it tax-free—no matter how much the amount is.
  </Accordion>

  <Accordion title="How does the small benefit exemption work in Poland?">
    This fund houses a separate bank account for every worker and has an employee's and employer's contribution to it. The ZFŚS is allocated to leisure, healthcare, entertainment, sports, recreation along with other expenses. Any purchase of gifts that ZFŚS finance is tax-free.
  </Accordion>

  <Accordion title="Where can I contact the tax authorities of Poland?">
    GOV.PL>>[https://www.gov.pl/web/national-revenue-administration/about-us](https://www.gov.pl/web/national-revenue-administration/about-us)
  </Accordion>
</AccordionGroup>

## France

<AccordionGroup>
  <Accordion title="What is the amount exempted from tax in the name of small benefits for employees?">
    In France, an exemption of €169 is given for every person through the year, provided that it's spent on activities other than food and fuel.
  </Accordion>

  <Accordion title="How is the taxation done if the small benefit exemption limit is crossed?">
    Provided that the amount goes about the SBE limit, it shall be fully taxed under the French Tax statutes.
  </Accordion>

  <Accordion title="How does the small benefit exemption work in France?">
    When the gifts are given for an event that marks a significant milestone, e.g. wedding, birth, retirement, Mother's Day, or Father's Day, etc. If the gift voucher given for the event (s)mentioned above, one can not redeem it for food or fuel (the voucher's value should still be €169 per event and calendar year). Cultural events that promote the country's colors and traditions are also exempted.
  </Accordion>

  <Accordion title="Where can I contact the tax authorities of France?">
    The Ministry of Economy & Finance>> [https://www.impots.gouv.fr/portail/](https://www.impots.gouv.fr/portail/)
  </Accordion>
</AccordionGroup>

## Netherlands

<AccordionGroup>
  <Accordion title="What is the amount exempted from tax in the name of small benefits for employees?">
    With an amount of €2207 for every employee through the year, the Dutch authorities have a generic gift tax statute for all its citizens.
  </Accordion>

  <Accordion title="How is the taxation done if the small benefit exemption limit is crossed?">
    The Dutch tax authority identifies tax slabs on gifts according to the value of donations. For donations ranging between €0 to €126,723, the tax rate is 30% on the gift value. Meanwhile, for donations with a value that goes above €126.723, the tax rate is 40% on the gift value.
  </Accordion>

  <Accordion title="How does the small benefit exemption work in the Netherlands?">
    In a general sense, there's no separate clause for the Dutch corporations signifying the gift tax rules for employees, so we are going to focus on what it says altogether.
  </Accordion>

  <Accordion title="Where can I contact the tax authorities of the Netherlands?">
    The Dutch Tax Authority>> [https://www.belastingdienst.nl/wps/wcm/connect/en/individuals/individuals](https://www.belastingdienst.nl/wps/wcm/connect/en/individuals/individuals)
  </Accordion>
</AccordionGroup>

## Norway

<AccordionGroup>
  <Accordion title="What is the amount exempted from tax in the name of small benefits for employees?">
    NOK1000 - that is the maximum an employee can get per year while being exempted from any kind of taxation under the small benefits exemption.
  </Accordion>

  <Accordion title="How is the taxation done if the small benefit exemption limit is crossed?">
    All gifts to employees over this amount and without special occasions and taxable.
  </Accordion>

  <Accordion title="How does the small benefit exemption work in Norway?">
    All gifts to employees over this amount and without special occasions and taxable. In the case of long service rewards,gifts up to NOK8,000 in value can be given for long service in the business.The first reward for long service opens up after 20 years of service, and after that in every 10 years. Gifts up to NOK4,000 can be given in case when the recipient gets married, reaches the age of fifty (and ten years thereafter), and when the recipient retires. The same amount of reward unlocks when the business reaches a jubilee landmark, i.e. 25 years, 50 years, and soon. It's a condition that to get tax exemptions, the gifts must be non-cash. Gift vouchers are acceptable.
  </Accordion>

  <Accordion title="Where can I contact the tax authorities of Norway?">
    The Ministry of Economy & Finance>> [https://www.impots.gouv.fr/portail/](https://www.impots.gouv.fr/portail/)
  </Accordion>
</AccordionGroup>

## Spain

<AccordionGroup>
  <Accordion title="What is the amount exempted from tax in the name of small benefits for employees?">
    Spanish Tax Authorities give a relaxation of up to €299 for every gift through the year per employee.
  </Accordion>

  <Accordion title="How does the small benefit exemption work in Spain?">
    There are certain benefits besides it, like meal vouchers worth up to €11 per day, nursery vouchers, public transport vouchers within certain limits, medical insurance premiums up to a maximum annual amount of EUR500 per family member covered, etc. that are exempted from tax.
  </Accordion>

  <Accordion title="Where can I contact the tax authorities of Spain?">
    Agencia Tributaria>> [https://www.agenciatributaria.es/AEAT.internet/en\_gb/Inicio.shtml](https://www.agenciatributaria.es/AEAT.internet/en_gb/Inicio.shtml)
  </Accordion>
</AccordionGroup>

## Germany

<AccordionGroup>
  <Accordion title="What is the amount exempted from tax in the name of small benefits for employees?">
    The EStG states a total of \$44 for every emplpoyee per month that can go tax free.
  </Accordion>

  <Accordion title="How is the taxation done if the small benefit exemption limit is crossed?">
    All gifts to employees over this amount and without special occasions and taxable.
  </Accordion>

  <Accordion title="How does the small benefit exemption work in Germany?">
    As per Section 8, (para two; clause 11) of the German Income Tax Act (EStG), tax and social security contributions are exempted up to € 44 a month. Section 19.6 (para one) of the German Income Tax Law (LStR) exempt from tax and social security contributions up to€60 for special personal occasions.
  </Accordion>

  <Accordion title="Where can I contact the tax authorities of Germany?">
    BZSt>> [https://www.bzst.de/EN/Home/home\_node.html](https://www.bzst.de/EN/Home/home_node.html)
  </Accordion>
</AccordionGroup>

## Denmark

<AccordionGroup>
  <Accordion title="What is the amount exempted from tax in the name of small benefits for employees?">
    With an amount of DKK1100 for every employee for a year, the Danish tax authorities has a threshold for gift vouchers and other non-cash gifts.
  </Accordion>

  <Accordion title="How is the taxation done if the small benefit exemption limit is crossed?">
    The gifts going beyond this limit are taxable to the given slabs.
  </Accordion>

  <Accordion title="How does the small benefit exemption work in Denmark?">
    Skattestyrelsen, the Danish tax authority signifies that gift vouchers and other non-cash gifts aren't taxable up to DKK1,100 in case they are unrelated to the employees' jobs. Benefits related to employees' jobs have a more relaxed threshold, and they are tax-exempt until their value exceeds DKK5,600.
  </Accordion>

  <Accordion title="Where can I contact the tax authorities of Denmark?">
    SKAT.DK>> [https://skat.dk/skat.aspx?oid=2244343](https://skat.dk/skat.aspx?oid=2244343)
  </Accordion>
</AccordionGroup>

## Singapore

<AccordionGroup>
  <Accordion title="What is the amount exempted from tax in the name of small benefits for employees?">
    No corporate gift tax is charged on presents worth under the value of SGD200.
  </Accordion>

  <Accordion title="How is the taxation done if the small benefit exemption limit is crossed?">
    As for the values exceeding SGD200, it would only be taxed in case of a single gift value surpassing the limit. However, multiple gifts can given under the value of SGD200 without being taxed.
  </Accordion>

  <Accordion title="How does the small benefit exemption work in Singapore?">
    If the nature of benefit or gift is that of bereavement, i.e. on the occasion of loss, then it's exempted from any tax. Such gifts are never taxable, even if their value exceeds S\$200. Do note that the above rules apply to cash and non-cash gifts.
  </Accordion>

  <Accordion title="Where can I contact the tax authorities of Singapore?">
    [https://www.iras.gov.sg/IRASHome/Businesses/Employers/Tax-Treatment-of-Employee-Remuneration/Gifts/](https://www.iras.gov.sg/IRASHome/Businesses/Employers/Tax-Treatment-of-Employee-Remuneration/Gifts/)
  </Accordion>
</AccordionGroup>

## Malaysia

<AccordionGroup>
  <Accordion title="What is the amount exempted from tax in the name of small benefits for employees?">
    Normally, gift vouchers are not taxable in the hands of the employee unless they are of a recurring nature and are provided in circumstances where the employee expects such gifts as part of his remuneration.
  </Accordion>

  <Accordion title="How is the taxation done if the small benefit exemption limit is crossed?">
    In case the Gift Vouchers are part of the remuneration, it will be taxed at the hand of the employee.
  </Accordion>

  <Accordion title="How does the small benefit exemption work in Malaysia?">
    The small benefit exemptions aren't applicable, however, on long service or festivities. The value of gift vouchers would be taxed on the recipient's gross income.
  </Accordion>

  <Accordion title="Where can I contact the tax authorities of Malaysia?">
    [http://www.hasil.gov.my/index.php?bt\_lgv=2](http://www.hasil.gov.my/index.php?bt_lgv=2)
  </Accordion>
</AccordionGroup>

## Philippines

<AccordionGroup>
  <Accordion title="What is the amount exempted from tax in the name of small benefits for employees?">
    Any gifts below P5000 are exempted from taxation.
  </Accordion>

  <Accordion title="How is the taxation done if the small benefit exemption limit is crossed?">
    These gifts, however, are advisable to be crossed only on special occasions and festivities. Any gift above P5000 would be considered as a fringe benefit and will be taxed.
  </Accordion>

  <Accordion title="Where can I contact the tax authorities of Philippines?">
    [https://www.bir.gov.ph/](https://www.bir.gov.ph/)
  </Accordion>
</AccordionGroup>


# Training and Awareness
Source: https://help-plum.xoxoday.com/faq/security-compliance/training-and-awareness

Find answers to frequently asked questions about the security training and awareness programs Plum runs for its employees.

<AccordionGroup>
  <Accordion title="Are all personnel required to sign NDA or Confidentiality Agreements as a condition of employment to protect customer/tenant information?">
    Yes, our personnel - both full-time and on-contract are bound by an agreement of non-disclosure and a confidentiality agreement as a condition of employment to protect the customers and tenant's information.
  </Accordion>

  <Accordion title="Do you specifically train your employees, contractors, and third-party users regarding their specific role and the information security controls they must fulfill?">
    Yes, all the employees and personnel pass through induction and job training, along with contractors and third-party users for their share of information security controls.
  </Accordion>

  <Accordion title="Are personnel trained and provided with awareness programs at least once a year?">
    Yes, all personnel are well-trained with awareness programs annually.
  </Accordion>

  <Accordion title="Do you have an information security awareness training program? Do you perform phishing tests on your employees? Please describe frequency of the security awareness training, phishing exercises, and subjects addressed in your training.">
    We conduct the Infosec Awareness training as soon as employee joined the organization and on annual basis. Each employee, when inducted, signs a confidentiality agreement and acceptable use policy, after which they undergo training in information security, privacy, and compliance. Furthermore, we evaluate their understanding through tests and quizzes to determine which topics they need further training in. We provide training on specific aspects of security that they may require based on their roles.
  </Accordion>

  <Accordion title="Do all staff receive information security awareness training?">
    We conduct ISMS training for all the employees.
  </Accordion>

  <Accordion title="Are all systems security configuration standards documented and based on external industry or vendor guidance?">
    Attached the IT policy. We also have communicated these to all the employees to spread awareness among them.
  </Accordion>

  <Accordion title="Are there awareness training sessions on remote working guidelines, social engineering, etc. conducted? What is the periodicity of training?">
    We conduct ISMS training for all the employees. The frequency of the training will be annually.
  </Accordion>

  <Accordion title="Is a Training and Awareness Program maintained that addresses data privacy and data protection obligations based on role?">
    Data privay and Data protection is a part of our Infoarmation security awareness training.
  </Accordion>

  <Accordion title="Does the organization conduct pre-joining & periodic information security trainings & awareness programs to convey criticality of the customer data?">
    Yes. We conduct ISMS training for newly joined employees and existing employees.
  </Accordion>

  <Accordion title="Describe your security awareness program for personnel">
    Yes. We do conduct security awareness training for all the employees as soon as they joined the organization and also annually as per the ISMS requirements.
  </Accordion>

  <Accordion title="Third parties should ensure its personnel have role-based training programme for information security on an annual basis.">
    We conduct annual ISMS training for all the employees as per the compliance requirements
  </Accordion>

  <Accordion title="What kind of cloud security awareness you provide to your administrators?">
    We provide mandatory security and awareness training to all our employees and spread awareness about the information security accrross the organization.
  </Accordion>

  <Accordion title="Do all staff formally complete annual end user security awareness training?">
    Yes. We conduct Infosec awareness training as soon as the new employees join the organization and annually once for all the existing employees.
  </Accordion>

  <Accordion title="Are data privacy compliance taken into consideration in the design of new and/or redevelopment of existing systems or business processes? (If so please detail how and when)">
    Yes. We have eduated all our employees throgh training on Data privacy compliance. The Production or devolopment team always make sure that the new devolopments made will be complied with the data privacy requirements. We also educate our Production or devolopment on the recent updates throgh necessary trainings.
  </Accordion>
</AccordionGroup>


# Vulnerability and Threat Management
Source: https://help-plum.xoxoday.com/faq/security-compliance/vulnerability-and-threat-management

Find answers to frequently asked questions about Plum's vulnerability scanning and threat management practices.

<AccordionGroup>
  <Accordion title="Do you have the capability to rapidly patch vulnerabilities across all of your computing devices, applications, and systems?">
    Yes, policies and procedures are established and mechanisms are implemented to detect, address, and stabilize vulnerabilities in a timeframe that matches the Security Patch Management Standards.
  </Accordion>

  <Accordion title="Do you have anti-malware programs that support or connect to your cloud service offerings installed on all of your systems?">
    Yes, Xoxoday's products are supported by leading anti-malware programs. These are connected with our cloud service offerings and are a part of all our systems.
  </Accordion>

  <Accordion title="Do you conduct local operating system-layer vulnerability scans regularly as prescribed by industry best practices?">
    Yes, we perform periodic scans of operating systems and databases along with server applications for vulnerability and configuration compliance. This is done by using suitable vulnerability management tools as per the industry standards.
  </Accordion>

  <Accordion title="Do you conduct network-layer vulnerability scans regularly as prescribed by industry best practices?">
    Yes, we ensure that there is no breach in network layers with vulnerability scans as per the industrial standards.
  </Accordion>

  <Accordion title="Do you conduct application-layer vulnerability scans regularly as prescribed by industry best practices?">
    Yes, to check the hygiene of application layer, our vulnerability scans are done as prescribed by the industrial standard.
  </Accordion>

  <Accordion title="Will you make the results of vulnerability scans available to tenants at their request?">
    Yes, tenants can request for vulnerability scan reports.
  </Accordion>

  <Accordion title="Do you have controls and processes in place to perform host/file integrity monitoring for all systems storing and transmitting sensitive data?">
    Yes, in order to detect any unauthorized changes in the data or system configuration, we have a procedure in place for host/file integrity monitoring.
  </Accordion>

  <Accordion title="Do you conduct daily vulnerability scans at the operating system layer?">
    No, our periodic vulnerability scans are conducted just the right number of times to ensure the prominence of security measures and protection of the operating system layer.
  </Accordion>

  <Accordion title="Do you conduct daily vulnerability scans at the database layer?">
    No, our periodic vulnerability scans are conducted just the right number of times to ensure prominence of security measures and protection of the database layer.
  </Accordion>

  <Accordion title="Do you conduct daily vulnerability scans at the application layer?">
    No, our periodic vulnerability scans are conducted just the right number of times to ensure the prominence of security measures and protection of the application layer.
  </Accordion>

  <Accordion title="Do you have external third-party services conduct vulnerability scans and periodic penetration tests on your applications and networks?">
    Yes, vulnerability scans and penetration tests are conducted periodically by third parties and external services to test our security measures.
  </Accordion>

  <Accordion title="Whom do we contact if we identify a security issue or breach involving or impacting your product? Please provide an email address and/or full contact information?">
    Reach out to us at [cs@xoxoday.com](mailto:cs@xoxoday.com) to raise a ticket, if you happen to notice any potential security issue whilst meeting all the required criteria in our policy. The validation of the reported issue in terms of severity & authenticity will be done by our security team in around 90 days. Post validation, steps will be taken to fix the security issues in accordance with our security policies. The owner of the ticket will be informed once the issue is resolved.
  </Accordion>

  <Accordion title="Do you conduct application and infrastructure penetration tests of your infrastructure regularly as prescribed by industry best practices and guidance?">
    Vulnerability scanning gives us deep insight for quick identification of out-of-compliance or potentially vulnerable systems. In addition to our extensive internal scanning and testing program, Xoxoday employs third-party security experts to perform a vulnerability assessment and penetration testing.
  </Accordion>

  <Accordion title="Are the results of the penetration tests available to customers at their request?">
    We have fixed all the issues identified during the VAPT Audit and rescanned it once again to make sure that all the vulnerabilities are remideiated. Post confirmation of these fixes we got the final VAPT Certificate for our product.
  </Accordion>

  <Accordion title="Do you have external third party services conduct vulnerability scans and periodic penetration tests on production and publicly facing applications, systems and infrastructure?">
    Vulnerability scanning gives us deep insight for quick identification of out-of-compliance or potentially vulnerable systems. In addition to our extensive internal scanning and testing program, Xoxoday employs third-party security experts to perform a vulnerability assessment and penetration testing.
  </Accordion>

  <Accordion title="What are your timelines for remediation on: Critical, High, Medium, and Low vulnerabilities?">
    60 days.
  </Accordion>

  <Accordion title="Do you conduct application and network-layer vulnerability scans regularly as prescribed by industry best practices? What tool? Frequency? Provide evidence.">
    We conduct the VA/PT on annual basis as per the compliance requirements. Manual and third party tools are used for this assessment.
  </Accordion>

  <Accordion title="Do you have a capability to patch vulnerabilities across all of your computing devices, applications, and systems?">
    Yes. We have the capabilities to patch the vulnerabilities.
  </Accordion>

  <Accordion title="Is VA / PT performed at regular intervals? If yes, what is the frequency">
    We conduct VAPT on annual basis.
  </Accordion>

  <Accordion title="How does vendor ensure Application Security for the customer services in Cloud?">
    we follow all the technical guidelines for development of our code and applications that come under the Open Web Application Security Project. And also we conduct VAPT Assessment for our application and remidiate the findings
  </Accordion>

  <Accordion title="How does vendor ensure Secure configurations of Operating System on cloud?">
    we perform periodic scans of operating systems and databases along with server applications for vulnerability and configuration compliance. This is done by using suitable vulnerability management tools as per the industry standards.
  </Accordion>

  <Accordion title="How does vendor ensure Secure configurations of Database on cloud?">
    our periodic vulnerability scans are conducted just the right number of times to ensure prominence of security measures and protection of the database layer.
  </Accordion>

  <Accordion title="Clearly defined responsibility for closure of observations as well as adherence to the customer remediation timeframes">
    We have implemented the Threat and Vulnerability Management procedures. We close the identified vulnerabilities or fixes the issues.
  </Accordion>

  <Accordion title="Is there a defined process set by function to review critical transactions">
    We conduct code reviews, VA-PT assessments, Log monitoring, Incident reportings etc and these controls are monitored and reviewed during the internal and external parties.
  </Accordion>

  <Accordion title="Is regular network vulnerability scanning performed?">
    Attached the latest VAPT Certificate.
  </Accordion>

  <Accordion title="Is application vulnerability scanning performed on regular intervals?">
    Attached the letest VAPT Certificate.
  </Accordion>

  <Accordion title="Regular appraisals of security controls as well as security hardening and patching of systems is performed.">
    Vulnerability scanning gives us deep insight for quick identification of out-of-compliance or potentially vulnerable systems. In addition to our extensive internal scanning and testing program, Xoxoday employs third-party security experts to perform a vulnerability assessment and penetration testing. Attached the Threat and Vulnerability Management and Patch Management Procedure.
  </Accordion>

  <Accordion title="Does the Company conduct technical security assessments (e.g. vulnerability, penetration tests) on its own IT environment?">
    We conduct the Vulnerability assessment and penetration testing for maximum security.
  </Accordion>

  <Accordion title="How often do you scan for vulnerabilities on your network and applications?">
    We conduct on yearly basis as per the compliance requirements.
  </Accordion>

  <Accordion title="What is your vulnerability remediation process?">
    Attached the Threat and Vulnerability Management Policy.
  </Accordion>

  <Accordion title="Are all 3rd Party Libraries regularly reviewed and checked for potential vulnerabilities?">
    Yes. As part of every build, the third-party libraries are scanned for security vulnerability.
  </Accordion>

  <Accordion title="Are mechanisms in place to ensure that all debugging and test code elements are removed from released software versions?">
    Our software will be free from all the vulnerabilities.
  </Accordion>

  <Accordion title="Has an independent third party performed a Penetration Test covering the solution to be provided to Customer?">
    Attached the independent third party performed a Penetration Test report.
  </Accordion>

  <Accordion title="The vendor should specify what ongoing security testing they perform on their product, such as static and / or dynamic code analysis and any automated or manual penetration testing.">
    We conduct the periodical vulnerability and penetration testing as per the compliance requirements which includes Static, Dynamic, API, Manual etc..
  </Accordion>

  <Accordion title="Penetration Testing: Does the vendor perform penetration testing on a regular basis?">
    We perform the VA/PT on an annual basis as per the compliance requirements. Attached the VA/PT report and certificate.
  </Accordion>

  <Accordion title="Do you conduct regular vulnerability assessment to the service/platform you are providing for customers? For example, Asset Check/Vulnerability scan/Penetration test?">
    We do conduct Vulnerability and Penetration testing from the Authorized vendor.
  </Accordion>

  <Accordion title="NSE shall comply with the control requirements of Operations Security Policy of NSE for the Operating system, database and application, as applicable.">
    We comply with the requirements. We also conduct periodical Vulnerability assessment and penetration testing with the help of the authorised third party vendor.
  </Accordion>

  <Accordion title="How are these procedures validated?">
    We conduct internal review and audited by the exteranal auditors for our security standard certification and VAPT assessment
  </Accordion>

  <Accordion title="How are security vulnerabilities identified in Supplier developed applications?">
    We conduct periodical Vulnerability assessment and Penetration Testing from the Inductry approved authorized vendor to make sure that all the vulnerabilities are closed and having secured applications.
  </Accordion>

  <Accordion title="What testing is done during a penetration test?">
    Exhaustive Vulnerability Assessment and Penetration Testing has been conducted along with business logic testing based on OWASP framework which incorporates 120+ test cases like Access Controls, Authentication and Session Management, Cross-site Request Forgery, Cross-site Scripting, Cryptography and Insecure Storage, Data Validation, Information Leakage and Error Handling, Malicious Execution etc.
  </Accordion>

  <Accordion title="How is your network security testing performed? Internal, third parties or both? If so, how often is it tested? Explain your methodology">
    We have conducted Vulnerability assessment and penetration testing with the help of Industry approved third party vendor. We conduct VAPT for every six months. During the testing, if any observations found by the auditor our team will work on those Audit observations and fix the issues.
  </Accordion>

  <Accordion title="Please summarise or attach your network vulnerability management processes and procedures?">
    See Threat and Vulnerabilities Management procedure attached. Periodic scans has been performed on all network assets deployed on Xoxoday by the third party vendor.
  </Accordion>

  <Accordion title="What is your timeframe for patching critical vulnerabilities?">
    The critical vulnerabilities are fixed immediately within a span of 5 days.
  </Accordion>

  <Accordion title="What tools do you use for vulnerability managment?">
    We have the third party vendor called Appknox for scanning the vulnerabilities. They use Appknox tool(Mannual and Automated) for vulnerability management
  </Accordion>

  <Accordion title="Please summarise or attach your application vulnerability management processes and procedures?">
    See Threat and Vulnerabilities Management procedure attached. Periodic scans has been performed for application and the identified observation has been fixed by our engineering team.
  </Accordion>

  <Accordion title="What tools do you use for application vulnerability management?">
    We have the third party vendor called Appknox for scanning the vulnerabilities. They use Appknox tool(Mannual and Automated) for vulnerability management
  </Accordion>

  <Accordion title="Avoiding sources of risk">
    We have Access control policy, and we follow Role based access system and review the access provided periodically to eliminate the risk and make sure that only the Authorised individual have access to avoid risk. We have implemented the controls with regards to avoiding source of Risk and to make sure that we prevent an unauthorised access of the data. We have implemented end point security in all the computers and servers to prevent the unauthorised access. We have Patch Management Procedure and Logging and Monitoring Procedure in place as per the compliance requirements. We also conduct periodical Vulnerability and penetration testing for identifying the source of risk and implement controls for mitigating the risk.
  </Accordion>

  <Accordion title="All applications, third-party applications, software and firmware (for all provided system components such as network devices) are covered under patch and vulnerability management processes">
    Yes. We update the patched and conduct the vulnerability assessment and penetration testing and remidiate the risks identified.
  </Accordion>

  <Accordion title="Third parties shall have Incident management process to support the customer during information security incidents including, but not limited to: Information security incident of supplier-provided system at the customer. Vulnerability report on supplier provided systems for the customer.">
    We have implemented the Incident Management Procedure and VAPT Audit periodically. Attached the latest VAPT Certificate.
  </Accordion>

  <Accordion title="Third parties shall have vulnerability management process for all its supplied systems.">
    We have implemented the Threat and Vulnerabilities Management procedures is to proactively expose security flaws and correct them before a malicious attacker can leverage the same weaknesses and cause irrecoverable damages.
  </Accordion>

  <Accordion title="Details on how to manage system vulnerabilities and inform the customer on start and resolution of security issue shall be provided.">
    We have implemented the Threat and Vulnerabilities Management procedures. We conduc the Vulnerabilities assessment and fixes the issue identified during the assessments.
  </Accordion>

  <Accordion title="Vulnerability assessments shall be conducted for all new information assets during testing and prior to production operations.">
    We conduct the Vulnerability assessment for our application during the testing and prior to deployment.
  </Accordion>

  <Accordion title="Security and robustness testing of protocols shall be considered during procurement and installation phases in the lifecycle to discover and mitigate security vulnerabilities.">
    We conduct Vulnerability assessment and penetration testing during the testing and before deployment. And we make sure that all the issues has been fixed and mitigated security vulnerabilities.
  </Accordion>

  <Accordion title="As part of system tests (such as Factory Acceptance Test, Loop Test, Integrated Factory Acceptance Test, Functional Test and Site Acceptance Test), the functionality of input/output data validation, control of internal processing and data integrity of systems shall be verified.">
    We conduct Vulnerability assessment and penetration testing for our application in order to make sure that issues has been fixed and mitigated security vulnerabilities.
  </Accordion>

  <Accordion title="Periodic Integrity verification methods shall be performed to detect, record, report, and protect against the effects of tampering.">
    We conduct Vulnerability assessment and Penetration testing in order to make sure that we identify the vulnerabilities and fixes the issue or mitigate the risk involved.
  </Accordion>

  <Accordion title="All products and components shall be hardened as per the customer documented security and operational baselines taking in consideration vendor's specific recommendations and endorsement.">
    We have deployed our application on AWS cluod virtual platform and hardened in order to secure a system by reducing its surface of vulnerability.
  </Accordion>

  <Accordion title="Configuration baselines shall be continually managed to maintain applicability as software is updated or patched, security vulnerabilities are reported, or configurations are modified to allow the installation of new software or to support new operational requirements.">
    We continuously monitor the Vulnerabilities and fixes the issue on a periodical basis. We also update the patches regularly to eliminate the security risk.
  </Accordion>

  <Accordion title="Identify anti-malicious code protection requirements for networks and hosts.">
    We make sure that we identify the vulnerabilities and fixes the issues in order to make sure that Information system is secure and free from vulnerabilities.
  </Accordion>

  <Accordion title="Security risks associated with technical vulnerabilities, throughout the lifecycle, shall be managed through activities such as: Identification of potentially applicable technical vulnerabilities. Evaluation of applicability of technical vulnerabilities. Evaluation of risk to the customer from applicable technical vulnerabilities. Remediation of technical vulnerabilities based on criticality. Mitigation of technical vulnerabilities that remain un-remediated. Monitoring of risk associated with un-remediated technical vulnerabilities.">
    We conduct periodical vulnerability and penetration testing and fixes the issue identified and make sure that all the risk associated with these vulnerabilities are identified.
  </Accordion>

  <Accordion title="Timelines for each phase of the technical vulnerability management lifecycle shall be defined: Timelines shall specify the maximum time between Identification, Evaluation, Remediation/Mitigation and Monitoring phases. Timelines shall be based on the risk to the entity. Timelines shall be defined in a standard specific to each entity or function.">
    We have implemented the Threat and Vulnerability Management to identify and eliminate problems that could lead to a breach of confidentiality, availability, or the integrity of application data resources and to ensure adequate protection of client data. The treatment of vulnerabilities consists of the definition and implementation of controls and measures to eliminate vulnerabilities
  </Accordion>

  <Accordion title="Technical vulnerabilities shall be identified: the customer shall identify resources that will be used to identify relevant technical vulnerabilities. An internal technical vulnerability assessment of all system components storing or processing the customer data and the related system components should be performed after any significant information system network changes and as a minimum once every 90 days. The parameters of the vulnerability scans have to conform to the requirements of ISR, ISO 27001, SANS and OWASP and other best practices. The relevancy of published technical vulnerabilities may be determined by the customer through the Asset Inventory. Intrusive scans of systems shall not be considered without appropriate understanding of their impacts to production systems and shall not be used without appropriate approval. Technical vulnerability assessment tools (e.g. scanners, exploitation tools, scripts, configuration audit, passive monitoring, etc.) shall be pre-approved for the customer environment before it's use. An approved technical vulnerability scanner should be implemented and kept current with latest test definitions of signature database. A continuous process of technical vulnerability identification shall be established, scheduled and maintained for IT and OT the customer environment.">
    We have implemented the Threat and Vulnerability Management to identify and eliminate problems that could lead to a breach of confidentiality, availability, or the integrity of application data resources and to ensure adequate protection of client data.
  </Accordion>

  <Accordion title="Technical vulnerabilities shall be evaluated: Each relevant technical vulnerability shall be evaluated for both applicability and criticality. Applicable technical vulnerabilities shall be recorded against applicable assets. This may be incorporated into Asset Inventory. For all technical vulnerabilities determined to be applicable, the customer shall evaluate the risk to the OT and the customer through Risk Assessment Processes. Remediation/mitigation and compliance reports shall be produced including topics such as: List of Vulnerabilities - All discovered vulnerabilities, the severity, and the affected systems. Remediation and/or mitigation recommendation - Each listed vulnerability shall have detailed information on how the vulnerability will be remediated or mitigated. Non-compliance summary.">
    Vulnerabilities will be categorized as Critical, High, Medium, Low and Information. We remidiate all the vulnerabilities identified.
  </Accordion>

  <Accordion title="Technical vulnerabilities shall be remediated or mitigated in timely manner following Change Management Processes: A phased rollout can be used to minimise impact. Establish expected remediation/mitigation timelines based on the criticality rating level. Any deviations to the customer defined management of technical vulnerability requirements should be recorded. Risks due to deviations shall be managed to acceptable levels through compensating controls.">
    We have implemented the Threat and Vulnerability Management to identify and eliminate problems that could lead to a breach of confidentiality, availability, or the integrity of application data resources and to ensure adequate protection of client data.
  </Accordion>

  <Accordion title="Technical vulnerabilities shall be Monitored: As factors in the risk equation change, un-remediated technical vulnerabilities shall be reviewed at a defined interval to ensure that current controls are still effective at managing risk to an acceptable level.">
    We monitor the vulnerabilities identified and remidiate it.
  </Accordion>

  <Accordion title="All reports of potential technical security vulnerabilities on operational systems must be communicated promptly to all relevant internal stakeholders, in a timely manner, on a restricted basis, in order to effectively manage associated security risks.">
    We follow this as a part of Threat and Vulnerabilities Management procedure.
  </Accordion>

  <Accordion title="Details of technical vulnerabilities shall not be shared outside of the customer, except where required for legal or regulatory purposes by authorised personnel.">
    We do not share the vulnerabilities to any unauthorised individual.
  </Accordion>

  <Accordion title="the customer reserves the right to intercept and monitor information processed by the customer information resources and networks. This activity is solely used to identify threats to company information assets and enable early detection of potential malicious activities.">
    We conduct Vulnerability assessment and penetration testing periodically and we can make this available for the customer on need to knoe basis.
  </Accordion>

  <Accordion title="The appropriate the customer stakeholders shall be informed of all potential vulnerabilities and non-compliance issues on a regular basis and be accountable for providing adequate resources to mitigate these issues.">
    We inform on our potential vulnerabilities and non-compliance issues aand make sure that we mitifate these issues
  </Accordion>

  <Accordion title="Service Provider shall employ an independent security professional to perform penetration testing and other types of security testing on at least an annual basis or after major changes.">
    We conduct Penetration testing with the help of industry approved thord party vendor
  </Accordion>

  <Accordion title="Does the vendor use Third Party vulnerability testing of the infrastructure and the application?">
    Yes. We conduct third party Vulnerability assessment. Attached the certificate for your reference.
  </Accordion>

  <Accordion title="Will any detected security violations and incidents be reported to the X Company Information Security Manager?">
    Yes. We also fix the issues identified and conduct the test once again for confirmation of fixes.
  </Accordion>

  <Accordion title="What are the contract termination processes? How will we have access to our data on termination of the service? Would our data be completely deleted from the vendor's servers after termination?">
    We will delete the data upon termination of the contract and confirm you. Our data cleaning process goes through an organized purge. Once the data is purged, it's purged from all places.
  </Accordion>

  <Accordion title="How often do you perform periodic vulnerability scans on your information technology systems, networks and supporting security systems? i.e. Internal assessments, third party assessments, automated? What is the security patch management cadence to address vulnerabilities identified?">
    Vulnerability scanning gives us deep insight for quick identification of out-of-compliance or potentially vulnerable systems. In addition to our extensive internal scanning and testing program, Xoxoday employs third-party security experts to perform a Vulnerability assessment and penetration testing. We conduct the VA/PT on annual basis and Attached the latest certificate. Security patches are rated as Critical, High, Medium and Low. Critical patches will be deployed immediately High patches will get deployed within 5 days Medium Patches will get deployed within 15 day Low will get deployed in 25 days.
  </Accordion>

  <Accordion title="Share the vulnerability remediation program.">
    Attached the Threat and Vulnerabilities Management program.
  </Accordion>

  <Accordion title="Do you conduct vulnerability scanning or Penetration tests?">
    Attached the latest VAPT Certificate
  </Accordion>

  <Accordion title="A copy or summary of the most recent vulnerability assessments or penetration tests performed against the product or environment – this summary should include a statement on remediation of vulnerabilities from management.">
    Attached the VA/PT Executive report and Certificate issued upon remediation of all the vulnerabilities identified during the third party assessment.
  </Accordion>

  <Accordion title="Is VA/PT carried on the infrastructure? How frequently? Who conducts the vulnerability assessment. Please share a copy of the latest VA/PT report.">
    VA/PT has been consucted with the help of the third party VAPT auditor. The name of the vendor is Appknox. We conduct VPAT for every six months and shared the latest VAPT Certificate.
  </Accordion>

  <Accordion title="Infrastructure security standard and hardening processes">
    Attached the Infrastructure Architecture diagram where all the security components are included. Attached the VAPT certificate and Cloud Computing Security Policy
  </Accordion>

  <Accordion title="Dynamic application security test report">
    Attached the Executive summary of VAPT report
  </Accordion>

  <Accordion title="Are all 3rd Party Libraries regularly reviewed and checked for potential vulnerabilities? (2)">
    Yes. As part of every build, the third party libraries are scanned for security vulnerability.
  </Accordion>

  <Accordion title="Security safeguards must be in place to protect system from unauthorized code execution.">
    Vulnerability scanning gives us deep insight for quick identification of out-of-compliance or potentially vulnerable systems. In addition to our extensive internal scanning and testing program, Xoxoday employs third-party security experts to perform a vulnerability assessment and penetration testing.
  </Accordion>

  <Accordion title="Perform ongoing security assessments to identify and remediate high risk vulnerabilities on servers, data stores, web applications, and dependent systems and software.">
    We are compliant with this requirements. Vulnerability scanning gives us deep insight for quick identification of out-of-compliance or potentially vulnerable systems. In addition to our extensive internal scanning and testing program, Xoxoday employs third-party security experts to perform a vulnerability assessment and penetration testing as per the compliance requirements.
  </Accordion>

  <Accordion title="3rd party components shall be evaluated for known vulnerabilities prior to and during use in production. Protect against supply chain threats to the information system, system component, or information system service by employing security safeguards as part of a comprehensive, defense-in-breadth information security strategy. EIS Architecture team shall be notified to conduct an assessment of the information system, system component, or information system service prior to selection, acceptance, or update. Review & replace information system components when support for the components is no longer available from the developer, vendor, or manufacturer; and Provides justification and documents approval for the continued use of unsupported system components required to satisfy mission/business needs.">
    Vulnerability scanning gives us deep insight for quick identification of out-of-compliance or potentially vulnerable systems. In addition to our extensive internal scanning and testing program, Xoxoday employs third-party security experts to perform a vulnerability assessment and penetration testing. Attached the VAPT Certificate and executive report. All the vulnerabilities has been fixed.
  </Accordion>

  <Accordion title="Application must ensure that input validation or encoding routines must be performed and enforced on the server side. I.e. a centralized input validation strategy must be used where appropriate. Client-side validation can be implemented as an additional layer of security.">
    We conduct the VAPT Assessment with the help of the authorised vendor and compliant with the requirement.
  </Accordion>

  <Accordion title="How is identification and timely resolution of vulnerabilities taken care? Please elaborate your Vulnerability Management program. What process is in place to track the effectiveness of the closure of vulnerabilities? Please share the SLAs defined for closure of vulnerabilities based on their criticality. What is the process for notifying Infosys of the steps Infosys must undertake with respect to any identified vulnerabilities on the infrastructure used to provide service to Infosys?">
    We conduct Vulnerability assessment and penetration testing from the Authorised vendor, and the identified Vulnerabilities will be closed in a timely manner. The treatment of vulnerabilities consists of the definition and implementation of controls and measures to eliminate vulnerabilities (e.g. applying a patch to the affect system) or to prevent the vulnerabilities from being exploited (e.g. deactivating a service or disallowing a firewall connection). Vulnerabilities will be categorized as Critical, High, Medium, Low and Information. We inform the Infosys Immediatly if any critical Vulnerability to be reported.
  </Accordion>

  <Accordion title="Are there any open vulnerabilities which have not been patched?">
    All are fixed and there are no open Vulnerabilities.
  </Accordion>

  <Accordion title="Is security testing conducted wherever required before production release and vulnerabilities mitigated before release?">
    The testing is conducted and vulnerabilities has been mitigated before any releases.
  </Accordion>

  <Accordion title="Does the provider perform regular vulnerability assessments/penetration tests to determine security gaps? If so, state the date of the most recent vulnerability assessment/penetration test and provide a comprehensive list of all security risks/gaps identified">
    We conduct Vulnerability assessment and Penetration testing as per the compliance requirements. The date of the most recent certificate is 01st March, 2021. Attached the vulnerability assessments/penetration tests report.
  </Accordion>
</AccordionGroup>


# Account Settings
Source: https://help-plum.xoxoday.com/faqs/for-admins/account-management-faqs

Find answers to frequently asked questions about managing your Plum account settings, admin users, and wallet balance.

*Get answers to questions on account management, user management, gift cards, the storefront, and gifting programs on Xoxoday Plum.*

## User Management

<AccordionGroup>
  <Accordion title="Can your platform support multi-departmental management, including the ability to set up unique goals, budgets, and reporting parameters for each team?">
    Yes. The Xoxoday customer rewards platform enables the management of multi-departmental reward programs. Admins can create department-specific configurations such as goals, budgets, roles, and performance metrics. Each team can independently manage its reward programs while leveraging shared platform features like real-time reports and budget tracking.
  </Accordion>

  <Accordion title="Can authorized personnel access real-time reports for monitoring and audits?">
    Yes, the Xoxoday customer rewards platform includes a robust admin portal that enables authorized personnel to access on-demand, real-time reports. These reports can be viewed, customized, and downloaded instantly, supporting a wide range of audit, compliance, and operational tracking requirements. Features such as filtered views, saved report templates, and exportable formats (e.g., CSV, XLSX) enhance data accessibility for ongoing program optimization and transparency.
  </Accordion>

  <Accordion title="Can the system record and time-stamp user activity and identify individual users?">
    Yes, the system offers complete activity logging with time-stamping capabilities for all user actions. Each transaction is tied to an individual user profile, enabling auditability, compliance tracking, and robust administrative control. This is essential for financial transparency and operational accountability.
  </Accordion>

  <Accordion title="Does the platform offer timestamping and user-level tracking for activities?">
    Yes. All Xoxoday solutions maintain precise timestamping and user-level activity tracking for accountability and compliance:

    * **Global rewards marketplace and payout platform** — Tracks reward issuance, catalog changes, and redemption approvals in real time.
    * **Employee engagement and recognition platform** — Logs recognition events, budget updates, and survey deployments with exact timestamps.
    * **Sales commission and incentive management system** — Records commission plan changes, payout processing, and performance updates with user attribution.
    * **Customer loyalty management solution** — Captures member enrolments, points accruals, and redemption events with user and time logs.
    * **Merchant-funded offers and promotion engine** — Tracks merchant offer activations, validations, and campaign edits with full audit trails.
  </Accordion>
</AccordionGroup>

## Gift cards

<AccordionGroup>
  <Accordion title="Can someone other than the person placing the gift card order send them to recipients?">
    Yes, the Xoxoday gift card marketplace supports role-based distribution, allowing designated administrators to send gift cards to recipients regardless of who initially placed the order. Once the cards are delivered via secure links to the recipient's email, they can be activated and redeemed independently. This flexibility supports decentralized reward distribution within large organizations.
  </Accordion>
</AccordionGroup>

## Storefront: a global reward marketplace

<AccordionGroup>
  <Accordion title="Does the solution allow users to access international airport lounges with comfort amenities?">
    Yes, the Xoxoday rewards catalog includes access to a worldwide network of airport lounges. Users can redeem their points to enjoy premium airport lounge experiences, which include Wi-Fi, refreshments, relaxation areas, and other business traveler amenities.
  </Accordion>

  <Accordion title="How does the marketplace support product discovery and filtering for customers?">
    The Xoxoday gift card marketplace includes intuitive search and filter functionalities that empower customers to browse by category, product type, point eligibility, and preferences. This streamlined navigation enhances the overall user experience, helping users find exactly what they're looking for across a diverse range of digital and physical reward options. The AI copilot further helps customers with insightful product recommendations and queries.
  </Accordion>

  <Accordion title="Is travel insurance included for scenarios like cancellations, lost baggage, or medical emergencies?">
    Travel insurance is generally included in the booking you make via our partners. We also provide an option to choose an insurance from our options while booking.
  </Accordion>

  <Accordion title="Does the rewards catalog include access to exclusive loyalty programs or premium services such as hotel memberships, concierge benefits, or streaming subscriptions like Netflix or Spotify?">
    Yes, the Xoxoday reward marketplace includes premium experiences such as hotel loyalty memberships (e.g., IHG, Hilton Honors, Radisson Rewards) and global subscription services such as Netflix, Spotify, and Amazon Prime. Availability may vary by region, and we continue to expand our catalog based on geographic feasibility. Clients will be notified when new options become available in their local reward environment.
  </Accordion>

  <Accordion title="Can users access benefits like priority boarding on flights as part of their rewards program?">
    These benefits are generally handled directly by airlines to ensure personalized service. However, the platform provides an option to redeem on airmiles to upgrade your bookings.
  </Accordion>

  <Accordion title="Is it possible to offer baggage check-in with no additional charges through the rewards system?">
    At present, complimentary baggage check-in benefits are not available in the Xoxoday gift card marketplace. Airlines often handle such privileges directly to maintain control over customer service standards.
  </Accordion>

  <Accordion title="What closed-loop gift card partners are available, and can new partners be added to the catalog?">
    The Xoxoday rewards, incentives, and payout platform provides access to one of the world's most comprehensive closed-loop gift card networks via its AI-powered global rewards marketplace. These merchant-specific cards are redeemable exclusively with the issuing brand, making them ideal for targeted reward experiences.

    **Availability of closed-loop gift cards** — Clients benefit from:

    * 10,000+ brand-specific gift card options
    * Coverage in 100+ countries
    * 30+ major reward categories to meet diverse user needs

    **Top closed-loop gift card categories:**

    * Retail & shopping (e.g., Amazon, Walmart, Flipkart)
    * Dining & food delivery (e.g., Starbucks, Uber Eats, Swiggy)
    * Travel & hospitality (e.g., Airbnb, Booking.com)
    * Entertainment & gaming (e.g., Netflix, Spotify, Xbox, Steam)
    * Fashion & lifestyle (e.g., Nike, H\&M, Sephora)
    * Digital subscriptions & utilities (e.g., Google Play, Apple, mobile top-ups)
    * Charity & donations (1000+ nonprofit options)
    * Financial products (e.g., Visa/Mastercard prepaid cards)

    **Custom catalog additions** — Clients can request new closed-loop gift card partners during onboarding or later via customer support. The Xoxoday team evaluates requests based on:

    * Regional demand and popularity
    * Brand integration and compliance
    * Procurement and fulfillment feasibility

    If approved, new partners can be added to the client's private catalog or made available platform-wide based on relevance and viability.
  </Accordion>

  <Accordion title="What types of gift cards are available, and are there any limits on the retailers or brands offered — including specific brands like Amazon, Walmart, Target, or Kroger?">
    The Xoxoday rewards marketplace offers both digital and physical gift cards to meet the diverse needs of businesses and recipients globally.

    **Card types offered:**- **Digital gift cards** — Delivered instantly via email, SMS, or WhatsApp; ideal for scalable campaigns.

    * **Physical gift cards**— Available in bulk or individually; suitable for events or regions with limited digital adoption.**Catalog scale and customization:**

    * Access to 10M+ reward options across 30+ categories in 100+ countries.

    * No upper limits on the number or type of brands; supports 50,000+ daily transactions.

    * Businesses can customize catalogs by geography, audience segment, redemption value, or campaign purpose.

    **Popular global brands included:**

    * Amazon, Walmart, Target, Kroger
    * 21,000+ other trusted global and local brands, regularly updated for relevance and seasonal promotions.

    This extensive offering ensures global scale, personalization, and seamless reward delivery.
  </Accordion>

  <Accordion title="Is it possible to provide users access to premium lifestyle benefits such as private events and invitation-only memberships through the platform?">
    The platform can support premium experiences like invite-only memberships and private events. These are offered based on client demand, subject to third-party approvals and potential additional costs, enabling high-value, exclusive loyalty and recognition programs.
  </Accordion>

  <Accordion title="Does the platform offer an online catalog for departments to order gift cards with workflow approval?">
    Yes, the Xoxoday rewards, incentives, and payout platform provides an online catalog accessible to departments for ordering gift cards. Workflow approval can be configured to ensure that requests follow internal governance policies. The catalog includes the same comprehensive closed-loop gift card options, covering 30+ categories in 100+ countries, and supports custom partner additions as needed.
  </Accordion>

  <Accordion title="What product categories are supported in the Xoxoday reward marketplace?">
    The Xoxoday reward marketplace supports a comprehensive range of redemption categories to suit diverse business needs:

    * Digital vouchers such as gift cards across retail, dining, travel, wellness, and more
    * Prepaid digital cards from major card issuers, available across geographies
    * Digital services including subscriptions, mobile top-ups, and digital utilities
    * Branded merchandise spanning electronics, fashion, lifestyle products, and more
    * OEM products such as accessories, gadgets, and device-related tools

    All these categories are part of the standard catalog offering in the Xoxoday gift card marketplace, covering 30+ categories in 100+ countries.
  </Accordion>

  <Accordion title="Does the platform include an integrated e-commerce portal with a multi-brand catalog for voucher redemption?">
    The Xoxoday reward marketplace features a fully integrated digital rewards catalog, offering a wide portfolio of multi-brand vouchers. End users can redeem rewards from a curated selection of e-vouchers and gift cards across 30+ categories, including travel, food, lifestyle, and more. This comprehensive and user-friendly interface ensures an intuitive redemption journey. Explore the catalog: [stores.xoxoday.com/marketplace/rewards-api-catalogue](https://stores.xoxoday.com/marketplace/rewards-api-catalogue).
  </Accordion>

  <Accordion title="Does the system support currency conversion for international users during loyalty redemption or payments?">
    Yes, the Xoxoday gift card marketplace includes a built-in currency conversion feature. Loyalty points and payments are automatically converted to the user's local currency based on real-time exchange rates, ensuring seamless global reward fulfillment and user convenience.
  </Accordion>

  <Accordion title="Can users search for rewards by merchant, product attributes, or save favorites?">
    Yes, users can filter rewards by merchant, product type, keywords, location, price, and popularity. They can also mark favorites and view results based on those preferences, making catalog navigation simple and efficient.
  </Accordion>

  <Accordion title="How do you distinguish yourself from the competition?">
    We differentiate through the breadth, flexibility, and global scale of our digital reward infrastructure. Key points include:

    * 1M+ reward options across 100+ countries
    * Multiple delivery modes: email, SMS, API, and storefront
    * Customizable storefronts and branded experiences
    * Multi-lingual, multi-currency rewards catalog
    * Data privacy and regional deployment
    * Value for money and low total cost of ownership
    * Dedicated enterprise support with SLAs
  </Accordion>

  <Accordion title="Can members redeem their points for airline loyalty programs like airmiles and Airpoints?">
    Xoxoday rewards marketplace supports a wide array of global airline loyalty programs for airmiles and airpoints.
  </Accordion>

  <Accordion title="Can clients onboard and manage their own vendors and partners to distribute digital rewards?">
    Yes. The Xoxoday customer rewards platform supports custom vendor onboarding and partner management. The platform allows you to add products from your vendors.
  </Accordion>
</AccordionGroup>

## Gifting program

<AccordionGroup>
  <Accordion title="Can loyalty point redemptions be restricted based on account types or tiers?">
    Yes, the Xoxoday customer incentive software allows you to configure redemption limits at the customer group level. This includes setting maximum redemption thresholds per transaction or restricting access based on the user's loyalty tier. These rules can be aligned with your broader loyalty program strategy.
  </Accordion>
</AccordionGroup>

For feedback or questions, reach out to us at [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Campaigns
Source: https://help-plum.xoxoday.com/faqs/for-admins/campaigns-faqs

Find answers to frequently asked questions about creating, editing, and managing your reward campaigns in Plum.

*Get quick answers to questions on running campaigns on Xoxoday Plum.*

## Dashboard

<AccordionGroup>
  <Accordion title="Is there a centralized dashboard to monitor all active reward or gift card campaigns?">
    Yes. The Xoxoday reward payout platform includes a centralized dashboard for administrators to oversee all active and past campaigns.

    * Provides real-time status updates: issued, redeemed, pending, or failed gift cards
    * Offers recipient-level insights and program-wide analytics
    * Streamlines campaign management and simplifies tracking of usage, performance, and budget compliance across initiatives
  </Accordion>
</AccordionGroup>

## Gifting Program

<AccordionGroup>
  <Accordion title="Can you assist in running marketing campaigns or promotions tied to gift cards?">
    Yes. The Xoxoday customer incentive software supports end-to-end execution of marketing campaigns and promotions tied to gift cards.

    * Distribute both digital and physical cards via the gift card marketplace
    * Personalize campaigns and automate reward delivery
    * Track redemptions through a real-time analytics dashboard
    * Send reminders or nudges to users to boost engagement
  </Accordion>

  <Accordion title="What controls are available to manage eligibility for specific products or services in the reward catalog?">
    The Xoxoday reward marketplace allows businesses to create and manage custom catalogs linked to specific customer groups.

    * Eligibility can be based on location, loyalty tier, or account type
    * Ensures only qualified users can access certain rewards
    * Supports targeted reward delivery through the customer rewards platform
  </Accordion>

  <Accordion title="How can a rewards platform support referral programs that incentivize clients to bring in new users?">
    Xoxoday customer incentive software powers referral programs by automatically rewarding users for successful referrals.

    * Built-in referral tracking and reward automation
    * Rewards can include points, gift cards, or bonus credits
    * Supports both B2B and B2C audiences
    * Drives customer acquisition and loyalty through meaningful incentives
  </Accordion>

  <Accordion title="Can the platform support gifting rewards and managing similar remuneration projects like reimbursements, athletic stipends, and mileage reimbursements?">
    Yes, the Xoxoday gifting platform supports a wide range of digital reward use cases, including gifting for employees and students, processing reimbursements, managing athletic stipends, and mileage-related rewards.

    It also accommodates similar custom remuneration projects through its robust configuration options and integrations. These features are adaptable to academic, administrative, and research environments, making the platform highly versatile for university-wide use.
  </Accordion>

  <Accordion title="What options do you offer for Scalability & Automation (allowing for batch sending, etc)?">
    Our admin portal provides a self-service platform for distributing rewards, allowing administrators to log in and send rewards either in bulk or individually. Bulk uploads support lists of up to 10,000 recipients in a single file. Administrators can download cards in bulk to their email address through the portal or via API.
  </Accordion>
</AccordionGroup>

## Reporting

<AccordionGroup>
  <Accordion title="Does the platform support leaderboards to encourage competition among users?">
    Yes, the customer rewards platform includes gamification tools like leaderboards that rank participants based on performance, points earned, or other defined KPIs. These visual metrics help foster healthy competition and increased participation. Leaderboards can be segmented by region, team, or cohort and are particularly effective in sales, channel partner, and customer engagement programs. Combined with rewards from the Xoxoday gift card marketplace, this feature maximizes user motivation.
  </Accordion>
</AccordionGroup>

## Dashboard

<AccordionGroup>
  <Accordion title="Is there a centralized dashboard to monitor all active reward or gift card campaigns?">
    Yes. The Xoxoday reward payout platform includes a centralized dashboard for administrators to oversee all active and past campaigns.

    * Provides real-time status updates: issued, redeemed, pending, or failed gift cards
    * Offers recipient-level insights and program-wide analytics
    * Streamlines campaign management and simplifies tracking of usage, performance, and budget compliance across initiatives
  </Accordion>
</AccordionGroup>

## Gifting Program

<AccordionGroup>
  <Accordion title="Can you assist in running marketing campaigns or promotions tied to gift cards?">
    Yes. The Xoxoday customer incentive software supports end-to-end execution of marketing campaigns and promotions tied to gift cards.

    * Distribute both digital and physical cards via the gift card marketplace
    * Personalize campaigns and automate reward delivery
    * Track redemptions through a real-time analytics dashboard
    * Send reminders or nudges to users to boost engagement
  </Accordion>

  <Accordion title="What controls are available to manage eligibility for specific products or services in the reward catalog?">
    The Xoxoday reward marketplace allows businesses to create and manage custom catalogs linked to specific customer groups.

    * Eligibility can be based on location, loyalty tier, or account type
    * Ensures only qualified users can access certain rewards
    * Supports targeted reward delivery through the customer rewards platform
  </Accordion>

  <Accordion title="How can a rewards platform support referral programs that incentivize clients to bring in new users?">
    Xoxoday customer incentive software powers referral programs by automatically rewarding users for successful referrals.

    * Built-in referral tracking and reward automation
    * Rewards can include points, gift cards, or bonus credits
    * Supports both B2B and B2C audiences
    * Drives customer acquisition and loyalty through meaningful incentives
  </Accordion>

  <Accordion title="Can the platform support gifting rewards and managing similar remuneration projects like reimbursements, athletic stipends, and mileage reimbursements?">
    Yes, the Xoxoday gifting platform supports a wide range of digital reward use cases, including gifting for employees and students, processing reimbursements, managing athletic stipends, and mileage-related rewards.

    It also accommodates similar custom remuneration projects through its robust configuration options and integrations. These features are adaptable to academic, administrative, and research environments, making the platform highly versatile for university-wide use.
  </Accordion>

  <Accordion title="What options do you offer for Scalability & Automation (allowing for batch sending, etc)?">
    Our admin portal provides a self-service platform for distributing rewards, allowing administrators to log in and send rewards either in bulk or individually. Bulk uploads support lists of up to 10,000 recipients in a single file. Administrators can download cards in bulk to their email address through the portal or via API.
  </Accordion>
</AccordionGroup>

## Reporting

<AccordionGroup>
  <Accordion title="Does the platform support leaderboards to encourage competition among users?">
    Yes, the customer rewards platform includes gamification tools like leaderboards that rank participants based on performance, points earned, or other defined KPIs. These visual metrics help foster healthy competition and increased participation. Leaderboards can be segmented by region, team, or cohort and are particularly effective in sales, channel partner, and customer engagement programs. Combined with rewards from the Xoxoday gift card marketplace, this feature maximizes user motivation.
  </Accordion>
</AccordionGroup>

## Gamificationamification

<AccordionGroup>
  <Accordion title="How does the platform support gamification to enhance user engagement and loyalty?">
    The Xoxoday customer incentive software includes gamification tools that turn passive users into active participants, fostering deeper engagement and loyalty.

    * Interactive challenges, themed campaigns, and behavioral triggers (e.g., service milestones, driving habits)
    * Custom digital badges, points-based rewards, and seasonal quests
    * Leaderboards, milestone-based unlocks, and social sharing features
    * Campaign refresh mechanisms aligned with monthly or seasonal themes
    * Gamification analytics to track participation rates, app dwell time, badge completion, and social influence

    These features create a dynamic, experience-driven loyalty environment beyond simple transactional engagement.
  </Accordion>
</AccordionGroup>

<AccordionGroup>
  <Accordion title="How does the platform support gamification to enhance user engagement and loyalty?">
    The Xoxoday customer incentive software includes gamification tools that turn passive users into active participants, fostering deeper engagement and loyalty.

    * Interactive challenges, themed campaigns, and behavioral triggers (e.g., service milestones, driving habits)
    * Custom digital badges, points-based rewards, and seasonal quests
    * Leaderboards, milestone-based unlocks, and social sharing features
    * Campaign refresh mechanisms aligned with monthly or seasonal themes
    * Gamification analytics to track participation rates, app dwell time, badge completion, and social influence

    These features create a dynamic, experience-driven loyalty environment beyond simple transactional engagement.
  </Accordion>
</AccordionGroup>


# Customize Communication
Source: https://help-plum.xoxoday.com/faqs/for-admins/customize-reward-communication

Find answers to common questions on customizing the reward communication, such as emails and messages, sent to recipients through Plum.

*Get quick answers to questions on customizing reward communication on Plum.*

## Communication

<AccordionGroup>
  <Accordion title="How does the platform facilitate communication with customers across different channels?">
    The communication module, part of the Xoxoday reward payout platform, enables seamless and timely multi-channel messaging to keep users informed and engaged. It supports both promotional and transactional messaging formats and integrates across:

    * **Email:** for personalized promotions, surveys, and transactional updates
    * **SMS:** for brief, time-sensitive communications like reminders or confirmations
    * **Messaging apps (e.g., WhatsApp):** for interactive campaigns, push notifications, and engagement flows

    This omnichannel communication framework ensures consistent brand messaging, improves open rates, and supports personalized customer journeys triggered by real-time behavior or events.
  </Accordion>

  <Accordion title="Can the gift cards be customized with brand logos or themes? Are there associated fees or lead times?">
    Yes, the Xoxoday reward payout platform allows organizations to customize gift cards with their company logo, brand colors, and messaging. This branding enhances recipient experience and reinforces your identity. Customization may incur additional fees and lead times, depending on the complexity and scale of the request.
  </Accordion>

  <Accordion title="Is it possible to include custom messages with the gift cards?">
    Yes, through the Xoxoday customer incentive software, you can easily personalize messages that accompany gift card deliveries via email, SMS, or other supported formats. These custom messages allow for tailored communication that aligns with campaign goals or occasions.
  </Accordion>

  <Accordion title="How does the system enable personalized communication for user engagement and reward updates?">
    The Xoxoday reward payout platform supports automated, data-driven communication workflows to deliver tailored messages via email, SMS, and in-app notifications. Messages can be personalized based on user milestones, available rewards, expiring points, or seasonal offers. This helps create a consistent engagement loop, keeping users informed and motivated throughout their rewards journey. These communications can be white-labeled and aligned with your brand voice.
  </Accordion>

  <Accordion title="How does the platform enable marketing communications and engagement across channels?">
    The Xoxoday platform includes a multi-channel engagement suite to deliver personalized, timely, and consistent messaging throughout the customer lifecycle.

    **Communication Tools Across Channels**

    * Email: Transactional and promotional emails with customizable templates
    * SMS & WhatsApp: Time-sensitive updates with rich media support
    * Push Notifications: In-app or mobile prompts for real-time updates
    * In-App Messaging: Banners and widgets for contextual nudges
    * Social Integrations: Export lists for targeted ad campaigns on platforms like Facebook

    **Campaign Management & Personalization**

    * Automation workflows (e.g., welcome journeys, tier milestone celebrations)
    * Dynamic personalization with member data such as points, names, or personalized offers
    * Multi-language support for local engagement

    **Marketing Support Services**

    * Assistance with campaign planning, creative design, loyalty calendar management, and promotions
    * End-to-end catalog updates and merchant partnership management

    **Integration with Marketing Tech Stack**

    * Loyalty triggers (e.g., birthdays, tier upgrades) synced with CRM, email, or SMS tools via APIs or native integrations
    * Enables unified, omnichannel member experiences

    **Use Case Examples**

    * Onboarding journeys (Day 0/7/14)
    * Tier achievements – Automated rewards and congratulations
    * Birthday campaigns – Personalized monthly promotions
    * Reactivation – Limited-time incentives for dormant users
    * Partner offers – Geo-targeted promotional messages

    By combining technology and marketing expertise, the platform ensures communications are relevant, measurable, and high-performing.
  </Accordion>

  <Accordion title="How does the solution ensure a seamless brand experience for my reward recipients?">
    Yes. With our Custom Branding feature, you can tailor the user experience by applying your company's colors, fonts, and logos across all emails, landing pages, and the marketplace. You can customize every aspect of your reward emails, including subject lines, sender names, salutations, logos, sending domains, and banner images. Additionally, you can create unique landing pages for your rewards by personalizing content, logos, and banner images.
  </Accordion>
</AccordionGroup>


# Getting started
Source: https://help-plum.xoxoday.com/faqs/for-admins/getting-started-for-admins-faqs

Find answers to frequently asked questions about getting started with Plum as an admin, from setup to your first reward.

*Get quick answers to questions on Plum*

## Set up process

<AccordionGroup>
  <Accordion title="What is the account setup and registration process?">
    The steps are as followed:

    **Step 1:** Initial Consultation: Detailed requirement gathering covering incentive types, program goals, and regional scope.

    **Step 2:** Contract Finalization: Commercial agreement, compliance verification, and account security approvals.

    **Step 3:** Admin Account Creation: Creation of the primary admin account with defined roles and permissions.

    **Step 4:** Platform Configuration: Customization of reward catalogs, branding, languages, currencies, payout modes, and taxation rules.

    **Step 5:** Regional Enablement: Activation of services across 55+ countries in all major continents:

    * North America – United States, Canada
    * South America – Brazil, Argentina, Chile
    * Europe – United Kingdom, Germany, France, Spain, Italy, Netherlands, etc.
    * Asia – India, Singapore, UAE, Japan, China, Indonesia, etc.
    * Africa – South Africa, Nigeria, Kenya
    * Oceania – Australia, New Zealand

    **Step 6:** Integration & Testing: API, SSO, and payment gateway setup with sandbox testing.

    **Step 7:** Go-Live: Platform launch, assignment of the Relationship Manager, and user onboarding.

    This process ensures full operational readiness, security compliance, and localization for each target market.
  </Accordion>
</AccordionGroup>

## Security Requirement

<AccordionGroup>
  <Accordion title="Will a dedicated relationship manager be assigned to the client?">
    Yes. Every client is assigned a dedicated Relationship Manager (RM) or Customer Success Manager (CSM) to ensure smooth implementation, adoption, and ongoing support. The RM acts as the primary point of contact for escalations, program reviews, and best-practice recommendations.
  </Accordion>
</AccordionGroup>

## Implementation & Roll out

<AccordionGroup>
  <Accordion title="What is the phased rollout approach for launching a personalized customer engagement rewards program?">
    Xoxoday follows a structured, customer-centric implementation methodology across all its Platforms to ensure seamless program rollout and long-term success. The approach is collaborative, phased, and designed to minimize disruption while maximizing adoption.

    * **Pre-Implementation:** This stage involves foundational readiness checks such as reviewing the Statement of Work (SOW), obtaining required InfoSec clearance, finalizing the Master Services Agreement (MSA), establishing payment and subscription terms, and transitioning ownership from the sales team to the implementation team.

    * **Requirements Gathering & Discovery:** At this stage, we work closely with client stakeholders to capture program goals, success metrics, and specific requirements. This includes understanding user segments, reward policies, technical dependencies, and branding preferences to form the blueprint of the engagement program.

    * **Planning & Configuration:** A joint launch team is established, and timelines are finalized. The platform is configured based on business rules, policies, and workflows. This includes integration with critical enterprise systems such as HRIS, SSO, ERP, CRM, and communication tools.

    * **Customization & Integration:** The platform is customized with client-specific branding, logos, color palettes, and program elements to ensure a consistent user experience. Technical integrations are validated to enable smooth data flows and reward automation across channels.

    * **Testing & Validation:** Before launch, rigorous user acceptance testing (UAT) is conducted to ensure the platform is functioning as expected. This includes testing user journeys, redemption workflows, system integrations, and reporting dashboards.

    * **Launch & Change Management:** A formal go-live is executed with supporting communication and engagement strategies. Training materials, FAQs, and guides are provided to drive user adoption and ensure all stakeholders are aligned for a smooth rollout.

    * **Post-Deployment Support & Success Reviews:** Following launch, clients receive dedicated support through account managers and customer success teams. Regular reviews, monthly, quarterly, and annual, are conducted to monitor adoption, measure KPIs, and align with evolving business needs. Continuous feedback loops and proactive recommendations ensure that the program remains effective and delivers ROI.

    By following this phased methodology, Xoxoday ensures that each customer engagement rewards program is launched smoothly, tailored to business requirements, and continually optimized for success.
  </Accordion>
</AccordionGroup>

## Gifting Program

<AccordionGroup>
  <Accordion title="What levers can Xoxoday pull within your gift card program to help reduce costs, streamline processes, and increase efficiency?">
    The Xoxoday customer rewards platform offers multiple levers to optimize spend and improve operational ease:

    * Volume & tiered discounts – Benefit from pricing advantages when purchasing at scale.
    * Digital-first rewards – Reduce costs tied to packaging, logistics, and physical distribution.
    * Bulk ordering & automation – Use self-serve bulk issuance, API integrations, and wallet-based payments for faster, low-touch reward distribution.
    * Customizable reporting – Configure custom fields, generate real-time insights, and track redemptions and spend for greater visibility and accountability.

    Together, these features streamline workflows, improve delivery speed, and maximize ROI on your rewards program.
  </Accordion>

  <Accordion title="Can the platform offer tailored reward experiences based on individual user behavior?">
    Yes, a consumer reward platform can deliver highly personalized reward experiences by using rule-based automation or machine learning models. It can track user activity, preferences, transaction history, and frequency of engagement to curate personalized reward recommendations. Through the Xoxoday solution, administrators can display curated catalog options that resonate with user profiles—resulting in higher redemption satisfaction and stronger program engagement.
  </Accordion>
</AccordionGroup>

## Gifting Catalog

<AccordionGroup>
  <Accordion title="What additional features or capabilities does the platform support beyond gift card rewards?">
    The Xoxoday reward marketplace supports a broad range of reward capabilities beyond traditional gift cards, including:

    * Distribution of gift cards to employees, students, or research participants
    * Reimbursements and expense allowances
    * Support for athletic stipends and fringe benefits
    * Management of mileage or lifestyle reimbursements
    * Custom remuneration workflows tailored to organizational needs

    Designed as a holistic consumer reward platform, Xoxoday can handle diverse use cases across engagement, recognition, and financial compensation.
  </Accordion>
</AccordionGroup>

## Customer Service

<AccordionGroup>
  <Accordion title="Is there a toll-free number to manage card status, deactivation, or reissuance?">
    While a toll-free number is available for platform support during standard business hours, all core functions such as deactivating gift cards, verifying their status, and reissuing them can be seamlessly handled via the self-service admin panel on the Xoxoday reward payout platform. The dashboard displays delivery status, recipient engagement (email/SMS), and options to cancel or resend rewards.
  </Accordion>
</AccordionGroup>

## Invoice

<AccordionGroup>
  <Accordion title="What invoicing options are available, and can itemized invoices be provided?">
    The Xoxoday reward payout platform provides flexible and transparent invoicing options tailored to organizational needs. Invoices are typically generated during wallet top-ups initiated by the business.

    Once payment is processed, the wallet balance is instantly updated, and confirmation is shared with the finance team. Itemized invoices, listing transaction details such as quantity, unit costs, reward type, and applicable service fees, can be provided in accordance with pre-approved invoice templates or customized formats preferred by the organization. This ensures detailed financial visibility and simplifies reconciliation.
  </Accordion>

  <Accordion title="Can a financial institution generate detailed invoices for reward transactions and share them with customers via email, including narration and payment method?">
    The Xoxoday customer rewards platform can support invoice generation and email delivery to customers upon successful redemption or transaction. These invoices can include detailed transaction information such as date, time, itemized rewards, payment method, and custom narration if scoped appropriately.

    However, the exact implementation is subject to further technical scoping, customer-specific integration requirements, and platform configuration. For financial institutions like banks, integration via API and secure email delivery mechanisms can be explored.
  </Accordion>
</AccordionGroup>

## Financial

<AccordionGroup>
  <Accordion title="Are there any additional fees associated with Xoxoday's reward payout platform?">
    Yes, Xoxoday applies a 5% transaction fee on reward redemptions. For example, if a user redeems 100 points for a $100 reward, the organization will be billed $105. This fee supports operational costs including reward processing, delivery logistics, and catalog management. There are no hidden fees for catalog access or customization.
  </Accordion>

  <Accordion title="Can the system differentiate between participant compensation and reimbursements, as well as between human subject payments and general reward payouts (e.g., employee or athletic stipends)?">
    Yes, the Xoxoday reward payout platform is designed to distinguish between compensation and reimbursement payments, as well as between human subject rewards and general-purpose payouts such as employee recognition or athletic stipends. This segmentation enhances financial accuracy and supports compliance with tax and privacy policies across different stakeholder groups.
  </Accordion>
</AccordionGroup>

## Record Creation

<AccordionGroup>
  <Accordion title="Does the system allow for setting flexible payment schedules based on participant milestones or study completion?">
    Yes. The Xoxoday reward payout platform supports milestone-based and task-driven payment scheduling. This allows program administrators to automate variable compensation based on criteria such as study phase completion, participant tenure, or activity type. The platform is built to accommodate custom payment logic and workflows aligned with research objectives.
  </Accordion>
</AccordionGroup>

## Wallet management

<AccordionGroup>
  <Accordion title="When are card balances billed? Can you explain the card funding process? Is this flexible?">
    The Xoxoday gift card solution operates on a prepaid wallet model. Organizations can fund their wallet in advance and issue gift cards to recipients based on required denominations.

    The system deducts the card value from the wallet at the time of issuance, ensuring transparency and control. This flexible funding mechanism supports real-time transactions and can scale according to fluctuating reward needs. You get a notification when the wallet balance hits a low threshold.
  </Accordion>
</AccordionGroup>

## Payments

<AccordionGroup>
  <Accordion title="Which payment methods does Xoxoday support for rewards and payouts?">
    Xoxoday supports a wide array of payout methods tailored to global needs:

    * UPI and equivalent
    * Digital wallets like PayPal, Venmo, Zelle (region-specific)
    * Reloadable gift cards (Visa, Mastercard, etc.)
    * Direct debit card payouts, and
    * Bank transfers where supported.

    These options are part of Xoxoday's multi-country reward catalog. Full details are available at [https://stores.xoxoday.com/marketplace/home](https://stores.xoxoday.com/marketplace/home).
  </Accordion>

  <Accordion title="Does the system record the amount and date of each payment?">
    Yes. Every transaction processed through the Xoxoday reward payout platform is automatically logged with a precise timestamp and payment amount. This ensures full visibility into the financial flow of rewards, facilitating transparent audits and program accountability.
  </Accordion>

  <Accordion title="Can the system verify payments made on participants' payment cards?">
    Yes. The platform includes real-time tracking capabilities that capture and display the delivery and redemption status of each reward or payment card. This includes information such as whether the card has been delivered, activated, or redeemed, ensuring payment verification and fraud prevention.
  </Accordion>
</AccordionGroup>

## Process

<AccordionGroup>
  <Accordion title="What is the procedure for requesting software enhancements?">
    Xoxoday follows a structured, transparent, and industry-aligned process for handling software enhancement requests across all its Platforms. This ensures client feedback is systematically captured, prioritized, and aligned with the long-term product roadmap.

    * **Submission of Requests:** Enhancement requests can be submitted through the Customer Success Manager (CSM), the support portal, or via account management channels. Each request is logged with details such as business impact, use case, urgency, and expected outcomes.

    * **Review & Prioritization:** Requests are validated by product teams before being assessed by the Chief Product Officer. Evaluation is based on customer impact, technical feasibility, security implications, and alignment with the product vision.

    * **Roadmap Planning & Transparency:** Approved requests are incorporated into the product roadmap, with expected timelines communicated back to the customer. Xoxoday emphasizes roadmap transparency, enabling clients to plan adoption in advance.

    * **Development & Release:** Enhancements are built using agile methodology and CI/CD (continuous integration/continuous deployment) for faster, incremental releases. Each update undergoes rigorous QA testing before deployment, with customers informed via release notes, newsletters, and business reviews.

    * **Feedback & Iteration:** Post-release, feedback is actively collected to ensure enhancements deliver intended outcomes. This feedback loop ensures continuous refinement and innovation in our product suite.

    Through this structured approach, combining customer co-creation, agile execution, transparent communication, and impact-driven prioritization, Xoxoday ensures enhancement requests are handled effectively, driving long-term customer success and innovation across all Platforms.
  </Accordion>

  <Accordion title="What are your capabilities in responding to enhancement, change, or customization requests to accommodate business needs?">
    Xoxoday has robust capabilities to address enhancement, change, and customization requests across all its platforms. Our approach balances agility with governance, ensuring business needs are met while maintaining platform stability, scalability, and compliance.

    * **Structured Intake & Assessment:** Requests can be submitted through Customer Success Managers (CSMs), the support portal, or account teams. Each request is assessed for business impact, urgency, and technical feasibility.

    * **Customization Flexibility:** Platforms are modular and API-first, enabling configuration of workflows, branding, catalog rules, and integrations without heavy development. For unique needs, custom modules, connectors, and extensions can be built while ensuring compatibility with future releases.

    * **Enhancement & Change Management:** Enhancement requests are reviewed by the Product Management team and prioritized for inclusion in the product roadmap. Changes are delivered using Agile and CI/CD practices, enabling faster iterations and frequent incremental improvements. All updates undergo QA, regression testing, and InfoSec review before deployment.

    * **Transparency & Communication:** Clients are kept informed through release notes, success reviews, and roadmap discussions. Dedicated CSMs ensure requests are tracked, communicated, and followed up on until resolution.

    * **Post-Implementation Support:** Once changes or customizations are deployed, user feedback is gathered and performance is monitored through analytics and KPIs. Feedback loops enable continuous refinement to maximize business value.

    By combining flexible configuration options, structured change management, agile delivery, and transparent communication, Xoxoday ensures enhancement and customization requests are handled efficiently.
  </Accordion>

  <Accordion title="What is your methodology for implementing changes to the system?">
    Xoxoday follows a well-defined Change Management Methodology across all its Platforms to ensure changes are implemented securely, efficiently, and with minimal disruption to customer operations.

    * **Change Request & Impact Assessment:** Change requests are initiated via the support portal, CSMs, or account management. Each request undergoes an impact assessment covering business value, security, compliance, dependencies, and potential risks.

    * **Planning & Prioritization:** Approved requests are slotted into release cycles or sprint backlogs, depending on urgency. Prioritization is based on business impact, customer need, technical feasibility, and roadmap alignment. Transparent communication of planned changes ensures clients can anticipate timelines and prepare internal stakeholders.

    * **Development & Testing:** Changes are developed following Agile methodology and CI/CD practices, enabling incremental, high-quality releases. Rigorous unit testing, regression testing, InfoSec checks, and UAT (User Acceptance Testing) are conducted before deployment.

    * **Deployment & Rollout:** Deployment follows a staged rollout approach (sandbox → staging → production), ensuring validation at every level. Automated monitoring is in place to detect anomalies, with rollback procedures available in case of unexpected issues.

    * **Post-Implementation Review & Continuous Feedback:** After rollout, customer feedback and performance metrics are captured to confirm change effectiveness. Release notes and communication updates are shared proactively with customers. Continuous improvement is embedded, ensuring learnings from each change cycle inform future updates.

    By combining structured intake, agile development, staged rollouts, rigorous testing, and transparent communication, Xoxoday ensures system changes are implemented seamlessly.
  </Accordion>

  <Accordion title="Do you provide any guarantees on the performance of new software releases?">
    Yes, the Xoxoday reward platform guarantees 99.9% uptime and delivers high throughput performance across modules. All new releases undergo rigorous performance benchmarking and regression testing before rollout to ensure system stability and reliability.
  </Accordion>

  <Accordion title="How can the client audit pricing, including verifying discounts and product categories?">
    The Xoxoday gift card solution provides a comprehensive admin dashboard with built-in audit and tracking features. Universities can monitor discount structures in real-time, filter data by category, and export detailed reports in formats like Excel and CSV. The reporting module supports advanced filtering by product type, recipient, time range, or department, offering full visibility into pricing accuracy. This ensures that all transactions are verifiable and align with contractual terms.
  </Accordion>
</AccordionGroup>

## Incentive Program

<AccordionGroup>
  <Accordion title="How does Xoxoday handle the process of purchasing and distributing incentives, including managing IPA files, returned mail, and incentive-related complaints?">
    Xoxoday streamlines the end-to-end incentive lifecycle through its global reward marketplace. Incentives are sourced from a curated network of brand partners, offering 10M+ options across 100+ countries. IPA files containing recipient details can be processed in bulk via CSV upload or API integrations. Once validated, incentives are delivered instantly through SMS, email, or WhatsApp. Returned or failed deliveries are flagged for retries or admin review. If recipients report any issues (like malfunction or redemption failures), Xoxoday's dedicated support and SLA-backed ticketing system resolves them swiftly, ensuring a seamless experience.
  </Accordion>

  <Accordion title="How is the administration of provider incentive programs managed on the Xoxoday gift card solution?">
    The Xoxoday gift card solution offers robust admin capabilities for managing provider incentive programs. Program admins are responsible for wallet recharges and can distribute rewards through Xoxo Points, Xoxo Codes, Xoxo Links, or branded gift cards. The system supports multi-admin access—ideal for distributed teams across geographies.

    To ensure smooth operations, admins are provided with detailed training kits, documentation, and access to a dedicated Customer Success Manager (CSM) who acts as the single point of contact for all ongoing support and strategic guidance.

    More on administrative features can be found here: [User Management](/account-administration/user-management/user-management)
  </Accordion>
</AccordionGroup>

## Points based system

<AccordionGroup>
  <Accordion title="How does the platform manage panelist data and incentive allocation when shared bi-annually?">
    The Xoxoday customer incentive software allows seamless panelist data management and point allocation. Clients can upload panelist information directly through the self-service dashboard. Incentive rules and allocation can be configured manually or automated using rule-based logic for recurring bi-annual reward cycles.
  </Accordion>
</AccordionGroup>


# Integrations
Source: https://help-plum.xoxoday.com/faqs/for-admins/integration-faqs

Find answers to frequently asked questions about integrating Plum with your CRM, HR, and survey tools and platforms.

*Get quick answers to questions relating to integration*

<AccordionGroup>
  <Accordion title="Can your platform integrate with Vivint, NRG, or similar enterprise systems via API?">
    Yes, the Xoxoday customer rewards platform supports robust API integrations with platforms like Salesforce, PunchOut, ERP, and Point-of-Sale systems. Custom API connections can also be developed to meet specific system requirements, including those of platforms like Vivint or NRG.
  </Accordion>

  <Accordion title="Can businesses access the reward catalog via API and onboard new vendors?">
    Businesses using the Xoxoday reward marketplace can access the full product catalog via secure APIs. These APIs allow for custom configurations and selective catalog displays. While catalog access is API-driven, onboarding new vendors is managed through the backend to ensure quality control, compliance, and proper integration with the platform.
  </Accordion>

  <Accordion title="Is it possible to fetch real-time product availability, pricing, and promotions?">
    Yes. Xoxoday's API suite supports real-time data retrieval on product inventory, pricing updates, and time-sensitive promotional offers. This ensures customers always view the latest catalog information, enhancing trust and driving higher engagement across the Xoxoday gift card solution.
  </Accordion>

  <Accordion title="How does the platform manage synchronization of product inventory and redemption options?">
    The Xoxoday customer incentive software supports real-time synchronization of product inventory and redemption configurations. Businesses can manage digital vouchers, merchandise stock, and availability statuses seamlessly, ensuring accurate catalog experiences for all users.
  </Accordion>

  <Accordion title="How can the Xoxoday reward marketplace integrate with an existing loyalty management system (LMS) to enable point-based redemptions and earnings?">
    The Xoxoday reward marketplace can be seamlessly integrated with any existing loyalty management system to support both points redemption and earnings. For redemptions, the platform facilitates real-time access to user point balances, updates, and redemptions via APIs.

    For point earnings, transactional data can be securely shared with the loyalty engine, enabling it to allocate reward points based on purchases made through the marketplace. This integration empowers businesses to deliver a cohesive loyalty experience across all user touchpoints.
  </Accordion>

  <Accordion title="Can the Xoxoday gift card marketplace enable cross-vertical points accumulation across telecom, fintech, and travel purchases?">
    Yes, the Xoxoday gift card marketplace supports cross-vertical use cases by sharing detailed transaction data via APIs. This data can be utilized by a central loyalty engine to accumulate and manage points from purchases made across different verticals such as telecom, fintech, and travel. The system is flexible and API-first, allowing easy integration with diverse business models.
  </Accordion>

  <Accordion title="Is it possible for vendors and partners to manage their listings and fulfillment through the Xoxoday customer rewards platform?">
    Yes, the Xoxoday customer rewards platform offers partners and vendors access to a dedicated admin portal. Through this portal, partners can manage their product catalogs, update pricing, configure shipping or digital delivery options, and handle fulfillment processes. This self-service capability enables better autonomy and faster go-to-market execution for suppliers while maintaining full visibility and control within the marketplace ecosystem.
  </Accordion>
</AccordionGroup>


# Reward Code
Source: https://help-plum.xoxoday.com/faqs/for-admins/reward-code-faqs

Find answers to frequently asked questions about sending, customizing, and managing your reward codes in Plum.

*Get quick answers to questions relating to Reward Code*

## Delivery

<AccordionGroup>
  <Accordion title="How does the reward platform handle unsuccessful or incorrect reward code deliveries?">
    We have rarely seen incidents on our platform where the delivery of e-vouchers and incorrect codes for redemption are sent to the end users.

    However, if such incidents occur, Xoxoday offers 24/7 email and chat support ([cs@xoxoday.com](mailto:cs@xoxoday.com)) for all users of the platform. We'll also share a proper escalation matrix with you. Your account manager and customer success teams will also work with you closely to address any issues.
  </Accordion>

  <Accordion title="Who bears the responsibility for duplicate or incorrect reward code deliveries?">
    For prepaid cards such as Visa or Mastercard, the customer incentive software does not support fund withdrawal once issued. However, for Xoxo reward codes, the funds can be retracted for unused gift cards if you are on the "redemption based plan".
  </Accordion>
</AccordionGroup>

## Reporting

<AccordionGroup>
  <Accordion title="What kind of analytics and admin tools are available to track customer engagement and rewards performance?">
    The Xoxoday reward payout platform provides a robust self-service analytics and admin dashboard that empowers internal teams with real-time insights and actionable metrics. Features include:

    * Automated daily, weekly, monthly, and quarterly reports
    * Reward analytics: total vs. unique redemptions, preferred reward categories
    * Communication analytics: campaign open and click-through rates across email, SMS, and other channels
    * Segmentation tools: filters by geography, behavior, reward usage tiers, service touchpoints
    * Customer satisfaction indicators: Net Promoter Score (NPS), Sales Satisfaction Index (SSI), and Customer Satisfaction Index (CSI)

    This data-driven dashboard helps teams fine-tune campaign performance, increase redemptions, and deliver targeted experiences.
  </Accordion>
</AccordionGroup>

## Security Requirement

<AccordionGroup>
  <Accordion title="Does the system support immediate revocation and re-authentication of reward IDs in the event of fraudulent activity?">
    The platform prioritizes security in reward distribution. In case of frauds, the system can cancel the reward orders. The system can also block reward codes which are not misused. If the fraud happens on a 3rd party service, we'll have to check with the 3rd party to check possibilities.
  </Accordion>
</AccordionGroup>


# Reward Points
Source: https://help-plum.xoxoday.com/faqs/for-admins/reward-points-faqs

Find answers to frequently asked questions about sending, tracking, and managing your reward points balance in Plum.

*Get quick answers to questions relating to Reward Points*

## Points Redemption

<AccordionGroup>
  <Accordion title="Can points requests be processed automatically via APIs from a CRM platform to a frequent flyer program?">
    The Xoxoday incentive management platform supports automated file processing through APIs for real-time or scheduled transfers of points data from CRM tools such as Salesforce to external programs. This allows for a fully integrated and automated rewards experience across systems.
  </Accordion>

  <Accordion title="Will rejected points requests automatically credit points back to the member's account?">
    Absolutely. The Xoxoday customer rewards platform includes automated workflows that credit points back to the member's account when a redemption request is rejected by the external partner. This ensures accurate balances and a transparent user experience.
  </Accordion>

  <Accordion title="Will accepted points requests result in automatic deduction of points from the member's account?">
    Yes, once a redemption request is accepted, the Xoxoday reward marketplace automatically deducts the corresponding number of points from the member's balance. This ensures real-time updates and alignment between the redemption activity and point balances.
  </Accordion>

  <Accordion title="Is it possible to configure redemption denominations for airline points within the system?">
    Yes, the Xoxoday consumer reward platform offers configurable redemption denominations for airline loyalty programs or any reward category. This enables clients to define specific point tiers for redemptions, supporting both user flexibility and budget control.
  </Accordion>
</AccordionGroup>

## Rewards Redemption

<AccordionGroup>
  <Accordion title="How is the reward value determined on Xoxoday's customer incentive software?">
    Reward values on Xoxoday's platform are fully configurable to align with your program's budget and objectives. During program design, you can set a preferred point-to-currency ratio.

    Many clients choose a simple 1:1 ratio (1 point = \$1.00) for transparency, though other ratios like 1:2 can also be applied. Points are not marked up, and there's no breakage in the pay-on-redemption model. The catalog value always matches the points spent, ensuring full transparency and cost-efficient reward distribution.
  </Accordion>
</AccordionGroup>

## Points Redemption - Invoice Credit

<AccordionGroup>
  <Accordion title="Can administrators configure minimum and maximum redemption or credit values for reward points?">
    Yes, the Xoxoday reward payout platform allows full control over redemption rules. Program administrators can set both minimum and maximum limits for how members convert reward points into credits or benefits.
  </Accordion>

  <Accordion title="How does invoice credit redemption work for members?">
    When members choose to redeem their points as invoice credit, the equivalent credit amount is automatically applied to their next billing cycle. This credit appears as a line item on the upcoming invoice, providing full transparency and ease of tracking. The Xoxoday customer rewards platform supports such redemption workflows through customizable automation rules and flexible reward configurations.
  </Accordion>

  <Accordion title="Will members receive confirmation when they redeem points as invoice credit?">
    Yes. As part of the redemption workflow on the Xoxoday reward payout platform, members instantly receive an email confirmation once their point redemption is complete. This notification includes the details of the credit applied, the number of points redeemed, and confirmation of the amount that will be adjusted on their next invoice. This real-time communication enhances user trust and ensures a seamless post-redemption experience.
  </Accordion>

  <Accordion title="Can bonus credit promotions be offered during point redemption (e.g., $5 extra for 5,000 points)?">
    Yes. The Xoxoday reward marketplace allows administrators to set up bonus credit promotions linked to specific redemption thresholds. For example, you can configure a rule where users receive an additional \$5 reward when redeeming 5,000 points. These promotions can be tailored for time-limited campaigns, member tiers, or seasonal offers, helping businesses drive engagement and encourage more redemptions.
  </Accordion>

  <Accordion title="Can invoice credits be applied before taxes such as GST?">
    Yes, invoice credits can be configured to apply to the pre-tax amount, depending on the specific integration setup. The Xoxoday reward payout platform can accommodate this requirement through customized billing workflows. For greater flexibility, financial rules such as credit application logic can be defined during the onboarding phase to ensure compliance with local taxation and accounting standards.
  </Accordion>

  <Accordion title="Can invoice credits be configured to apply only to specific product categories?">
    Yes. The Xoxoday customer incentive software lets administrators define rules so invoice credits apply only to selected product categories. Using configurable reward logic and advanced rule-based segmentation, businesses can restrict credits to specific SKUs or catalog sections—such as electronics, apparel, or seasonal merchandise—helping optimize budget allocation and maximize reward spend efficiency.
  </Accordion>
</AccordionGroup>

## Points Redemption - Travel Credit

<AccordionGroup>
  <Accordion title="Is daily overnight batch file transfer of points requests supported?">
    Yes, the Xoxoday reward payout platform supports secure overnight batch file transfers for points-based reward programs. This allows seamless integration with partner systems and ensures efficient processing of bulk transactions.
  </Accordion>

  <Accordion title="Can the system accept hand-back files from a partner to confirm or reject points requests?">
    Yes, the Xoxoday rewards platform supports hand-back file processing to confirm or reject points redemption requests. This feature helps maintain transactional accuracy, reconciliation, and audit readiness in partner-integrated workflows.
  </Accordion>

  <Accordion title="Does the platform support crediting points back to a member's rewards account in case of rejected requests?">
    The Xoxoday incentive management software can automatically credit points back to a member's rewards account when a redemption or reward request is rejected. This ensures data accuracy, improves the user experience, and maintains the integrity of the reward points balance.
  </Accordion>

  <Accordion title="Can accepted points requests result in a deduction from the member's rewards account?">
    Yes, with the Xoxoday customer incentive platform, approved points requests are automatically deducted from the member's rewards balance. This deduction process is secure and traceable, ensuring compliance and transparency within your points management program.
  </Accordion>

  <Accordion title="Is it possible to receive monthly reports detailing points requests, including those accepted and rejected?">
    The Xoxoday reward payout platform provides robust reporting features that can be configured to deliver monthly reports on all points-related activities—such as requested, approved, and rejected redemptions. These reports support audit-readiness, transparency, and informed decision-making.
  </Accordion>

  <Accordion title="Does the platform support APIs for automatic processing of points requests from a client system to the rewards platform?">
    Yes, the Xoxoday customer rewards platform supports robust API integrations to enable automatic file processing of points requests. This ensures a seamless and scalable exchange of data between client systems and the reward infrastructure.
  </Accordion>
</AccordionGroup>

## Gifting Program

<AccordionGroup>
  <Accordion title="How can users engage in activities to earn more reward points?">
    The Xoxoday rewards platform enables users to participate in various games & contests such as surveys, feedback campaigns, or milestone-based actions to earn points. Submissions are automatically tracked within the platform, and corresponding points are added in real time. The gamification can be chosen by the client.
  </Accordion>
</AccordionGroup>


# Send Gift Cards
Source: https://help-plum.xoxoday.com/faqs/for-admins/send-gift-cards-faqs

Find answers to frequently asked questions about sending digital gift cards to recipients through the Plum platform.

*Get quick answers to questions on sending gift cards on Plum*

## Customer Service

<AccordionGroup>
  <Accordion title="How does the platform ensure fulfillment accuracy and presentation standards for each order?">
    The Xoxoday reward payout platform deems an order successful only when all quality checks are met:

    * Correct voucher, denomination, or merchandise is fulfilled
    * Branded collateral or cover letter (where required) follows approved format and tone
    * One printed cover letter is included per package, where applicable
    * Shipping is completed to the exact address provided by the organization

    If deliveries are incorrect or products damaged, issues are treated as P2 priority with a 4-hour response time and 24-hour resolution window.
  </Accordion>

  <Accordion title="What happens if an order is disputed or marked as not received?">
    The Xoxoday customer rewards platform ensures end-to-end order traceability with strong logistics protocols.

    * Valid Proof of Delivery (POD) is provided for disputed or undelivered orders
    * If POD is unavailable, a replacement is issued at no extra cost
    * Issues are prioritized as:
      * P1: Time-sensitive cases like undelivered items or critical errors
      * P2: Moderately urgent issues such as incorrect names, vouchers, or denominations
    * Response time is 4 business hours for both categories, with resolution expected within 8 hours for P1 and 24 hours for P2
  </Accordion>
</AccordionGroup>

## Gift Card

<AccordionGroup>
  <Accordion title="Do the gift cards have a fixed expiration period after they are issued?">
    Yes, all gift cards issued through the Xoxoday gift card solution come with a defined expiration period. The duration varies by card type or issuing brand and is communicated upfront at the time of issuance, ensuring recipients have ample time to redeem their rewards.
  </Accordion>

  <Accordion title="Are there fees associated with reloadable gift cards?">
    Xoxoday's rewards, incentives, and payout platform enables flexible global reward distribution, including Visa and Mastercard gift cards across 100+ countries.

    * Visa & Mastercard digital gift cards: No activation fees when issued digitally via the Xoxoday marketplace, ensuring cost efficiency at scale.
    * Other branded or physical cards: For cards such as American Express, Discover, or physical card formats, activation fees may apply. These fees are determined by the issuing bank and regional regulations, not by Xoxoday.

    All applicable charges are displayed transparently on the platform when selecting reward types, so businesses have full clarity before issuing. Alongside this, Xoxoday offers real-time tracking, multi-currency support, and a self-serve dashboard to manage issuance, activation, cancellation, and re-delivery.
  </Accordion>

  <Accordion title="Can gift cards be deactivated, tracked, and their balances verified?">
    Yes. The Xoxoday reward marketplace's admin interface allows authorized users to:

    * Deactivate issued gift cards
    * Track usage and redemption status
    * Verify remaining balances

    This centralized control ensures transparency and oversight for large-scale rewards distribution.
  </Accordion>

  <Accordion title="Do vouchers provided by the platform offer a minimum validity of 12 months?">
    Vouchers delivered through the Xoxoday reward payout platform typically offer flexible validity, including 12 months or longer. While validity is governed by individual brand partners, most vouchers offer ample redemption windows to ensure a satisfying end-user experience.
  </Accordion>

  <Accordion title="How long does it take to deliver a reward after placing an order?">
    * Digital rewards: Delivered instantly via email, WhatsApp, or SMS
    * Physical rewards: Delivered within 2 to 7 days, depending on the delivery location
  </Accordion>

  <Accordion title="Is there an option to expedite the delivery of gift cards?">
    All digital gift cards from the Xoxoday reward marketplace are delivered instantly via email or SMS, ensuring real-time fulfillment with no delays. This makes the solution ideal for time-sensitive campaigns such as on-the-spot rewards, contests, or service recovery gestures.
  </Accordion>

  <Accordion title="Do you handle the printing, packaging, and delivery of physical gift cards?">
    Yes, the Xoxoday gift card solution manages end-to-end fulfillment for physical gift cards, including printing, packaging, and delivery. Orders can be shipped across the 100+ countries with reliable logistics support. This turnkey offering simplifies the physical reward process while maintaining branding and quality standards.
  </Accordion>

  <Accordion title="Can funds be retracted from unused gift cards?">
    For prepaid cards such as Visa or Mastercard, the customer incentive software does not support fund withdrawal once issued. However, for Xoxo reward codes, the funds can be retracted for unused gift cards if you are on the "redemption based plan".
  </Accordion>

  <Accordion title="Is there an option to distribute gift cards that are not pre-assigned to specific individuals?">
    Yes, the Xoxoday gift card solution enables administrators to generate gift cards without assigning them to a specific individual at the time of issue. These unassigned cards are delivered via email in bulk to the designated admin in secure format.

    These cards can be sent in inactive format and can be activated on demand securely. This approach is particularly useful for open campaigns, event-based rewards, or when the final recipient is yet to be determined.
  </Accordion>

  <Accordion title="What shipping options are available for physical rewards?">
    The Xoxoday rewards, incentives, and payout platform offers global delivery of physical rewards across 100+ countries with standard and expedited shipping options.

    * Coverage: Rewards shipped to North America, Europe, APAC, MENA, and LATAM
    * Reward types: Prepaid Visa/Mastercard gift cards, branded merchandise, swag, and corporate gifting bundles
    * Tracking: Most shipments are trackable via integrated courier partners

    **Standard Shipping**

    * Carriers: Local postal services (USPS, Royal Mail, Canada Post, India Post, etc.)
    * Delivery times:
      * North America & Europe: 3–7 business days
      * APAC & Middle East: 5–10 business days
      * LATAM & Africa: 7–14 business days (varies by region)
    * Cost: Included in base fulfillment charges for most reward categories

    **Expedited Shipping**

    * Carriers: FedEx, DHL, UPS, Aramex (region-based)
    * Delivery times:
      * Major metros (US, UK, EU, India): Next-day or 2-day delivery
      * Remote/international: 3–5 business days
    * Cost: Additional, based on volume, country, and weight

    **Security & SLA**

    * Tamper-proof packaging for prepaid and branded cards
    * Delivery confirmation and audit trail via the platform
    * Insurance for high-value shipments (available on request)
  </Accordion>
</AccordionGroup>

## Points Redemption

<AccordionGroup>
  <Accordion title="Are gift card denominations restricted to pre-defined values set by merchants?">
    Yes, the Xoxoday gift card marketplace adheres to merchant-specific denomination constraints. Each brand or merchant in the platform defines their available gift card values, and these denominations are clearly displayed during the selection process to ensure transparency and accuracy for end-users.
  </Accordion>

  <Accordion title="Can the point cost of gift card redemption be configured based on brand, denomination, and delivery method?">
    Yes, the Xoxoday reward marketplace supports full configurability of reward point costs by gift card brand, denomination, and delivery mode (digital or physical). This allows program administrators to tailor the redemption logic to business rules, regional pricing, or marketing objectives, ensuring flexibility and cost control.
  </Accordion>
</AccordionGroup>

## Distribution

<AccordionGroup>
  <Accordion title="Through which channels can gift cards be distributed?">
    The Xoxoday customer rewards platform offers omnichannel gift card distribution, enabling delivery via email, SMS, WhatsApp, and in-app notifications. For those preferring tangible rewards, physical gift cards are available and can be shipped directly to recipients. This multichannel approach ensures a seamless and tailored reward delivery experience across digital and physical touchpoints.
  </Accordion>

  <Accordion title="How can digital gift cards be distributed individually to recipients?">
    Admins can send rewards directly to individual email addresses or mobile numbers. This flexibility is ideal for targeted recognition, milestone achievements, or just-in-time incentive distribution.
  </Accordion>

  <Accordion title="How are gift cards distributed in bulk through the platform?">
    The Xoxoday reward payout platform provides bulk distribution capabilities via both the self-service portal, Spreadsheets and API integrations. Admins can upload a list of recipients and distribute rewards in bulk, or use the API to get these rewards.

    These links remain accessible until activated by the recipients. There's no restriction on the number of orders per day, making it easy to run large-scale reward campaigns across departments, regions, or audience segments.
  </Accordion>

  <Accordion title="Do you provide both open and closed-loop gift cards?">
    Yes, the Xoxoday reward payout platform supports both open-loop and closed-loop gift cards. Open-loop cards (such as prepaid Visa and Mastercard) can be used universally, while closed-loop cards are redeemable at specific retail or service brands. This dual offering ensures flexibility in consumer reward experiences across different geographies.
  </Accordion>
</AccordionGroup>

## Gifting Program

<AccordionGroup>
  <Accordion title="What differentiates your gift card program from those of your competitors?">
    The Xoxoday rewards, incentives, and payout platform offers a gift card program that stands out for its scale, flexibility, and global coverage. Designed to meet the needs of modern enterprises, it empowers businesses with a seamless, secure, and highly customizable way to reward employees, customers, partners, or research participants.

    Here's how the program differentiates itself:

    * **Global gift card catalog with unmatched scale:** Our platform offers access to over 10 million reward choices across 30+ categories, with a strong emphasis on gift cards. It includes 10,000+ brand gift cards — such as Amazon, Walmart, Starbucks, and Visa/Mastercard — available in 100+ countries with support for 55+ currencies and 50+ languages.

    * **Dual-mode delivery: physical & digital:** The gift card program supports both physical and electronic delivery, ensuring users can choose the mode that best suits their location and preference.

    * **Real-time reward delivery & status tracking:** Gift cards can be sent instantly via email, SMS, or WhatsApp, with access to a self-service admin dashboard to track delivery and redemption status in real time. Bulk issuance is also supported for up to 10,000 recipients at once.

    * **Custom branding and localization:** Businesses can fully customize gift card emails, landing pages, and catalogs with brand logos, messages, and localization settings (language, currency, etc.) to ensure a white-labeled, personalized gifting experience.

    * **Transparent pricing with pay-on-redemption model:** Unlike many providers, Xoxoday uses a transparent pricing structure with no markups on gift card value or shipping, and offers pay-on-redemption billing for point-based programs, minimizing breakage and optimizing spend efficiency.

    * **Fraud prevention and redemption controls:** Admins can set expiration periods, block specific gift cards, enable approval workflows, and use maker-checker models for high-value distributions. Built-in fraud detection further secures transactions.

    * **Dedicated account management and global support:** Clients receive a dedicated account manager, access to 24/7 customer support, and optional onboarding and integration assistance. This ensures smooth implementation, timely issue resolution, and scalable program management.

    These capabilities collectively make the Xoxoday gift card program a highly secure, flexible, and globally scalable rewards solution trusted by over 5000+ businesses, including Fortune 500 enterprises and leading research institutions.
  </Accordion>

  <Accordion title="Can users place gift card orders and activate them in both bulk and single-card formats?">
    Absolutely. The Xoxoday gift card solution is designed for flexible ordering to suit varied use cases. Administrators can issue single cards for individual rewards or execute bulk distributions to thousands of recipients in one go. Cards can be activated and sent instantly via email, SMS, or custom links. This dual-mode ordering capability supports dynamic reward campaigns, whether for a one-off recognition or a large-scale loyalty or engagement program.
  </Accordion>

  <Accordion title="What are the minimum and maximum gift card ordering requirements on the platform?">
    There are no minimum or maximum order limits. Organizations can issue a single reward or run bulk campaigns for thousands of recipients. The platform is designed to scale seamlessly without constraints.
  </Accordion>

  <Accordion title="Is there a limit to the dollar amount of gift cards that can be ordered in a single transaction?">
    No fixed dollar limit exists.

    * Gift card denominations are selected within brand-specific ranges displayed during order setup
    * Virtual prepaid cards support custom denominations (e.g., \$1, ₹2500, £52)
    * Reward Codes can hold up to 50,000 points each, with up to 15 codes applicable per transaction within the total balance
  </Accordion>

  <Accordion title="Does the platform allow loading prepaid gift cards in multiple denominations?">
    Yes, the incentive software provides full flexibility to load digital prepaid cards in custom denominations as per your requirements. This helps tailor the value of each reward to specific user actions, performance tiers, or campaign milestones.
  </Accordion>

  <Accordion title="Can users send personalized gifts to friends or contacts through the platform, and choose specific delivery timings?">
    Yes. The platform supports personalized gifting:

    * Custom messages and delivery scheduling for occasions like birthdays or holidays
    * Delivery via email, SMS, WhatsApp, or other social channels
    * Recipient selection from contact directories
    * Confirmation notifications for senders and email receipts summarizing the transaction
    * Functionality is configurable based on integration and implementation requirements
  </Accordion>

  <Accordion title="How are physical gift cards delivered to participants?">
    The Xoxoday gift card marketplace supports global shipping of physical vouchers. Cards can be sent to a designated location as per project instructions, including consolidated delivery to client-appointed audit hubs. There are no additional costs to participants for receiving these rewards.
  </Accordion>

  <Accordion title="Can digital gift cards be uploaded to mobile wallets such as Apple Wallet or Google Pay?">
    Yes, the gift cards can be uploaded in Apple or Google wallet for easy tracking.
  </Accordion>

  <Accordion title="Can you provide a breakdown of all potential fees associated with your gift card program? Are there any hidden or variable fees related to card issuance, inactivity, or reporting?">
    The Xoxoday gift card solution maintains a transparent pricing model. There are no hidden fees related to card issuance, inactivity, or reporting. Clients only pay for what is redeemed, with no markup on gift card value or hidden service costs.
  </Accordion>

  <Accordion title="Can your system provide real-time data for virtual gift cards, including issuance, balance checks, and redemptions?">
    Yes, the Xoxoday gift card solution offers a real-time dashboard that allows administrators to track every stage of gift card activity. This includes issuance status, redemption history, balance checks, delivery confirmations, and user-level usage insights. The platform ensures transparency and accountability by updating these records dynamically as transactions occur.
  </Accordion>

  <Accordion title="Can users share a product or gift card from the rewards platform via social media, email, or messaging platforms?">
    Yes, the Xoxoday gift card solution enables users to seamlessly share rewards, e-gift cards, and merchandise links with others. These can be sent through multiple digital channels such as WhatsApp, text message, email, or social platforms, directly from the integrated app experience. This functionality enhances social gifting and engagement and can be embedded within any app ecosystem via API or SDK integration.
  </Accordion>
</AccordionGroup>

## Refunds and Returns

<AccordionGroup>
  <Accordion title="How are refunds and cancellations managed for digital and physical rewards?">
    The Xoxoday gift card solution supports cancellations and refund processing for cancelled or unfulfilled orders. The refunds go to the original payment method which can be reward points or reward codes or credit card/bank through payment gateway.
  </Accordion>

  <Accordion title="Can you offer upfront discounts on gift card purchases based on anticipated breakage?">
    While the Xoxoday gift card solution does not offer guaranteed upfront discounts based solely on expected breakage, organizations can benefit from its pay-on-redemption pricing model, where costs are incurred only for claimed gift cards. Additionally, volume-based pricing tiers and program-specific commercial models may be available depending on usage scale and scope.
  </Accordion>

  <Accordion title="How is breakage handled? What happens with unused card balances?">
    The treatment of breakage depends on the type of card issued.

    * For prepaid Visa or Mastercard-type gift cards, unused funds are not recoverable.
    * For gift cards, the breakage is handled as per the terms of the brand and the country. For unused balances, the terms of the brand define the usage.
  </Accordion>

  <Accordion title="What is the process for canceling an order or returning a gift card?">
    Through the Xoxoday gift card solution's admin dashboard, authorized personnel can:

    * Cancel issued rewards
    * Resend gift cards when needed

    If the gift card hasn't been accessed or used, the order can usually be reversed, ensuring a smooth and secure process for administrators managing both bulk and individual reward programs.
  </Accordion>
</AccordionGroup>


# Cancellation/Refund
Source: https://help-plum.xoxoday.com/faqs/for-end-users/cancellation-refund

Find answers to frequently asked questions about cancellations and refunds for rewards received through the Plum platform.

*FAQ's on cancellation and refunds.*

<AccordionGroup>
  <Accordion title="Can I cancel or postpone an experience?">
    You cannot cancel an experience after booking confirmation is received from Xoxoday. Any modification in the booking will be at the service provider's discretion. Please drop a mail to [cs@xoxoday.com](mailto:cs@xoxoday.com) for any rescheduling/canceling changes. You can also [raise a ticket](https://www.xoxoday.com/support#raise_a_ticket) or Whatsapp us at **+91 8061915050**.
  </Accordion>

  <Accordion title="Are there any cancellation charges if I cancel any experience?">
    Cancellation charges are dependent on the cancellation policy of the experience. It is mentioned while booking the experience.
  </Accordion>

  <Accordion title="Can I change the experience once the booking is done?">
    You would be able to change the experience before a confirmation is received. Currently, this feature isn't available online. Please contact at [cs@xoxoday.com](mailto:cs@xoxoday.com) to help you guide through the process. You can also [raise a ticket](https://www.xoxoday.com/support#raise_a_ticket) or Whatsapp us at +91 8061915050.

    But once you receive the confirmation of your booking, any modifications will be at the service provider's discretion.
  </Accordion>

  <Accordion title="Is the amount refunded if the experience is not available?">
    Yes, the amount will be refunded to your account without any cancellations, if the experience is not available.
  </Accordion>
</AccordionGroup>


# Create Support Ticket
Source: https://help-plum.xoxoday.com/faqs/for-end-users/create-support-ticket

Learn how to create a support ticket as an end user on Plum if you run into any issue with a reward you've received.

*How to create customer support ticket for a quick resolution of your query*

At Xoxoday, we strive to deliver a superior experience to all our users at all times.

However, we understand that at times, the users may be left with unanswered questions or are simply not sure about what to do next. The Plum customer support team is available to resolve all such queries and issues that the customers are facing.

## How to Create a Customer Support Ticket?

<AccordionGroup>
  <Accordion title="How do I create a customer support ticket?">
    1. Navigate to the in-app resource centre.

       <img alt="" />

    Empuls Resource Center

    2. Go to Home --> Raise A Support Ticket.

       <img alt="" />

    Raise A ticket

    3. Fill out the form on the new tickets creation page and submit.

       <img alt="" />

    Ticket Creation Form

    Users can also simply drop an email to [support@empuls.io](mailto:support@empuls.io) with the details of their query/issue for a swift resolution.
  </Accordion>
</AccordionGroup>


# Delivery related Issues
Source: https://help-plum.xoxoday.com/faqs/for-end-users/delivery-related-issues

Find answers to frequently asked questions about delivery-related issues for rewards sent through the Plum platform.

*Get answers to Delivery FAQ's*

<AccordionGroup>
  <Accordion title="Can I change my postal address once dispatched?">
    Please [raise a ticket](https://www.xoxoday.com/support#raise_a_ticket) or send a mail to [cs@xoxoday.com](mailto:cs@xoxoday.com) or Whatsapp us at +91 080 61915050. We will check and get back to you on the same.
  </Accordion>

  <Accordion title="I am unable to submit the address in the provided address link?">
    Please [raise a ticket](https://www.xoxoday.com/support#raise_a_ticket) or send a mail to [cs@xoxoday.com](mailto:cs@xoxoday.com) or Whatsapp us at +91 8061915050. We will update you in the next 4 business hours.
  </Accordion>

  <Accordion title="Can my friends/Family/Neighbours accept the Gift box on my behalf?">
    Yes, you may coordinate with the delivery executive at the time of delivery and arrange an alternate person to collect the Gift Box on your behalf.
  </Accordion>

  <Accordion title="Which address should I provide? Office or residential?">
    You may provide any address to deliver the gift box, be it residential or otherwise.
  </Accordion>

  <Accordion title="How can I track my gift box delivery after updating the address?">
    Once the Gift Box is dispatched from our end, you will be notified with the tracking details on your official mail ID to track the shipment further.
  </Accordion>
</AccordionGroup>


# Getting started
Source: https://help-plum.xoxoday.com/faqs/for-end-users/getting-started-for-end-users-faqs

Find answers to frequently asked questions about getting started as an end user redeeming rewards on the Plum platform.

*FAQ's for End Users*

<AccordionGroup>
  <Accordion title="Is Plum Storefront accessible on my Android or iOS device?">
    The Storefront ([https://stores.xoxoday.com/companyname/](https://stores.xoxoday.com/companyname/)) is accessible in a mobile browser and can be accessed via an Android or an iOS device.
  </Accordion>

  <Accordion title="How can I log in to Plum for the first time?">
    For first-time users, please follow the steps below:
    Go to "stores.xoxoday.com/\[companyname]," click on the login page, and enter your email and password.
    You will receive an OTP to verify and be successfully signed up.
  </Accordion>

  <Accordion title="How can I redeem my Xoxoday reward code?">
    The user has to visit stores.xoxoday.com to redeem the code. Users can redeem the code through guest checkout. You don't have to log in or sign up. [Read more](/getting-started/for-end-users/how-to-redeem/reward-code) here.
  </Accordion>

  <Accordion title="How can I redeem my Xoxoday reward points?">
    After logging in to the store, your reward points balance will be shown at the top right corner of the page or under "Xoxo Points" in the profile icon. Choose any gift vouchers or any product from 30+ categories. During checkout, the user will be able to see the points balance and will be asked if he wants to use the points for the order payment. After checking the same, your points can be used for checkout. [Read more](/getting-started/for-end-users/how-to-redeem/redeem-reward-points) here.
  </Accordion>

  <Accordion title="How can I redeem my Giift reward link?">
    When you get the email about the reward, click "Redeem Now." You'll be taken to a page listing all of your vouchers. Read more here.
  </Accordion>

  <Accordion title="Can I redeem Giift reward points/vouchers for cash?">
    No, you cannot redeem Giift points/vouchers for cash.
  </Accordion>

  <Accordion title="How can I redeem Mastercard/Virtual Visa Card using Reward code/Reward points?">
    To use your Mastercard/Visa cards, you can pay the excess amount during checkout by selecting the option to pay via "Credit Card" and choosing the card of your choice.
  </Accordion>

  <Accordion title="Do I need to log in to buy on the Plum storefront?">
    For Reward Codes and Rewards links, the user need not log into Plum. Checkout is available for guest login.
  </Accordion>

  <Accordion title="How fast does Xoxoday resolve customer issues?">
    We generally respond to customer inquiries within 8 business hours. Our customer support timings are as follows:
    Monday to Friday (9:00 am to 9 pm)\*
    Saturday to Sunday (9:30 am to 6.30 pm)\*
    Note: All times are in IST.
    For queries please raise a ticket at [cs@xoxoday.com](mailto:cs@xoxoday.com) or Whatsapp us at +91 080 61915050.
  </Accordion>

  <Accordion title="How do you check the order delivery status?">
    You can check the order status under your Profile. Click on the profile icon and select "Orders." Then, navigate to "Your Orders" to view a list of your orders.
    Order Status is mentioned right next to the order. (Delivered/Pending).
    If your order status is pending, please check the Delivery TAT of the Gift voucher mentioned in T\&C of the Brand.
    Note: The order history can only be checked if the user is registered in Plum and has placed the order by logging into the account and not guest check out.

    <img alt="" />

    <img alt="" />
  </Accordion>

  <Accordion title="How to change the mobile number from the storefront?">
    * Go to [https://stores.xoxoday.com/](https://stores.xoxoday.com/)
    * Now, click on the "Login" button that is present in the top right corner of the page.
    * Enter your company email address that is associated with Plum.
    * Now, click on "Verify Email".
    * Now, enter the password and click on "Login"
    * After logging in to the Plum Storefront, click on the "Profile" button.
    * You can edit information from the "Basic Information" section in the dashboard.
    * Now, change the mobile number in the "Phone" section by clicking on "Edit Information".
    * Now, click "Confirm"
    * You will receive an OTP. Please enter the OTP on the screen.
    * Congratulations, you have successfully changed your mobile number in the storefront.

      <img alt="" />
  </Accordion>

  <Accordion title="How to view your points balance in the dashboard?">
    After logging in to the Plum Storefront, you can see your reward points on top-right corner.

    <img alt="" />
  </Accordion>

  <Accordion title="Is multi-lingual support provided for the Xoxoday Plum marketplace?">
    Yes, we allow multi-lingual support in 10 different languages for the convenience of our end users.
  </Accordion>

  <Accordion title="I have not received OTP though I have generated it multiple times?">
    Kindly check if the number provided is correct this might happen due to network issues, please retry after some time. If you still face issues, raise a ticket in the help section at the top right corner. You can also email us at [cs@xoxoday.com](mailto:cs@xoxoday.com) or WhatsApp us at +91 080 61915050.
  </Accordion>

  <Accordion title="Do the perks & privileges section have validity on it?">
    Yes, they come with validity, the validity of the offer is limited and subject to change.
  </Accordion>

  <Accordion title="What do you mean by conversion rates during redemption?">
    Conversion rates are the conversion amount of the points that you have received. For example: 1 Point = 1 INR.
  </Accordion>

  <Accordion title="Can I go with a friend for a couple of experience?">
    Yes, "Couple" in this case denotes any two people who can visit and enjoy the experience.
  </Accordion>

  <Accordion title="Are the experiences available on the app and portal the same?">
    Yes, they are identical.
  </Accordion>

  <Accordion title="Can I gift the experience to my friend?">
    You may redeem the experience and gift the same to your family & friends but the booking name has to be provided so that we can inform the service provider in whose name it has to be booked.
  </Accordion>

  <Accordion title="Can I swap the booking I have done for experience?">
    No, once the booking is confirmed it cannot be canceled or swapped.
  </Accordion>

  <Accordion title="How to add points to my account?">
    The Reward points are usually rewarded from your Company and the same cannot be added manually by an individual.
  </Accordion>

  <Accordion title="How can I change my email id?">
    Please drop us an email at [cs@xoxoday.com](mailto:cs@xoxoday.com) with the existing mail ID and the reason for the change of mail ID. We will validate the details and update you on the request.
  </Accordion>

  <Accordion title="I didn't get an email or a reset link to reset the password.">
    Kindly check your spam folder if the reset link is delivered. You can click on reset password after 15 min to check if you are receiving the reset link. If you still have not received the reset link, write to [cs@xoxoday.com](mailto:cs@xoxoday.com) to help you with the query.
  </Accordion>

  <Accordion title="Is Cash on Delivery (COD) available in Plum?">
    No, Plum doesn't support cash on delivery right now.
  </Accordion>

  <Accordion title="Are there any hidden charges or taxes during checkout?">
    In Plum, you pay the price that is mentioned on the checkout page. There are no hidden charges present.
  </Accordion>

  <Accordion title="How do I check the balance and validity of Xoxo Points?">
    To check the validity of xoxo points, please write to [cs@xoxoday.com](mailto:cs@xoxoday.com).
  </Accordion>

  <Accordion title="How to check reward history - in terms of who it has been rewarded, amount, and procurement date?">
    Information like date of procurement, amount, quantity can be seen in the history reports on the Plum Admin platform.
  </Accordion>

  <Accordion title="How to add/change the company logo? Where does it reflect?">
    Yes, we allow custom changes to the company logo. The following steps can be followed to do the same. Settings >> Platform Preference >> Storefront >> Click on company logo >> Upload new image >> Click on upload.
  </Accordion>

  <Accordion title="Does the platform allow participants to place orders by phone?">
    Phone support is available for administrators in case of order placement or redemption issues on a case-by-case basis. Placing orders by phone is possible through some custom configurations.
  </Accordion>

  <Accordion title="Will users receive notifications for key reward lifecycle events such as reward generation and expiry?">
    The Xoxoday consumer reward platform provides complete support to track events like reward issuance and expiration. These data points can be leveraged by client-owned communication systems to trigger timely user notifications. This setup allows for seamless integration while maintaining flexibility in how end-user communication is managed.
  </Accordion>

  <Accordion title="Can the redemption process require two-factor authentication (2FA) via email or SMS to the registered account holder?">
    Yes, the redemption process within the Xoxoday reward solution can be configured to require two-factor authentication (2FA). Codes can be sent via SMS or email to the registered mobile number or email ID of the designated primary or secondary account holder, ensuring secure and compliant redemption processes.
  </Accordion>
</AccordionGroup>


# Gift Box Queries
Source: https://help-plum.xoxoday.com/faqs/for-end-users/gift-box-queries

Find answers to frequently asked questions about gift box orders and other related queries for Plum end users.

<AccordionGroup>
  <Accordion title="I have a Gift Box from my organization through which I have logged in to the enterprise website to book the experience. Should I create a new account on Xoxoday?">
    No, you do not have to create a new account on Xoxoday. You can log in to your enterprise account, and click to visit the e-store option and select Experiences and Activities you will be redirected to stores.Xoxoday.com and you can proceed to choose and book the experience.
  </Accordion>

  <Accordion title="How can I track my gift box delivery after updating the address?">
    Once the Gift Box is dispatched from our end, you will be notified with the tracking details on your official mail ID to track the shipment further.
  </Accordion>

  <Accordion title="Does the Gift Box contain a Xoxo voucher?">
    You may receive either a Xoxo voucher in the Gift Box or Xoxo points to your Email ID.
  </Accordion>

  <Accordion title="How many days does it take to dispatch the Gift Box?">
    The gift box will be dispatched and delivered to you on or before the anniversary date. In case, the employee updates the address after the anniversary date or near the anniversary date, the gift box will be dispatched within 7-8 working days.

    In case of any queries, you will have to write to [cs@xoxoday.com](mailto:cs@xoxoday.com) with your Employee ID/Official Mail ID. You can also [raise a ticket](https://www.xoxoday.com/support#raise_a_ticket) or Whatsapp us at +91 080 61915050. We will revert to you with the updates on Gift Box Delivery.
  </Accordion>
</AccordionGroup>


# Gift Vouchers
Source: https://help-plum.xoxoday.com/faqs/for-end-users/gift-vouchers-faqs

Find answers to frequently asked questions about redeeming the gift vouchers you've received through the Plum platform.

*Get answers to commonly asked questions on Gift Vouchers*

<AccordionGroup>
  <Accordion title="What are gift vouchers?">
    * E-gift vouchers are gift vouchers (Ex: Flipkart, Myntra, Lifestyle, etc.,) available on Xoxoday.
    * You can use Xoxo points to redeem the e-gift vouchers.
    * Each brand has a different way of redeeming itself. We suggest you go through the "Terms & Conditions" and "How to Use" sections for that particular brand that you wish to redeem and then use your XoxoPoints accordingly.
    * The order will be delivered to your mail ID instantly. Please check your spam box/junk/promotional/updates folders just in case.
    * We make it a point to deliver the vouchers instantly, however, if there is a delay from the vendor's side, it might take up to 24 to 48 hours.
    * If you are still unable to find the voucher, please write to [cs@xoxoday.com](mailto:cs@xoxoday.com) or click on "[Raise a ticket](https://www.xoxoday.com/support#raise_a_ticket)" on the header of this page. You can also WhatsApp us at +91 080 61915050.
    * Every gift voucher has a specific validity and specific time of delivery. You will be able to find the validity of the voucher and the T\&C of the voucher at the time of purchase. Please note that the validity of the voucher cannot be extended and the vouchers cannot be canceled after delivery to the recipient.
  </Accordion>

  <Accordion title="How to use a brand voucher?">
    * The reward email will have the redirecting link to the brand website if its online, you can use the instruction to redeem the voucher.
    * Every gift voucher has a specific validity and specific time of delivery. You will be able to find the validity of the voucher and the T\&C of the voucher at the time of purchase. Please note that the validity of the voucher cannot be extended and the vouchers cannot be canceled after delivery to the recipient.

    <Frame>
      <img />
    </Frame>
  </Accordion>

  <Accordion title="I can't access my mail. How do I know about the voucher code?">
    Please write to [cs@xoxoday.com](mailto:cs@xoxoday.com) with your official email id and company details. Xoxoday will send you a copy of the voucher code. You can also WhatsApp us at +91 8061915050 or raise a help ticket from the header of this page.
  </Accordion>

  <Accordion title="What if I haven't received my voucher details?">
    * Please check the order status, if the delivered voucher details will be available in your inbox, spam, or Junk folder.
    * If pending - Please check the **Terms and conditions** for delivery turnaround time.
    * If you are still struggling to resolve this, please raise a ticket or send a mail to [cs@xoxoday.com](mailto:cs@xoxoday.com) or Whatsapp us at +91 080 61915050.
  </Accordion>

  <Accordion title="I need to resend the voucher to my alternative email ID. I don't have access to the work email right now.">
    Please drop us an email to [cs@xoxoday.com](mailto:cs@xoxoday.com) with the Order ID & alternate mail ID marking your official mail ID in CC. We will validate the details and re-send them to your alternate mail ID.

    You can also raise a ticket or Whatsapp us at +91 080 61915050.
  </Accordion>

  <Accordion title="What if my gift card/voucher is stolen/there is fraud detected?">
    Please raise a ticket or send a mail to [cs@xoxoday.com](mailto:cs@xoxoday.com) or Whatsapp us at +91 8061915050. We will ensure that this is resolved.
  </Accordion>

  <Accordion title="Is there any validity for gift vouchers?">
    Yes, every gift voucher has a specific validity, please check the T\&C while placing the order.
  </Accordion>

  <Accordion title="I have placed the order for a gift voucher. Will I get a physical voucher delivered to my address?">
    No physical vouchers are sent for any gift vouchers. These are the e-vouchers that are sent only to your provided email ID.
  </Accordion>

  <Accordion title="Why is there a delay in voucher delivery?">
    Most of the vouchers are delivered instantly. There are a few vouchers with the defined TAT (Turn Around Time) and it is mentioned on our website under T\&C. This will help you to know the delivery TAT.
  </Accordion>

  <Accordion title="I have tried to redeem the voucher; however, I get an error message stating the code is Invalid or Used, why?">
    Please raise a ticket or send a mail to [cs@xoxoday.com](mailto:cs@xoxoday.com) or Whatsapp us at +91 8061915050. We will update you in the next 24 hours.
  </Accordion>

  <Accordion title="Where to add my Xoxo voucher if received, in the stores portal?">
    Currently, we do not support the feature to add xoxo code to your account and use it during the time of checkout. This is something our team is currently working on and will be getting this feature live soon.
  </Accordion>

  <Accordion title="Is there a validity for points and Xoxo code?">
    Yes, xoxo points and xoxo codes are usually valid for one year. You can view all such necessary details in the terms and condition section on the specific gift voucher page.
  </Accordion>
</AccordionGroup>


# Performance and Reliability
Source: https://help-plum.xoxoday.com/faqs/for-end-users/performance-and-reliability

Find answers to frequently asked questions about Plum's platform performance and reliability from an end user's view.

*Get quick answers to questions on Performance and Reliability.*

<AccordionGroup>
  <Accordion title="Can the system scale efficiently during promotions or seasonal spikes in traffic?">
    Yes. Xoxoday is engineered for scalability and reliability, ensuring smooth performance even during peak events like promotions, campaigns, or seasonal reward cycles. The platform currently supports 10,000+ transactions per minute and uses auto-scaling infrastructure to handle sudden surges without affecting user experience.

    **How Xoxoday Manages Seasonal Spikes**

    * **Scalable Architecture:** Built on containerized microservices, async messaging, and caching so each component can scale independently. Stateless services scale horizontally behind AWS Application Load Balancers. Kafka-backed queues absorb "flash-sale" traffic, while Redis caching avoids database hot spots.

    * **High Availability & Reliability:** Active-active deployments across availability zones ensure continuity. Datastores run with replication, hourly snapshots, and disaster recovery (RTO/RPO of 120 minutes). Target uptime of 99.99%.

    * **Performance Under Load:** Search & audit handled by managed Elasticsearch; reporting & analytics run on Redshift—keeping transactions fast. WAF and Cloudflare bot protection secure the perimeter against promo-related bot traffic.

    * **Modern Scaling Practices:** Kubernetes-ready microservices with HPA/VPA pod autoscaling, cluster autoscaler, and safe rollout strategies (blue-green, canary). Rate-limiting, back-pressure, circuit breakers, and exponential backoff prevent overloads during sudden spikes.

    * **Operational Playbook for Peak Events:** Capacity planning and load testing ahead of campaigns. Pre-scaling hot services and pre-warming caches. Partitioned messaging and tuned concurrency to maximize throughput. Real-time observability with APM and alerting (PagerDuty) for proactive autoscaling.
  </Accordion>

  <Accordion title="What options do you offer for scalability and automation (e.g., batch sending, reward scheduling)?">
    The Xoxoday reward payout platform is designed to scale with institutional needs, supporting high-volume reward distribution and automation. Through the self-service admin portal, administrators can upload reward recipient lists in bulk (up to 10,000 records in a single file) or send individual rewards. Automation capabilities include API-triggered sends, scheduling for time-based rewards, and rule-based workflows. Bulk delivery options via email, SMS, or shareable reward links streamline processes, making it ideal for recurring programs, cohort-based campaigns, or seasonal events.
  </Accordion>
</AccordionGroup>

## Reporting

<AccordionGroup>
  <Accordion title="How scalable is the Xoxoday reward payout platform for growing organizations?">
    The Xoxoday reward payout platform is designed to scale effortlessly with growing organizations. As a cloud-hosted, enterprise-grade solution, it can handle expanding user bases and higher transaction volumes without impacting performance. The platform supports a global rewards store that can be customized to meet organizational needs, and the catalog team ensures fast onboarding of new products and categories across geographies.

    While adding new features or integrating with additional tools may require project-based implementation, core functions such as user onboarding, catalog scaling, and reward fulfillment operate autonomously and are built for enterprise-scale performance.
  </Accordion>

  <Accordion title="Can the platform capture user interaction events within the marketplace and support export to a data warehouse?">
    The customer incentive software is designed to support flexible event tracking mechanisms. To ensure accurate export of event data to your enterprise data warehouse, our team would need further clarity on event taxonomy, expected data granularity, and data warehouse integration requirements. Xoxoday can work with your IT/data teams to configure a compliant event capture and delivery workflow based on custom needs.
  </Accordion>
</AccordionGroup>

## Integration

<AccordionGroup>
  <Accordion title="Can transactions made within the rewards catalog trigger loyalty events and share relevant payload details with loyalty systems?">
    Yes, transactions initiated through the Xoxoday reward marketplace can be configured to emit loyalty-related events. During the transaction creation process, you can pass an internal reference ID, which can then be included in the event payload and shared with existing or future loyalty systems. This enables a seamless connection between reward actions and loyalty event tracking, enhancing program integration.
  </Accordion>
</AccordionGroup>

## Reward Transaction

<AccordionGroup>
  <Accordion title="Can all transactions through the rewards catalog be mapped to the correct ledgers, including support for multiple ledger mappings if needed?">
    Yes, the Xoxoday reward payout platform supports automatic logging of all reward transactions into the appropriate ledgers. Each transaction is mapped based on its type—such as wallet recharges, redemptions, or refunds—and reflected accurately in the system. If required, the platform can be configured to reflect transactions across multiple ledgers depending on financial structure or reconciliation needs.
  </Accordion>

  <Accordion title="Are all transactions reflected within each ledger's report to support reconciliation workflows?">
    Absolutely. The Xoxoday customer incentive software offers a unified ledger view that includes all transaction types—redemptions, refunds, wallet top-ups—making reconciliation seamless. Admins can download these reports directly from the dashboard or retrieve them via API. This structure aligns with conventional MIS and reconciliation workflows, ensuring integration with existing financial protocols.
  </Accordion>
</AccordionGroup>


# SMS and WhatsApp Message Pricing
Source: https://help-plum.xoxoday.com/faqs/for-end-users/sms-and-whatsapp-message-pricing

Find answers to frequently asked questions about SMS and WhatsApp message pricing for reward notifications sent via Plum.

\*This document provides an overview of the per-message cost incurred by Xoxoday for sending SMS and WhatsApp notifications related to rewards delivery.

The cost varies by country and channel, as outlined below.\*

## SMS Cost (per message)

<AccordionGroup>
  <Accordion title="What are the SMS costs per message by country?">
    | **Country**          | **Per SMS unit cost (USD)** | **Average Cost per message (USD)** |
    | -------------------- | --------------------------- | ---------------------------------- |
    | India                | \$0.0015                    | \$0.0030                           |
    | United States        | \$0.0037                    | \$0.0088                           |
    | Canada               | \$0.0037                    | \$0.0097                           |
    | South Africa         | \$0.0229                    | \$0.0481                           |
    | Maldives             | \$0.0488                    | \$0.0488                           |
    | Turkey               | \$0.0270                    | \$0.0514                           |
    | Thailand             | \$0.0246                    | \$0.0532                           |
    | Qatar                | \$0.0477                    | \$0.0562                           |
    | Denmark              | \$0.0424                    | \$0.0635                           |
    | Bahrain              | \$0.0234                    | \$0.0642                           |
    | United Kingdom       | \$0.0288                    | \$0.0658                           |
    | Guatemala            | \$0.0455                    | \$0.0683                           |
    | Australia            | \$0.0298                    | \$0.0835                           |
    | Brazil               | \$0.0303                    | \$0.0835                           |
    | South Korea          | \$0.0325                    | \$0.0858                           |
    | Poland               | \$0.0381                    | \$0.0890                           |
    | Puerto Rico          | \$0.0418                    | \$0.0977                           |
    | Singapore            | \$0.0353                    | \$0.1012                           |
    | Czech Republic       | \$0.0548                    | \$0.1048                           |
    | Saudi Arabia         | \$0.0553                    | \$0.1112                           |
    | Malta                | \$0.0562                    | \$0.1123                           |
    | Costa Rica           | \$0.0418                    | \$0.1228                           |
    | Kenya                | \$0.0562                    | \$0.1246                           |
    | China                | \$0.0230                    | \$0.1257                           |
    | Taiwan               | \$0.0427                    | \$0.1262                           |
    | Mexico               | \$0.0442                    | \$0.1298                           |
    | Portugal             | \$0.0446                    | \$0.1308                           |
    | Croatia              | \$0.0513                    | \$0.1367                           |
    | Greece               | \$0.0548                    | \$0.1385                           |
    | Ukraine              | \$0.1249                    | \$0.1400                           |
    | Sweden               | \$0.0557                    | \$0.1452                           |
    | Morocco              | \$0.0565                    | \$0.1471                           |
    | United Arab Emirates | \$0.0596                    | \$0.1525                           |
    | Hong Kong            | \$0.0539                    | \$0.1540                           |
    | Italy                | \$0.0603                    | \$0.1632                           |
    | Slovakia             | \$0.0556                    | \$0.1668                           |
    | Finland              | \$0.0708                    | \$0.1680                           |
    | Japan                | \$0.0696                    | \$0.1696                           |
    | Switzerland          | \$0.0585                    | \$0.1708                           |
    | Argentina            | \$0.0606                    | \$0.1769                           |
    | Austria              | \$0.0692                    | \$0.1792                           |
    | Ireland              | \$0.0640                    | \$0.1803                           |
    | Romania              | \$0.0625                    | \$0.1811                           |
    | Spain                | \$0.0637                    | \$0.1834                           |
    | France               | \$0.0659                    | \$0.1841                           |
    | Bolivia              | \$0.0640                    | \$0.1851                           |
    | Netherlands          | \$0.0845                    | \$0.2127                           |
    | Malaysia             | \$0.0778                    | \$0.2142                           |
    | Belgium              | \$0.0881                    | \$0.2246                           |
    | New Zealand          | \$0.0881                    | \$0.2307                           |
    | Kuwait               | \$0.0814                    | \$0.2442                           |
    | Lebanon              | \$0.0814                    | \$0.2442                           |
    | Germany              | \$0.0904                    | \$0.2514                           |
    | Israel               | \$0.0947                    | \$0.2539                           |
    | Pakistan             | \$0.1559                    | \$0.2560                           |
    | Hungary              | \$0.0873                    | \$0.2600                           |
    | Bulgaria             | \$0.1158                    | \$0.2702                           |
    | Nepal                | \$0.1133                    | \$0.2833                           |
    | Mauritius            | \$0.1302                    | \$0.2864                           |
    | Oman                 | \$0.0955                    | \$0.2864                           |
    | Egypt                | \$0.1040                    | \$0.3021                           |
    | Myanmar              | \$0.1009                    | \$0.3027                           |
    | Vietnam              | \$0.1102                    | \$0.3202                           |
    | Sri Lanka            | \$0.1795                    | \$0.3508                           |
    | Jordan               | \$0.1337                    | \$0.3674                           |
    | Philippines          | \$0.1328                    | \$0.3941                           |
    | Bangladesh           | \$0.1729                    | \$0.4593                           |
    | Indonesia            | \$0.2490                    | \$0.5452                           |

    **Notes:**

    * SMS costs represent the **per-unit cost** and Average cost per message charged to Xoxoday.
    * These rates may vary slightly depending on carrier and message length.
  </Accordion>
</AccordionGroup>

## WhatsApp cost (per message)

<AccordionGroup>
  <Accordion title="What are the WhatsApp costs per message by country?">
    | **Country**          | **WhatsApp Cost USD** |
    | -------------------- | --------------------- |
    | India                | \$0.0020              |
    | United States        | \$0.0116              |
    | Canada               | \$0.0116              |
    | South Africa         | \$0.0068              |
    | Maldives             | \$0.0350              |
    | Turkey               | \$0.0075              |
    | Thailand             | \$0.0350              |
    | Qatar                | \$0.0151              |
    | Denmark              | \$0.0312              |
    | Bahrain              | \$0.0151              |
    | United Kingdom       | \$0.0296              |
    | Guatemala            | \$0.0365              |
    | Australia            | \$0.0350              |
    | Brazil               | \$0.0261              |
    | South Korea          | \$0.0350              |
    | Poland               | \$0.0457              |
    | Puerto Rico          | \$0.0365              |
    | Singapore            | \$0.0350              |
    | Czech Republic       | \$0.0457              |
    | Saudi Arabia         | \$0.0100              |
    | Malta                | \$0.0312              |
    | Costa Rica           | \$0.0365              |
    | Kenya                | \$0.0123              |
    | China                | \$0.0350              |
    | Taiwan               | \$0.0350              |
    | Mexico               | \$0.0200              |
    | Portugal             | \$0.0312              |
    | Croatia              | \$0.0457              |
    | Greece               | \$0.0312              |
    | Ukraine              | \$0.0457              |
    | Sweden               | \$0.0312              |
    | Morocco              | \$0.0123              |
    | United Arab Emirates | \$0.0134              |
    | Hong Kong            | \$0.0350              |
    | Italy                | \$0.0311              |
    | Slovakia             | \$0.0457              |
    | Finland              | \$0.0312              |
    | Japan                | \$0.0350              |
    | Switzerland          | \$0.0312              |
    | Argentina            | \$0.0303              |
    | Austria              | \$0.0312              |
    | Ireland              | \$0.0312              |
    | Romania              | \$0.0457              |
    | Spain                | \$0.0283              |
    | France               | \$0.0564              |
    | Bolivia              | \$0.0365              |
    | Netherlands          | \$0.0587              |
    | Malaysia             | \$0.0120              |
    | Belgium              | \$0.0312              |
    | New Zealand          | \$0.0350              |
    | Kuwait               | \$0.0151              |
    | Lebanon              | \$0.0151              |
    | Germany              | \$0.0627              |
    | Israel               | \$0.0143              |
    | Pakistan             | \$0.0051              |
    | Hungary              | \$0.0457              |
    | Bulgaria             | \$0.0457              |
    | Nepal                | \$0.0350              |
    | Mauritius            | \$0.0123              |
    | Oman                 | \$0.0151              |
    | Egypt                | \$0.0050              |
    | Myanmar              | \$0.0350              |
    | Vietnam              | \$0.0350              |
    | Sri Lanka            | \$0.0350              |
    | Jordan               | \$0.0151              |
    | Philippines          | \$0.0350              |
    | Bangladesh           | \$0.0350              |
    | Indonesia            | \$0.0249              |

    **Notes:**

    * WhatsApp cost is **per session message**, billed based on conversation category (utility, marketing, authentication).
    * Prices are calculated based on Meta's Business API rates and Xoxoday's provider markup.
    * The cost reflects **average per-message delivery** charges.
  </Accordion>
</AccordionGroup>


# For Merchants
Source: https://help-plum.xoxoday.com/faqs/offer-management/faqs-offer-management-for-merchants

Find answers to frequently asked questions about using Plum's Offers Management portal as a registered merchant.

*Get quick answers to questions on Merchant platform*

## Getting Started

<AccordionGroup>
  <Accordion title="What is Xoxoday's merchant offer solution and how does it help merchants create offers digitally?">
    The Xoxoday offer management solution is an end-to-end digital platform that allows banks, payment providers, and reward platforms to launch, manage, and track merchant-funded offers seamlessly — all in one place. Designed for scalability and speed, it enables businesses to deliver personalised, data-driven promotions to their customers without operational complexity. Built with enterprise-grade architecture, the platform simplifies offer creation, automates validation, and improves customer engagement through real-time analytics and omnichannel distribution.

    Key highlights of the Xoxoday offer management solution include:

    * **Comprehensive offer creation:** Merchants can create digital offers, vouchers, and discounts across categories like fixed-value, percentage-based, and product-specific promotions.
    * **Omnichannel distribution:** Publish and share offers across websites, apps, emails, SMS, and social media with personalised URLs and QR codes.
    * **Merchant & customer management:** Simplifies onboarding, approval workflows, and redemptions with secure role-based access and store-level PIN validation.
    * **Smart analytics & reporting:** Access real-time dashboards to monitor redemptions, customer behaviour, and campaign ROI to make data-driven decisions.
    * **Flexible deployment:** Available as a white-labelled, mobile-responsive solution supporting multi-language and multi-currency environments across 175+ countries.
    * **Global scalability & security:** With 250+ integrations and enterprise-grade privacy settings, it guarantees seamless compatibility and compliance across diverse markets. Overall, the Xoxoday offer management solution streamlines how organisations deliver and measure promotional campaigns — reducing go-to-market time from weeks to minutes while driving higher engagement, conversions, and customer loyalty.
  </Accordion>
</AccordionGroup>

## Campaign & Offer Management

<AccordionGroup>
  <Accordion title="Can campaign owners add or remove users as pre-live testers to configure campaigns before going live?">
    Yes, administrators can create test cohorts of users who receive the campaign offers before the public launch. This allows thorough validation of configurations, rules, and notifications. The pre-live testing environment helps ensure that everything functions smoothly once the campaign goes live, all within the Xoxoday platform for merchant funded offers.
  </Accordion>

  <Accordion title="Can users create dynamic variables for notifications (SMS, Push, In-App) regarding claimed rewards, expiring vouchers, and system alerts?">
    Yes, the platform provides robust support for dynamic, event-based notifications. Campaign managers can personalize messages using variables like user name, voucher code, or expiry date. These messages can be sent via SMS, push notifications, or in-app alerts for events like reward claim confirmations, upcoming voucher expirations, or system-level updates. This ensures real-time, relevant communication tailored to each user through Xoxoday's merchant campaign management software.
  </Accordion>

  <Accordion title="Can users fund one or more campaigns simultaneously?">
    Yes. The platform for merchant funded offers by Xoxoday allows users to fund one or multiple campaigns at the same time. Users can allocate funds to each campaign individually based on their preferences and specify the amount for each.
  </Accordion>

  <Accordion title="Can users withdraw campaign funds back to a nominated bank account?">
    Yes. The merchant payout automation software by Xoxoday provides wallet debit APIs that allow users to initiate fund withdrawals to a nominated bank account. All debit transactions are recorded in the wallet for reconciliation and transparency.
  </Accordion>

  <Accordion title="Can users create a message template and set message queue priorities?">
    Yes. Message template creation is supported, allowing campaign owners to standardize communications. However, prioritizing the delivery queue of messages is not currently available as a built-in feature. If required, this functionality can be developed through custom configuration on the Xoxoday platform for merchant funded offers.
  </Accordion>

  <Accordion title="Can campaigns or contracts be assigned pricing models such as subscription-based, time-based, or usage-based?">
    Yes. The solution for merchant offer creation by Xoxoday enables businesses to apply pricing models such as subscription, time-based, or usage-based at the campaign or contract level. Once pricing definitions and dependencies are finalized, the system will be configured to support these billing structures.
  </Accordion>

  <Accordion title="Can users create campaigns with custom durations, recurring schedules, exclusivity, item/branch targeting, and task-based logic?">
    Yes. The platform for merchant funded offers by Xoxoday allows users to build highly customized campaigns. Features include defining campaign periods, setting up recurring schedules (e.g., every day or every few hours), restricting access to exclusive customer segments, targeting specific SKUs or branches, and enabling task-based offer logic.
  </Accordion>

  <Accordion title="Can users group campaigns and assign different prizes with varied claim limits and eligibility?">
    Yes. Grouping campaigns to assign multiple prizes with different claim limits and eligibility rules is supported.
  </Accordion>

  <Accordion title="How can merchants customize offers to match their brand identity?">
    Merchants can fully customize their offer templates to align with their brand's visual identity and campaign objectives. The platform enables selection from diverse coupon styles and layouts, allowing businesses to integrate their logo, brand colors, and messaging. It supports multiple offer types — such as fixed-value discounts, percentage-based offers, product-specific promotions, and free-format vouchers — ensuring every campaign looks and feels unique. These configurations can be adjusted instantly from the admin dashboard for greater creative flexibility.
  </Accordion>

  <Accordion title="How can campaigns be distributed across multiple channels?">
    The Xoxoday solution enables seamless omnichannel campaign distribution through websites, mobile apps, email, SMS, and social media. With just a few clicks, merchants can launch live campaigns and share personalized URLs or QR codes generated automatically by the system. These features make it easy for customers to discover, claim, and redeem offers both online and in-store, driving engagement and accelerating campaign visibility.
  </Accordion>

  <Accordion title="How can businesses reach and engage a wider audience with their offers?">
    The Xoxoday merchant-funded offers platform allows businesses to share promotions directly with their existing customer base and publish them across partner ecosystems to reach new audiences. Once published, offers begin generating high-quality, engaged traffic within hours. With proven mechanics that enhance conversion rates, merchants can leverage audience segmentation and targeting capabilities to maximize visibility and customer acquisition at scale.
  </Accordion>
</AccordionGroup>

## Gift Voucher & Promo Codes

<AccordionGroup>
  <Accordion title="What functionalities does the platform offer for gift voucher creation?">
    The Xoxoday platform for merchant funded offers supports a wide range of use cases for digital gift voucher creation and management. These include:

    * Creating electronic gift cards for marketplaces and campaigns
    * Uploading existing gift card voucher codes for use in promotions
    * Digitalizing physical gift cards or vouchers
    * Creating new digital gift cards based on inputs from previously issued ones
    * Configuring flexible validity periods, including rounding validity to month-end
    * Generating gift voucher codes and integrating with SMS/Email gateways to communicate these codes to customers
    * Enabling self-upload of voucher code lists
    * System-generated gift vouchers with preset denominations and code stock
    * Distributing vouchers via a white-labeled marketplace
    * Customizing marketplace selections and defining discounts
    * Sending vouchers via email campaigns
    * Defining campaign details and customer segments using customer data from retailers
  </Accordion>

  <Accordion title="How does the platform enable bulk generation of gift voucher codes?">
    The Xoxoday merchant reward program software facilitates bulk generation of gift voucher codes with user-defined denominations, code quantities, and downloadable reports. Additional capabilities include:

    * Blocking and unblocking gift voucher codes
    * Extending gift voucher validity
    * Viewing and editing gift card configurations
    * Downloading the list of voucher codes
    * Publishing or unpublishing gift cards directly within the platform
  </Accordion>

  <Accordion title="Can users seed real-time vouchers as single items, in bulk, or after a triggered event?">
    Yes, the platform allows users to distribute vouchers in multiple ways: as single items, in bulk batches, or automatically triggered by specific events. This flexibility enables targeted and timely engagement across different customer segments using Xoxoday merchant campaign management software.
  </Accordion>

  <Accordion title="Can users provide static or dynamic promo codes that offer discounts or SKU-level benefits?">
    Yes, the Xoxoday platform for merchant reward programs supports both static and dynamic promo code configurations. Campaign creators can issue common codes for mass distribution or auto-generate unique, single-use codes. Promo codes can be configured to offer fixed discounts, percentage discounts, or product/SKU-specific offers. Additionally, users can apply these codes across specific stores, merchants, or audience groups with customized redemption rules.
  </Accordion>

  <Accordion title="How can merchants list and sell vouchers on the rewards marketplace?">
    The software for merchant reward programs enables merchants to list and sell vouchers from various categories directly on a digital rewards marketplace. Merchants gain access to a wide customer base and can promote their offerings through targeted campaigns. The solution also supports localized redemption, omnichannel voucher delivery, and real-time performance tracking, making it a scalable tool for merchant acquisition and engagement.
  </Accordion>

  <Accordion title="How do merchants manage voucher inventory across categories and types?">
    The solution for merchant offer creation includes a robust inventory management module. Merchants can efficiently organize vouchers by categories (e.g., food, fashion), voucher types (e.g., digital, physical), and industries. This structured view enhances visibility and control, allowing merchants to optimize voucher availability and marketing efforts.
  </Accordion>

  <Accordion title="Can merchants manage the lifecycle of voucher orders including pending, cancelled, and completed?">
    Yes, the merchant payout automation software provides end-to-end order management capabilities. Merchants can track every stage of an order—whether it's pending, cancelled, or completed—through a centralized dashboard. This helps streamline operations, reduce manual overhead, and improve customer satisfaction through timely order handling.
  </Accordion>

  <Accordion title="How can merchants monitor voucher transaction performance in real time?">
    The software for merchant campaigns offers advanced analytics tools that let merchants monitor transaction orders in real time. They can access key metrics such as sales volume, redemption rates, and campaign performance. This enables data-driven decisions, proactive stock adjustments, and strategic optimization of voucher promotions.
  </Accordion>
</AccordionGroup>

## Customer Engagement & Loyalty

<AccordionGroup>
  <Accordion title="What customer engagement and retention tools are available in the merchant payout automation software?">
    The platform includes built-in customer engagement and loyalty tools to help merchants retain and grow their customer base. These include reward points, cashback campaigns, personalized offer targeting, referral programs, and automated notifications to keep customers engaged at every touchpoint. Merchants can also run segmented campaigns and track performance in real time to optimize retention strategies.
  </Accordion>
</AccordionGroup>

## Merchant Onboarding & Management

<AccordionGroup>
  <Accordion title="Can internal teams grant access to merchants who want to sell in the marketplace?">
    Yes, internal teams can easily onboard merchants by granting them access through the admin console. The system supports role-based access control, allowing internal users to define merchant permissions, assign contract terms, and manage activation workflows seamlessly.
  </Accordion>

  <Accordion title="Can the platform for merchant funded offers support building a network of merchants across diverse segments?">
    Yes. The Xoxoday solution for merchant offer creation enables businesses to build and manage a vast merchant ecosystem across verticals such as:

    * Travel, retail, wellness, healthcare, dining, and lifestyle
    * Dynamic onboarding of merchants and partners
    * Configurable discount structures tailored to different segments
    * Customer access to exclusive benefits and reward privileges

    This multi-segment approach enhances customer engagement and drives brand affinity while ensuring compliance with data privacy and security protocols.
  </Accordion>
</AccordionGroup>

## Financial & Wallet Management

<AccordionGroup>
  <Accordion title="Can the platform charge campaigns or contracts based on a prefunded or postpaid model?">
    Yes. The platform for merchant funded offers by Xoxoday supports both prefunded and postpaid charging models at the campaign or contract level. Users can define the applicable charging method, and the invoicing and settlement process will be configured accordingly.
  </Accordion>

  <Accordion title="Can users generate and settle invoices within the platform?">
    Yes. The platform offers automated invoice generation and settlement capabilities. Users can view campaign-level billing details, download invoices, and settle payments through integrated payment gateways or wallet balances.
  </Accordion>

  <Accordion title="How does the wallet solution enable funding from various bank accounts?">
    The Xoxoday wallet solution for merchant campaigns integrates with prefunding and invoicing systems to support multi-bank funding.

    Merchants can:

    * Nominate local, digital, or international banks to fund end-customer wallets.
    * Use third-party payment gateway integration to manage prefunding workflows.
  </Accordion>

  <Accordion title="Can users fund their customer wallet using a nominated bank account?">
    Yes. Through its third-party payment gateway integration, Xoxoday enables users to directly fund a customer wallet using their nominated bank account. This ensures seamless wallet top-ups while maintaining complete traceability and security across all funding actions.
  </Accordion>
</AccordionGroup>

## Reports and Analytics

<AccordionGroup>
  <Accordion title="How can merchants measure offer performance and optimize campaigns?">
    The Xoxoday solution provides advanced reporting and analytics tools that deliver deep insights into campaign performance and return on investment. Merchants can monitor key metrics such as clicks, views, redemptions, and customer interactions in real time. The platform highlights friction points across the customer journey, enabling data-driven optimizations for higher engagement and better conversion rates. Additionally, dynamic dashboards and exportable reports make it easy to evaluate offer success and fine-tune future campaigns.
  </Accordion>
</AccordionGroup>


# For Admins
Source: https://help-plum.xoxoday.com/faqs/offer-management/offer-management-for-admins-faqs

Find answers to frequently asked questions about managing Plum's Offers Management portal as an account admin.

*Get quick answers to questions on Loopr Admin platform*

## Overview

<AccordionGroup>
  <Accordion title="What are the key capabilities of the Xoxoday offer management solution?">
    The Xoxoday offer management solution is a comprehensive platform that helps businesses design, manage, and optimize their merchant-funded reward and offer programs. It supports a wide range of campaign types — from transactional incentives to behavioral rewards — ensuring flexibility and scalability.

    Key capabilities include:

    * **Flexible offer creation:** Design diverse reward programs aligned with your business objectives.
    * **Behavioral targeting:** Encourage specific customer actions through personalized, data-driven offers.
    * **Advanced analytics:** Gain full visibility into KPIs, ROI, and customer engagement metrics.
    * **Continuous optimization:** Identify performance trends and make real-time adjustments to enhance outcomes.
    * **Scalable infrastructure:** Manage multiple campaigns, merchants, and customer segments seamlessly across geographies.
  </Accordion>
</AccordionGroup>

## Campaign & Platform Management

<AccordionGroup>
  <Accordion title="Does the platform support a Maker role for campaign creation, budgeting, and promo code setup?">
    Yes, Xoxoday's merchant offer automation platform supports role-based access control, including a Maker role. Users with this role can:

    * Create and configure new campaigns
    * Define budgets and allocate funds
    * Generate and assign promo codes

    All Maker actions require approval from an assigned Approver role before execution.
  </Accordion>

  <Accordion title="Can users customize error messages at the campaign level?">
    Yes, users can fully customize error messages specific to each campaign. This includes setting messaging for different failure scenarios such as invalid promo codes, expired offers, or redemption issues. Personalized error handling improves clarity and user experience across campaigns managed through Xoxoday merchant offer automation software.
  </Accordion>

  <Accordion title="Is there a super admin role for managing the entire portal or account?">
    Yes. The platform provides a Super Admin role with full access and control over all modules, user roles, campaigns, and configurations within the account.
  </Accordion>

  <Accordion title="Can user views and access be restricted based on company or group affiliation?">
    Yes. User access can be restricted or customized based on company or group affiliation, ensuring proper governance and data visibility control.
  </Accordion>

  <Accordion title="What makes the Xoxoday platform for merchant offer creation uniquely different from others?">
    The platform stands out for its end-to-end campaign and offer management capabilities, real-time reporting, seamless merchant onboarding, multi-segment support, automated communication, and advanced rule configuration. It enables businesses to build, scale, and optimize their offer ecosystem efficiently while ensuring compliance and data security.
  </Accordion>

  <Accordion title="Can the operations team perform single or batch voucher recovery, check voucher/promo status, extend promo codes, and generate new or test codes?">
    Yes, Xoxoday's merchant campaign management software enables operations teams to:

    * View voucher and promo code status
    * Perform batch voucher recovery and extend expiry dates
    * Generate additional promo codes for ongoing campaigns
    * Create test codes for UAT or internal QA purposes
  </Accordion>
</AccordionGroup>

## Integration

<AccordionGroup>
  <Accordion title="How does the Xoxoday solution integrate with partner ecosystems and merchant networks?">
    The Xoxoday merchant-funded offers platform enables smooth integration between brands, merchants, and partner ecosystems, making it simple to publish and manage offers across multiple touchpoints.

    Integration highlights:

    * **Unified merchant portal:** Merchants can easily connect with brands to share discounts, promotions, and exclusive deals.
    * **Automated publishing:** Offers appear instantly across connected digital storefronts or marketplaces, expanding merchant visibility.
    * **SME enablement:** Simplifies onboarding for small and medium businesses, helping them reach customers more efficiently.
    * **Seamless synchronization:** All offers remain up to date across channels, ensuring a consistent customer experience.
    * **Enhanced reach:** Strengthens partnerships and boosts engagement through collaborative reward ecosystems.
  </Accordion>
</AccordionGroup>

## Reports

<AccordionGroup>
  <Accordion title="How can users view and extract transaction and summary reports for disbursements, usage, and errors?">
    Xoxoday's platform for merchant funded offers provides users with the ability to view, generate, and export both transaction-level and summary reports through the Reports module.

    The system supports:

    * **Disbursement Reports:** Track the issuance of vouchers across customers.
    * **Usage Reports:** Monitor redemptions, claim trends, and offer performance in real time.
    * **Error Logs:** View logs such as failed shares, offer expiration, and redemption failures.
    * **Filtering & Drill-Down:** Apply filters like date range, campaign, or store-level views for granular insights.
    * **Export Options:** Reports can be downloaded in CSV or Excel formats for offline analysis or external integration.
  </Accordion>
</AccordionGroup>


# For End Users
Source: https://help-plum.xoxoday.com/faqs/offer-management/offer-management-for-customers-faqs

Find answers to frequently asked questions about browsing and redeeming offers as a customer on the Plum platform.

*Get quick answers for commonly asked questions on Loopr customer portal*

<AccordionGroup>
  <Accordion title="Can users pay with multiple vouchers or fully redeem transactions using only vouchers?">
    Yes, the platform supports multi-voucher payments, enabling customers to combine multiple vouchers in a single transaction. They can also redeem the entire transaction amount using vouchers alone, providing a seamless and flexible payment experience powered by Xoxoday's merchant payout automation software.
  </Accordion>

  <Accordion title="How can users view, search, and manage voucher purchases on the platform?">
    The platform for merchant funded offers provides users with an intuitive marketplace dashboard. Through this unified interface, users can browse all available vouchers, search specific vouchers by name or category, and access essential details like denominations, redemption instructions, and expiry dates. Users can also review their purchase history and monitor voucher delivery status, ensuring full transparency and control over their transactions.
  </Accordion>
</AccordionGroup>


# Privacy and Security
Source: https://help-plum.xoxoday.com/faqs/security-compliance/privacy-and-security

Find answers to frequently asked questions about Plum's privacy and security practices for protecting user data.

*Get quick answers to your questions relating to Privacy and Security on Xoxoday Plum.*

## Data

<AccordionGroup>
  <Accordion title="Where is customer data stored geographically?">
    The Xoxoday rewards, incentives, and payout platform ensures secure, compliant, and globally accessible data hosting infrastructure through Amazon Web Services (AWS).

    Key aspects of data storage include:

    * **Primary Data Centers in the United States:** All customer data is stored on AWS cloud infrastructure, with primary hosting facilities located within the United States.
    * **High Availability and Redundancy:** The platform leverages AWS's geographically distributed data centers to ensure business continuity, high availability, and disaster recovery.
    * **ISO 27001 and SOC 2 Compliance:** All hosting infrastructure complies with globally recognized data protection and security standards.
    * **Data Encryption:** Customer data is encrypted both in transit (via TLS 1.2) and at rest (via AES-256 encryption), ensuring maximum security.
    * **Optional Regional Hosting:** For enterprise clients, data can also be hosted in other jurisdictions such as Singapore or the European Union, based on compliance and data residency requirements.

    This architecture ensures that customer data is protected by rigorous physical, administrative, and technical safeguards as outlined by AWS.

    Learn more: [https://aws.amazon.com/trust-center/data-center/our-controls/](https://aws.amazon.com/trust-center/data-center/our-controls/)
  </Accordion>
</AccordionGroup>

## Data, Policy and Privacy

<AccordionGroup>
  <Accordion title="What are Xoxoday's data security practices?">
    Xoxoday follows a comprehensive, enterprise-grade information security framework to fully protect customer and end-user data.

    Core data security practices:

    * **Certifications:** ISO 27001, SOC 2 Type II, GDPR-compliant
    * **Encryption:** AES-256 for data at rest; TLS 1.2+ for data in transit
    * **Access Management:** Role-based access control (RBAC), Multi-factor authentication (MFA), Least privilege principle, Regular access reviews and logs
    * **Cloud Infrastructure:** Hosted on AWS with VPC isolation and auto-scaling; Monitored using real-time security event tracking and anomaly detection
    * **Data Retention & Deletion:** Aligned with client contracts, GDPR, and PIPL retention requirements
    * **Audits & Testing:** Periodic internal audits, Annual third-party vulnerability assessments, Penetration testing and risk remediation workflows
    * **Incident Management:** Structured incident response plan with SLA-bound notification and containment steps
    * Ensures high availability, confidentiality, and integrity of data across all geographies and client use cases
  </Accordion>

  <Accordion title="Does the customer retain copyright on customizations made to the platform?">
    All proprietary rights, including customizations built within the Xoxoday gift card marketplace or customer incentive software framework, remain with the platform provider. Clients may use these customizations as part of their subscription but do not acquire ownership of the platform's source code or IP.
  </Accordion>

  <Accordion title="How does the platform maintain detailed records of transactions for audit and compliance purposes?">
    The Xoxoday customer rewards platform keeps comprehensive logs of all payments, user actions, and redemptions, ensuring audit readiness, transparency, and compliance. Authorized administrators can access these records anytime via the reporting dashboard.
  </Accordion>

  <Accordion title="Where can I find the privacy policy or product/service privacy notice for the platform?">
    Xoxoday's privacy notice is publicly accessible via its official website and outlines its full commitment to data privacy and user rights.

    Privacy notice includes:

    * The types of personal data collected across services.
    * Purposes for data processing (e.g., reward fulfillment, communication, analytics).
    * Legal basis under GDPR, CCPA, and other applicable frameworks.
    * User rights and instructions for submitting access or deletion requests.
    * Contact details for privacy and data protection queries.

    The privacy policy can be accessed on [https://www.xoxoday.com/security](https://www.xoxoday.com/security)
  </Accordion>
</AccordionGroup>

## AI Data Security

<AccordionGroup>
  <Accordion title="Can sensitive data be removed from your solution's AI model upon request?">
    Yes, the Xoxoday rewards, incentives, and payout platform is designed with enterprise-grade data governance and compliance frameworks that support the removal or de-identification of sensitive data from AI models and systems, upon valid customer requests. Below is a breakdown by product.

    * **Xoxoday Rewards, Incentives, and Payout Platform:** Data deletion upon request: The platform supports data subject rights under regulations like GDPR and CCPA, including the right to erasure ("right to be forgotten"), which applies to both structured and unstructured data—including inputs processed by AI systems. Model behavior isolation: LLM-based AI features do not persist user-specific training data beyond a session scope. Multi-tenant architecture ensures each client's data is logically segregated with encryption keys per tenant.

    * **Employee Engagement Platform:** PII sanitization via content moderation: Em's AI scans and blocks the ingestion of personally identifiable information before it's processed by internal models. Consent-based AI processing allows user or admin-led revocation of processed data. Data control APIs allow admins to raise requests to remove engagement logs and user-generated content used in AI training.

    * **Sales Incentives Platform:** Custom dashboards and reports built through natural language queries do not permanently train AI models on client data. These are temporarily cached and can be purged or redacted based on user role or admin request.

    * **Loyalty Platform:** All customer data used in AI-driven segmentation or CLTV prediction models can be excluded or deleted upon request, thanks to configurable segmentation rules and data access policies.

    * **Merchant Offer Platform:** AI modules that use personalization logic operate within secure, tenant-specific boundaries. Sensitive user or partner data involved in offer targeting can be excluded or wiped via admin-level operations or customer success support.
  </Accordion>

  <Accordion title="Is user input data used to influence or train the AI model within your platform?">
    Xoxoday uses user input data to enhance feature performance and personalization, not to train generalized or foundational AI models.

    * **Purpose:** Data is leveraged for smart recommendations, sentiment analysis, predictive analytics, and engagement insights.
    * **Patterns used:** Recognition activity, reward redemptions, and survey feedback inform contextual outputs.
    * **Personalization focus:** Inputs are applied to improve user-specific experiences within the platform.
    * **Examples:** Skill mapping from recognition messages, reward suggestions based on behavior, and predictive trends for retention and engagement.
  </Accordion>

  <Accordion title="Does your platform provide logging for AI features, including user actions, dates, and timestamps?">
    Yes. The platform provides real-time analytics and reporting with detailed user activity logs.

    * AI Co-pilot tracks active users, pending nominations, award givers/receivers, budget utilization, and engagement reports
    * Logs are time-bound and actionable, helping admins monitor AI usage over time
    * Supports auditability and transparency, with timestamped logs available for compliance needs
  </Accordion>

  <Accordion title="Do you have documented technical and procedural processes to address potential negative impacts of AI as described by the AI Risk Management Framework (RMF)?">
    Yes. Xoxoday's AI solutions follow responsible AI practices aligned with the NIST AI Risk Management Framework.

    * Safety checks are built into AI features for content moderation, fraud detection, and decision transparency
    * Technical safeguards include anomaly detection, rule-based overrides, and configurable escalation protocols
    * Procedural controls allow workflows to be flagged, paused, or escalated for manual oversight
    * AI outputs are designed for explainability, ensuring interpretability and auditability
  </Accordion>

  <Accordion title="Does the platform process protected health information (PHI) or any data under HIPAA compliance?">
    Yes. The Xoxoday rewards, incentives, and payout platform is capable of processing Protected Health Information (PHI) in compliance with the Health Insurance Portability and Accountability Act (HIPAA) when required by the client's use case. The platform's design, infrastructure, and operational processes incorporate the necessary safeguards to protect sensitive healthcare data. This includes:

    * **HIPAA compliance framework** – implemented controls and processes aligned with HIPAA's Privacy, Security, and Breach Notification Rules.
    * **Data encryption** – PHI is encrypted both in transit (using TLS protocols) and at rest (using AES-256 encryption) to prevent unauthorized access.
    * **Access control measures** – role-based access controls (RBAC) and multi-factor authentication (MFA) restrict PHI access to authorized personnel only.
    * **Audit logging and monitoring** – comprehensive logging of system access, data interactions, and administrative actions for accountability and traceability.
    * **Secure hosting environment** – cloud infrastructure hosted on ISO 27001 and SOC 2 Type 2 certified data centers with strong physical and network security controls.
    * **Data segregation** – multi-tenant architecture with logical separation of client data, ensuring PHI is isolated and protected from other tenants.
    * **Incident response protocols** – documented procedures to identify, contain, and report any potential data breaches in compliance with HIPAA requirements.
    * **Business Associate Agreement (BAA)** – available for clients in the healthcare sector who require contractual assurance of HIPAA compliance.
  </Accordion>
</AccordionGroup>

## System Requirement

<AccordionGroup>
  <Accordion title="Does Xoxoday reward payout solution meet all regulatory recordkeeping and reporting requirements applicable to the vendor?">
    The system is designed to comply with all regulatory recordkeeping and reporting standards applicable to vendors in the rewards and incentive space. It incorporates robust mechanisms to ensure accurate documentation, timely reporting, and data traceability. Whether it's audit trails, transaction logs, or compliance records, the platform maintains structured data practices that fulfill regulatory obligations. If there are specific regulatory needs, the customer incentive software team is open to customizing workflows or discussing tailored solutions.
  </Accordion>

  <Accordion title="How does the system ensure confidentiality of sensitive research data and human subject information?">
    The platform upholds high standards of data confidentiality and privacy for research participants. It utilizes end-to-end encryption, RBAC, anonymization techniques, and audit logs to ensure all sensitive data, including that of human subjects, is secured and de-identified where required. By applying secure design principles and adhering to data protection frameworks, the solution guarantees compliance with confidentiality requirements for human research data.
  </Accordion>

  <Accordion title="Are you PCI-DSS compliant?">
    The platform is not required to comply with PCI-DSS standards, as it does not collect, store, or process sensitive payment card data. Instead, all reward transactions are securely managed through the Xoxoday reward payout platform using industry-standard encryption and compliance protocols to ensure safety and integrity.
  </Accordion>

  <Accordion title="Can the system scale efficiently during promotions or seasonal spikes in traffic?">
    Yes, Xoxoday is built for scalability and is capable of handling large user bases and high transaction volumes. The system currently supports over 10,000 transactions per minute and includes auto-scaling infrastructure to handle demand surges during promotions, campaigns, or seasonal reward cycles.

    Xoxoday's Platforms are engineered for horizontal scale and seasonal spikes in traffic. The core architecture uses containerized microservices, async messaging, and caching so components can scale independently and absorb spikes without blocking user flows. High-availability is built in with active-active deployment across availability zones, fronted by an AWS Application Load Balancer, plus managed Kafka, Redis, and Elasticsearch to decouple workloads and keep latency low during traffic surges. Datastores run with replication, snapshots, and DR, and the estate is continuously watched via APM/monitoring with PagerDuty alerts; target uptime is 99.99% with RTO/RPO of 120 minutes.

    How we handle Seasonal Spikes in Traffic:

    * Stateless services scale out behind the ALB; critical data is cached to avoid database hot spots.
    * Kafka-backed queues smooth "flash-sale" style traffic; consumers scale horizontally to drain backlogs.
    * Search & audit workloads are offloaded to managed Elasticsearch; analytics run on Redshift so reporting never competes with transactions.
    * WAF/Bot protection (Cloudflare) shields the perimeter, important during promos when bot traffic rises.

    **Kubernetes & modern scaling practices:** Our microservices are containerized and orchestrator-ready; for K8s-based deployments we apply industry patterns such as HPA/VPA for pod autoscaling, cluster autoscaler, Pod Disruption Budgets, readiness/liveness probes, and rolling/canary or blue-green rollouts. We also employ rate-limiting, back-pressure, circuit breakers, and exponential backoff to prevent thundering-herd effects.

    **Operational playbook for peak events:** Capacity planning & load tests ahead of campaigns; pre-scaling hot services and pre-warming caches. Messaging partitioning & consumer concurrency tuning to raise throughput without impacting latency. Read replicas/replication on primary databases; hourly snapshots and cross-AZ DR safeguard data while allowing scale. Real-time observability with APM + alerting to spot hotspots early and autoscale safely.
  </Accordion>
</AccordionGroup>

## Legal

<AccordionGroup>
  <Accordion title="Can high-denomination physical Visa gift cards (e.g., $1,000–$1,500) be sourced if needed?">
    The Xoxoday gift card solution can support high-value physical Visa cards, but denomination limits vary by issuing partner and region. We recommend confirming availability and legal compliance during onboarding for denominations exceeding \$1,000.
  </Accordion>
</AccordionGroup>

## Security and Compliance

<AccordionGroup>
  <Accordion title="How does your firm stay current with state regulations that impact multi-state or multi-location users?">
    Xoxoday recognizes the importance of compliance in operating across multiple states, countries, and regulatory jurisdictions. Our approach combines governance, continuous monitoring, and proactive adaptation to ensure our Platforms remain compliant for all customers and users, regardless of their location.

    * **Dedicated Compliance & Legal Teams:** We have specialized compliance, data privacy, and legal teams who continuously monitor state, federal, and international regulations affecting employment, data privacy, rewards, taxation, and payments. Regulations such as GDPR, CCPA/CPRA, HIPAA (where applicable), SOC 2, and ISO 27001 are embedded into our global frameworks.

    * **Regulatory Intelligence & Partnerships:** Xoxoday leverages partnerships with audit firms, legal advisors, and compliance consultants in different geographies to stay ahead of state-specific regulatory updates. We subscribe to regulatory intelligence feeds and compliance monitoring services that track multi-state taxation, digital rewards governance, data residency, and employment-related laws.

    * **Product Flexibility for Multi-State Needs:** Our Platforms allow localization of program rules, including tax handling, redemption catalogs, accrual structures, payout modes, and communication templates, ensuring adaptability to state or region-specific mandates. For payments and financial products, we integrate with licensed payment partners who are compliant with state money movement and tax reporting laws.

    * **Global Best Practices in Data Privacy and Security Compliance:** We adopt Privacy by Design and Security by Default principles across all products. Frequent third-party audits, penetration testing, and certification renewals validate compliance against changing standards. Our multi-region hosting options (e.g., USA, Singapore, EU) ensure adherence to data residency and sovereignty requirements.

    * **Customer Communication & Assurance:** Any regulatory changes impacting product usage are communicated through release notes, compliance updates, and customer success reviews. Clients benefit from configurable compliance controls such as audit trails, retention policies, and access management to meet their own internal governance needs.

    By combining dedicated compliance governance, expert partnerships, flexible platform configurations, and global data privacy and security best practices, Xoxoday ensures that multi-state and multi-location users are supported in a compliant, secure, and future-ready manner.
  </Accordion>
</AccordionGroup>

## Security Requirement

<AccordionGroup>
  <Accordion title="Will the platform have access to confidential business data?">
    Yes. The platform securely manages confidential and sensitive business data as part of its operations.

    Data types handled include:

    * Employee and customer PII (names, emails, contact details)
    * Transaction and redemption history
    * Financial identifiers for payouts and prepaid cards

    Security and compliance measures include:

    * Enterprise-grade encryption for data at rest and in transit
    * Role-based access control (RBAC)
    * Secure API integrations with audit logs
    * Compliance with GDPR and relevant local data privacy laws
    * Regular third-party audits to prevent unauthorized access and mitigate risks
  </Accordion>
</AccordionGroup>

## Technical Requirement

<AccordionGroup>
  <Accordion title="Does your solution require institutions to host a virtual appliance or make firewall exceptions for remote access?">
    No. All Xoxoday solutions are cloud-based and accessible via secure HTTPS connections, without requiring clients to host virtual appliances or modify firewall rules.

    * Global rewards marketplace & payout platform: Fully cloud-hosted, with optional on-premise deployment available for highly regulated environments.
    * Employee engagement & recognition platform: Delivered as SaaS, accessible via browsers and mobile apps with no additional network configuration.
    * Sales commission & incentive management system: Cloud-native, integrating securely with CRM and HRMS platforms via APIs.
    * Customer loyalty management solution: Entirely online, eliminating the need for local hosting or infrastructure.
    * Merchant-funded offers & promotion engine: Cloud-based with secure API access for seamless partner integrations.
  </Accordion>

  <Accordion title="Does your platform have access to institutional or personal data?">
    Yes, but only as required to deliver contracted services, with strict role-based access controls and full GDPR compliance.

    * Global rewards marketplace & payout platform: Uses recipient names, emails, and transaction data solely to process and deliver rewards.
    * Employee engagement & recognition platform: Stores and processes employee identifiers, email addresses, and engagement activity to support recognition and surveys.
    * Sales commission & incentive management system: Handles sales team identifiers, performance metrics, and payout details to calculate and distribute incentives.
    * Customer loyalty management solution: Manages loyalty member data including profiles, points balances, and redemption history.
    * Merchant-funded offers & promotion engine: Maintains merchant details, customer segment data, and redemption records for campaign management.
  </Accordion>

  <Accordion title="Do you have a documented business continuity plan (BCP) with ownership and annual testing?">
    Yes. All Xoxoday solutions operate under a corporate-level Business Continuity Plan owned by senior management and tested annually.

    * Global rewards marketplace and payout platform: Includes continuity procedures for reward delivery, catalog access, and payment processing.
    * Employee engagement and recognition platform: Ensures uninterrupted engagement, recognition, and survey operations during disruptions.
    * Sales commission and incentive management system: Maintains continuous access to commission tracking, incentive calculations, and reporting.
    * Customer loyalty management solution: Keeps loyalty enrolment, accrual, and redemption systems available in crisis scenarios.
    * Merchant-funded offers and promotion engine: Provides continuity for merchant offer creation, validation, and redemption tracking during outages.
  </Accordion>

  <Accordion title="Do you maintain a documented disaster recovery plan (DRP) with ownership and regular testing?">
    Yes. Xoxoday has a corporate Disaster Recovery Plan owned by the Information Security team and tested regularly to meet RTO/RPO objectives.

    * Global rewards marketplace and payout platform: Covers restoration of transaction processing, catalog services, and payment integrations.
    * Employee engagement and recognition platform: Ensures rapid recovery of recognition data, engagement analytics, and survey records.
    * Sales commission and incentive management system: Restores commission plans, sales performance data, and payout schedules promptly after incidents.
    * Customer loyalty management solution: Recovers loyalty member accounts, points balances, and redemption records with minimal downtime.
    * Merchant-funded offers and promotion engine: Brings back merchant campaign data, offer rules, and redemption history in line with recovery targets.
  </Accordion>
</AccordionGroup>

## Record Creation

<AccordionGroup>
  <Accordion title="Can the system maintain a secure record of credit card issuance while preserving subject confidentiality?">
    Yes. The Xoxoday gift card solution maintains detailed records of credit card issuance, including information on both issuers and recipients. These records are encrypted and accessible only by authorized personnel, ensuring complete confidentiality of participant data while supporting compliance and audit requirements.
  </Accordion>

  <Accordion title="Can the system flag studies or projects that are exempt from collecting personally identifiable information (PII) like name or SSN, and assign this flag based on user roles?">
    Yes, the Xoxoday customer rewards platform enables administrators to flag studies or projects as exempt from collecting personally identifiable information (PII), such as names or SSNs. These exemption flags are configurable based on user roles, allowing secure, role-specific access while ensuring compliance with research privacy protocols and institutional review board (IRB) requirements.
  </Accordion>

  <Accordion title="Does the system allow attaching an IRS Form W-9 when entering subject information (unless the study is exempt from SSN collection)?">
    The Xoxoday reward payout platform supports the secure upload and attachment of IRS Form W-9 during the input of subject information. This ensures streamlined compliance with U.S. tax documentation requirements, particularly for human subject payments that require IRS reporting, such as 1099 filings.
  </Accordion>

  <Accordion title="Can the system flag or identify studies conducted entirely outside the United States?">
    Yes, the Xoxoday survey rewards platform includes geo-tagging capabilities that allow administrators to classify and flag studies based on their geographic scope. This supports accurate reporting, compliance, and operational tracking for global studies conducted outside the U.S.
  </Accordion>

  <Accordion title="Does the platform support the externalization of back-office operations such as account management, reporting, reconciliation, and customer support through APIs or partner portals?">
    The platform is designed to support selective externalization of back-office functions via APIs. Transaction data necessary for reporting and reconciliation can be programmatically accessed using secure APIs provided by the Xoxoday reward payout platform.
  </Accordion>

  <Accordion title="Can Xoxoday host the reward portal within a client's private infrastructure?">
    Yes. Xoxoday supports on-premise deployments and can host the reward portal within the client's internal network. This deployment option ensures full control over infrastructure, data governance, and security settings. Our implementation team will work closely with your IT and security stakeholders to align with existing policies and protocols, while ensuring seamless integration and compliance throughout the deployment process.
  </Accordion>

  <Accordion title="Is the solution provider a dependency for any business-critical activity?">
    Yes. Xoxoday plays a direct role in mission-critical engagement and incentive workflows for enterprises, SMBs, and global organizations:

    * Powers customer loyalty programs, employee recognition programs, sales and channel incentives, and instant payout delivery, all of which are essential for business continuity.
    * Delivers time-sensitive reward redemptions for events like sales milestones, festive gifting, employee anniversaries, and customer retention campaigns.
    * Supports multi-region and multi-currency operations, ensuring that global incentive programs remain uninterrupted.
    * Operates on high-availability infrastructure with redundancy, minimizing downtime risk.
    * Without Xoxoday, businesses would face disruptions in engagement programs, potentially leading to reduced retention, sales performance, and customer satisfaction.
  </Accordion>

  <Accordion title="Is your solution designed to handle, store, or transmit credit card data?">
    No. Xoxoday does not process, store, or transmit credit card information. It operates as a digital rewards and incentives engine and does not serve as a payment gateway or financial processing tool.
  </Accordion>
</AccordionGroup>

## Xoxolink

<AccordionGroup>
  <Accordion title="Does Xoxoday comply with regulatory recordkeeping and reporting requirements?">
    Xoxoday adheres to all major global regulatory standards. It maintains comprehensive audit trails, logs, and exportable reports for every transaction. Custom reports can be scheduled or generated on-demand to support compliance with tax, financial, or internal audit policies.
  </Accordion>
</AccordionGroup>


# Account Verification
Source: https://help-plum.xoxoday.com/getting-started/for-admins/account-verification/account-verification-overview



*In this article, you'll see the information you need to complete the KYB verification step to kick start rewarding journey with Xoxoday.* *Everything you need to complete the KYB verification step and kick start your rewarding journey with Xoxoday.* *Everything you need to complete the KYB verification step and kick start your rewarding journey with Xoxoday.*

## What is Account Verification?

Xoxoday, as a Fintech company, verifies businesses and gift card usage to comply with regulations. Plum's account verification ensures we understand your business and intended use case to provide tailored assistance.

***

## Verification Process

<Steps>
  <Step title="Client Submission">
    Provide the necessary business details via the Plum Admin Panel.
  </Step>

  <Step title="Document Verification">
    Our compliance team reviews your submission within **2 working days** and may request additional information if needed.
  </Step>

  <Step title="Use Case Classification">
    Once all details are gathered, the compliance team classifies your use case.
  </Step>

  <Step title="Catalog Availability">
    Upon use case determination, the catalog team maps available products for immediate redemption.
  </Step>
</Steps>

<Info>
  Expect an acknowledgement email within **2 hours** of submission. Any additional information needed will be requested via email.
</Info>

***

## Use Case Classification

Once verified, your account is classified into one of the following use cases, which determines the catalog products available to you:

* **Regular Business** — Can procure vouchers from the catalog, excluding Amazon and Open Loop cards. Contact your Account Executive or [cs@xoxoday.com](mailto:cs@xoxoday.com) to request access to these cards.
* **Resellers (B2B & B2C)** — Can purchase closed-loop cards, except for brands explicitly prohibiting resellers and Amazon/Open-Loop cards.
* **Crypto** — Can only procure closed-loop cards and brands that permit crypto use cases.

***

## Escalation Matrix

For anything related to account verification, reach out through the appropriate level:

| Level   | Designation           | Email                                             |
| ------- | --------------------- | ------------------------------------------------- |
| Level 1 | Customer Success Team | [cs@xoxoday.com](mailto:cs@xoxoday.com)           |
| Level 2 | Implementation Lead   | [damodar@xoxoday.com](mailto:damodar@xoxoday.com) |
| Level 3 | Customer Success Head | [kailash@xoxoday.com](mailto:kailash@xoxoday.com) |

***


# Submitting Brand KYC
Source: https://help-plum.xoxoday.com/getting-started/for-admins/account-verification/submitting-brand-kyc-amazon-india-and-mastercard



Some brands and reward options require additional **KYC**  or **KYB (Know Your Business)** verification before you can issue rewards through Plum.

The verification required depends on the reward you want to issue:

| Verification                                 | Applicable rewards                                                               |
| :------------------------------------------- | :------------------------------------------------------------------------------- |
| **Amazon India Brand KYC**                   | Amazon India gift cards                                                          |
| **Amazon Global Brand KYC**                  | Amazon gift cards in applicable international markets                            |
| **Prepaid Instruments & Digital Wallet KYB** | Visa/Mastercard prepaid instruments, PayPal, Venmo, and other applicable rewards |

## Access the Verification Form

1. Sign in to your **Plum Admin Portal**.
2. Go to **Admins**.
3. Click the **Settings** icon.
4. Select **Verifications**.
5. Select the verification applicable to the reward you want to issue.
   <Frame>
     <img alt="Screenshot 2026 09 05 At 8 39 16 PM" />
   </Frame>

Before you begin, make sure you have the required company information and supporting documents ready.

***

# Amazon India Brand KYC

Amazon requires additional information about your organisation and reward programme for **security and compliance purposes** before you can issue Amazon India gift cards.

### Information required

You will need to provide:

* **Registered Email ID** – Email address registered with your Plum account.
* **Company Legal Name** – Registered legal name of your organisation.
* **Business Category** – Select the category that best describes your organisation.
* **Reward Use Case** – Select how you plan to use the Amazon gift cards.
* **Annual Reward Spend** – Estimated annual amount you plan to spend on rewards.
* **Reward Programme Description and Goals** – Briefly explain what the programme is, who it is intended for, and its objective.

### Documents required

| Requirement                         | Accepted document                                           |
| :---------------------------------- | :---------------------------------------------------------- |
| **Business Establishment Document** | Company Incorporation/Registration Certificate              |
| **Company ID Document**             | GST Registration Certificate or PAN Card                    |
| **Business Address Proof**          | Telephone Bill, Electricity Bill, or Water Bill             |
| **Company Declaration**             | Declaration on company letterhead using the sample provided |

### Complete the verification

Enter the required information, upload the supporting documents, and click **Submit**.

Make sure that:

* The company name matches your official registration documents.
* All uploaded documents are valid and legible.
* The information in the form is consistent with the supporting documents.
* The declaration is prepared using the required format.

<Frame>
  <img alt="Screenshot 2026 09 05 At 10 49 46 PM" />
</Frame>

<Note>
  **Additional requirements for consumer and marketing use cases**<br /><br />If you plan to use Amazon gift cards for **consumer incentives or marketing campaigns**, you may also need to submit your marketing collateral.

  Make sure the collateral follows Amazon's applicable guidelines before submitting it for review.

  You will also need to prepare an **undertaking document on your company letterhead** using the sample undertaking provided as part of the verification process.
</Note>

***

# Amazon Global Brand KYC

Amazon Global KYC requires additional information about your organisation and reward program before you can issue Amazon gift cards in applicable international markets.

### Information required

You will need to provide:

* **Registered Email ID**
* **Company Legal Name**
* **Countries where you plan to distribute rewards**
* **Business Category**
* **Company Website**
* **Annual Reward Spend** in USD
* **Applicable Business Activities**
* **Reward Programme Description and Goals**
* **Programme Start Date**
* **Reward Use Case**

You may also be asked whether the Amazon gift cards will be distributed **exclusively within the US**.

### Complete the verification

Enter the required information and review your responses before clicking **Submit**.

<Frame>
  <img alt="Screenshot 2026 09 05 At 8 39 30 PM 1" />
</Frame>

Make sure the company and programme information provided in the form is accurate and consistent with your organisation's details.

***

# Prepaid Instruments and Digital Wallet KYB

KYB verification is required for certain **Visa/Mastercard prepaid instruments** and **digital wallet rewards such as PayPal and Venmo**.

The information submitted through the form may be shared with the relevant card issuers and reward partners for review and approval.

### Information required

You will need to provide details about both your organisation and the person submitting the form:

* **Registered Email ID**
* **Name**
* **Designation/Title**
* **Organisation Legal Name**
* **Company Brand Name**
* **Number of Employees**
* **Type of Business**
* **Tax ID** – TAX, VAT, EIN, GST, or other applicable tax identification number
* **Official Website URL**
* **Country of Business Formation**
* **Date of Business Formation**
* **Lawsuits or Regulatory Actions** – Indicate whether the company is currently or has previously been subject to any lawsuits or regulatory actions.

### Complete the verification

1. Enter the required user and business information.
2. Click **Next** to proceed through the form.
3. Complete all remaining sections.
4. Review the information you have provided.
5. Click **Apply for Verification**.

<Frame>
  <img alt="Screenshot 2026 09 05 At 8 39 58 PM" />
</Frame>

<Info>
  Ensure that all information submitted is complete and accurate. The information may be shared with the respective card issuers and partners as part of the approval process.
</Info>

***

# What happens after you submit the form?

Once you submit the verification form, the relevant brand or issuing partner reviews the information and documents provided.

The typical timelines are:

* **Amazon India Brand KYC:** 3–4 business days
* **Prepaid Instruments and Digital Wallet KYB:** 2–4 business days
* **Amazon Global Brand KYC:** The timeline may vary depending on the market and programme details.

The verification may take longer if additional information or documents are required.

Once your verification is approved, the applicable reward options will become available for issuance through Plum.

## Need Help?

If you need assistance with the verification process, contact [**cs@xoxoday.com**](mailto:cs@xoxoday.com) or reach out to your designated SPOC.


# Submitting Verification Detail
Source: https://help-plum.xoxoday.com/getting-started/for-admins/account-verification/submitting-verification-details



*In this article, you'll see the information you need to complete the KYB verification step to kick start rewarding journey with Xoxoday!*

## Steps and some pre-requisites

Start by logging in to the [Admin Dashboard](https://stores.xoxoday.com/marketplace/login)

Here are some of the things you'll need to keep handy:

Details of the company as follows:

| Requirement             | Details                                                                                                                      |
| :---------------------- | :--------------------------------------------------------------------------------------------------------------------------- |
| **Basic Admin Details** | Name, Email address, and a valid Phone number (you'll receive an OTP here).                                                  |
| **Company Details**     | Registered Business Name, Country of Registration, Registered Identification number (Example: GST, TAX ID, EIN, or DUNS etc) |
| **Company Address**     | Company's registered address.                                                                                                |

<Info>
  KYB details must be completed before funds can be added or rewards can be sent.
</Info>

***

## Step-by-step guide

<Steps>
  <Step title="Navigate to Settings >> Account and complete the details">
    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Search and confirm company details">
    Alternatively, for select geographies, we can fetch company details based on the name input. This feature is currently supported only for customers in India.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>
</Steps>

***

## What to expect next

Expect an acknowledgement email within 2 hours. Our compliance team will then verify your details for account approval. Any additional information needed will be requested via email.


# Updating Billing Address
Source: https://help-plum.xoxoday.com/getting-started/for-admins/changing-billing-address-during-wallet-recharge



This article explains how administrators can **add or update the billing address while adding funds to a client's Plum wallet**. The billing address selected during the transaction is used on the **Proforma Invoice** and **Invoice PDF** generated for the wallet recharge.

# Manage Billing Addresses

The Account Page allows you to view, add, update, or remove billing addresses associated with your Plum account.

To access the billing address settings, navigate to **Settings > Account & Billing Address** and click **Change**.

## Add a Billing Address

To add a new billing address:

1. Navigate to **Settings > Account & Billing Address**.
2. Click **Change**.
   <Frame>
     <img alt="Image" />
   </Frame>
3. Click **Add New**.
4. Enter the required billing address details:
   * **GST/Identification Number:** Mandatory for India and optional for other countries.
   * **Country, State, and City**
   * **Billing Address**
5. Click **Save**.

The new billing address is added to your account.

***

## Edit a Billing Address

To update an existing billing address:

1. Navigate to **Settings > Account >Billing Address**.
2. Click on Change
3. Select the billing address you want to update.
4. Click the **Edit** icon.
   <Frame>
     <img alt="Image" />
   </Frame>
5. Update the required details:
   * **GST/Identification Number:** Mandatory for India and optional for other countries.
   * **Country, State, and City**
   * **Billing Address**
   <Frame>
     <img alt="Screenshot 2026 08 31 At 9 57 32 PM" />
   </Frame>
6. Click **Update**.

The updated billing address is saved to your account.

***

## Remove a Billing Address

To remove an existing billing address:

1. Select the billing address you want to remove.
2. Click the **Remove/Delete** icon.
   <Frame>
     <img alt="Image" />
   </Frame>
3. Confirm the deletion.

The selected billing address is removed from your account.

## Update an Existing Billing Address

You can update or add a billing address while adding funds to your Plum wallet. The selected billing address is used on the invoice generated for the transaction.

To update the billing address while adding funds:

1. Navigate to **Payments > Wallet Balance** in the Plum Admin Dashboard.
   <Frame>
     <img alt="Screenshot 2026 08 31 At 8 27 05 PM" />
   </Frame>
2. Click **View Funds**.
3. On the **Add Funds to Wallet** screen, locate the **Billing Details** section.
4. Click **Change**.
   <Frame>
     <img alt="Image" />
   </Frame>
5. Update the required billing details:
   * **Billing Address**
   * **GST/Identification Number:** Mandatory for India and optional for other countries.
   * **Country, State, and City**
   * **Client POC, Email, and Phone:** These details are auto-filled based on the Admin's information.
     <Frame>
       <img alt="Image" />
     </Frame>
6. Click **Update** and proceed.

The selected billing address is included on the invoice generated for the transaction.

## Add a New Billing Address

You can also add a new billing address while adding funds to the wallet.

To add a new billing address:

1. On the **Add Funds to Wallet** screen, navigate to the **Billing Details** section.
2. Click **Add New**.
   <Frame>
     <img alt="" />
   </Frame>
3. Enter the required billing details:
   * **GST/Identification Number:** Mandatory for India and optional for other countries.
   * **Country, State, and City**
   * **Billing Address**
   * **Client POC, Email, and Phone:** These details are auto-filled based on the Admin's information.
     <Frame>
       <img alt="" />
     </Frame>
4. Click **Save**.

The new billing address is saved and becomes available for selection when adding funds to the wallet.

Feedback or Questions: Reach out to [**cs@xoxoday.com**](mailto:cs@xoxoday.com)


# Signing Up
Source: https://help-plum.xoxoday.com/getting-started/for-admins/signing-up



*Follow the step-by-step instructions to create your Xoxoday business account.*

We have enhanced the sign-up flow to improve usability and engagement, ensuring a seamless experience. This guide will walk you through the process.

## Prerequisites

Before starting, ensure you have the following information ready:

* **Full Name**
* **Company Name**
* **Business Email Address**
* **Password**
* Business Email Address
* Password

| Requirement                | Details                                |
| -------------------------- | -------------------------------------- |
| **Full Name**              | Your first and last name               |
| **Company Name**           | Your organization's name               |
| **Business Email Address** | A valid company email (not personal)   |
| **Password**               | Min. 8 characters including one number |

***

## Creating Your Account

<Steps>
  <Step title="Access the Sign-Up Page">
    Open your browser and navigate to [https://stores.xoxoday.com/admin/signup](https://stores.xoxoday.com/admin/signup).
  </Step>

  <Step title="Create Your Account">
    Enter your **Full Name** and **Business Email Address**, then submit the information to proceed.
  </Step>

  <Step title="Verify Your Email">
    Check your inbox for an OTP sent to your registered email. Enter the OTP on the sign-up page to validate your email address.
  </Step>

  <Step title="Set Your Password">
    Create a strong password (at least 8 characters, including one numeric digit) and confirm it to complete this step.
  </Step>

  <Step title="Provide Employee Count">
    Specify the number of employees in your organization.
  </Step>
</Steps>

<img alt="" />

***

<Info>
  Need help? Contact our support team at [**cs@xoxoday.com**](mailto:cs@xoxoday.com)
</Info>


# Funding the Account
Source: https://help-plum.xoxoday.com/getting-started/for-admins/wallet-management/funding-the-account



To get started with Plum, you need to add funds to your **Company Wallet**. The available wallet balance is used to fund rewards sent through your Plum account.

<Steps>
  <Step title="Sign in to the Plum Admin Dashboard. Navigate to Payments > Wallet Balance > View Funds. Click Add Funds to Wallet.">
    <Frame>
      <img alt="Screenshot 2026 08 31 At 8 27 28 PM" />
    </Frame>
  </Step>

  <Step title="Enter the amount you want to add to your wallet.The amount is entered in the account's configured Base Currency. ">
    <Frame>
      <img alt="Screenshot 2026 08 31 At 3 23 48 PM 1" />
    </Frame>
  </Step>

  <Step title="Select the payment method you want to use to add funds to the wallet. ">
    <Frame>
      <img alt="Screenshot 2026 08 31 At 8 13 43 PM" />
    </Frame>
  </Step>

  <Step title="**To make an online payment:** Click on Pay Online and click Make Payment. Complete the payment using the selected payment method.">
    <Frame>
      <img alt="Screenshot 2026 08 31 At 8 17 52 PM" />
    </Frame>
  </Step>

  <Step title="**To make an offline payment:** Select Pay Offline and click on Create Invoice. Enter the PO Number and click create. ">
    <Frame>
      <img alt="Screenshot 2026 08 31 At 3 25 13 PM" />
    </Frame>
  </Step>

  <Step title="An invoice is generated based on the amount entered and sent to the designated email ID.">
    <Frame>
      <img alt="Screenshot 2026 09 05 At 8 18 28 PM" />
    </Frame>
  </Step>

  <Step title="You can send a copy of the invoice to additional email addresses. Add the email addresses of the relevant Finance, Procurement, or Accounts team members. You can add up to **10 additional email addresses**.">
    <Frame>
      <img alt="Screenshot 2026 09 05 At 8 22 52 PM" />
    </Frame>
  </Step>
</Steps>

Once the payment is made, kindly **share the payment receipt** via email. After verification by our Finance team, the funds will be credited to your Xoxoday wallet within **2–3 business days**.

<Info>
  You can view the status in the reports section. It might take a couple of minutes to show up on the dashboard.
</Info>

Feedback or Questions: Reach out to [**cs@xoxoday.com**](mailto:cs@xoxoday.com)


# Payment Methods
Source: https://help-plum.xoxoday.com/getting-started/for-admins/wallet-management/payment-methods



*Learn about different ways to fund your Plum account.*

Plum supports multiple ways for you to fund your account. Below is a list of a few, please select as applicable:

***

## 1. Online Payment Methods

Online Payment Methods using Credit Card & Debit Card.

<Frame>
  <img alt="" />
</Frame>

### Fund addition for INR Accounts

Online options available - UPI, Credit/Debit Card, Net banking, e-Wallets and more.

<Frame>
  <img alt="" />
</Frame>

***

## 2. Pay Offline

### Create an Invoice

An invoice (or pre-payment invoice) is a great way if you want to get your finance team involved in making the payment. Here's how to do this:

<Steps>
  <Step title="Log in to your Xoxoday Admin Account" />

  <Step title="Go to the Add Funds section" />

  <Step title="Create Invoice">
    Input the desired amount in your base currency click "Create Invoice" to proceed.
  </Step>

  <Step title="Enter Purchase Order details">
    Enter the Purchase Order Number (Optional) and Purchase Order Date using the calendar icon.

    The selected date is stored in the system and displayed clearly on the invoice template, giving finance and procurement teams the visibility they need for smooth tracking and reporting.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Invoice sent to your email">
    That's it! The invoice will be sent to your email address.

    After the payment is made, share the details with [ar@xoxoday.com](mailto:ar@xoxoday.com). The finance team will verify the details, and after the verification, the funds will be credited to your account.
  </Step>
</Steps>

<Info>
  **Pro tip**

  * You can optionally enter a PO number at the time of generating the invoice.
  * You can view the status in the reports section. It might take a couple of minutes to show up on the dashboard.
</Info>

***

Feedback or Questions: Reach out to [cs@xoxoday.com](mailto:cs@xoxoday.com)


# Wallet Management
Source: https://help-plum.xoxoday.com/getting-started/for-admins/wallet-management/wallet-management-overview



Super Admins can manage the organization's pre-funded Plum wallet. You can add funds to the wallet and use the available balance to send rewards.

## Base Currency

The **Base Currency** is the currency in which your organisation's wallet, funds, and transactions are maintained.

The Base Currency is selected by the **Super Admin** when the account is created and is used as the default currency for activities such as adding funds and redeeming rewards.

To view your account's Base Currency:

1. Navigate to **Settings**.
2. Select **Account**.
3. View the configured **Base Currency**.

<Frame>
  <img alt="Screenshot 2026 08 31 At 12 17 30 AM" />
</Frame>

Plum supports major currencies, allowing Super Admins to select the appropriate currency for their organization when creating a business account.

## Pre-funded Wallet

Plum uses a **pre-funded wallet** to process rewards. You must add funds to the wallet before you can send rewards.

Super Admins can add other Admins to help manage the Plum account and send rewards.

## Add Funds to the Wallet

To add funds to your Plum wallet:

1. Sign in to your **Plum Admin Dashboard**.
2. Navigate to **Payments** from the left navigation menu
3. Click **Add Funds to Wallet**.
4. Enter the amount you want to add in your **Base Currency**.
5. Complete the payment using the designed payment method.

Once the payment is successfully completed, the funds are added to the company wallet.

<Frame>
  <img alt="Screenshot 2026 08 31 At 8 38 34 PM" />
</Frame>

## Payment Methods

Plum supports multiple payment methods for adding funds to your wallet.

Check out this article to learn all payment methods [Payment Methods.](/getting-started/for-admins/wallet-management/payment-methods)


# Redeem Reward Link
Source: https://help-plum.xoxoday.com/getting-started/for-end-users/how-to-redeem/redeem-reward-link

Learn how to redeem a reward link you've received as an end user on Plum, from opening the link to claiming your reward.

Learn how to redeem a Reward Link as an end user.

<Steps>
  <Step title="Click Redeem Now">
    Click "**Redeem Now**" when you get the email about the reward. You'll be taken to a page where all of your vouchers are listed.

    <Frame>
      <img alt="Image" />
    </Frame>
  </Step>

  <Step title="View your reward">
    On click of '**Redeem Now**', you will see a landing page. Here, you can view your reward value and the link validity.

    <Frame>
      <img alt="Image" />
    </Frame>
  </Step>

  <Step title="Pick a brand and Send OTP">
    Pick the brand you like the most. Click on **Send OTP.**

    <Frame>
      <img alt="Image" />
    </Frame>

    Enter your information, either your email address or phone number, if asked to get vouchers. You'll be asked to enter the OTP for verification purposes.

    <Frame>
      <img alt="Image" />
    </Frame>
  </Step>

  <Step title="Get your voucher">
    You can also choose other gift cards by clicking on the cross. This will take you back to the previous page so you can use another gift card.

    Once you have the code, you can copy it or click the "**Send me a copy**" button to send it to your email or phone number.
  </Step>
</Steps>

***

## HRMS such as Darwinbox, Here is how you can redeem

**Here are the steps to redeem:**

<Steps>
  <Step title="Login to your Darwinbox account" />

  <Step title="Go to Recognition">
    Under "**My Access**", click the "**Recognition**" tile.
  </Step>

  <Step title="Check your reward points balance">
    Within the "**Recognition Overview**", you check your accumulated reward points balance.
  </Step>

  <Step title="Click Redeem">
    Click **"Redeem".**
  </Step>

  <Step title="Browse the Plum Storefront">
    You will now be redirected to the Plum Storefront via single sign-on. You can check your points balance in the top right corner of the page.
  </Step>

  <Step title="Add to cart">
    Choose any experience, gift vouchers, etc, from categories based on location.Click on "**Add to cart**" on the selected option. Please read the item's Terms and Conditions, Validity, and Description before proceeding.
  </Step>

  <Step title="Proceed to Checkout">
    After adding all the items to the cart, click on the cart icon to proceed with the purchase. Verify your items and click on "**Proceed to Checkout**".
  </Step>
</Steps>

***

## If you are using SAP® SuccessFactors or a custom platform, here is how you can redeem

<Steps>
  <Step title="Login to your SAP® SuccessFactors account" />

  <Step title="Go to Compensation">
    Under the **"Home"** tab, click the **"Compensation"** module.
  </Step>

  <Step title="Check your reward points">
    You can check your accumulated reward points under "**My Team**".
  </Step>

  <Step title="Click Redeem">
    Now, click **"Redeem"**; with a single sign-on, you will be redirected to the Plum Storefront.
  </Step>

  <Step title="Add to cart">
    Choose any experience, gift vouchers, etc, from 30+ categories based on location.

    Click on **"Add to cart"** on the selected option.

    Please read the item's Terms and Conditions, Validity, and Description before proceeding.
  </Step>

  <Step title="Proceed to Checkout">
    After adding all the items to the cart, click on the cart icon to proceed with the purchase. Verify your items and click on **"Proceed to Checkout".**
  </Step>
</Steps>

***

## How to redeem Mastercard/Virtual Visa Card using Reward Code/Reward Points

**To redeem your Mastercard/Virtual Visa Card, follow these steps below:**

*

<Steps>
  <Step title="Visit the storefront">
    Visit [**https://stores.xoxoday.com/**](https://stores.xoxoday.com/).
  </Step>

  <Step title="Choose Guest Checkout">
    Select the Product of your choice and choose the "**Guest Checkout**" option on the landing page.

    Enter a valid email ID to proceed as a guest user.

    You can successfully place an order by choosing the Guest Checkout option.
  </Step>

  <Step title="Enter your details">
    Mention your name, email, dialling code, and phone number. Before continuing with the purchase, an OTP will be sent to the mobile number provided.
  </Step>

  <Step title="Apply reward points or gift card">
    Select the option to use available reward points for the purchase.

    If you have a gift card, add the gift card code and click on **"Apply"**.
  </Step>

  <Step title="Pay Now">
    You can also pay the excess amount by selecting the option to pay via "Credit Card" and choosing the card of your choice.

    Click "**Pay Now**" to continue with the selected payment mode.
  </Step>
</Steps>


# Redeem Reward Points
Source: https://help-plum.xoxoday.com/getting-started/for-end-users/how-to-redeem/redeem-reward-points

Learn how to redeem the reward points you've received as an end user on Plum, from browsing options to confirming your choice.

*Learn how to redeem Reward Points as an end user.*

Upon registration, you will receive mail from Xoxoday to set up your account as shown below.

<Frame>
  <img alt="" />
</Frame>

***

<Steps>
  <Step title="Log into your account">
    Your reward points balance is shown at the top right corner of the page.
  </Step>

  <Step title="Choose a gift voucher">
    Choose any gift vouchers, etc, from the different categories shown.

    Click on "**Add to cart**" on the selected brand.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Go to Cart">
    Once you add the product to your card, "Add to cart" button will show the "**Go to Cart**" option making the journey simple. You can click on the "**Go to Cart**" button.

    You can also "**Go to cart**" by clicking on the cart icon in the top right corner beside the profile.

    Please read the Terms and Conditions, Validity, and Description of the item before proceeding.
  </Step>

  <Step title="Checkout">
    Click on "**Checkout Now**" to move to the check-out page.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Enter your details and complete payment">
    Enter your name, email, dialing code, and phone number. An OTP will also be sent to the mobile number provided before continuing with the purchase.

    The user will be able to see the reward point balance and ask if he wants to use the points for the order payment.
  </Step>
</Steps>


# Redeem Reward Code
Source: https://help-plum.xoxoday.com/getting-started/for-end-users/how-to-redeem/reward-code

Learn how to redeem a reward code you've received as an end user on Plum, step by step from entry to confirmation.

*Learn how to redeem your reward code on the Plum Marketplace.*

The user has to visit [stores.xoxoday.com](https://stores.xoxoday.com/) to redeem the code.

<Info>
  Users can redeem reward codes through Guest Checkout. You don't have to log in or sign up.
</Info>

**Things to Remember:**

* Reward code can be used within the validity period only.
* Partial redemptions for Reward codes are allowed and can be used until the code balance is exhausted.
* You can choose multiple codes (**Up to 10 reward codes in a single transaction**) to order as long as the amount does not exceed your code Balance.

***

## Redeeming Reward Codes

<Steps>
  <Step title="Click Redeem Now">
    On receiving the reward email, click on "**Redeem Now**" as shown below. You will be redirected to our marketplace to consume the code.

    <Frame>
      <img alt="Image" />
    </Frame>
  </Step>

  <Step title="Choose a gift voucher">
    Choose any gift vouchers or search your favorite brand from 30+ categories and 21,000+ branded options and click "**Add to Cart**".
  </Step>

  <Step title="Go to Cart and Checkout">
    Visit the cart or click on "**Go to Cart**" and click on "**Checkout Now**".
  </Step>

  <Step title="Add your Delivery address details">
    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Enter your Reward Code">
    Under the Payment Details Card, select '**Click here**' and paste your Reward Code.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Apply code">
    You can paste code in the input text field. You can apply up to 10 valid codes against a single order. Once done, click '**Proceed**' to move ahead.
  </Step>

  <Step title="Enter Contact Details">
    Enter your **name, email, dialling code, and phone number.** An OTP will also be sent to the mobile number provided before continuing with the purchase.

    <Frame>
      <img alt="" />
    </Frame>

    Enter your contact details and click 'Proceed' to check out. You will get an OTP for confirmation in the email.

    * You can also pay the excess amount with credit/debit cards or net banking.
    * You'll receive an order delivery email with the necessary details.
  </Step>
</Steps>

***

<Info>
  We regret that the reward code cannot be exchanged for cash. If you face a code error, kindly share a screenshot of the code and the error with us at [cs@xoxoday.com](mailto:cs@xoxoday.com).
</Info>


# Sign Up
Source: https://help-plum.xoxoday.com/getting-started/for-end-users/signing-up-logging-in

Learn how to sign up and log in as an end user on Plum so you can view and redeem the rewards you've received.

*How to Login/Signup to the Storefront?*

***

## Sign up to Plum Storefront

<Steps>
  <Step title="Go to the Storefront">
    Go to [https://stores.xoxoday.com/](https://stores.xoxoday.com/)companyname.
  </Step>

  <Step title="Login using your credentials">
    Login using your registered email address and password.

    <Frame>
      <img alt="" />
    </Frame>

    <Frame>
      <img alt="" />
    </Frame>

    You have successfully signed up for Xoxoday Plum.
  </Step>
</Steps>

<Info>
  **Note:** Users with a valid Reward Code do not need login credentials. During checkout, they can continue as a guest and redeem the code directly.
</Info>

* For Signing up, select the signup option from the accounts dropdown.

Provide necessary information such as name, email address, country etc to proceed with the signup process.

<Frame>
  <img alt="" />
</Frame>

Congratulations! You have successfully signed up for Xoxoday Plum.

<Info>
  **Note:** Users with a valid Reward Code need not have login credentials. During checkout, they can continue as guest users and redeem the Reward Code.
</Info>

***

## Forgot your password?

<Steps>
  <Step title="Visit the storefront">
    Visit [https://stores.xoxoday.com/vouchers](https://stores.xoxoday.com/nreachtech/vouchers/)
  </Step>

  <Step title="Click Forgot Password">
    Enter your registered email ID and click "**Forgot password**".
  </Step>

  <Step title="Reset your password">
    A reset password link is sent to the email ID provided. Click on the link and set a password.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>
</Steps>

You will now be able to log into the portal with a new password.

<Info>
  **Note:** Any users with a valid Reward Code need not have login credentials. During the checkout, continue as a guest user and redeem the Reward Code.
</Info>

***

## Logging in for the first time

First-time users, please follow the steps below:

<Steps>
  <Step title="Go to the Storefront">
    Go to [stores.xoxoday.com](https://stores.xoxoday.com/)/companyname, click on the login page and select sign up and this opens the Sign-up form as below.
  </Step>

  <Step title="Enter your details">
    Enter the required information, such as your "Name", "Email ID", "Country Code for Phone Number", and "Password". You will receive an OTP to verify and you will be successfully signed up.
  </Step>
</Steps>

***

Feedback or Questions: Reach out to [cs@xoxoday.com](mailto:cs@xoxoday.com)


# Overview
Source: https://help-plum.xoxoday.com/getting-started/overview

Get an overview of Plum, Xoxoday's rewards platform, and learn how admins send gift cards, reward links, codes, and points.

Welcome to Xoxoday Plum's Help Center — here you'll find comprehensive guides and documentation to help you get started with Plum as quickly as possible. You can also find self-help guides, tips, and tricks. Let's jump right in.

<img alt="" />

# Account Set up

First things first — below is a collection of articles that will help you get up and running in no time and get you acquainted with Xoxoday Plum's features in an instant!

Here is a collection of articles that will get you started with your Xoxoday plum account:

# Account Verification

As part of regulatory requirements, customers need to complete a quick verification step as part of the KYB requirements for bands.

## KYB Verification

Head over to this article [Submitting Verification Details](/getting-started/for-admins/account-verification/submitting-verification-details) to know everything about the KYB verification steps.

# Add Funds

Xoxoday Plum works on a pre-funded wallet that gives you total control over your spending and budget for all your rewards.

## Wallet Management

Xoxoday operates on a pre-funded wallet. Head over to [Recharge & Wallet Management](/getting-started/for-admins/wallet-management/wallet-management-overview) to know everything about managing your Xoxoday wallet.

# Rewards

Distribute rewards and incentives the way you want seamlessly and quickly. First things first, let's start with different modes of reward in Xoxoday Plum.

## Modes of Reward

Plum lets you reward anyone, anywhere, in your own special way as a Code, a Link or as a Point. [Click here](/send-rewards/reward-modes/reward-modes-types-overview) to learn all about it.

## Reward Code

Reward Code provides a fast and secure method to send unique reward codes to participants. Learn more here [Reward Code](/send-rewards/reward-code/reward-code-overview)

## Reward Link

A unique reward link that can be sent to each recipient and provide a one-click redemption experience. [Reward Link](/send-rewards/reward-links/reward-link-overview)

## Reward Point

Reward points can be accumulated, and used for redemption from our extensive rewards catalog. Learn more here: [Reward Points](/send-rewards/reward-points/reward-points-overview)

## Brand Vouchers

Instantly send brand gift cards directly to recipients' inboxes. There are over 8,000 top global brands from Amazon to Walmart and everything in between! Learn more here [Brand Vouchers](/getting-started/for-end-users/gift-vouchers-faqs)

If you want to learn more about which mode fits best for you, [check out this article](/send-rewards/reward-modes/comparison-of-when-to-use-what).

# Send Reward

## Send Reward Links

* [Send Reward Links: to a Few](/send-rewards/reward-links/send-reward-links-send-individually)
* [Send Reward Links: to Many](/send-rewards/reward-links/send-reward-links-bulk-upload)
* [Send Reward Links: to Self](/send-rewards/reward-links/send-reward-links-to-self)

## Send Reward Code

* [Send Reward Code: to Many](/send-rewards/reward-code/send-reward-code-bulk-upload)
* [Send Reward Code: to a Few](/send-rewards/reward-code/send-reward-code-individually)

## Reward Points

* [Reward Points](/send-rewards/reward-points/reward-points-overview)

# Campaigns

Xoxoday Plum enables super admins and admins to create and manage bespoke campaigns, enriching the rewarding experience for end-users by offering customizable storefronts and personalized rewards, thereby boosting engagement and driving outcomes.

Click here: [Overview: Campaigns](/campaigns/campaigns-overview)

# Plug-n-Play Native Integration

Plum Apps enables seamless integration with leading SaaS platforms in marketing automation, CRMs, customer engagement tools, HR software, collaboration platforms, and more. This integration streamlines workflows and enriches Plum with contextual information, providing a comprehensive perspective on your mutual growth.

## List of Most Popular Integration

* [HubSpot](/integrations/hubspot/hubspot-overview)
* [Salesforce](/integrations/salesforce/salesforce-overview)
* [Zoho CRM](/integrations/zoho-crm/zoho-crm-overview)
* [ActiveCampaign](/integrations/activecampaign/activecampaign-overview)
* [SAP SuccessFactors](/integrations/sap-successfactors/sap-successfactor-overview)
* [Darwinbox](/integrations/darwinbox/darwinbox-overview)
* [Zoho People](/integrations/zoho-people)
* [Qualtrics](/integrations/qualtrics/using-qualtrics-workflow-extension-to-send-rewards)
* [SurveyMonkey](/integrations/surveymonkey/public-survey-automation)
* [Typeform](/integrations/typeform/typeform)

# ‍ For Developers

Xoxoday’s developer platform is a core part of our mission to empower organizations to bake in rich rewarding experiences inside their application(s) and blitzkrieg growth and revenue. Unlock seamless rewards distribution and redemption within your application using our extensive library of API integrations. Developer Documentation is here: [Overview](https://developers.xoxoday.com/reference/api-reference-documentation)

## Rewards API

Add rewards to your application with seamless integration to our rewards catalog, featuring over 8,000 gift cards from top brands. Check out the documentation. [About Rewards API](https://developers.xoxoday.com/reference/about-rewards-api)

## Integrate Marketplace

Transform your reward points redemption process instantly with our plug-and-play global rewards catalog integration, delivering an exhilarating experience to your users within minutes. Check out the documentation [About Marketplace Integration](https://developers.xoxoday.com/reference/about-marketplace-integration)

## Reward Link API

Programmatically send unique reward links to recipients from within your application, redeemable against a curated catalog. Check out the documentation [About Reward Link APIs](https://developers.xoxoday.com/reference/about-xoxolink-apis)

​

​


# Plum Help Center
Source: https://help-plum.xoxoday.com/home

Guides and walkthroughs for Plum — sending rewards, campaigns, the reward marketplace, wallets and payments, reports, offers management, and integrations.

<div>
  <div>
    <div>
      <h1>Plum Help Center</h1>
      <p>Plum is Xoxoday's rewards, incentives and payouts infrastructure. Send gift cards, prepaid cards, experiences and cash-outs to employees, customers and channel partners across 100+ countries.</p>

      <div>
        <div>
          <div>
            <svg>
              <path />

              <path />
            </svg>

            <span>Search the Plum Help Center</span>
            <span>⌘K</span>
          </div>

          <button>
            <svg>
              <path />
            </svg>

            Ask AI
          </button>
        </div>
      </div>

      <div>
        <span>Popular:</span>
        <a href="/getting-started/for-admins/signing-up">Sign up for Plum</a>
        <a href="/send-rewards/reward-links/reward-link-overview">Send a reward link</a>
        <a href="/getting-started/for-admins/wallet-management/funding-the-account">Fund your account</a>
        <a href="/getting-started/for-end-users/how-to-redeem/redeem-reward-points">Redeem reward points</a>
        <a href="https://developers.xoxoday.com/docs">API docs</a>
      </div>
    </div>
  </div>

  <div>
    <div>
      <h2>What you can do with Plum</h2>
      <p>The core of the platform, and the guides for each.</p>

      <div>
        <div>
          <span>
            <svg>
              <path />

              <path />

              <path />
            </svg>
          </span>

          <h3>Get started</h3>
          <p>Sign up, verify your account, and take the first tour as an admin or as a recipient.</p>

          <div>
            <a href="/getting-started/overview"><span>Plum overview</span><span>→</span></a>
            <a href="/getting-started/for-admins/signing-up"><span>Signing up as an admin</span><span>→</span></a>
            <a href="/getting-started/for-end-users/signing-up-logging-in"><span>Signing up as an end user</span><span>→</span></a>
          </div>
        </div>

        <div>
          <span>
            <svg>
              <path />

              <rect />

              <path />

              <path />

              <path />
            </svg>
          </span>

          <h3>Send rewards</h3>
          <p>Reward links, reward codes and reward points — and how to choose between them.</p>

          <div>
            <a href="/send-rewards/reward-modes/reward-modes-types-overview"><span>Reward modes and types</span><span>→</span></a>
            <a href="/send-rewards/reward-links/reward-link-overview"><span>Reward links</span><span>→</span></a>
            <a href="/send-rewards/reward-code/reward-code-overview"><span>Reward codes</span><span>→</span></a>
          </div>
        </div>

        <div>
          <span>
            <svg>
              <path />

              <path />

              <path />
            </svg>
          </span>

          <h3>Reward points</h3>
          <p>Issue points in bulk or one by one, and let recipients redeem them how they like.</p>

          <div>
            <a href="/send-rewards/reward-points/reward-points-overview"><span>Reward points overview</span><span>→</span></a>
            <a href="/send-rewards/reward-points/send-reward-points-bulk-upload"><span>Send points in bulk</span><span>→</span></a>
            <a href="/getting-started/for-end-users/how-to-redeem/redeem-reward-points"><span>Redeem reward points</span><span>→</span></a>
          </div>
        </div>

        <div>
          <span>
            <svg>
              <path />

              <path />

              <path />
            </svg>
          </span>

          <h3>Campaigns</h3>
          <p>Run recurring reward programmes without sending each reward by hand.</p>

          <div>
            <a href="/campaigns/campaigns-overview"><span>Campaigns overview</span><span>→</span></a>
            <a href="/campaigns/create-a-reward-link-campaign"><span>Create a reward link campaign</span><span>→</span></a>
            <a href="/campaigns/create-a-reward-code-campaign"><span>Create a reward code campaign</span><span>→</span></a>
          </div>
        </div>

        <div>
          <span>
            <svg>
              <path />

              <path />

              <path />
            </svg>
          </span>

          <h3>Reward marketplace</h3>
          <p>Gift cards, merchandise, experiences, flights, charity and cash-outs in one catalogue.</p>

          <div>
            <a href="/reward-marketplace/reward-marketplace-overview"><span>Marketplace overview</span><span>→</span></a>
            <a href="/reward-marketplace/merchandise"><span>Merchandise</span><span>→</span></a>
            <a href="/reward-marketplace/experiences"><span>Experiences</span><span>→</span></a>
          </div>
        </div>

        <div>
          <span>
            <svg>
              <path />

              <rect />

              <path />
            </svg>
          </span>

          <h3>Wallet & payments</h3>
          <p>Fund the account, pick a payment method, and keep the balance topped up.</p>

          <div>
            <a href="/getting-started/for-admins/wallet-management/wallet-management-overview"><span>Wallet management</span><span>→</span></a>
            <a href="/getting-started/for-admins/wallet-management/funding-the-account"><span>Funding the account</span><span>→</span></a>
            <a href="/getting-started/for-admins/wallet-management/payment-methods"><span>Payment methods</span><span>→</span></a>
          </div>
        </div>

        <div>
          <span>
            <svg>
              <path />

              <path />
            </svg>
          </span>

          <h3>Reports</h3>
          <p>Track what was sent, what was claimed, and what it cost — with exports.</p>

          <div>
            <a href="/account-administration/reporting/reporting-overview"><span>Reporting overview</span><span>→</span></a>
            <a href="/account-administration/reporting/reward-link-report"><span>Reward link report</span><span>→</span></a>
            <a href="/account-administration/reporting/payments"><span>Payments report</span><span>→</span></a>
          </div>
        </div>

        <div>
          <span>
            <svg>
              <rect />

              <path />

              <path />
            </svg>
          </span>

          <h3>Prepaid cards</h3>
          <p>Virtual Visa and international PayPal payouts for recipients who want cash.</p>

          <div>
            <a href="/prepaid-cards/virtual-visa-card"><span>Virtual Visa card</span><span>→</span></a>
            <a href="/prepaid-cards/virtual-paypal-international"><span>Virtual PayPal international</span><span>→</span></a>
            <a href="/reward-marketplace/cash-outs"><span>Cash-outs in the marketplace</span><span>→</span></a>
          </div>
        </div>

        <div>
          <span>
            <svg>
              <path />

              <path />

              <path />
            </svg>
          </span>

          <h3>Integrations</h3>
          <p>Connect Plum to your CRM, survey tool or HRMS so rewards fire automatically.</p>

          <div>
            <a href="/integrations/integration-overview"><span>Integrations overview</span><span>→</span></a>
            <a href="/integrations/salesforce/salesforce-overview"><span>Salesforce</span><span>→</span></a>
            <a href="/integrations/hubspot/hubspot-overview"><span>HubSpot</span><span>→</span></a>
          </div>
        </div>
      </div>
    </div>

    <div>
      <h2>Keep up with Plum</h2>
      <p>What shipped recently, how it works on screen, and where to get help.</p>

      <div>
        <a href="/product-updates/june-2026-2">
          <span>
            <svg>
              <path />

              <path />
            </svg>
          </span>

          <h3>Product updates</h3>
          <p>Release notes for every new feature and improvement.</p>
          <span>See what's new →</span>
        </a>

        <a href="/walkthrough-videos/plum-product-videos">
          <span>
            <svg>
              <path />

              <path />
            </svg>
          </span>

          <h3>Walkthrough videos</h3>
          <p>Short video tours of the dashboard, campaigns and offers management.</p>
          <span>Watch the videos →</span>
        </a>

        <a href="mailto:cs@xoxoday.com">
          <span>
            <svg>
              <rect />

              <path />
            </svg>
          </span>

          <h3>Talk to support</h3>
          <p>Stuck on something that is not covered here? Reach the customer success team.</p>
          <span>Raise a ticket →</span>
        </a>
      </div>
    </div>

    <div>
      <h2>More from Xoxoday</h2>
      <p>The other two products, and the FAQs that cover all three.</p>

      <div>
        <a href="https://help-empuls.xoxoday.com">
          <img alt="Empuls" />

          <img alt="Empuls" />

          <p>Employee engagement, recognition and rewards, surveys, and the social intranet.</p>
          <span>Empuls Help Center →</span>
        </a>

        <a href="https://help-loyalife.xoxoday.com">
          <img alt="Loyalife" />

          <img alt="Loyalife" />

          <p>Build and run customer loyalty programmes — tiers, points, rules and member engagement.</p>
          <span>Loyalife Help Center →</span>
        </a>

        <a href="https://faqs.xoxoday.com">
          <img alt="Xoxoday" />

          <img alt="Xoxoday" />

          <p>Answers to the questions we are asked most often, across every Xoxoday product.</p>
          <span>Product FAQs →</span>
        </a>
      </div>
    </div>

    <div>
      <div>
        <div>
          <a href="https://www.xoxoday.com/privacy">Privacy Policy</a>
          <a href="https://www.xoxoday.com/terms">Terms of Service</a>
          <a href="https://www.xoxoday.com/cookies">Cookie Policy</a>
          <a href="https://www.xoxoday.com/plum/demo">Talk to sales</a>
          <a href="https://internal-wiki.xoxoday.com/partners/overview">Partner Centre</a>
        </div>

        <p>© 2026 Xoxoday, Inc. · Make every day rewarding.</p>
      </div>

      <img alt="Xoxoday" />

      <img alt="Xoxoday" />
    </div>
  </div>
</div>


# ActiveCampaign: Overview
Source: https://help-plum.xoxoday.com/integrations/activecampaign/activecampaign-overview

Get an overview of the Plum-ActiveCampaign integration and how it automates rewards triggered by marketing automation events.

*This article will guide you through integrating ActiveCampaign with Xoxoday Plum and setting up your first automation.*

## Here is how the Xoxoday ActiveCampaign Integration works?

Follow the below steps to create ActiveCampaign Reward Automation in Plum. Creation of automation in ActiveCampaign to connect Xoxoday plum.

## Pre-requisite

The App should be installed to be used as an action.

## Steps to Connect Rewards on ActiveCampaign with Plum

Xoxoday Plum can simply be integrated into ActiveCampaign by following the steps below:

You (the admin) can log in to ActiveCampaign and set up Xoxoday automation in either of the two ways.

## Method 1

* Sign in to **ActiveCampaign with** your credentials.

* Under the **"Automations" tab, click on "Create an Automation**"

* Choose "**Xoxoday Plum" from the "Actions**" tab to set up the workflow.

* Click on the account to which you would like to set up the automation.

<img alt="" />

<img alt="" />

<img alt="" />

<img alt="" />

<img alt="" />

## Method 2:

* Under the "**Automations**" tab

* Click on "Create a new automation" and click on the\*\*"+"\*\* button to add your first action and choose Xoxoday Plum from the options below:

<img alt="" />

<img alt="" />

<img alt="" />

## Creation of Reward Automation on Plum

* Next, sign in to Plum using [https://www.xoxoday.com/](https://www.xoxoday.com/)

* Once signed up to Plum, add funds to your account.

* Now go to Campaign on the sidebar, and click on Create New to create a reward campaign.

* Define the Reward Amount, Select rewards from the catalog, customize your email and click on Proceed.

* Now go to "Manage Integrations" and select ActiveCampaign Integration.

* Click on "Create New Automation" give your reward automation a name and select the type of trigger manual or automated.

* Finally, click on launch.

* To view Reward automation statistics, open the reward automation from the dashboard.

## Disconnecting Xoxoday Plum from ActiveCampaign

* Go to "Apps" on ActiveCampaign, Select Connected Apps

<img alt="" />

2\. Select "Xoxoday Plum" and Select the account you wish to disconnect

3. Click on "Disconnect":
   ​

<img alt="" />

## Integrate Your ActiveCampaign with Plum and witness amazing results!

Positively impact your audience’s journey and get that prospect which ultimately becomes a sale. Integrate your ActiveCampaign with Xoxoday Plum and see the difference with positive results. With dedicated account managers, full-time support to admins as well as end-users, and ISO, GDPR, and SOC compliance, Xoxoday Plum is as safe as it gets.
​

For any questions or feedback reach out to us at [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Creating Automation
Source: https://help-plum.xoxoday.com/integrations/activecampaign/creating-automation

Learn how to create a reward automation inside ActiveCampaign using Plum, so contacts are rewarded automatically at the right moment.

*This page will help you in creating your first automation with Xoxoday's ActiveCampaign Integration*

## Steps to Connect & Automate Rewards on ActiveCampaign with Plum

\*\*Step 1:\*\*Connect your Xoxoday & active campaign account.**Step 2:** Login/Signup to your Xoxoday account.

<img alt="" />​

Step 3:\*\* Click on ActiveCampaign Integration under Manage Integration and select "Connect" to sync ActiveCampaign with Xoxoday.

<img alt="" />

Login to your ActiveCampaign account and connect with Xoxoday Plum as shown in previous article.

Create a Reward Campaign as shown in ::Xoxo-link::

## Create Reward Automation

Step 1: Click on '**Create New Automation**' in ActiveCampaign Dashboard.\*\*​

Step 2: Name your automation and click on 'Save and Proceed'.\*\* \*\*​

<img alt="" />

## Set your Reward

Here you can select the Campaign which holds the type of rewards and brands you want to use for this automation. You can set reward expiry and select the Approval type as manual or automatic. In Advanced Settings, you can set start and end date of automations and many more customisations.\*\*​

<img alt="" />

Now, click on "Save and Launch" \*\*to move to next step.

<img alt="" />

Now, Click '**Yes, Launch'** button to launch automation.

### Automation created Successfully

<img alt="" />

**Link to the Xoxoday Plum recipe:**

Send Gift to New Client [https://www.activecampaign.com/marketplace/recipe/send-gift-card-to-new-client](https://www.activecampaign.com/marketplace/recipe/send-gift-card-to-new-client)

## Based on the triggers, rewards can be:

* Sent automatically without restrictions, which will be automatically distributed based on a customized time range and the maximum count of rewards, or

* Subjected to manual approval by admins.

* Now that the reward triggers are set, head back to the ActiveCampaign dashboard and click on ‘Create an Automation’. The template can be created from scratch or a readymade template aka ‘Recipe\*\*’ can be put to use.

* Next up, you ‘**Add a New Trigger**’ on the workflow builder, which is made easy with the recipe templates that come with their own sets of triggers.

* Once this is done, you can **‘Add a New Action**’ by clicking on CX Apps and selecting Reward through Xoxoday Plum. In case the [Xoxoday Plum Rewards App](https://www.activecampaign.com/apps/xoxoday-plum-integration) hasn’t been installed, it can be done at this very step.

* Remember the Automation we configured in Step 5? When the configured automation list appears, select your particular automation, and activate it with ‘Active’. Before activation, a quick review can be done with ‘View Contacts’. Refer to the above GIF for a better outlook.

* Bravo! Your ActiveCampaign Reward Automation is all set to be launched.

**Some points to note**

* While setting up the reward automation, the denomination will be in the same currency as the one selected in your Billing Details.

* You will have all access to the dashboard features of the Reward Automation and can deactivate the reward automation at any stage.

* On the condition that someone on the recipients’ list matches the criteria on ActiveCampaign automation, he/she automatically receives the reward delivered to his inbox in the form of Reward Codes.

As for your audience, check **how one can redeem the Xoxo Codes** on Marketplace.


# Zapier Integration
Source: https://help-plum.xoxoday.com/integrations/connect-plum-to-thousands-of-apps-using-zapier

Learn how to connect Plum to thousands of apps using Zapier, letting you trigger reward sends from almost any tool you use.

*Connect Xoxoday Plum to thousands of apps for various use-cases*

Below are some of the many Apps and their Use-Cases with templatized triggers that can be connected to Xoxoday Plum to send rewards, via Zapier:

## HRMS Tools

## 1. BambooHR

By connecting BambooHR with Xoxoday Plum, rewards can be sent to newly joined employees on successful onboarding completion.

Step 1: Select BambooHR as the Trigger application, the Trigger, in this case, is\*\*“When a new employee is added to BambooHR”. First, log in to your BambooHR account and Test trigger to Find data.\*\*

<img alt="" />

**Step 2:** Next, pick Xoxoday Plum as the Action application to send rewards in the form of e-gift cards automatically as a response to the Trigger, i.e. to new employees on BambooHR.

<img alt="" />

**Step 3:** After DIY set-up, log in as a registered user of Xoxoday Plum.

<img alt="" />

Step 4: Click\*\*'Continue\*\*' and begin Customizing the Reward. Fill up all the fields depending on the use-case of the Action you have set. Double-check everything. For example, the Recipient Email field is important if the gift card(s) need to be sent to the user via email.

<img alt="" />

**Step 5: Test and Review or Continue.**

<img alt="" />

<img alt="" />

**Congrats! Your Zap is ready.**

As a result of this integration, when a new employee is added to BambooHR, he/she receives Xoxoday Plum’s customized Gift Card via email.

**2. Namely**

By connecting Namely with Xoxoday Plum, rewards can be sent to new employees on successful onboarding completion.

Step 1: Select Namely as the Trigger application, the Trigger, in this case, is\*\*“When a new employee is added to Namely”\*\*. First, log into your Namely account and Test the trigger to Find data.

<img alt="" />

**Step 2:** Next, pick Xoxoday Plum as the Action application to send rewards in the form of e-gift cards automatically as a response to the Trigger, i.e. to new employees on Namely.

<img alt="" />

**Step 3:** After DIY set-up or log in as a registered user of Xoxoday Plum.

<img alt="" />

**Step 4:** Click Continue and begin Customizing the Reward. Fill up all the fields depending on the use case of the Action you have set. Double-check everything. For example, the "Recipient Email" field is important if the gift card(s) need to be sent to the user via email.

<img alt="" />

**Step 5:** Test and Review or Continue.

<img alt="" />

<img alt="" />

As a result of this integration, when a new employee is added on Namely, he/she receives Xoxoday Plum’s customized Gift Card via email.

**3. Beekeeper**

By connecting Beekeeper with Xoxoday Plum, rewards can be sent for an employee’s personal milestones (birthdays, wedding anniversary celebration, etc.) as well as professional milestones (for work anniversaries, superior performance, employee referrals, achieving targets, participation in events conducted, etc.).

**Step 1:** Select Beekeeper as the Trigger application, the Trigger, in this case, is \*“an employee celebrating an anniversary on a particular day”. First, log into your Beekeeper account and Test the trigger to Find data.

<img alt="" />

<img alt="" />

**Step 2:** Next, pick Xoxoday Plum as the Action application to send rewards in the form of e-gift cards automatically as a response to the Trigger, i.e. to new employees on Beekeeper.

<img alt="" />

**Step 3:** After DIY set-up or login as a registered user of Xoxoday Plum.

<img alt="" />

**Step 4:** Click Continue and begin Customizing the Reward. Fill up all the fields depending on the use case of the Action you have set. Double-check everything. For example, the Recipient Email field is important if the gift card(s) need to be sent to the user via email.

<img alt="" />

**Step 5:** Test and Review or Continue.

<img alt="" />

<img alt="" />

**Congrats! Your Zap is ready.**

As a result of this integration, the day on which an employee celebrates his/her anniversary on Beekeeper, he/she receives Xoxoday Plum’s customized Gift Card via email.

## Survey tools & Forms

**1.Survey Monkey**

**2. Survey Sparrow**

By connecting SurveySparrow with Xoxoday Plum, rewards can be sent to a respondent on completion of any given survey.

Step 1: Select SurveySparrow as the Trigger application, the Trigger, in this case, is\*\*“when a user completes a survey”\*\*. First, log into your SurveySparrow account and Test the trigger to Find data.

<img alt="" />

<img alt="" />

**Step 2:** Next, pick Xoxoday Plum as the Action application to send rewards in the form of e-gift cards automatically as a response to the Trigger, i.e. to new responses to a survey on SurveySparrow.

<img alt="" />

**Step 3:** After DIY set-up or log in as a registered user of Xoxoday Plum.

<img alt="" />

**Step 4:** Click Continue and begin Customizing the Reward. Fill up all the fields depending on the use-case of the Action you have set. Double-check everything. For example, the Recipient Email field is important if the gift card(s) need to be sent to the user via email.

<img alt="" />

**Step 5:** Test and Review or Continue.

<img alt="" />

**Congrats! Your Zap is ready.**

As a result of this integration, whenever a new response is submitted by a user on SurveySparrow, the user receives Xoxoday Plum’s customized Gift Card via email.

**3. SurveyGizmo**

By connecting SurveyGizmo with Xoxoday Plum, rewards can be sent to a respondent on completion of any given survey.

Step 1: Select SurveyGizmo as the Trigger application, the Trigger, in this case, is\*\*“when a user completes a survey”\*\*. First, log into your SurveyGizmo account and Test the trigger to Find data.

<img alt="" />

**Step 2:** Next, pick Xoxoday Plum as the Action application to send rewards in the form of e-gift cards automatically as a response to the Trigger, i.e. to new responses to a survey on SurveyGizmo.

<img alt="" />

**Step 3:** After DIY set-up or log in as a registered user of Xoxoday Plum.

<img alt="" />

**Step 4:** Click Continue and begin Customizing the Reward. Fill up all the fields depending on the use-case of the Action you have set. Double-check everything. For example, the Recipient Email field is important if the gift card(s) need to be sent to the user via email.

<img alt="" />

**Step 5:** Test and Review or Continue.

<img alt="" />

<img alt="" />

**Congrats! Your Zap is ready.**

As a result of this integration, whenever a new response is submitted by a user on SurveyGizmo, the user receives Xoxoday Plum’s customized Gift Card via email.

**4. TypeForm**

By connecting TypeForm with Xoxoday Plum, rewards can be sent to new entries on TypeForm.

Step 1: Select TypeForm as the Trigger application, the Trigger, in this case, is\*\*“when a new entry is made”\*\*. First, log into your TypeForm account and Test the trigger to Find data.

<img alt="" />

**Step 2:** Next, pick Xoxoday Plum as the Action application to send rewards in the form of e-gift cards automatically as a response to the Trigger, i.e. to new entries on TypeForm.

<img alt="" />

**Step 3:** After DIY set-up or log in as a registered user of Xoxoday Plum.

<img alt="" />

**Step 4:** Click Continue and begin Customizing the Reward. Fill up all the fields depending on the use-case of the Action you have set. Double-check everything. For example, the "Recipient Email" field is important if the gift card(s) need to be sent to the user via email.

<img alt="" />

**Step 5:** Test and Review or Continue.

<img alt="" />

<img alt="" />

**Congrats! Your Zap is ready.**

As a result of this integration, whenever a new entry is made on TypeForm, the user receives Xoxoday Plum’s customized Gift Card via email.

**5. Qualtrics**

By connecting Qualtrics with Xoxoday Plum, rewards can be sent to new entries on Qualtrics.

**Step 1:** Select Qualtrics as the Trigger application, the Trigger, in this case, is “when a new response is added to the survey”. First, log in to your Qualtrics account and Test the trigger to Find data.

<img alt="" />

**Step 2:** Next, pick Xoxoday Plum as the Action application to send rewards in the form of e-gift cards automatically as a response to the Trigger, i.e. to new responses to a survey on Qualtrics.

<img alt="" />

**Step 3:** After DIY set-up or log in as a registered user of Xoxoday Plum.

<img alt="" />

**Step 4:** Click Continue and begin Customizing the Reward. Fill up all the fields depending on the use-case of the Action you have set. Double-check everything. For example, the Recipient Email field is important if the gift card(s) need to be sent to the user via email.

<img alt="" />

**Step 5:** Test and Review or Continue.

<img alt="" />

**Congrats! Your Zap is ready.**

As a result of this integration, whenever a new response is submitted by a user on a Qualtrics survey, the user receives Xoxoday Plum’s customized Gift Card via email.

## Sales and Marketing Enablement, CRM

**1.** \*\*[Salesforce CRM](/integrations/connect-plum-to-thousands-of-apps-using-zapier)**​**

**2. Zoho CRM**

By connecting Zoho with Xoxoday Plum, rewards can be sent to new leads/prospects added on Zoho.

Step 1: Select Zoho as the Trigger application, the Trigger, in this case, is\*\*“when a new lead(a record) is added”\*\*. First, log in to your Zoho account and Test the trigger to Find data.

<img alt="" />

**Step 2:** Next, pick Xoxoday Plum as the Action application to send rewards in the form of e-gift cards automatically as a response to the Trigger, i.e. to a new lead added on Zoho.

<img alt="" />

**Step 3:** After DIY set-up or log in as a registered user of Xoxoday Plum.

<img alt="" />

**Step 4:** Click Continue and begin Customizing the Reward. Fill up all the fields depending on the use-case of the Action you have set. Double-check everything. For example, the Recipient Email field is important if the gift card(s) need to be sent to the user via email.

<img alt="" />

**Step 5:** Test and Review or Continue.

<img alt="" />

<img alt="" />

**Congrats! Your Zap is ready.**

As a result of this integration, whenever a new lead is added to Zoho, the user receives Xoxoday Plum’s customized Gift Card via email.

**3. Freshsales CRM**

By connecting Freshsales with Xoxoday Plum, rewards can be sent to new leads/prospects added on Freshsales.

Step 1: Select Freshsales as the Trigger application, the Trigger, in this case, is\*\*“when a new lead(a record) is added”\*\*. First, log into your Freshsales account and Test the trigger to Find data.

<img alt="" />

**Step 2:** Next, pick Xoxoday Plum as the Action application to send rewards in the form of e-gift cards automatically as a response to the Trigger, i.e. to a new lead added on Freshsales.

<img alt="" />

**Step 3:** After DIY set-up or log in as a registered user of Xoxoday Plum.

<img alt="" />

**Step 4:** Click Continue and begin Customizing the Reward. Fill up all the fields depending on the use-case of the Action you have set. Double-check everything. For example, the Recipient Email field is important if the gift card(s) need to be sent to the user via email.

<img alt="" />

**Step 5:** Test and Review or Continue.

<img alt="" />

<img alt="" />

​

**Congrats! Your Zap is ready.**

As a result of this integration, whenever a new lead is added to Freshsales, the user receives Xoxoday Plum’s customized Gift Card via email.

**4. Hubspot Marketing Automation**- By connecting HubSpot with Xoxoday Plum, rewards can be sent to **new form submissions** on HubSpot.

<img alt="" />

​

* By connecting HubSpot with Xoxoday Plum, rewards can be sent to \***new deals added** on HubSpot.

Step 1: Select HubSpot as the Trigger application, the Trigger, in this case, is\*\*“when a new deal is added”\*\*. First, log into your HubSpot account and Test the trigger to Find data.

<img alt="" />

**Step 2:** Next, pick Xoxoday Plum as the Action application to send rewards in the form of e-gift cards automatically as a response to the Trigger, i.e. to a new deal added on HubSpot.

<img alt="" />

**Step 3:** After DIY set-up or log in as a registered user of Xoxoday Plum.

<img alt="" />

**Step 4:** Click Continue and begin Customizing the Reward. Fill up all the fields depending on the use-case of the Action you have set. Doublecheck everything. For example, the "Recipient Email" field is important if the gift card(s) need to be sent to the user via email.

<img alt="" />

**Step 5:** Test and Review or Continue.

<img alt="" />

<img alt="" />

**Congrats! Your Zap is ready.**

As a result of this integration, whenever a new deal is added to HubSpot, the user receives Xoxoday Plum’s customized Gift Card via email.

### 5. Mailchimp Email Newsletter

By connecting Mailchimp with **Xoxoday Plum**, rewards can be sent to every new subscriber of Mailchimp’s email newsletter.

Step 1: Select Mailchimp as the Trigger application, the Trigger, in this case, is\*\*“new subscriber of the newsletter”\*\*. First, log in to your Mailchimp account and Test the trigger to Find data.

<img alt="" />

**Step 2:** Next, pick Xoxoday Plum as the Action application to send rewards in the form of e-gift cards automatically as a response to the Trigger, i.e. to a new subscriber on Mailchimp.

<img alt="" />

**Step 3:** After DIY set-up or log in as a registered user of Xoxoday Plum.

<img alt="" />

**Step 4:** Click Continue and begin Customizing the Reward. Fill up all the fields depending on the use-case of the Action you have set. Double-check everything. For example, the "Recipient Email" field is important if the gift card(s) need to be sent to the user via email.

<img alt="" />

​

**Step 5:** Test and Review or Continue.

<img alt="" />

<img alt="" />

**Congrats! Your Zap is ready.**

As a result of this integration, whenever a new subscriber is added to Mailchimp, the user receives Xoxoday Plum’s customized Gift Card via email.

**6. Google Sheets**

By connecting GoogleSheet with Xoxoday Plum, rewards can be sent to every new user row(prospect lead) added to the Google spreadsheet.

Step 1: Select GoogleSheet as the Trigger application, the Trigger, in this case, is\*\*“new row added to spreadsheet”\*\*. First, log into your Google account and Test the trigger to Find data.

<img alt="" />

**Step 2:** Next, pick Xoxoday Plum as the Action application to send rewards in the form of e-gift cards automatically as a response to the Trigger, i.e. to a new row on Google Sheet.

<img alt="" />

**Step 3:** After DIY set-up or log in as a registered user of Xoxoday Plum.

<img alt="" />

**Step 4:** Click Continue and begin Customizing the Reward. Fill up all the fields depending on the use-case of the Action you have set. Double-check everything. For example, the Recipient Email field is important if the gift card(s) need to be sent to the user via email.

<img alt="" />

**Step 5:** Test and Review or Continue.

<img alt="" />

<img alt="" />

**Congrats! Your Zap is ready.**

As a result of this integration, whenever a new spreadsheet row is added to GoogleSheet, the user receives Xoxoday Plum’s customized Gift Card via email.

## Webinar Tools

**1. Go to Webinar**

By connecting GoToWebinar with Xoxoday Plum, rewards can be sent to every new webinar attendee.

Step 1: Select GoToWebinar as the Trigger application, the Trigger, in this case, is\*\*“new webinar attendee”. First, log in to your GoToWebinar account and Test the trigger to Find data.

<img alt="" />

**Step 2:** Next, pick Xoxoday Plum as the Action application to send rewards in the form of e-gift cards automatically as a response to the Trigger, i.e. to a new attendee of a webinar in GoToWebinar.

<img alt="" />

**Step 3:** After DIY set-up or log in as a registered user of Xoxoday Plum.

<img alt="" />

**Step 4:** Click Continue and begin Customizing the Reward. Fill up all the fields depending on the use-case of the Action you have set. Double-check everything. For example, the "Recipient Email" field is important if the gift card(s) need to be sent to the user via email.

<img alt="" />

**Step 5:** Test and Review or Continue.

<img alt="" />

<img alt="" />

**Congrats! Your Zap is ready.**

As a result of this integration, every new webinar attendee in GoToWebinar receives Xoxoday Plum’s customized Gift Card via email.

2. Zoom \*\*By connecting Zoom with **Xoxoday Plum**, rewards can be sent to every new registrant.

Step 1: Select Zoom as the Trigger application, the Trigger, in this case, is\*\*“new registrant in Zoom”. First, log in to your Zoom account and Test the trigger to Find data.

<img alt="" />

**Step 2:** Next, pick Xoxoday Plum as the Action application to send rewards in the form of e-gift cards automatically as a response to the Trigger, i.e. to new registrants in Zoom.

<img alt="" />

**Step 3:** After DIY set-up or log in as a registered user of Xoxoday Plum.

<img alt="" />

**Step 4:** Click Continue and begin Customizing the Reward. Fill up all the fields depending on the use-case of the Action you have set. Double-check everything. For example, the "Recipient Email" field is important if the gift card(s) need to be sent to the user via email.

<img alt="" />

**Step 5:** Test and Review or Continue.

<img alt="" />

<img alt="" />

**Congrats! Your Zap is ready.** As a result of this integration, every new registrant in Zoom receives Xoxoday Plum’s customized Gift Card via email.

## What Next? : Quick Zap Creation

The use cases mentioned in the above section are a few of the many popular Zap templates that already exist to connect applications like **Salesforce, HubSpot, SurveyMonkey, GoToWebinar, Mailchimp, etc. to Xoxoday Plum**. Using these pre-created templates will help you automate the workflow and get it up and running in no time.

For more information about building your first **Xoxoday → Zapier integration**, [Contact us](https://www.xoxoday.com/contact-us).


# Darwinbox: Overview
Source: https://help-plum.xoxoday.com/integrations/darwinbox/darwinbox-overview

Learn how the Plum-Darwinbox integration works, connecting your HRMS to Plum so employee rewards can be triggered and disbursed automatically.

*Learn all about integration of Darwinbox with Xoxoday Plum.*

## Overview

Xoxoday integrates with DarwinBox, one of the leading HRMS automation platforms for modern businesses. This integration enables organizations using DarwinBox to not only streamline and automate HR workflows, but also seamlessly reward employees to keep them motivated, engaged, and appreciated.

With Xoxoday Plum, companies can build a culture of recognition through a unified rewards platform offering a global catalog of products and experiences — helping teams feel valued and inspired to do their best work.

## Points Redemption procedure

* Log in to your DarwinBox account.

* \*\*Darwinbox + Xoxoday Integration \*\*Click on the **Recognition** tile.

* Click **Redeem**, get redirected to [stores.xoxoday.com](https://docs.xoxoday.com/docs/stores.xoxoday.com), and get auto logged in via SSO.

* Users will be automatically logged in to [Xoxoday plum stores](https://docs.xoxoday.com/docs/stores.xoxoday.com) (Catalog front).

* Users can redeem their points in plum on a variety of experiences and vouchers.

* Select your Country & Click on **Gift Vouchers, experiences**, or other classification of your choice.

* Select the listed Brand Voucher or any other option.

* Select the Denomination and Quantity and then Add to the Cart.

* Under the payment option, click on Use available xxx points for this order and place the order. You may use a debit/credit card to augment points in case it is insufficient.

* You can also view the integration video here:

* You can view the interactive demo using this [***<u>Link</u>***](https://reward-path-showcase.lovable.app)


# Guide to Configure End-points
Source: https://help-plum.xoxoday.com/integrations/darwinbox/guide-to-configure-end-points

Follow this step-by-step guide to configure the Darwinbox API endpoints needed to connect your HRMS with Plum for reward automation.

*Learn about the configuration on Darwinbox.*

Step 1: Initiate the process by logging in to the Xoxoday Admin dashboard using the provided link:\*\*stores.xoxoday.com.\*\*Step 2: Navigate to the "**Integrations" section and select "Darwinbox**".

<img alt="" />

**Step 3:** Proceed to Configure the Darwinbox settings.

<img alt="" />

Step 4: Fill in the necessary fields, namely **Username, Password, Datasetkey, and Redirect URL**. You should have received these specific details from the Darwinbox team.

<img alt="" />

Step 5:\*\* Update the Endpoint URL and API Key for the following subsequent endpoints:

* Fetch Point Balance API

* Update Point Balance API Endpoint

* Fetch Employee Master API

<img alt="" />

Step 6: After completing the previous step, click "**Verify and Proceed"**. Afterwards, please notify to your implementation manager from Xoxoday, so that we can inform the Darwinbox team to activate the redemption button on your behalf.

<img alt="" />

Step 7:\*\* Upon the successful completion of this configuration, feel free to arrange a call with us to facilitate an onboarding session. During this session, we will guide you through both the end user journey and the admin dashboard.

​
​


# Forsta (Decipher) Integration
Source: https://help-plum.xoxoday.com/integrations/forsta-decipher-integration

Get an overview of the Plum integration with Forsta Decipher and how it automates reward distribution to survey respondents.

*Learn more about Forsta and Xoxoday Plum Integration.*

# Overview

Boost survey response rates and gather meaningful insights with instant rewards! Xoxoday Plum, integrated with Forsta, automates digital rewards, letting you engage respondents effortlessly. Create reward automation campaigns to send rewards instantly, eliminating manual gift-code management for a seamless experience.

## Highlights of the Integration

Once the integration between the two platforms is enabled, you no longer have to juggle between spreadsheets to track or manage reward campaigns, or manually procure and distribute rewards.

Xoxoday Plum not only simplifies the rewarding process but also brings a host of value additions to the integration. Here are some of the key highlights:

* **Automated Rewards on Completion of Survey** The integration allows you to set up Reward automation Campaigns on Xoxoday Plum and send out rewards to respondents who complete the survey. Not just that, the survey respondents can choose gifts, perks, and experiences of their choice from Xoxoday’s extensive global catalog.You can also restrict the number of rewards sent out based on criteria like - campaign time range, Maximum Reward count, etc.

* Built-in Approval Workflows

Integration with Xoxoday allows you to have complete control over whom among your respondents to send the rewards to. The built-in approval system lets you review and approve respondents individually or in bulk. This ensures that there are no repeat claims that take place.

* **Customised Communication Templates**

Survey rewards can be sent to respondents through customized email templates that represent your organizational DNA - with your own logo, messaging, and images. This ensures they are instantly recognised and don't get lost in their inbox.

* **Dedicated Redemption Support**

Our API integrations ensure that the redemption process is seamless and non-intrusive for your users. Furthermore, we also offer global support for all your user queries during redemption.

## How does the Integration Work?

Follow the step-by-step guide to set up the integration between Xoxoday Plum and Forsta, and create & run reward campaigns.

## STEP 1: Connect to Decipher

Go to Integrations and Search for **Forsta (Decipher).** \*\*​

<img alt="" />

Click on ‘Connect\*\*’

​

<img alt="" />

Enter the API Key provided by Forsta (Decipher) account to authenticate and connect your account.

Once the Authentication is done, you are now successfully connected to Xoxoday.
This authentication allows Xoxoday to fetch the Survey Projects on Frosta and set Reward Automation to send rewards.

Setting up Reward Automation

Reward Automation defines Reward Campaigns and provides additional settings to the reward processing.

Click on ‘Create new Automation

<img alt="" />

Here, Name the Automation and Select the Survey from the Frosta account for which you want to send rewards to respondents.
​

<img alt="" />

In the next steps, Select the Reward Campaign you already set up, which defines the reward denomination, catalog, and reward email.

You can set:

* Expiry of Automation: Define the end date of automation.

* Approval type:

Automatic: Automatically send rewards as soon as the survey is submitted by the respondent.

* Manual: This will capture the respondents and you can choose whom they send reward by simply choosing to Approve or Reject button.

<img alt="" />

Click on ‘Save and Launch’ to start reward Automation.
​

<img alt="" />

Once created, Copy the reward claim page link and paste it into Redirect URL of your Survey.

<img alt="" />

​


# Complete Wellness with Fitterfly
Source: https://help-plum.xoxoday.com/integrations/health-and-wellness/complete-wellness-with-fitterfly

Learn how the Plum-Fitterfly integration gives employees access to Complete Wellness programs as part of your rewards and benefits catalogue.

*Learn about integrating Wellness with Fitterfly*

## About Fitterfly

Fitterfly is a health-tech startup specializing in digital therapeutics (DTx) for metabolic health. Fitterfly combines personalized coaching with advanced technology to help individuals manage and reverse chronic conditions.

Fitterfly's programs are clinically validated and have shown significant improvements in health outcomes, including reductions in HbA1c levels, weight loss, and enhanced physical fitness.

## Key Benefits

* **For HRs**

Holistic Employee Wellness Empower your workforce with personalized digital health programs that address diabetes, weight, and lifestyle management — promoting overall well-being.

* Improved Productivity & Engagement Healthier employees are more focused, energetic, and motivated, leading to better workplace performance.

* Preventive Health Insights Gain access to anonymized wellness data and trends to identify potential health risks and plan proactive interventions.

* Scalable, Digital Implementation Easily integrate Fitterfly’s digital platform across teams, ensuring smooth access without logistical challenges.

* For Employees

Personalized Health Coaching Get digital programs tailored to your unique needs — from managing diabetes to maintaining a healthy weight and lifestyle.

* Continuous Progress Tracking Monitor your health metrics and track improvements with smart digital tools and real-time insights.

* Expert Support at Your Fingertips Access guidance from certified coaches, nutritionists, and wellness professionals anytime, anywhere.

* Sustainable Lifestyle Habits Adopt small, consistent changes that help build long-term health, energy, and confidence.

## Support

For setup or usage assistance, contact us at [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Comprehensive Flexibility & Mobility Wellness with STRETCHIT
Source: https://help-plum.xoxoday.com/integrations/health-and-wellness/comprehensive-flexibility-mobility-wellness-with-stretchit

See how the Plum-StretchIt integration lets you offer employees flexibility and mobility wellness programs through your rewards catalogue.

*Learn all about integrating STRETCHIT*

## About STRETCHIT

STRETCHIT is a digital flexibility and mobility training platform designed to improve movement, posture, and overall physical well-being. The platform provides structured stretching programs guided by expert coaches to help users reduce muscle stiffness, prevent injuries, and improve flexibility over time.

Through the STRETCHIT mobile app, users gain access to personalized stretching routines, guided mobility sessions, and progressive training programs tailored to different fitness levels and health goals. The platform focuses on improving mobility, reducing musculoskeletal discomfort, and supporting healthier movement habits for people with sedentary or desk-based lifestyles.

## Why connect with STRETCHIT

Integrating STRETCHIT enables organizations to support employee well-being by addressing mobility, posture, and physical strain caused by long working hours and sedentary routines. This integration helps companies introduce structured flexibility programs that encourage movement, reduce workplace discomfort, and improve overall employee wellness.

## Key Benefits

**For Leaders and HR**- Improved workplace wellness Structured flexibility programs help address common workplace issues such as back pain, muscle stiffness, and poor posture.

* Preventive health support Regular stretching routines can help reduce the risk of musculoskeletal issues and support long-term physical well-being.

* Employee engagement Interactive wellness programs encourage employees to stay active and maintain healthier daily routines.

* Seamless program access Employees can easily access flexibility training sessions through the platform.

For Employees

* Guided stretching programs Access professionally designed flexibility routines tailored to different skill levels.

* Improved mobility and posture Programs designed to help relieve tension from long sitting hours and improve body alignment.

* Convenient training sessions Short and effective sessions that can be performed anytime through the STRETCHIT mobile app.

* Progressive flexibility training Structured programs that help employees gradually improve flexibility and range of motion.

## How Employees Can Use STRETCHIT

* Guided Stretching Sessions

Employees can follow structured stretching routines led by professional trainers that target flexibility, mobility, and posture improvement.

* **Mobility Training Programs**

Users can participate in progressive mobility programs designed to improve joint health and muscle flexibility.

* **Workplace-Friendly Routines**

Short routines designed specifically for people who spend long hours sitting or working at a desk.

* **Progress Tracking**

Employees can track their flexibility progress and stay consistent with guided sessions through the STRETCHIT mobile app.

* **Corporate Wellness Programs**

Organizations can introduce flexibility and mobility training programs to support employee health, reduce physical strain, and promote active lifestyles.

For setup or usage assistance, contact us at [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Comprehensive Home Healthcare Made Easy with Portea
Source: https://help-plum.xoxoday.com/integrations/health-and-wellness/comprehensive-home-healthcare-made-easy-with-portea

Learn how the Plum-Portea integration brings comprehensive home healthcare benefits to employees directly through your rewards program.

*Learn more about integration with Portea*

## About Portea

Portea is a trusted home healthcare company, delivering doctor consultations, physiotherapy, nursing, lab tests, and chronic care management right at patients’ doorsteps. Operating across 60+ cities with 4,000+ clinicians, Portea brings hospital-quality healthcare to homes—reducing hospital visits and ensuring continuous care with convenience for healthier, happier employees and families.

## Why Connect Portea with Xoxoday Plum

Integrating Portea helps organizations provide employees and their families with easy access to home healthcare services. Employees can book medical visits, physiotherapy, or lab tests at home, while business leaders can promote preventive health, reduce absenteeism, and support employees’ holistic wellbeing—especially for aging family members or those recovering from illness.

## Key Benefits

**For Employers**- \*\*End-to-end health support Offer home-based medical and nursing care as part of employee benefits.

* Reduce absenteeism Enable faster recovery and continuity of work through at-home care.

* Inclusive wellness Extend benefits to employees’ families and dependents.

* Stronger wellbeing culture Promote preventive and post-hospitalization care programs.

For Employees

* **Convenient Home Healthcare** \*\* Access professional medical care, nursing, and wellness services from the comfort of home—saving time and ensuring continuous care.

* Trusted Support for Family Health\*\* \*\* Receive reliable and compassionate healthcare solutions for yourself and your loved ones, including specialized elder care services.

## Support

For setup or usage assistance, contact us at [cs@xoxoday.com](mailto:cs@xoxoday.com)


# Comprehensive Wellness with HealthiFy
Source: https://help-plum.xoxoday.com/integrations/health-and-wellness/comprehensive-wellness-with-healthify

See how the Plum-Healthify integration lets you deliver comprehensive employee wellness programs as part of your rewards and benefits offering.

*Learn how to integrate Xoxoday with HealthiFy*

## About HealthiFy

HealthiFy is a global digital health and wellness platform offering AI-led nutrition, fitness, and wellness solutions. Combining advanced analytics with human expertise, it helps users build healthy habits through data-driven insights and coaching support.

## Why Integrate with HealthiFy

The integration enables HR teams to deliver a unified, science-backed wellness experience for employees. Through this integration, employees can access wellness programs, monitor progress, and receive expert guidance—all within their corporate wellness ecosystem.

## Key Benefits

* **For Employers/ HR Leaders**

Comprehensive wellness ecosystem Offer employees AI-powered health tracking, expert coaching, and engagement tools in one platform.

* Seamless integration Embed HealthiFy’s programs directly into the platform for unified wellness delivery.

* Data insights & engagement Track participation, engagement, and overall wellness trends across teams.

* Preventive health impact Encourage early health awareness and reduce long-term healthcare costs.

* ## For Employees

Personalised wellness journey Receive customized plans for diet, exercise, and mindfulness.

* Continuous support Access guidance from professional health coaches and AI-driven insights.

* Sustainable habit formation Build long-term healthy routines through consistent nudges and motivation.

* Engaging digital experience Use the HealthiFy app to log meals, track progress, and celebrate milestones.

## How Employees Can Redeem Points Using HealthiFy

* Enroll in the Program Employees can sign up through the Xoxoday platform and get a personalized wellness assessment.

* Set Health Goals Define goals—such as fitness, nutrition, or mindfulness—and receive tailored plans.

* Track Daily Progress Use the Healthify app to log meals, workouts, and hydration.

* Get Expert Support Interact with nutritionists and fitness coaches for customized advice.

* Stay Motivated Participate in wellness challenges, leaderboards, and team activities for engagement.

## Support

For setup or usage assistance, contact us at [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Comprehensive Wellness with Humm Care
Source: https://help-plum.xoxoday.com/integrations/health-and-wellness/comprehensive-wellness-with-humm-care

Learn how the Plum-Humm Care integration supports employee wellness with comprehensive care benefits available through your rewards catalogue.

*Learn more about integration with Humm Care*

## About Humm Care

Humm Care provides comprehensive, inclusive healthcare solutions focused on women’s health, family care, and eldercare. Through expert consultations and personalized programs, it supports employees across fertility, pregnancy, postpartum, and caregiving journeys.

Why Connect with Humm Care Integrating Humm Care offers employees holistic wellness support across life stages while enabling HR teams to track engagement and well-being, fostering a healthier, more supported workforce.

## Key Benefits

* For HRs

Enhanced Employee Well-being Support employees through life’s most important phases with structured maternal and childcare programs that promote physical and emotional health.

* Improved Retention & Loyalty Provide meaningful benefits that help new and expecting parents feel supported, reducing turnover and increasing long-term engagement.

* Inclusive Wellness Offering Create a family-friendly workplace by extending wellness initiatives beyond traditional healthcare to include maternal and child development support.

* Seamless Program Integration Easily enable Humm Care’s services through Xoxoday’s platform, ensuring convenient access for employees across locations.

* For Employees

\*\*Work-Life Balance Support Access flexible, family-centered care options that help balance personal wellness and professional responsibilities with ease.

* Emotional and Mental Well-being Benefit from empathetic care programs and resources that promote mental resilience and reduce stress during major life transitions.

* Reliable Expert Network Connect with trusted healthcare professionals, counselors, and specialists for guidance whenever needed.

* Empowered Health Awareness Gain knowledge and confidence to make informed health and lifestyle choices for yourself and your family.

## How Employees Can Use Humm Care

Humm Care provides comprehensive support programs for maternal health, prenatal care, and child development\*\*, helping parents and expecting parents navigate every stage with expert guidance and confidence.

* Maternal Health Support Access tailored health programs that support physical and emotional well-being throughout pregnancy and postpartum recovery.

* Prenatal Care Programs Receive personalised care plans, consultations, and resources to ensure a safe and well-supported prenatal experience.

* Child Development Support Get expert advice and developmental guidance to monitor and enhance your child’s early milestones and well-being.

* Easy Digital Access Connect with healthcare professionals, access educational content, and manage your journey conveniently through Humm Care’s digital platform.

## Support

For setup or usage assistance, contact us at [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Comprehensive Wellness with Unlock.fit
Source: https://help-plum.xoxoday.com/integrations/health-and-wellness/comprehensive-wellness-with-unlockfit

See how the Plum-UnlockFit integration enables comprehensive employee wellness benefits as part of your organization's rewards catalogue.

*Learn how to integrate Unlock.Fit with Xoxoday*

## About Unlock.fit

Unlock.fit is a cutting-edge wellness platform that leverages genetic insights to deliver personalized nutrition and fitness plans. By analyzing over 700,000 gene markers, Unlock.fit provides users with tailored recommendations that align with their unique genetic makeup. Their services include DNA testing, blood analysis, personalized diet plans, exercise routines, and expert consultations, all accessible through a user-friendly mobile app.

## Why this integration

Integrating Unlock.fit enables HR teams to offer employees a holistic wellness program that combines genetic insights with personalized nutrition and fitness plans. This integration supports preventive healthcare, enhances employee engagement, and promotes a culture of health and well-being within the organization.

## Key Benefits

* For Organization/ HR Leaders Comprehensive wellness supportDNA and blood-based analysis to tailor nutrition and fitness plans.

* Data-driven insights
  Access to anonymized wellness reports to monitor employee health trends.

* Employee engagement
  Personalized wellness programs that foster a healthier, more productive workforce.

* Seamless integration
  Easy deployment and management through the platform.

* For Employees

Personalized wellness plans Tailored nutrition and fitness recommendations based on genetic and health data.

* Expert guidance:

Access to certified nutritionists and fitness coaches for ongoing support.

* Convenient access
  Wellness programs available anytime, anywhere through the Unlock.fit app.

* Holistic health approach
  Programs designed to address individual health goals and challenges.

## How Employees Can Use Unlock.fit

* DNA & Blood Testing Employees can collect saliva and blood samples using provided kits, which are then analyzed to provide insights into their genetic and health profiles.

* Personalized Wellness Plans Based on test results, employees receive customized diet and exercise plans designed to optimize their health and performance.

* Expert Consultations Access to certified nutritionists and fitness coaches for personalized guidance and support.

* Progress Tracking Monitor health metrics and track progress through the Unlock.fit mobile app, ensuring continuous improvement and engagement.

* Corporate Wellness Programs Organizations can implement DNA-based wellness programs, like CorpGene, to enhance employee health and productivity on a larger scale.

## Co-Sponsor & Deliver Unlock.fit Benefits at Scale

Employers can roll out Unlock.fit’s personalized wellness programs across their organization, ensuring every employee has access to tailored health solutions. By this integration, companies can streamline wellness initiatives, track engagement, and foster a culture of health and well-being.

## Support

For setup or usage assistance, contact us at [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Dental Care with Clove Dental
Source: https://help-plum.xoxoday.com/integrations/health-and-wellness/dental-care-with-clove-dental

Learn how the Plum-Clove Dental integration lets you offer employees dental care benefits directly through your rewards and benefits program.

*Learn more about integration with Clove Dental with Xoxoday*

## About Clove Dental

Clove Dental is India's largest dental chain with 600+ multi-specialty clinics, 1200+ expert dentists, and presence across 27 cities. Their Corporate Dental Health Programme addresses stress-related oral health issues through preventive education, assessments, and accessible healthcare delivery, helping organizations reduce dental-related absenteeism and healthcare costs.

## Why Connect Clove Dental

Employees gain easy access to dental checkups, treatments, and emergency care at convenient locations, while HR can promote wellness, reduce absenteeism, and demonstrate care through accessible health benefits.

## Key Benefits

* **For Organizations**

All-in-one platform: rewards + comprehensive dental wellness

* Nationwide coverage: 600+ clinics across 27 cities for easy employee access

* Reduced absenteeism: Preventive care addresses dental issues before they escalate

* Simplified administration: Centralized booking and benefit delivery at scale

* **For Employees**

Convenient access: Walk-in appointments at 600+ clinics near home or office

* Weekend availability: All clinics open on Saturdays and Sundays

* Comprehensive care: From routine checkups to complex procedures

* Expert treatment: 1200+ qualified dentists including specialists

* Flexible payments: Cash, card, and digital payment options

## How Employees Can Use Clove Dental

* **Preventive Care**

Routine dental checkups, cleanings, and oral health assessments to catch issues early and maintain healthy gums and teeth.

* **Restorative Treatments**

Comprehensive solutions like root canal therapy, crowns, dentures, and dental implants to restore function and comfort.

* **Orthodontics & Alignment**

Consultations and treatments for braces, clear aligners, and bite correction to achieve proper teeth alignment.

* **Cosmetic Dentistry**

Teeth whitening, veneers, and smile enhancement procedures to boost confidence and appearance.

* **Surgical & Emergency Care**

Safe wisdom tooth extractions, emergency dental treatments for pain or injury, and immediate care for infections or trauma.

* **Corporate Dental Wellness**

On-site dental camps, awareness sessions, and educational programs to promote preventive oral health at the workplace.

## Co-Sponsor Health Benefits with Ease

Xoxoday allows organizations to co-sponsor wellness benefits like Clove Dental at reduced costs, making it simple to invest in employee well-being without exceeding budget constraints.

## Support

For setup or usage assistance, contact us at [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Digital Healthcare for Employees with Practo
Source: https://help-plum.xoxoday.com/integrations/health-and-wellness/digital-healthcare-for-employees-with-practo

See how the Plum-Practo integration gives employees access to digital healthcare consultations as part of your organization's benefits catalogue.

*Learn more about integration with Practo*

## About Practo

Practo is a digital healthcare platform that connects employees with doctors across 25+ specialties for both online and in-person consultations. It offers a complete healthcare ecosystem including medicine delivery, diagnostic tests, dental care, and preventive health checkups. Through one easy-to-use app, Practo ensures employees can access trusted medical care anytime, anywhere.

## Why Connect with Practo?

Integrating with Practo enables organizations to extend reliable, round-the-clock healthcare support to their workforce. Employees can easily access medical consultations, book diagnostic tests, or schedule health checkups from their devices. For HR, it simplifies benefit distribution, strengthens employee wellbeing, and reduces absenteeism through preventive care.

## Key Benefits

## For Business Leaders/HR

* Seamless healthcare integration Offer employees convenient access to medical services directly through Xoxoday platform.

* Preventive wellness programs Encourage regular checkups and early diagnosis to maintain workforce health.

* Improved productivity Reduce sick leaves and boost employee morale by providing easy access to care.

## For Employees

* All-in-one medical access Connect with doctors, book tests, or get medicines—all through a single app.

* Choice and convenience Select from 25+ specialties and access care online or at clinics near you.

* Trusted quality care Consult certified doctors and specialists, ensuring reliable treatment and guidance.

## How Employees Can Use Practo

* Health Checkup Book comprehensive preventive health packages and diagnostic tests online with quick scheduling and trusted results.

* Teleconsultation Consult general physicians or specialists online for quick, reliable, and secure medical advice—without leaving home.

* OPD Care Access affordable outpatient care packages for routine checkups and specialized medical consultations.

## Support

For setup or usage assistance, contact us at [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Employee Wellness Sessions with 1to1 help
Source: https://help-plum.xoxoday.com/integrations/health-and-wellness/employee-wellness-sessions-with-1to1-help

Learn how the Plum-1to1Help integration lets employees book wellness sessions through your rewards and benefits catalogue.

*Learn all about integration with 1to1help*

## About 1to1help

1to1Help is a holistic employee well-being platform offering personalized counselling and expert-led support. It helps employees manage stress, mental health, and personal challenges, while enabling organizations to build a healthier, productive, and emotionally resilient workforce.

## Why Integrate with 1to1help?

Integration with 1to1help brings well-being and recognition together on one platform. Employees get the mental health support they need, while HR teams can drive engagement and rewards alongside holistic wellness programs.

## Key Benefits

For Organizations/Business Leaders/HR Leaders

* Manage recognition and well-being from a centralized platform

* Provide easy access to counselling services

* Boost engagement with automated rewards and recognition

For Employees

* Confidential, one-on-one counselling sessions

* Direct access to well-being resources within Empuls

* Work in a supportive, mental health-friendly environment

## How Employees Can Use 1to1help

1to1Help gives employees a confidential and convenient way to address personal and professional challenges.

* Manage Stress & Anxiety

Get guidance on coping with work stress, deadlines, or anxiety

* Learn practical techniques to reduce tension and stay focused

* Maintain Work-Life Balance

Receive support in balancing professional responsibilities with personal commitments.

* Tips for managing time, prioritizing tasks, and avoiding burnout.

* Career Guidance & Performance Coaching

Improve productivity, focus, and overall performance.

* Explore career decisions, goal-setting, and professional development opportunities.

* Relationship & Family Support

Guidance on managing interpersonal challenges, family stress, or parenting concerns.

* Learn strategies to resolve conflicts and improve communication.

* Emotional & Mental Health Support

Discuss feelings of burnout, low motivation, or emotional distress in a safe space.

* Receive practical advice from trained counsellors.

## Support

For setup or usage assistance, contact us at [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Employee Wellness Support with Samvedna Care
Source: https://help-plum.xoxoday.com/integrations/health-and-wellness/employee-wellness-support-with-samvedna-care

See how the Plum-Samvedna Care integration supports employee wellness by making counselling and care services available through your benefits catalogue.

*Learn more about integrating Samvedna Care*

## About Samvedna Care

Samvedna Care supports employee emotional wellbeing with counseling, individual and group therapy, and eldercare. Expert counsellors reduce stress, build resilience, and address work-life challenges, fostering a culture that prioritises mental health, awareness, and employee satisfaction. ​

## Why Connect Samvedna Care

Xoxoday Plum and Samvedna Care combine engagement and wellbeing—giving employees easy access to online counselling, psychiatrist consultations, eldercare and dementia support, while helping HR promote workplace mental health, drive participation, and improve overall well‑being and productivity.

## Benefits

* **For Employers**

One platform for counseling, therapy, and eldercare support.

* Fosters a mental-health-first culture.

* Boosts satisfaction with expert care.

* Frees HR to focus on programs.

* **For Employees**

Easy access

* Individual or group therapy options.

* Eldercare guidance for better balance.

* A workplace that prioritizes well-being.

## How Employees Can Use Samvedna Care

* Access to Counseling Book one-on-one sessions easily with experienced counselors for stress management, emotional support, or personal issues.

* Mental Health Assessments Take confidential self-assessments to evaluate their mental health and get personalized recommendations.

* Elder Care Support Avail guidance and support for employees managing eldercare responsibilities, reducing stress and improving focus at work.

* Workshops & Training Participate in mental wellness workshops and training sessions to build emotional resilience and improve overall well-being.

* Confidentiality Completely confidential interactions allowing employees to feel safe and supported when seeking help.

## Support

For setup or usage assistance, contact us at [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Empower Employee Mental Wellness with Your DOST
Source: https://help-plum.xoxoday.com/integrations/health-and-wellness/empower-employee-mental-wellness-with-your-dost

Learn how the Plum-YourDOST integration empowers employee mental wellness by making counselling support available through your rewards catalogue.

*Learn more about integrating Xoxoday with Your DOST.*

## About Your DOST

Your DOST provides confidential mental health support through one-on-one counseling, self-help tools, and workshops. Its clinically validated approach builds emotional resilience and long-term wellbeing for employees.

## Why this integration

This integration brings mental health and employee engagement together on one platform. Employees can access confidential counseling and self-care tools directly through Xoxoday, while HR teams can foster an open, stigma-free culture of emotional wellness — leading to improved morale, reduced burnout, and stronger team connections.

## Key benefits

**For business leaders and HR**- **Enhance employee wellbeing** — Address emotional and mental health proactively.

* **Boost productivity** — Support mental clarity, focus, and motivation at work.
* **Reduce attrition** — Help employees manage burnout and stress effectively.
* **Measure impact**— Access anonymized wellness insights to guide HR initiatives.**For employees**- **24/7 availability** — Access emotional support anytime, anywhere.
* **Diverse expertise** — Reach professional counsellors specializing in stress, anxiety, relationships, career issues, and more.
* **Personal growth** — Access life coaching for confidence, performance, and leadership skills.
* **Completely private** — All sessions are 100% confidential and secure.

## How employees can use Your DOST

* **Connect with a counselor** — Book one-on-one online sessions with licensed psychologists or life coaches.
* **Instant chat support** — Get immediate help through real-time chat with emotional wellness experts.
* **Video or audio therapy** — Choose flexible formats for therapy sessions based on comfort and need.
* **Self-help tools** — Access personalized assessments, progress tracking, and self-guided exercises.
* **Confidentiality and security** — All data and sessions are encrypted and anonymized to protect employee privacy.

## Deliver Your DOST benefits at scale

Integrating Your DOST with Xoxoday unites mental health and engagement in one place — enabling easy access to mental health counselling while helping HR nurture a stigma-free culture of wellbeing.

## Support

For setup or usage assistance, contact us at [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Empower Employee Wellbeing with TruWorth Wellness
Source: https://help-plum.xoxoday.com/integrations/health-and-wellness/empower-employee-wellbeing-with-truworth-wellness

See how the Plum-Truworth Wellness integration empowers employee wellbeing with health programs available through your benefits catalogue.

*Learn more about integrating TruWorth with Xoxoday*

## About TruWorth Wellness

TruWorth Wellness is a leading digital corporate wellness platform helping organizations enhance employee health through analytics, preventive care, and expert coaching—creating happier, healthier, and more productive workplaces at scale.

## Why Connect with TruWorth Wellness

Integrating TruWorth Wellness enables organizations to deliver data-driven wellness programs, monitor engagement, and give employees easy access to health assessments, fitness challenges, and expert consultations—all in one platform.

## Key Benefits

* **For Business Leaders/HR**

**Holistic Wellness Engagement:** Combine engagement activities with customized wellness journeys.

* **Actionable Insights:** Use analytics and dashboards to measure program impact and participation.

* **Enhanced Productivity:** Promote preventive health to reduce absenteeism and improve morale.

## Support

For setup or usage assistance, contact us at [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Empower Women’s Wellness Journeys with Newmi Care
Source: https://help-plum.xoxoday.com/integrations/health-and-wellness/empower-womens-wellness-journeys-with-newmi-care

Learn how the Plum-Newmi Care integration supports women's wellness journeys by making specialised care available through your rewards catalogue.

*Learn more about Newmi Care integration*

## About Newmi Care

Newmi Care is India’s first comprehensive women’s wellness ecosystem that supports women across every stage of life—menstruation, fertility, pregnancy, motherhood, and menopause. The platform brings together expert consultations, curated wellness programs, and a marketplace of trusted health and lifestyle products designed exclusively for women’s physical, mental, and emotional wellbeing.

## Key Benefits

* **For Employers**

**Inclusive wellness initiative:** Promote women’s health and wellbeing through tailored programs.

* **Effortless rollout:** Deliver healthcare, counselling, and lifestyle benefits via Empuls.

* **Engagement & retention:** Build a culture of care and inclusivity through holistic wellness support.

* **For Employees**

**End-to-end wellness support:** Access programs for fertility, pregnancy, parenting, and beyond.

* **Expert consultations:** Book gynecologists, nutritionists, and therapists anytime.

* Curated marketplace:Explore and shop trusted women’s health and wellness products.**How Employees Can Use Newmi** Care

* Book Wellness Services Employees can use the Newmi Care platform to schedule consultations, join fitness or nutrition programs, and access specialized women’s health services—directly through Empuls.

* Explore the Newmi Care Store Discover products across maternity, hygiene, and self-care categories tailored to women’s unique needs.

## Co-Sponsor & Deliver Newmi Care at Scale

Integrate Newmi Care across your organization through Empuls to drive holistic women’s wellness initiatives. Celebrate inclusivity, support every stage of women’s health, and make wellbeing a core part of your workplace culture.

## Support

For setup or usage assistance, contact us at [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Fast Diagnostic Testing with Orange Health
Source: https://help-plum.xoxoday.com/integrations/health-and-wellness/fast-diagnostic-testing-with-orange-health

See how the Plum-Orange Health integration gives employees access to fast diagnostic testing as part of your organization's benefits catalogue.

*Learn more about integrating Orange Health*

## About Orange Health

Orange Health is a modern diagnostics platform that delivers lab tests at home in just 60 minutes, combining speed, accuracy, and convenience. With NABL-accredited labs and expert phlebotomists, Orange Health makes preventive and diagnostic testing simple, seamless, and trusted for individuals and families.

## Why Connect with Orange Health

Adding Orange Health empowers employees to take charge of their health with quick, at-home diagnostics. It eliminates the need to visit labs or wait for appointments — ensuring health checks fit easily into employees’ schedules while maintaining the highest testing standards.

## Key Benefits

**For HR/ Leaders**- **Wellbeing made easy:** Offer employees instant access to at-home lab testing.

* **Low admin lift:** Partner-managed logistics, communication, and report delivery.

* Reliable network:Backed by NABL-accredited labs for accurate, professional results.**For Employees**- **At-home testing:** Book tests online and get samples collected at home in 60 minutes.

* **Quick results:** Receive verified reports digitally within 6–8 hours.

* **Trusted care:** Enjoy hospital-grade accuracy, hygiene, and service quality.

## How Employees Can Use Orange Health

Access Orange Health to book preventive or diagnostic lab tests. Choose your preferred time slot, have samples collected at home, and receive certified reports directly on your phone or email — all within hours

.

## Co-Sponsor & Deliver Orange Health at Scale

Employers can make Orange Health available across teams to promote preventive healthcare and early detection. It’s a powerful way to strengthen employee wellbeing through fast, reliable, and accessible diagnostics.

## Support

For setup or usage assistance, contact us at [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Holistic Employee Wellness with YogiFi
Source: https://help-plum.xoxoday.com/integrations/health-and-wellness/holistic-employee-wellness-with-yogifi

Learn how the Plum-YogiFi integration delivers holistic employee wellness benefits, including guided yoga and fitness, through your rewards catalogue.

*Learn more about integrating with YogiFi*

## About YogiFi

YogiFi is an innovative AI-powered yoga solution that integrates intelligent sensor technology to offer personalized, real-time posture feedback during yoga sessions. This intelligent yoga mat helps users enhance their practice by providing accurate corrections, ensuring a more effective and therapeutic yoga experience.

## Why Connect with YogiFi?

Integrating YogiFi allows HR teams and business leaders to promote physical wellness through personalized yoga programs. Employees can access real-time posture feedback and therapeutic yoga sessions, fostering a healthier workforce. HR leaders can track engagement, encourage holistic wellness, and reduce stress-related absenteeism, all while promoting a culture of wellness within the organization.

## Key Benefits

* For Business Leaders/ HR Leaders AI-driven wellness supportPersonalized yoga sessions that correct posture and enhance practice.

* Data-driven insights
  Monitor engagement and track wellness metrics across your organization.

* Employee retention boost
  Improve morale and productivity through tailored wellness initiatives.

* Simplified program delivery
  Easily integrate YogiFi’s digital yoga programs across the workforce.

* For Employees

Real-time posture feedback Improve your yoga practice with AI-powered corrections.

* Therapeutic yoga sessions
  Enjoy stress relief and mental clarity anytime, anywhere.

* Accessible wellness
  Yoga sessions that fit into any schedule and require no prior experience.

* Interactive learning
  Engage with personalized sessions that adapt to your skill level.

## How Employees Can Use YogiFi

* Personalized Yoga Classes Employees can participate in yoga sessions tailored to their unique needs, with real-time feedback that helps improve posture and enhances the practice.

* Therapeutic Sessions Enjoy instant stress relief and therapeutic benefits with sessions designed to promote mental clarity and physical wellness.

* Anywhere, Anytime Access With YogiFi, employees can practice yoga from the comfort of their home, office, or while traveling, ensuring wellness is always within reach.

* Posture Correction YogiFi’s AI-driven sensor technology provides accurate posture corrections during yoga sessions, helping employees maintain proper alignment and avoid strain.

* Engagement & Tracking HR leaders can monitor employee engagement with the program, track wellness progress, and ensure that every employee has access to the resources they need for a healthier lifestyle.

## Support

For setup or usage assistance, contact us at [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Holistic Fitness & Wellness with Cult.fit
Source: https://help-plum.xoxoday.com/integrations/health-and-wellness/holistic-fitness-wellness-with-cultfit

See how the Plum-cult.fit integration offers employees holistic fitness and wellness benefits directly through your rewards and benefits catalogue.

*Learn all about integrating Xoxoday with Cult.fit*

## About Cult.fit

Cult.fit is India's largest integrated fitness and wellness platform with 200+ cult centers, 8,000+ partner gyms, and presence across 25+ cities. Their corporate wellness program combines fitness, nutrition, sports, and engagement activities to help organizations improve employee health, boost productivity, and create a culture of wellness through flexible access to workouts, expert guidance, and company-wide challenges.

## Why this integration

This integration combines employee recognition with comprehensive fitness and wellness. Employees get flexible access to workouts, sports, nutrition, and wellness programs, while HR can drive engagement through wellness, track analytics, and demonstrate commitment to employee wellbeing.

## Key Benefits

* **For HR**

All-in-one platform Enhance the rewards and recognition ecosystem with easy access to fitness

* Drive engagement Improve engagement with fitness challenges and transformation contests

* Flexible offerings Avail the services at the center, at-home, and sports options for diverse workforce

* For Employees

Multiple workout options Easy access to 200+ cult centers + 8,000+ partner gyms nationwide

* Flexible scheduling Avail the services from the center, at-home workouts

* Expert guidance: Take guidance from the best of trainers, nutritionists, and wellness coaches

* Convenience Book classes, track progress, and workout anytime through the cult app

## How Employees Can Use Cult.fit

* Gym Access Across India Get a 12-month gym membership with options like Cult Elite, Fitternity OnePass (includes OnePass & Cult HOME), or Fitso/Cultpass PLAY — giving you flexibility to choose how and where you work out.

* Train Your Way Enjoy access to top gyms, fitness studios, and Cult centers nationwide. Choose in-person workouts or home-based sessions through the Cult platform (as per your selected pass).

* Dietician Consultations Opt for 3, 6, or 8 consultation sessions with certified dieticians to receive personalized nutrition guidance and maintain healthy habits.

* All-in-One Fitness Solution Combine expert-led workouts and professional nutrition support to stay active, motivated, and balanced throughout the year.

## Support

For setup or usage assistance, contact us at [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Integrated Health & Wellness Solutions with MediBuddy
Source: https://help-plum.xoxoday.com/integrations/health-and-wellness/integrated-health-wellness-solutions-with-medibuddy

Learn how the Plum-MediBuddy integration provides employees with integrated health and wellness solutions through your rewards catalogue.

*Learn all about integrating Xoxoday with MediBuddy*

## About MediBuddy

MediBuddy is a leading digital healthcare platform offering comprehensive medical services, including online consultations, lab tests, medicine delivery, mental health support, and preventive care. With a trusted nationwide network, it makes quality healthcare accessible, affordable, and convenient for individuals and organizations alike.

## Why this integration

Integrating MediBuddy with Xoxoday allows organizations to promote preventive care, reduce absenteeism, and improve employee wellness through on-demand digital healthcare. Employees gain instant access to qualified doctors and essential medical services, while HR leaders can track health engagement, drive wellness initiatives, and create a healthier, more productive workplace.

## Key Benefits

* **For Employers/HR Leaders**

Comprehensive wellness coverage Integrate physical and mental health services into employee benefits.

* Reduce medical claims Encourage preventive care through early diagnosis and regular check-ups.

* Boost productivity Support employees’ health to minimize downtime and stress-related issues.

* Data insights Monitor utilization trends and wellness participation securely.

* For Employees

Convenient Access to Healthcare Employees can easily book health checkups, consultations, and diagnostic tests online, making healthcare accessible and hassle-free.

* Affordable and Reliable Medical Support With cost-effective OPD and teleconsultation options, employees receive dependable medical care and advice without leaving home.

## How Employees Can Use MediBuddy

* Book Health Checkups Schedule comprehensive preventive health checkups and diagnostic tests easily through MediBuddy for reliable results.

* Access OPD Packages Choose affordable outpatient consultation packages for routine health checkups and specialized medical care.

* Connect via Teleconsultation Consult with doctors online conveniently from home through MediBuddy’s teleconsultation feature.

* Manage Healthcare Digitally Use the MediBuddy platform to book services, access reports, and track appointments in one place.

## Co-Sponsor & Deliver Medibuddy Benefits at Scale

Employers can implement MediBuddy Corporate Health Programs to offer doctor access, preventive care, and comprehensive medical services to their teams. By digitizing healthcare delivery, organizations can ensure their employees stay healthy, engaged, and supported—both physically and mentally. ​

## ​Support

For setup or usage assistance, contact us at [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Master O
Source: https://help-plum.xoxoday.com/integrations/health-and-wellness/master-o

See how the Plum-Master-O integration connects gamified learning and training outcomes to rewards, letting you incentivise employee skill-building.

*Learn all about integration with Master O*

## About Master-O

Master-O is a gamified microlearning platform delivering bite-sized training to sales and support teams—boosting knowledge, engagement, and performance.

## Why Connect Master-O with Empuls

Blend recognition with continuous, snackable learning—easy to launch, fun to complete, and proven to reinforce skills.

## Key Benefits

### For HR

* High engagement: Game mechanics keep learners active.

* Faster rollout: Micro modules fit busy schedules.

* Skills tracking: Monitor progress and outcomes.

### For Employees

* Short, impactful lessons: Learn in minutes, retain more.

* Practice through play: Quizzes and challenges reinforce skills.

* Sales & support focus: Directly tied to daily workflows.

## How Employees Can Use Master-O

* Interactive Microlearning: Consume bite-sized lessons designed for quick retention.

* Game-Based Assessments Reinforce learning with gamified quizzes and challenges.

* Sales Enablement Use microlearning tools to strengthen sales techniques and customer engagement skills.

* Spaced Learning Workflows Follow structured workflows that reinforce concepts over time.

## Support

For setup or usage assistance, contact us at [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Personalized Nutrition and Weightloss with Fitelo
Source: https://help-plum.xoxoday.com/integrations/health-and-wellness/personalized-nutrition-and-weightloss-with-fitelo

Learn how the Plum-Fitelo integration offers employees personalized nutrition and weight-loss coaching programs through your benefits catalogue.

*Learn more about integrating Fitelo*

## About Fitelo

Fitelo is India's personalized nutrition and wellness platform with 500+ doctors, nutritionists, and lifestyle experts, serving 25,000+ users across 55+ countries. Their evidence-based approach addresses weight management, disease management, and lifestyle transformation through customized diet plans based on individual body types, medical conditions, and preferences—helping organizations reduce lifestyle-related absenteeism and healthcare costs.

## Why Connect Fitelo with Xoxoday Plum

Integrating Fitelo with Xoxoday Plum combines employee engagement with personalized nutrition and wellness. Employees gain access to expert-led diet plans, health coaching, and disease management support, while HR can promote preventive health, track wellness outcomes, and build a culture of sustainable wellbeing.

## Key Benefits

## For Employers

* **All-in-one platform:** Execute employee engagement and personalized nutrition and wellness

* **Reduce healthcare costs:** Address lifestyle diseases before they escalate

* **Boost productivity:** Healthier employees with improved energy and focus

* **Measurable outcomes:** Gain visibility into engagement levels, health scores, and program outcomes with real-time reports.

## For Employees

* **Personalized plans:** Diet plans tailored to body type, lifestyle, and medical conditions

* **Expert guidance:** 500+ nutritionists, doctors, and wellness coaches

* **Holistic approach:** Nutrition, fitness, and habit coaching

* **Long-term results:** Sustainable lifestyle changes, not quick fixes

For set up or usage assistance, reach out to us at [cs@xoxoday.com](mailto:cs@xoxoday.com)


# Preventive Health Checkups with Healthians
Source: https://help-plum.xoxoday.com/integrations/health-and-wellness/preventive-health-checkups-with-healthians

See how the Plum-Healthians integration gives employees access to preventive health checkups as part of your organization's rewards catalogue.

*Learn all about integration with Healthians*

## About Healthians

Healthians is India’s leading health test at-home service offering a wide range of diagnostic tests, full body check-ups, and preventive health packages. With certified labs, trained phlebotomists, and accurate reports delivered digitally, Healthians makes preventive healthcare simple, affordable, and accessible right at your doorstep.

## Why Connect with Healthians

Integrating Healthians with Xoxoday brings preventive healthcare into your recognition and engagement ecosystem. Employees can book convenient at-home tests and receive digital reports, while HR can promote participation in checkups, support wellbeing initiatives, and signal a strong commitment to employee health.

## Key Benefits

* **For Business Leaders/HR**

Promote Employee Health and Productivity Encourage preventive checkups to reduce sick days and build a healthier, more productive workforce.

* Boost Employee Satisfaction and Retention Improving employee satisfaction, loyalty, and retention with at-home health services.

## How Employees Can Use Healthians

* Book At-Home Sample Collection Choose the required diagnostic test or check-up and schedule a doorstep visit at a convenient time.

* Quality & Safety Benefit from certified labs and trained phlebotomists for a reliable testing experience.

## Support

For setup or usage assistance, contact us at [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Preventive Health Checkups with Thyrocare
Source: https://help-plum.xoxoday.com/integrations/health-and-wellness/preventive-health-checkups-with-thyrocare

Learn how the Plum-Thyrocare integration offers employees preventive health checkups directly through your organization's benefits catalogue.

*Learn more about integration with Thyrocare*

## About Thyrocare

Thyrocare is one of India’s leading diagnostic and preventive healthcare service providers, offering a wide range of pathology and wellness tests through a trusted, technology-driven network. With a focus on accuracy, affordability, and convenience, Thyrocare ensures early detection and proactive health management for employees and their families.

## Why Connect with Thyrocare

Adding Thyrocare supports employee wellbeing by making preventive health checkups easy to access and affordable. With nationwide coverage, at-home sample collection, and digital reports, Thyrocare ensures a smooth and reliable health testing experience for every employee.

## Key Benefits

**For HR**- **Employee wellbeing:** Promote preventive health with reliable and accessible diagnostics.

* Nationwide reach:Enable employees to access health checkups anywhere in India.**For Employees**- **Convenient testing:** Get samples collected from home or office.

* **Accurate results:** Benefit from advanced lab automation and quality processes.

* **Comprehensive packages:** Choose from a wide range of health and wellness tests.

## How Employees Can Use Thyrocare

Access Thyrocare to book preventive health checkups or specific diagnostic tests. Schedule at-home sample collection, receive updates digitally, and get reports directly through secure online access.

## Co-Sponsor & Deliver Thyrocare at Scale

Employers can roll out Thyrocare health packages across teams to build a culture of wellbeing and preventive care. Enable hassle-free access to health services that keep employees proactive and productive.

## Support

For setup or usage assistance, contact us at [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Seamless OPD Coverage for Employees with OPDSure
Source: https://help-plum.xoxoday.com/integrations/health-and-wellness/seamless-opd-coverage-for-employees-with-opdsure

See how the Plum-OPDsure integration provides employees with seamless outpatient (OPD) coverage as part of your rewards and benefits program.

*Learn more about integration with OPDSure*

## About OPDSure

OPDSure is a healthcare platform that focuses on outpatient care, covering essential medical expenses such as doctor consultations, pharmacy costs, diagnostic tests, and preventive health checkups. It helps individuals and families manage the high proportion of healthcare spending that comes from routine outpatient needs, while promoting regular health monitoring and preventive care.

## Why Connect OPDSure

Connecting OPDSure allows organizations to provide employees with structured support for everyday healthcare needs. Employees gain access to consultations, medicines, diagnostics, and checkups under a unified healthcare benefit, encouraging timely medical attention and contributing to overall well-being at work.

## Key Benefits for Employees

* Offer Comprehensive and Manageable OPD Benefits Enable employees to access a wide range of outpatient services while managing everything effortlessly through seamless integration.

* Gain Actionable, Data-Driven Insights Track utilization, engagement, and wellness trends to understand employee health behavior and enhance benefits strategies effectively.

## How Employees Can Use OPDSure

* Access Routine Consultations Easily Employees can book convenient outpatient consultations for regular health checkups and everyday medical needs.

* Get Specialized Care When Required Avail packages for specialized consultations, helping employees seek expert advice for specific health concerns.

## Support

For setup or usage assistance, contact us at [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Unlock Employee Wellness with Fitpass
Source: https://help-plum.xoxoday.com/integrations/health-and-wellness/unlock-employee-wellness-with-fitpass

Learn how the Plum-Fitpass integration unlocks employee wellness benefits, including gym and fitness access, through your rewards catalogue.

*Learn more about Fitpass integration*

## About Fitpass

Fitpass is India’s largest fitness and wellness network offering flexible access to 7,500+ gyms, studios, and fitness centers across 40+ cities. It empowers users with an integrated fitness ecosystem that includes AI-powered fitness tracking, personalized nutrition guidance, and corporate wellness programs designed to enhance employee health, reduce sedentary habits, and improve workplace productivity.

## Why Connect Fitpass with Xoxoday Plum

Integrating Fitpass helps organizations deliver holistic employee wellness experiences. Employees gain instant access to personalized fitness routines, gym memberships, and expert coaching, while organizations can promote healthy lifestyles, measure engagement, and enhance retention through data-driven wellness insights.

## Key Benefits

* **For Employers**

Unified wellness platform Combine engagement, rewards, and physical wellbeing.

* Reduce absenteeism Encourage consistent fitness to improve employee health.

* Data-backed insights Track participation and wellness outcomes.

* Attract and retain talent Offer modern wellness benefits employees love.

* For Employees

Personalized Fitness Options Employees can select flexible subscription plans tailored to their lifestyle and fitness preferences.

* Smart Wellness Integration
  Each plan enhances the fitness experience with connected tools to monitor progress and stay active.

Reach out to us at [cs@xoxoday.com](mailto:cs@xoxoday.com) to get started with the integration.


# Wellbeing Reimagined with Fitterfly
Source: https://help-plum.xoxoday.com/integrations/health-and-wellness/wellbeing-reimagined-with-fitterfly

See how the Plum-Fitterfly integration reimagines employee wellbeing with structured wellness programs available through your rewards catalogue.

*Learn more about integration with Fitterfly*

## About Fitterfly

Fitterfly is a health-tech startup specializing in digital therapeutics (DTx) for metabolic health. Fitterfly combines personalized coaching with advanced technology to help individuals manage and reverse chronic conditions. The programs include:

* Fitterfly Diabetes Prime A 6–12 month program designed to prevent, manage, or reverse type 2 diabetes and prediabetes.

* Fitterfly Weight Loss A 3–6 month program focused on sustainable weight loss and maintenance.

* Fitterfly FitHeart A program aimed at improving heart health through lifestyle modifications.

Fitterfly's programs are clinically validated and have shown significant improvements in health outcomes, including reductions in HbA1c levels, weight loss, and enhanced physical fitness.

## Why Connect with Fitterfly

This integration empowers HR leaders to offer employees data-driven, personalized care plans backed by science. With real-time progress tracking and expert support, it enhances engagement, well-being, and overall organizational productivity.

## Key Benefits

* **For Employers/HR Leaders**

AI-driven health solutions Provide employees with personalized metabolic health plans based on real-time data.

* Seamless integration Easily incorporate Fitterfly's programs into existing wellness initiatives through the platform.

* Data-driven insights Monitor employee health metrics and track program engagement to assess effectiveness.

* Cost-effective Reduce healthcare expenses by addressing the root causes of chronic conditions and promoting preventive care.

* For Employees

Personalized care Receive tailored recommendations for nutrition, activity, sleep, and stress management.

* Continuous support Access a dedicated care team of health coaches and medical professionals.

* Sustainable health improvements Achieve long-term health goals, such as weight loss and medication reduction, through evidence-based interventions.

* User-friendly technology Utilize the Fitterfly app to track progress and stay connected with your care team.

## How Employees Can Use Fitterfly

* Enroll in the Program Employees can sign up for Fitterfly's program through the platform, providing basic health information to personalize their care plan.

* Wearable Sensors Upon enrollment, employees receive wearable sensors that continuously monitor key health metrics, feeding data into their digital twin.

* Personalized Recommendations The Fitterfly app provides daily guidance on nutrition, activity, sleep, and stress management based on the individual's unique metabolic profile.

* Regular Check-ins Employees have access to regular consultations with health coaches and medical professionals to discuss progress and adjust their care plan as needed.

* Track Progress Through the Fitterfly app, employees can monitor their health metrics, set goals, and celebrate milestones, fostering motivation and sustained engagement.

## Co-Sponsor & Deliver Fitterfly Benefits at Scale

Enable employees to access Fitterfly’s personalized metabolic health programs organization-wide. Through this integration, employers can easily launch wellness initiatives, monitor participation, and foster a healthier workplace culture.

## Support

For setup or usage assistance, contact us at [cs@xoxoday.com](mailto:cs@xoxoday.com).


# 1-Many Link for Xoxolink’s Reward Automation
Source: https://help-plum.xoxoday.com/integrations/hubspot/1-many-link-for-xoxolinks-reward-automation

Learn how to automate one-to-many reward distribution in HubSpot using Xoxoday reward links, so an entire segment can be rewarded in one action.

*1 - many Xoxolink feature helps in enabling real-time rewarding and CTA hyperlinking for sending emails to the masses.*

This feature is specially designed for sales and marketing teams using Xoxoday plum integrated with HubSpot.

1-many automation can be created from Xoxoday’s dashboard and the link generated can be copied and pasted to your marketing emails in HubSpot.

Feature Specification: Only the ones who are part of the contact list in HubSpot will be eligible to redeem their rewards, anyone apart from that will not have access.

## Pre-requisites

* As an admin, You should have already connected the Xoxoday with [HubSpot](/integrations/hubspot/hubspot-overview).

## Steps to create a 1-many campaign:

**Step 1:** The admin creates the Xoxolink [campaign](/getting-started/overview).

​

Step 2: The admin creates Automation for HubSpot — and selects ‘1-many reward link’. Accepts the Information message and tick that you understood the guidelines. Click '**Continue'.**

<img alt="" />

<img alt="" />

Step 3: Select 'Campaign' Upon selecting Campaign, set the Expiry date, select Approval type as Manual or Automatic as per your preferences. You can also add **Additional settings** on 1. Start and End Date of Automation 2. Maximum number of Rewards to sent - Upon reaching max limit, the Automation will be completed. \*Repeat Rewarding is disabled.

<img alt="" />

**Step 4:** Upon creating a 1-many link for the automation — a link is generated to trigger rewards for that automation which users can ‘copy’ and use inside HubSpot emails.

<img alt="" />

<img alt="" />

Pro Tip: Don't forget to copy the link( as shown in the above image), as you will have to hyperlink it to your email’s CTA on HubSpot.

**Step 5:** Adding the link inside HubSpot for launching Emails:

<img alt="" />

**Step 6:** Now you are good to go!! You can now send rewards to all of your contact lists in one go.

## Steps to Redeem a 1-Many campaign

Below are the steps to redeem your rewards:

**Step 1:** From your reward email Click the CTA to go about redeeming.

<img alt="" />

**Step 2:** Below screen will open for you to redeem the reward:

<img alt="" />

<img alt="" />

Step 3:Once Authenticated, you will receive a redemption email for selecting your desirable reward.**Step 4:** Select the Reward you wish to avail yourself:

During the Redemption journey —

* End user inputs email address say [xyz@gmail.com](mailto:xyz@gmail.com)

* **If** the email address is present in the HubSpot contacts, we proceed to send the reward

* **Else**, we show an error message saying ‘Unable to validate. Please contact the sender of the email for further assistance ‘

<img alt="" />

​


# Email based Reward Automation
Source: https://help-plum.xoxoday.com/integrations/hubspot/email-based-reward-automation

See how to automate reward sends that are triggered by HubSpot email actions, using the Plum-HubSpot integration to reward engaged contacts.

*Learn how to automate rewards for email recipients.*

Now you can reward your prospects, contacts, and leads directly via email marketing campaigns (without any workflow-based triggers in HubSpot). Just select the contact 'List' from HubSpot.

In a few simple clicks, you can set up a reward automation campaign in Plum and use the reward-enriched contacts to send emails with your own template from HubSpot. Not just that, the email recipient (contacts, prospects, or leads) can choose gift cards of their choice from Xoxoday’s extensive global catalog.

You can also restrict the number of rewards sent out based on criteria like - campaign time range, Maximum Reward count as well as repeated rewards, etc.

## ​Follow the step to step guide to make your first rewarding automation for email recipients.

Skip Section 1 if you have already integrated Xoxoday Plum with HubSpot

# Section I: Sync up your HubSpot with Plum

Step 1: \*\*Connect your Xoxoday plum to HubSpot.\*\*​

<img alt="" />

## Step 2: Go to App Marketplace and search for Xoxoday plum.

Now, click on the app marketplace by clicking on the shop icon on the right top corner of your dashboard.

## Step 3: Click on the Install app

Search for Xoxoday Plum in the app marketplace, and click on the “Install” button.

## Step 4: Signup or Sign In on Plum

If you are new to Xoxoday Plum, click on the “**Signup” button. You can learn how to set up a Plum account [here](https://xoxoday.gitbook.io/plum/for-admins-1/getting-started). It's recommended that you use the email registered with HubSpot to signup with Plum as well.If you are an existing user, use your Xoxoday credentials to log in to the admin dashboard.**

**Congrats, you have successfully installed the application.**

# Section II: Create Reward Automation in Plum

## Step 1: Setting up the Reward Automation.

Once the Xoxoday Plum Rewards App is downloaded, follow the steps given below and hook Xoxoday Plum up to your Hubspot CRM.

These are for the Admins operating the HubSpot CRM dashboard.

Please ensure that you follow the steps on the dashboard to create the reward automation and recharge your account.
​

<img alt="" />

Step 2: Choose to Automate your first reward
Once you choose ‘automate your first reward’ from the dashboard you will be shown a pop-up with the option to choose a type of reward automation. You need to choose “email-based reward automation” Existing Plum admins can go to their HubSpot integration and click on ‘create new automation’ and they will also be presented with the same automation selection pop-up.

## Step 3: Enter Reward Automation Name and Choose Contact list

On the automation first step enter the reward automation name which you will be using during the email template creation to embed the reward link in HubSpot. Choose the contact list from HubSpot which will be fetched to enrich the contacts with reward links.

Once selected, you can click on "Save & Proceed" to proceed to move to the next steps:
​

<img alt="" />

## Step 4: Create or select the Xoxolink campaign

As a first-time user, you have to create a Xoxolink campaign from where the rewards will actually flow.

Perform the following actions to set up your Xoxolink campaign: Enter Campaign Name, Set Link expiry date, Select the country and denomination as per your choice. For existing users, you can select the existing Xoxolink campaign or choose to create a new one.

<img alt="" />

<img alt="" />

​

## Step 5: Let the contact enrichment complete on plum.

Once you launch the reward automation, then you will be redirected to the reward report page where you could see how the contact enrichment is progressing. (The time taken to complete the enrichment is relative to the number of contacts you have in the contact list). Once the enrichment is complete, follow the below-mentioned steps in HubSpot to generate and send emails with a reward link embedded into them.

<img alt="" />

<img alt="" />


# HubSpot Integration
Source: https://help-plum.xoxoday.com/integrations/hubspot/hubspot-overview

Get an overview of the Plum-HubSpot integration, including how it connects your CRM workflows to automated reward disbursal for contacts.

*Learn more about Xoxoday Plum and Hubspot integration*

## Overview

The HubSpot ↔ Xoxoday Plum integration enables you to automate the way you send rewards, incentives, and branded gifts to your customers, prospects, and partners directly from HubSpot. Whether you want to reward a single contact when they convert, or send rewards at scale after an event, the integration makes the process seamless, branded, and trackable.

**Typical use cases include:**

* Sending welcome kits to new customers during onboarding.

* Rewarding attendees of webinars and events.

* Driving survey completions with incentives.

* Encouraging referrals and advocacy programs.

* Nudging trial users to upgrade to paid plans.

* Re-engaging dormant leads or inactive users.

* Recognizing partners, affiliates, and advocates.

## Key Features

* **Seamless HubSpot integration**: Trigger rewards directly from workflows, contact lists, or emails.

* **White-labeled experience**: Customize reward emails and landing pages with your branding.

* **Flexible catalogues**: Choose from Xoxoday’s global catalogue or curate your own campaigns with selected items.

* **Vast reward catalogue & automated fulfillment**: Choose from thousands of options including global gift cards and merchandise. Whether you curate branded swags or send digital gift cards, Plum handles delivery, redemption, and order tracking end-to-end.

* **Multiple automation options**: Choose the flow that fits your use case — Workflow-based, Email-based, 1-Many Reward Links, or 1-1 Widget.

* **Reporting & analytics**: Track rewards sent, claimed, and delivered directly within HubSpot and Plum.

## How to integrate HubSpot with Xoxoday?

Discover how to integrate Xoxoday Plum with HubSpot to automate and personalize reward campaigns. This video walks you through connecting both platforms, mapping contact data, and triggering rewards directly from your HubSpot workflows.

<iframe title="Supademo walkthrough" />## Ways to Send Rewards via HubSpot

* ### Workflow-Based Reward Automation

What it is:Automate rewards triggered by HubSpot workflows (e.g., when a contact’s lifecycle stage changes to Customer).Best for:Targeted, event-driven rewarding.**Use cases:**

* Welcome gift when a lead converts into a paying customer.

* Send a thank-you gift when a deal is marked Closed Won.

* Celebrate customer milestones (renewals, anniversaries, or usage achievements).

**How it works:** HubSpot workflow → triggers Plum automation → Plum sends reward email → contact redeems via landing page → fulfillment handled automatically.

See detailed setup guide: [Workflow-Based Reward Automation.](https://help.plum.xoxoday.com/en/articles/11483885-workflow-based-reward-automation)

* ### Email-Based Reward Automation

What it is:Send rewards to an entire HubSpot contact list in bulk.Best for:Rewarding segmented groups of contacts without building a new workflow.**Use cases:**

* Reward all contacts who completed a survey in the last month.

* Send incentives to webinar attendees pulled into a HubSpot static list.

* Deliver a gift to a segment like “Top 100 engaged customers.”

**How it works:** Plum enriches the HubSpot list with unique reward links → you design an email in HubSpot → insert Plum token → each recipient gets their own secure reward link.

See detailed setup guide: [Email-Based Reward Automation.](https://help.plum.xoxoday.com/en/articles/9403738-email-based-reward-automation)

* ### 1-Many Reward Link

What it is:Generate one reusable reward claim link and embed it into HubSpot emails.Best for:Mass campaigns where the same CTA goes to many recipients.**Use cases:**

* Add a reward CTA in an NPS survey follow-up email.

* Incentivize signups by including a reward link in a marketing newsletter.

* Reward all webinar registrants at once with a single campaign.

**How it works:** Plum creates a 1-Many URL → you add it to a HubSpot marketing email (as a CTA) → when contacts click, Plum validates their identity and allows them to redeem.

See detailed setup guide: [1-Many Reward Link Automation.](https://help.plum.xoxoday.com/en/articles/10225649-1-many-link-for-xoxolink-s-reward-automation)

* ### 1-1 Rewards via Widget

What it is:Send a reward manually to a single contact directly from their HubSpot profile.Best for:High-touch, personal gestures.**Use cases:**

* Send a thank-you to a VIP client after a meeting.

* Appreciate a partner for closing a big referral deal.

* Resolve a support issue with a goodwill gift to the affected customer.

**How it works:** From the HubSpot contact profile → open the Xoxoday Plum widget → select a campaign → send reward instantly.

See detailed setup guide: [Send 1-1 Reward via Widget.](https://help.plum.xoxoday.com/en/articles/9398889-send-1-1-reward-via-xoxoday-widget)

## Reporting & Tracking

* **In HubSpot**: Use reward-specific properties to track which contacts have received or claimed rewards. Add these to your HubSpot dashboards for reporting.

* **In Plum**: Use the automation dashboard to track triggered rewards, redemptions, and order status.

This dual visibility ensures your marketing, sales, and customer success teams can measure ROI and manage budgets effectively.

## Getting Started

* Connect your HubSpot account with Plum from the Integrations section in Plum.

* Choose the automation type that fits your use case.

* Create and customize campaigns with your chosen rewards and branding.

* Test with a sample contact or list before rolling out.

Next: Explore the [detailed setup guides for each automation type](https://help.plum.xoxoday.com/en/collections/9503710-hubspot) to configure your first campaign.

Reach out to us at [cs@xoxoday.com](mailto:cs@xoxoday.com) for any questions or feedback.

​


# Report Dashboard in HubSpot
Source: https://help-plum.xoxoday.com/integrations/hubspot/report-dashboard-in-hubspot

Learn how to track reward automation performance from a dedicated dashboard embedded directly inside your HubSpot account.

*All about tracking your Xoxoday Reward Campaigns in Hubspot*

There are a few ways that you can currently track and measure the impact of Xoxoday Rewards campaign efforts and their influence on your deals.

**​At a personal level, for each contact,** you can see the outcome of your Xoxoday campaigns in the activity timeline.

\#For example, below you can see that this person has been sent a gift 'Coffee On Us' campaign and they have claimed it. These are populated as custom events and will update when a status changes:

<img alt="" />

You can also use **lists** to group contacts who have responded to a Xoxoday campaign in the same way (example: Sent, Claimed, etc) by using the details within the event to the group i.e. by campaign name, status, etc.

For more holistic rewarding activity reporting specifically **relating to deal influence**, there are a few options that you could call upon, using workflows.

# Here’s How to Set Up RoI Reporting

**​Step 1:** Creating custom contact properties for Xoxoday reward activity touch points

* Add Xoxoday campaign/touches to a contact custom field —

This will allow you to see the last Xoxoday campaign associated to a contact, related to deals (open and closed).

## - ## Requirements

2 custom fields/properties on a contact:

* 1 single line text field, name this Xoxoday Reward Campaign Status

* 1 boolean field, name this **Xoxoday Touch**

**Step 2:** Create a workflow to update these fields

Our recommended workflow would be to update the 2 custom fields set out above when a Xoxoday reward is redeemed. The Xoxoday campaign Status field should be populated with the campaign Statusas it exists within Xoxoday. The Xoxoday Touch field will be populated with 'True'.These workflows should be set up per campaign, and it would look something like this:

<img alt="" />

Once your workflow is switched on, anyone who redeems your particular campaign will have those fields populated as a result.

You can also add additional contact properties and workflows to add more granularity to your Xoxoday reward campaign reporting if you like.

Now you can build a 'contacts and deals' report to see the influence of Xoxoday campaigns on open and closed deals.

**For open opportunities:**

Select Create Custom Report> cross-object and select contacts and deals.
​

<img alt="" />

Configure Bar Chart

<img alt="" />

Let us know if you're reporting in other ways by sending us email at [plum.product@giift.com](mailto:plum.product@giift.com).

We will update our documentation once HubSpot release attribution for custom events


# Send 1-1 reward via Xoxoday Widget
Source: https://help-plum.xoxoday.com/integrations/hubspot/send-1-1-reward-via-xoxoday-widget

See how to send individual one-to-one rewards from within HubSpot using the embedded Xoxoday widget, without leaving your CRM.

*Learn how to send a personalized 1-1 reward.*

Xoxoday Plum Rewards widget feature helps a sales rep to send 1-1 personalized emails for building a better relationship with their clients.

\*\*This helps by allowing teams to reward a single contact with a personalized email and select a campaign. Every contact can be rewarded with a different campaign depending on various variables.

Feature Specification: \*\*Only the ones who are part of the contact list in HubSpot will be eligible to redeem their rewards, anyone apart from that will not have access.

# Sending 1-1 rewards using Xoxoday Plum Widget

**​Prerequisites**

**As an admin, You should have already connected the Xoxoday with HubSpot. If not check this article.**

**HubSpot users who need access to 1-1 rewards widget should be added as a user in Xoxoday Plum with Admin or Super admin access as required.**

## Steps to send 1-1 Rewards

## Step 1: Open Xoxoday 1-1 Rewards Widget

* Open the detail page of the contact to whom you want to send rewards in HubSpot.

* Find Xoxoday Card on the left panel and click ‘Send Rewards’,\*\* then Xoxoday’s 1-1 widget opens.

<img alt="" />

<img alt="" />

Now, There are two ways to send 1:1 Rewards

### Through a Reward Link

This features generates a unique reward link. This link can be embedded in your custom emails to send rewards.

<img alt="" />

## Step 2: Select Campaign

Select your Campaign from the dropdown menu.

<img alt="" />

## Step 3: Reward Link Generated

Voila! a unique Reward Link is generated for the Contact. This link can be sent to contact through any medium. We suggest you include this link in your custom emails\*\*.\*\* ​

<img alt="" />

## Reward Email via Plum

This feature will send a custom email from the selected Campaign to the Contact.

<img alt="" />

## Step 2: Select Campaign

From the Dropdown option, select your preferred Campaign.

<img alt="" />

## Step 3: Reward Email Sent

Voila! The Reward email is sent.

<img alt="" />

Check Reward History

* Reward History shows the rewards sent through ‘Rewards by Plum Email’ and ‘Reward Link’.

* Only Super-admins will be able to view the global list of Rewards sent by the team.

<img alt="" />

<img alt="" />


# Workflow based Reward Automation
Source: https://help-plum.xoxoday.com/integrations/hubspot/workflow-based-reward-automation

Learn how to automate rewards using HubSpot workflows connected to Plum's reward automation engine, triggered by contact or deal properties.

Follow the step-by-step guide to set up the integration between Xoxoday Plum and HubSpot.

## Step 1: Log in to your HubSpot account using your credentials.

<img alt="" />

Now, click on the app marketplace by clicking on the shop icon on the right top corner of your dashboard.

<img alt="" />

## Step 2: Click on the Install app

Search for Xoxoday Plum in the app marketplace, and click on the “Install” button.

<img alt="" />

## Step 3: Signup or Sign In on Plum(if you already do not have a plum account)

If you are new to Xoxoday Plum, click on the “Signup” button. It's recommended that you use the email registered with HubSpot to signup with Plum as well.

<img alt="" />

<img alt="" />

If you are an existing user, use your Xoxoday credentials to log in to the admin dashboard.

**Congrats, you have successfully installed the application.**

## Step 4: Click on the 'Add Funds' option on the Menu bar to Recharge your Plum

Account for the Reward automation campaign.

<img alt="" />

## Step 6: Recharging the account

* Click on Add Funds and Proceed with the Payment.

* Click [here](/getting-started/for-admins/wallet-management/funding-the-account) to know more on how to recharge your account.

The recharged amount will now be reflected in your Xoxoday Wallet.

## Step 7: Once you have enough funds in your Xoxoday account, click on the

HubSpot extension to Create a new Reward automation campaign.

<img alt="" />

## Step 8: Creating a New Automation.

Click on the “Create New” button to start a new Reward Automation.

<img alt="" />

* Select the **Workflow-based reward automation** as shown below:

* Now, Name the Automation.

## Step 9: Campaign Selection and Email Customization.

You will now be prompted to “Choose your Campaign” to customize your HubSpot Reward Automation. You can also customize your reward email [here](/send-rewards/reward-links/reward-link-customize-reward-communication).

Further to this, before launching your reward automation, you can also change reward trigger settings to either automatically send rewards, or have an approval process to manually approve rewards.

<img alt="" />

You can also set up a reward distribution logic based on a Custom time range or Maximum Reward count.

<img alt="" />

Now, click on the **Save & Launch** button to activate the HubSpot Reward automation.

## Step 10: Workflow Creation in HubSpot.

Now, on your HubSpot Account, Under the “Automation” tab, under workflows, click “Create Workflow”. Start a reward automation campaign by clicking on “Start from Scratch”.

<img alt="" />

You can choose to make a “Contact-based workflow” or a “Company-based workflow” or a “Deal-based workflow”.

Now, name the workflow and click “Next”.

<img alt="" />

## Step 11: Set-up the reward trigger.

Now, set an enrollment trigger. You can choose to set up the trigger when a lead becomes a new customer. Now, apply the filter and save it.

<img alt="" />

## Step 12: Select the action upon successful criteria match.

Insert Xoxoday Plum as the action application to automatically send rewards whenever a lead is converted into a customer.

Select from the “reward automation” that you have created a while back for HubSpot and click “Save”.

<img alt="" />

## Step 13: Select the campaign drop the plum dropdown.

<img alt="" />

Check your campaign parameters like enrollment, timing, etc., and turn on the workflow.

Congratulations, You have successfully triggered a reward workflow from HubSpot.


# Integrations Overview
Source: https://help-plum.xoxoday.com/integrations/integration-overview

Get an overview of all the integrations available in Plum, covering CRM, HR, survey, and automation platforms you can connect.

*Xoxoday Plum works seamlessly with all the tools you already use! Learn how to leverage integrations to automate rewarding.*

## Plug-n-Play Native Integration

Plum Apps enables seamless integration with leading SaaS platforms in marketing automation, CRMs, customer engagement tools, HR software, collaboration platforms, and more. This integration streamlines workflows and enriches Plum with contextual information, providing a comprehensive perspective on your mutual growth.

### List of Most Popular Integration

* HubSpot

* Salesforce

* Zoho CRM

* ActiveCampaign

* SAP Successfactors

* Darwinbox

* Zoho People

* Qualtrics Using Qualtrics Workflow Extension to Send Rewards

* SurveyMonkey Public Survey Rewarding

* Typeform

#### Here are some of the many PnP integration platform supports. Partial list

### Pro tip

If you don't see an integration list, just reach out to [cs@](mailto:cs@giift.com)xoxoday.com or [plum.product@](mailto:plum.product@giift.com)xoxoday.com

## Customer Experience & Survey Tools

<img alt="" />

Marketing Automation and CRM tools

<img alt="" />

## HRMS and People tools

<img alt="" />

​

Feedback or Questions: Reach out to us at [cs@xoxoday.com](mailto:cs@xoxoday.com).

​
​


# Integrations Report
Source: https://help-plum.xoxoday.com/integrations/integrations-report

Learn how to view the integrations report in Plum to track reward automation activity generated through connected apps.

*Learn all about the Integration Report on your Plum Dashboard.*

## Integration Report

The Integration report offers valuable insights into the integration of Xooday Plum with external systems or platforms. Users can monitor integration status, data synchronization, and troubleshoot any integration-related issues.

## Integration Reports

You can check out the reports for each of the integration in the specific article. Check it out here: [All Integration at a Glance](/integrations/integration-overview).

​


# Other Integrations
Source: https://help-plum.xoxoday.com/integrations/other-integrations

Explore additional Plum integrations beyond the core CRM, survey, and HR platforms covered elsewhere in this help center.

*Explore the complete range of integrations available on Xoxoday Plum to streamline your rewards, incentives, and engagement programs effortlessly.*

In addition to the existing integrations aforementioned, Plum by Xoxoday offers myriad integrations for marketers, HR teams, support teams, etc. Do check the entire set of integrations **[here](https://www.xoxoday.com/plum-integrations).**


# Anonymous Survey Rewarding
Source: https://help-plum.xoxoday.com/integrations/qualtrics/anonymous-survey-rewarding

See how to automatically reward anonymous survey respondents using the Plum-Qualtrics integration, without collecting identifying details.

*Learn about reward automation for anonymous survey on Qualtrics*

# Introduction

Now you can reward survey respondents anonymously via Xoxoday Plum. In a few simple clicks, you can set up a reward automation campaign in Plum and then attach the reward claim page at the end of your survey to enable quick and instant rewarding of respondents.

Not just that, the survey respondents can choose gift cards of their choice from Xoxoday’s extensive global catalog.

You can also restrict the number of rewards sent out based on criteria like - Campaign Time Range, Maximum Reward count as well as repeated rewarding, etc.

# Getting Started

## Create Reward Automation in Plum

\*\*Step 1:Go to your plum admin account by login in via xoxoday.com or if you are new create a plum admin account by clicking on a try for FREE.**For login go to [https://stores.xoxoday.com/](https://stores.xoxoday.com/) and login with your email and password**​

For Signup go to [https://www.xoxoday.com/](https://www.xoxoday.com/) and click on TRY FOR FREE

<img alt="" />

Step 2: Connect your Qualtrics Account to Xoxoday Plum.

Once you land into your Plum Admin Dashboard, click 'Manage Integrations' option on the left panel, search for Qualtrics and click '**connect'** \*\*​

<img alt="" />

​Step 3: Authentication of Qualtrics account

After clicking on the connect option, confirm if you want to proceed with the integration post which you will have to authenticate your Qualtircs account - simply login into your Qualtrics account for the final connection to establish.\*\*​

<img alt="" />

​Step 4: Create a new Reward automation campaign for an anonymous survey.

Once the account is authenticated, you will be redirected to the Qualtrics automation page on the Plum Dashboard.

Click **“Create New”**  and choose Anonymous to create anonymous survey.

Select a survey for which you want the respondent to be rewarded using **'Select a Survey'** which is intended for anonymous survey responses). You will be able to see the active campaign surveys in the dropdown.

<img alt="" />

## Step 5: Select the Campaign

Select a Campaign that specifies the rewards you want to send to anonyomous survey respondents.

<img alt="" />

Step 6: Trigger Setting

**Auto approval: The system will automate the reward once the trigger is met**

* Distribute rewards for a custom time range: You can define the time range till when you want the rewards to be sent

* Max rewards count: Select the number of rewards you want to trigger through this campaign

* Allow repeat rewarding: Same respondent can be rewarded multiple times for filling out the surveys again.

**Manual Approval: Approval to send the rewards to respondents.**

You will be shown all the respondents on the dashboard and you can manually approve them.

<img alt="" />

Step 7: Save and Launch Automation

Click **'Save and Launch'**.

<img alt="" />

<img alt="" />

## **​Embed the Reward claim page at the end of your survey**

Once you have successfully created your reward automation and recharged your wallet as well. Then you need to complete the remaining steps in Qualtrics in order to enable anonymous rewarding after survey completion.

Follow the step-by-step guide below :

**Step 1: Open your recently created reward automation** \*\*​

Go to your recently created reward automation under integration in Plum admin. Click on the latest automation in the colored tile.
​

<img alt="" />

​
​Step 2: Click on ‘ Follow next steps of Automation’ and copy the reward claim page link

Follow the screenshot below and copy the reward claim page link. This link will be embedded at the end of the survey under your Qualtrics account\*\*.\*\* \*\*​

<img alt="" />

Step 3: Now go to your Qualtrics account

Log in to your Qualtrics account and find and open the survey which you have used to create anonymous reward automation in the Plum Admin.\*\*​

<img alt="" />

​Step 4: Setup the end of Survey flow

Choose the survey flow option from the left menu, click on +Add a New Element Here and choose End of Survey option.\*\*​

<img alt="" />

​Step 5: Add the reward claim page link

Once you click **'End of the survey', click 'Customize' option. Highlight the ‘Override survey option**’ and then choose the third option ‘Redirect to a URL’. Paste the reward claim page link you copied from the reward automation in Plum admin. After completing all steps press OK and Apply all changes.\*\*​

<img alt="" />

<img alt="" />

​Then go back and publish your survey after saving the changes.

Rewards delivered to your respondent anonymously Once any of your respondents fill in your survey and click on complete/submit, they will be automatically redirected to the reward claim page as shown below. For any respondent to claim a reward they have to enter their email ID and submit. The respondents will receive an email with the reward link from which they can redeem the voucher of their choice.


# Public Survey Rewarding
Source: https://help-plum.xoxoday.com/integrations/qualtrics/public-survey-rewarding

Learn how to automatically reward respondents of public surveys through the Plum-Qualtrics integration as soon as they complete a response.

*Learn about setting up integrations, creating and running reward campaigns.*

Follow the step-by-step guide to set up the integration between Xoxoday and Qualtrics, and create & run reward campaigns.

You can find Xoxoday plum on the Qualtrics [marketplace](https://www.qualtrics.com/marketplace/xoxoday-plum-integration/), one can click on the "Get Started" button and fill in the basic information as **First Name, Last Name, company name, etc.**

The Xoxoday team will reach out to you to get you started with the integration.

## Step 1: Account creation and Password Reset

**Once you get confirmation about the account creation, you can visit the URL [stores@xoxoday.com](https://stores.xoxoday.com/marketplace/) and go to the "login option**" and reset the password using the forget password option.

Once the password is reset, you can log in to your account and click on the profile option on the top right beside the "cart" option and select the "**switch to Admin"** option from the drop-down.

## Step 2: Connect your Qualtrics Account to Xoxoday plum.

Once you land into your Plum Admin Dashboard, click **"Manage Integrations**" option on the left panel, search for Qualtrics and click\*\*"Connect"\*\*

<img alt="" />

## Step 3: Authentication of Qualtrics account

* **Click Connect**: After selecting the "Connect" option, you will be prompted to confirm if you want to proceed with the integration.

* **Authenticate Qualtrics Account**: To finalize the connection, log in to your Qualtrics account when prompted. Once authenticated, the integration will be successfully established.

<img alt="" />​

<img alt="" />

## Step 4: Create a new Reward Automation Campaign.

Once the account is authenticated, you will be redirected to the Qualtrics automation page on the Plum Dashboard.

Click “Create New” to start a new Reward Campaign. Select "Public" **and click**"Continue"\*\*.

<img alt="" />

<img alt="" />

## Step 5: Select the Survey for Campaign

* **Choose a Survey**: Use the\*\*"Select a Survey"\*\* dropdown to pick the survey for which you want respondents to be rewarded.

* **View Active Campaigns**: The dropdown will display all active campaign surveys. Select the appropriate survey to proceed.

<img alt="" />

## Step 6.1: Set How to Collect Email Addresses

In this step, you will be required to select between the two case

* Please provide your email address to send a reward: Select this if you already have any sample questions collecting the email id of the respondent in the survey.

* Create a question with "email" as input field: Select this if you already do not have any question collecting the email id of the respondent in the survey.

<img alt="" />

<img alt="" />

## Step 6.2: Select a Campaign

Select the Campaign which states the denomination and brands of rewardsApproval of the reward delivered can be done in two way:

* Auto Approval

* The system will automatically distribute rewards once the trigger conditions are met.

* **Options under Auto Approval**:

**Distribute Rewards for a Custom Time Range**: Define a specific time range during which rewards should be sent.

* **Max Rewards Count**: Set the maximum number of rewards to be distributed through this campaign.

* **Allow Repeat Rewarding**: Enable this option to allow the same respondent to be rewarded multiple times for filling out the survey again.**2. Manual Approval**

* Rewards will only be sent after manual approval.

* All respondents will be displayed on the dashboard, allowing you to manually approve rewards for distribution.

<img alt="" />

<img alt="" />

Now 'Save and Launch'.
​

<img alt="" />

Your Qualtrics - Xoxo Plum automation is all set to go!


# Qualtrics: Overview
Source: https://help-plum.xoxoday.com/integrations/qualtrics/qualtrics-overview

Get an overview of the Plum-Qualtrics integration and how it automates respondent reward distribution based on survey completion.

*Learn more about Qualtrics and Xoxoday Plum integration.*

## Overview

Once the integration between the two platforms is enabled, you no longer have to juggle between spreadsheets to track or manage reward campaigns or manually procure and distribute rewards. Xoxoday Plum not only simplifies the rewards process but also adds significant value to the integration. Here are some of the key highlights:

## Automated Rewards on Completion of Survey

The integration allows you to set up Reward automation Campaigns on Xoxoday Plum and send out rewards to respondents who complete the survey. Not just that, the survey respondents can choose gifts, perks, and experiences of their choice from Xoxoday’s extensive global catalog. You can also restrict the number of rewards sent out based on criteria like - campaign time range, Maximum Reward count, etc.

## Built-in Approval Workflows

Integration with Xoxoday lets you control who among your respondents receives rewards. The built-in approval system lets you review and approve respondents individually or in bulk. This ensures that no repeat claims occur.

## Customized Communication Templates

Survey rewards can be sent to respondents through customized email templates to represent your organizational DNA - with your own logo, messaging, and images so they are instantly recognized and don’t get lost in their inbox.

## Extensive Global Catalogue

Xoxoday’s storefront offers an extensive global catalog of 5000+ experiences, 3000+ gift vouchers, and 12000+ perks for your users to choose from. Plum also offers a wide range of reward distribution modes like sending bulk vouchers via emails, SMS, WhatsApp, generation of bulk voucher codes, and distribution through APIs.

## Dedicated Redemption Support

Our API integrations ensure that the redemption process is seamless and non-intrusive for your users. Further to this, we also offer global support for all your user queries during redemption.

## Prerequisite: Adding API Endpoint Access in your Qualtrics account.

**Step 1:** Log in to your Qualtrics account.

​Step 2: Select "**Admin**" from the top dropdown.\*\*​

<img alt="" />

​
​Step 3: **Select**"User"\*\*from the header.\*\*​

<img alt="" />

​
​Step 4:\*\* Click on the email id of the user, and a pop-up will appear, where you can tick the Access API as shown below:

<img alt="" />

Note: The User account must have access to Access API. Some roles who have this access are Brand Administrator, Account Manager, etc.

For any questions or feedback reach out to us at [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Using Qualtrics Workflow Extension to Send Rewards
Source: https://help-plum.xoxoday.com/integrations/qualtrics/using-qualtrics-workflow-extension-to-send-rewards

Learn how to send rewards automatically using the Qualtrics workflow extension connected to Plum, triggered by specific survey events.

First, you'll need to connect Qualtrics and Xoxoday accounts to be able to create a 'Task' inside your Qualtircs Workflow. Follow the steps outlined below:

## Step 1: Find Xoxoday extension

Find Xoxoday Extension from your Qualtrics account. To do this, go to 'Admin' and over to the 'Extensions\*\*' tab. Click on the Xoxoday extension (listed) and follow the steps to connect:

* Click '**Connect Account'** to add a Xoxoday Account.

<img alt="" /> Connect Account

* Now, login to your Xoxoday account and click **'Allow'** access.

<img alt="" />

Allow Permissions

# Creating a Qualtrics Workflow

Now, from your Qualtircs account, create a Qualtrics workflow by clicking '**Workflow'** from the main menu (options drop-down):

<img alt="" />

Create a Workflow in Qualtrics

* Select the 'Survey Response' and choose the survey project you want to send reward (upon completion).

* Click Start by an 'Event' for the Workflow.

* Select '**Newly created Resonse' and 'Response via APIs**'(if applicable). See the below image.

<img alt="" />

Select Response triggers for your survey as applicable

* Now, click '+' icon to add an action '**Task'** (see below)

<img alt="" />

Select 'Task' for setting up a Xoxoday Reward action

\*\*Now, select 'Xoxoday' from the available extensions (see below) and select the Xoxoday account.

# Configuring Xoxoday Reward Settings

Here you can configure Xoxoday reward settings for your action task in the workflow. This is a one-time setup and takes just a couple of mins, steps below:

* Select the reward campaign (pulled from your Xoxoday account).

* Approval Required? Select 'Yes\*\*' if you want to manually approve rewards, else, select 'No' to automatically send rewards out,

* Set the **Reward Expiry period** from the drop-down,

You can setup Additional Settings as follows for your Reward Automation:

* Set date range — the period during which this reward automation should be active.

* Maximum Reward count — Define the maximum number of times a reward can be sent for this survey completion.

* Repeat Rewarding — Turn the toggle ON if you want to enable the same email address to be rewarded multiple times.

That's it. Click 'Save' button and then proceed to 'Next' by clicking the 'Next' button.​

<img alt="" />

​Map the Survey question corresponding to the Email address
\*\*Here, map the survey question where you're collecting the email address from the recipient — this email address will be used to deliver their Xoxoday reward.

* Select 'Survey Question\*\*' from the main drop-down.

* Then, select the specific question which collects the email address.

* See below.

<img alt="" />

That's it. You've successfully configured Xoxoday Rewards with Qualtircs Extensions.


# Overview
Source: https://help-plum.xoxoday.com/integrations/salesforce-loyalty-cloud/salesforce-loyalty-cloud

Get an overview of the Plum integration with Salesforce Loyalty Cloud and how it powers automated, loyalty-driven customer rewards.

*Integrate Salesforce Loyalty Cloud with Xoxoday to offer seamless reward redemptions.*

This integration enables loyalty members to redeem loyalty points effortlessly through Xoxoday’s marketplace using SSO or SAML authentication.

# Salesforce Loyalty Cloud Integration

With **Xoxoday’s Salesforce Loyalty Cloud Integration, you can seamlessly redirect your loyalty members from member portal (via Salesforce experience cloud or your own mobile app) to Xoxoday’s global marketplace (storefront) for reward redemption. This integration ensures a frictionless experience by supporting SSO (Single Sign-On) or SAML-based authentication**, allowing loyalty members to log in effortlessly to Xoxoday’s hosted storefront.

## Why integrate Salesforce Loyalty Cloud with Xoxoday?

Leverage Salesforce Loyalty Points Use Salesforce Loyalty Cloud’s points engine to allocate loyalty points while allowing loyalty members to redeem them seamlessly through **Xoxoday’s reward catalog**.

**Seamless Authentication** **Enable SSO or SAML-based authentication**, providing secure and hassle-free access to Xoxoday’s storefront for redemptions.

Once loyalty members enter the storefront, Xoxoday’s system will consume your **Salesforce endpoints** to:

* **Fetch accrued loyalty points** from Salesforce

* **Post back the spent points** after redemption

***

## Salesforce Loyalty Cloud API Endpoints Consumed by Xoxoday

## FetchPointsAPI

Xoxoday consumes this API to fetch an employee’s available **Salesforce Loyalty points** for redemption.

* Method:GET **Sample Data**

**Required?**

**Description**

userId

jsmth23

Unique **Salesforce Loyalty Cloud user ID**, passed during the SSO session. Xoxoday uses this to fetch loyalty points.

availableAmount

8925.15

Available **loyalty points** accrued by the user, ready for redemption.

***

## Security & Authentication

## Xoxoday requests originate from the following IP addresses:

## Staging

* 50.112.248.135

* 54.184.56.156

* 52.24.158.163

* 34.217.113.26

* 54.185.176.191

## Production

* 52.76.120.90

* 52.74.39.101

* 52.221.42.47

* 46.137.196.217

## Xoxoday requests originate from these domains:

## Staging

* [https://stagingstores.xoxoday.com](https://stagingstores.xoxoday.com/)

* [https://stagingaccount.xoxoday.com](https://stagingaccount.xoxoday.com/)

* [https://staging.plum.gift](https://staging.plum.gift/)

## Production

* [https://stores.xoxoday.com](https://stores.xoxoday.com/)

* [https://accounts.xoxoday.com](https://accounts.xoxoday.com/)

* [https://app.xoxoday.com](https://app.xoxoday.com/)

* [https://plum.gift](https://plum.gift/)

***

This integration ensures a smooth and secure experience for **Salesforce Loyalty Cloud loyalty members, enabling them to redeem their loyalty points effortlessly via Xoxoday’s storefront**.


# Salesforce Loyalty Onboarding Guide for Xoxoday Plum
Source: https://help-plum.xoxoday.com/integrations/salesforce-loyalty-cloud/salesforce-loyalty-onboarding-guide-for-xoxoday-plum

Follow this onboarding guide to connect Xoxoday Plum with Salesforce Loyalty Cloud and set up automated loyalty reward disbursal.

This guide outlines the steps required to integrate Xoxoday Plum with **Salesforce Loyalty Cloud. By completing this onboarding process, customers can seamlessly connect their Salesforce Loyalty account** with Xoxoday to enable automated rewards and incentives.

***

## Step 1: Logging into Salesforce Loyalty Cloud

* Open a web browser and navigate to your **Salesforce Loyalty Cloud login page**.

* Enter your **username and password, then click Login**.

* Ensure that you have the necessary **admin permissions** to install external apps.

***

## Step 2: Installing the Xoxoday App Package in Salesforce

* Navigate to Salesforce AppExchange and search for the **Xoxoday Plum Integration Package**, or use the link below:​[Xoxoday Plum, Version 1.5](https://login.salesforce.com/packaging/installPackage.apexp?p0=04tJ3000000kaLr)

* Choose the Salesforce environment (Production or **Sandbox**) where you want to install the package.

* Follow the **on-screen prompts** to complete the installation.

* Once installed, ensure that all **necessary permissions** are granted for the app to function properly.

## <img alt="Installing Xoxoday Plum" />

## Step 3: Connecting Salesforce Loyalty Cloud with Xoxoday Plum

## 3.1. Logging into Xoxoday Plum

* Open a new browser tab and navigate to **Xoxoday Plum**.

* Enter your **Xoxoday login credentials** and sign in.

## 3.2. Navigating to the Integration Page

* Once logged in, go to the Integration page from the **Xoxoday dashboard**.

* Locate the **Salesforce Loyalty** card in the list of available integrations.

<img alt="Salesforce Loyalty Integration Card" />

## 3.3. Initiating the Connection

* Click the Connect button on the **Salesforce Loyalty integration card**.

* You will be redirected to the **Salesforce login page**.

<img alt="Salesforce Loyalty Connect Button" />

## 3.4. Logging into Salesforce Loyalty

* Enter your Salesforce Loyalty credentials and click **Login**.

* After successful authentication, you will be prompted to **approve permissions**.

<img alt="Salesforce Authorization Screen" />

## 3.5. Approving Permissions

* Review the list of permissions required for Xoxoday to function within **Salesforce Loyalty**.

* Click **Allow** to grant access.

## <img alt="" />

## Final Steps & Confirmation

* Once the connection is **approved, you will be redirected back to Xoxoday Plum**.

* A **confirmation message** will indicate that the integration has been successfully established.

* The Salesforce Loyalty Integration Card on Xoxoday will now show a **Connected** status.

<img alt="" />

This completes the Salesforce Loyalty & Xoxoday Plum integration. Your users can now seamlessly redeem **loyalty rewards** using Xoxoday’s marketplace.

## Standard Workflow for Salesforce Loyalty Cloud Integration

<img alt="" />


# Create a Flow and Add Trigger Rewards
Source: https://help-plum.xoxoday.com/integrations/salesforce/create-a-flow-and-add-trigger-rewards

Learn how to build a Salesforce Flow and add trigger-based rewards, so points or gift cards are sent automatically when conditions are met.

*Learn how to create a flow in Salesforce.*

# Creating a Flow in Salesforce for Xoxoday Plum Reward Automation

Before you get into creating your flows, you need to Create a Campaign and automation in Xoxoday Plum, Add the Xoxoday Refresh widget, and refresh it, to have all your old and new automation synced in.

​Step 0: Once you have added the widget, click\*\*"Refresh".**​Step 1: On the homepage, Go to Navbar->Select Setup and Click**"Setup"**​Step 2: On the Setup Dashboard, Search for "Flows" under Process Automation and Click**"New Flow".**​Step 3: Now select the template type and Configure the Start Trigger Settings, Under Object: Select Lead/Contact and Click**"done".\*\* \*\*​

<img alt="" />

Step 4: **Now next step would be to add a new element: from options select**"Create records".\*\* \*\*​

<img alt="" />

​Step 5: Edit the Create Records settings and under object look for "XoxodayRewardFlowAutomations" and then Click "Done".\*\* (refer to above image)

​Step 6: Now add another element and Select "\*\*Get Records".\*\*​Step 7: Edit the Get Records settings and under object look for "XoxodayRewardFlowAutomations" Once done, "Filter XoxodayRewardFlowAutomations Records" has to be updated. - In fields select "id" - In Values look for "Record (single) variables" ->Select your Xoxoday automation->Select "ID".​

<img alt="" />

Step 8: **Now the element that has to be added is "Action":** Add element->Select Action->Uncategorised-> Action name: Xoxoday Plum Reward API.

<img alt="" />

**Step 9:** Update Input fields as per your flow (refer below image)

<img alt="" />

<img alt="" />

Step 10: Now "Save" your flow and **Activate** it.


# Getting Started - Xoxoday Plum and Salesforce Integration
Source: https://help-plum.xoxoday.com/integrations/salesforce/getting-started-xoxoday-plum-and-salesforce-integration

Get started with the Xoxoday Plum and Salesforce integration, covering setup basics and how automated reward distribution works.

*Learn about integrating Xoxoday Plum and Salesforce*

# Creating a Reward Link Campaign

\*\*Step 1: Login/Signup \*\*to your Xoxoday account [here](https://stores.xoxoday.com/admin/signup).\*\*​

<img alt="" />

Step 2: **On the Admin Dashboard, navigate to **Settings > Campaigns**, Select Reward Link Campaign, and click**"Create New".

<img alt="" />​Step 3:\*\* Choose a Name

Choose a descriptive and memorable name for your campaign to easily identify it later. Consider including the campaign objective or target audience in the name.

<img alt="" />

​Step 4: Customize your Catalogue as per the Country, Denomination of the Campaign, and Select your Vouchers. Once done click\*\*"Save and Close".\*\* \*\*​

<img alt="" />

Step 5:\*\* Personalized Communication

Customize your email and SMS campaigns to resonate with your audience. Use personalization tokens to address recipients by name and segment your messaging based on demographics or past interactions.

Learn more here: [Customize Reward Communication](/send-rewards/reward-links/reward-link-customize-reward-communication)

Step 6: Click\*\*"Preview"\*\* and now you can edit the redemption page background.

Step 7: Click "**Update Campaign"** and you are good to go!

# Integrating Xoxoday Plum and Salesforce

Step 1: Click on Salesforce Integration under Manage Integration and select "**Connect"** to sync Salesforce with Xoxoday Plum.

Once you click on the "Connect" button, you will be taken to the salesforce page to finish connecting both Platforms. Refer to the below link for the Steps.

​[Getting Started and Setting up Salesforce Integration](/integrations/salesforce/salesforce-overview)

<img alt="" />

​
​


# Redemption Journey for your Recipients
Source: https://help-plum.xoxoday.com/integrations/salesforce/redemption-journey-for-your-recipients

See the full reward redemption journey your recipients experience after receiving a reward through the Plum-Salesforce integration.

**Once you have sent rewards to your users, the reward mail lands up in their Mailbox. If you have not sent the reward yet refer to:**

[Sending 1-1 Reward](/integrations/salesforce/send-1-1-reward)

[Steps to create a Flow and add a Trigger](/integrations/salesforce/create-a-flow-and-add-trigger-rewards)

## Steps to Redeem a Reward

**Step 1:** Check your mail for the reward email:

<img alt="" />

Step 2:Click on "Redeem now".**Step 3:** This will open the Campaign Catalogue for you to select your voucher.

<img alt="" />

**Step 4:** Select the Voucher of your preference and Click "Collect Voucher"

<img alt="" />

**Step 5:** This will give you a unique code to redeem at the partner store/website.

​


# Salesforce Integration
Source: https://help-plum.xoxoday.com/integrations/salesforce/salesforce-overview

Get an overview of the Plum-Salesforce integration and how it connects CRM workflows to automated reward disbursal for your contacts.

*Learn more about Salesforce integration with Xoxoday Plum*

## Introduction to Salesforce Integration with Plum

Plum's Salesforce integration empowers you to capture, engage and motivate your Clients/Contacts by inculcating personalized rewards, incentives, gift cards, etc. The seamless integration between the two platforms allows you to analyze and track details like the number of campaigns running, the number of gift coupons sent, etc. from either platform, without having to juggle between the two.

## Benefits of the integration

* This integration helps sales and marketing teams send rewards to Leads and Contacts directly from Salesforce.

* A seamless experience for the admins and end-users.

* Simple 4-step rewarding process: - Install the app - Choose the campaign - Send reward link - Track rewards sent

## Salesforce+Plum Integration for Marketing Teams:

* Account-based marketing (ABM)

* Demand Generation

## Salesforce+Plum Integration for Sales Teams:

* Re-engage cold leads

* Book more meetings

* Boost customer referrals

## Security and Compliance

Xoxoday platform meets the highest certification standards to help reduce compliance burdens for your business and keep payouts safe.

* Encryption of sensitive data

* HTTPS and HSTS for secure connections

* Vulnerability disclosure and reward program

Write to us at [cs@xoxoday.com](mailto:cs@xoxoday.com) for any questions or feedback.


# Send 1-1 reward
Source: https://help-plum.xoxoday.com/integrations/salesforce/send-1-1-reward

Learn how to send an individual one-to-one reward directly from Salesforce using the Plum integration, without switching tools.

*Learn how to send rewards using Salesforce and Xoxoday Plum.*

# Select, Customize and Send a Reward

**Prerequisites**

Salesforce CRM users who need access to 1-1 rewards widget should be added as a user in Xoxoday Plum with Admin or Super admin access as required.

Once the Xoxoday Reward Widget is added to your lead's dashboard, follow the steps given below to send rewards to your prospects.

​Step 1: On the Leads/Contacts Page, Under Xoxoday refresh automation widget-> Click\*\*"Refresh".**​Step 2.1: Under the Xoxoday reward widget, Select Name, Email, Campaign, Reward Amount and Click**"Next".\*\* \*\*​

<img alt="" />

​Step 2.2: If you have not already created a Campaign, Select "Create a Campaign"\*\* in the widget. or Create one from [here](https://stores.xoxoday.com/admin/campaign/).

## Getting Started with Xoxoday Plum

Step 3: **Customize the Email template, Select the banner most relevant to your campaign type and then Click** "Send Reward".

<img alt="" />

Congratulations! On sending your first 1-1 Reward.


# Setting up Salesforce Integration
Source: https://help-plum.xoxoday.com/integrations/salesforce/setting-up-salesforce-integration

Follow this step-by-step guide to setting up the Plum-Salesforce integration so your team can automate reward distribution from CRM records.

*Learn how to set up Salesforce Integration.*

# Steps to Install Salesforce Integration

Step 1: Sign in to Salesforce using your credentials:\*\*​

<img alt="" />

​Step 2. **Go to Apps-> AppExchange marketplace-> Search Xoxoday Plum and Click on**"Get it now!**": This will install plum on your salesforce.**//App once published, add an image

​

<img alt="" />

There are three options for installing your app:

* Install for Admins only

* Install for all users

* Install for Specific Users

This helps you in giving this app to required people and restricts everybody else.

**Congrats, you have successfully installed the application.**

# Steps to Authenticate and Connect

Before you start sending any rewards your connection to Xoxoday Plum AppExchange integration has to be authenticated with your specific callout end-points URL and authentication settings, this helps Salesforce to make callouts to Xoxoday's remote system.

​Step 1: In the home section: Go to Setup->Users->select users->Auth settings for external -> Named Credential.

<img alt="" />

<img alt="" />​Step 2: Under **Authentication-> Select Authenticator Provider->Click Edit->Under Authentication Protocol select Auth2.0.**

<img alt="" />

Step 3: Now under Authentication Provider-> Click on the search option and look for **"XOXODay\_AuthProvider" and then Click "Save".**

\*\*​

<img alt="" />

​Step 4: \*\*Once Saved, It will take you to connect Salesforce with Xoxoday Plum. Click "Allow". If everything looks good, then you'll be taken back to Salesforce.\*\*​

<img alt="" />

Congrats, you have successfully authenticated.

# Adding 1-1 Widget

\*\*Once the installation is done and you have finished the authentication, now you can access widgets by Xoxoday Plum to send your rewards.

​Step 1:\*\* On the Salesforce homepage-> Select either Leads or Contacts-> Select a Lead (to whomsoever you wish to send a reward)

​Step 2: From the **Navbar-> Select the Setup icon->Select Edit Page**. Under Components search for\*\*"Xoxoday"-> Drag and drop "Xoxodayreward"**on page**​

<img alt="" />

​Step 3: \*\*Click "Save" and you have successfully added the Xoxoday reward widget.

# Adding Refresh Widget for Automation

Once the installation is done and you have finished the authentication, now you can access widgets by Xoxoday Plum to send your rewards.

**​Step 1:** On the Salesforce homepage

​Step 2: From the Navbar-> Select the Setup icon->Select Edit Page. Under Components search for "Xoxoday"-> Drag and drop "**XoxodayRefreshAutomations**" on page.\*\*​

<img alt="" />

Step 3: \*\*Click "Save" and you have successfully added the XoxodayRefreshAutomation widget.**​Congrats, On successfully adding both the Xoxoday Widgets.**


# SAP Client Registration with Xoxoday for Stores Redemption
Source: https://help-plum.xoxoday.com/integrations/sap-successfactors/sap-client-registration-with-xoxoday-for-stores-redemption

Learn how to register your SAP client with Xoxoday to enable employees to redeem their rewards through the store redemption flow.

*Learn the technical details of integrating SAP® with Xoxoday Plum.*

# Overview

\*\*Xoxoday Plum acts as a Redemption Partner for SAP SuccessFactors. Points assigned to Employees on SAP SuccessFactors can be redeemed in Plum’s Marketplace via SSO Sign-On.

Employees can choose amongst the options available in the catalog and redeem their points.

The Plum rewards application is now available on the SAP SuccessFactors and is listed in the SAP App Center.

<img alt="" />

## Key User journeys

* Point Distribution & Wallet recharge\*\* \*\*Your customers' HR Admin user sets up a wallet fund and distributes Points to employees by SAP SuccessFactors Reward Program.

* Point Balance for Employee\*\* \*\*Employees of your customers can view their Points directly within your SAP Successfactors Recognition portal.

* Reward Redemption

Employees can click on a Button enabled inside the SAP app to redeem rewards. Xoxoday

* Plum auto-identifies and authenticates via an OAuth 2.0 SSO and the Employee\_user is redirected to the Plum dashboard, where they can explore the catalog and complete their redemption.

Xoxoday Plum sends the voucher details to employees' inbox

* **Balance Update**

The client application can get the Points balance by making an API call to Xoxoday Plum.

# Redemption on Xoxoday for Points-Based Award Programs

In a points-based program, recipients receive points instead of direct compensation. The system converts the points to virtual currency that employees redeem with Xoxoday.

**Connections to Xoxoday must be enabled before a points-based award program becomes active.**

Multiple steps are required for setting up redemption options. Configuration and sign-on to partner sites are only part of the requirement.

\*\*You also create different accounts, or wallets, for the points and how the points are redeemed.

Note\*\*: Award recipients can view their reward balances through the user interface. When converting points, the system rounds amounts to 2 decimal places. For amounts halfway between, the system rounds up.

To set up the program and setup Integration with Xoxoday:

* Enable points-based settings in Manage Award Program Settings

* Establish a connection with **Xoxoday** through whom employees redeem their awards.

* Configure a Single Sign-On connection with Xoxoday and configure **API communications**.

* Set up the points-based awards program, designate the redemption partner as Xoxoday, and configure the wallet (account) used to accumulate and then redeem the points.

## Step 1: Enable Point-Based Settings

* Enable points-based setting in the **Manage Award Program Settings**.

* Visit Reward and Recognition > Manage Award Program Settings and select the checkbox ‘**Enable Points Based Programs**’

<img alt="" />

<img alt="" />

## \*\*Step 2: Establishing a Single Sign-On (SSO) Connection with Redemption Partner Xoxoday.

* After enabling the points-based program, you next set up Single Sign-On connections with the partners that will fulfill your employees' requests to redeem their points. Note that part of this process involves contacting SAP SuccessFactors Technical Support.

* To expedite the process for you, please make sure that you are guided by Customer Success Partner from Xoxoday.

Context

When working with the partner Xoxoday, your company instance is referred to as the Identity Provider (IDP). Xoxoday is referred to as the Service Provider (SP).

\*\*Configuring API Communications with XOXODAY Redemption Partner \*\*The Reward and Recognition module shares information with redemption partner XOXODAY Web sites through API calls. To enable partners to configure their systems, you need to gather some critical information and add it to the Integration setup screen in Xoxoday:\*\*​

Company ID, API Key, Private Key, and Base API URL\*\*.

There are a number of steps required to retrieve the Private Key and **API Key**.

### Prerequisites

You have the role-based permission for **Manage OAuth2 Client Applications**.

### Procedure

1. Within your SAP SuccessFactors instance, go to **Admin Center Manage OAuth2 Client Applications**.\*\*​

2. Select Register Client Application\*\* \*\*​

<img alt="" />

3. Company will be auto-populated with CompanyID

4. Add Application Name as ‘**Xoxoday Plum**’

5. Add Description as:\*\*Rewards by Xoxoday Plum **6. Set Application URL field:** [https://www.xoxoday.com](https://www.xoxoday.com/)

Now, to **Generate Private Key**,

(i) Select **Generate X.509 Certificate**.\*\*​

A new panel appears.
​
(ii) Enter the same value into Common Name (CN) \*\*that you entered into Application Name previously.**​
(iii) Select Generate.The system returns you to the previous panel and fills in the X.509 Certificate **field.**(iv) Select Download**.

\*\*The system allows you to download the X.509 certificate once only.

(v) Open the X.509 Certificate - named certificate.pem **- and search for the string** ----BEGIN ENCRYPTED PRIVATE KEY-----

The Private key is between -----BEGIN ENCRYPTED PRIVATE KEY----- and\*\*-----END ENCRYPTED PRIVATE KEY-----\*\*

\*\*Copy the Private Key

To get the value for API Key\*\*, proceed as follows:

From the Manage OAuth2 Client Applications page, select View next to the **Application Name** you created in the previous set of steps.

* Copy the value for **API Key**.

* Note the Company ID for your SAP SuccessFactors instance. Use it for **Company ID**.

To create the Base API URL, use the Endpoint URL Patterns from the [List of SAP SuccessFactors API Servers](https://help.sap.com/docs/SAP_SUCCESSFACTORS_COMPENSATION/70b6f618048540f0847db586847bc14d/af2b8d5437494b12be88fe374eba75b6.html).\*\*To Retrieve the Security Assertion Markup Language (SAML) Metadata file \*\*for your company's instance, which you find at:**​YOUR-INSTANCE-URL/idp/samlmetadata?company=YOUR-COMPANY-ID**

​YOUR-INSTANCE-URL **depends on the data center where your company instance is located, and**​YOUR-COMPANY-ID \*\*is the Company ID for your instance.\*\*Add the extension .xml to the SAML Metadata file.

Now, You have:

* API Key

* **Private Key**- **Base API URL**- **SAML File**

# Step 3: Setup Account in Xoxoday Plum

Proceed to: Navigate to Integrations > SAP SuccessFactors. Click on the ‘Configure\*\*’ button.\*\*​

<img alt="" />

Step 1: Add API Details

<img alt="" />

Add the asked details and credentials collected from the above steps.

### Step 2: UPLOAD SAML METADATA

### Upload the SAML file generated from the above steps.

<img alt="" />

On Successful upload of SAML file

<img alt="" />

​

You will get:

​Assertion Consumer Service URL

​Logout URL Open a ticket with SAP SuccessFactors Technical Support with the following code: LOD-SF-RNR-SCR and provide Technical Support with the Assertion Consumer Service URL and **Logout URL** you gathered.

Technical Support adds the Assertion Consumer Service URL - along with the Logout URL - to its list of Authorized Service Provider Assertion Consumer Services.

Once, you have verified that Technical Support has added Assertion Consumer Service URL - and Logout URL.​

Select Checkbox ‘Please Verify that URLs are added by SAP’

and proceed to the next step by clicking on the ‘**Save and Proceed**’ button

### Step 3: Test Login

<img alt="" />

# Redemption Process

\*\*Xoxoday use the SAP SuccessFactors APIs to request the following information:

* First and last name

* Email address

* Mailing address

* Phone number

* Country/Region

* Award balance

* Currency type

When an award recipient initiates a transaction with a redemption partner i.e. Xoxoday, Xoxoday sends a transaction log to SAP SuccessFactors by means of the Redemption API.
​

The log includes the details of the transaction.
​

For example, transaction ID, order and product details, user initiating the transaction, and so on. The award recipient's balance is adjusted in the Reward and Recognition award wallet.

Note\*\* There may be additional configurations or restrictions required by the redemption partner when using multiple wallets.


# SAP Successfactor: Overview
Source: https://help-plum.xoxoday.com/integrations/sap-successfactors/sap-successfactor-overview

Get an overview of the Plum-SAP SuccessFactors integration and how it automates HR-driven employee reward distribution from your HRMS.

*Learn more about SAP SuccessFactor integration with Xoxoday Plum.*

## The purpose of the association

Xoxoday Plum is an API-driven digital rewards platform offering a global catalog with over 10 million redemption options across 55+ countries, including 2,000+ digital gift cards, 10,000+ international experiences, and 10,000+ perks.

Ideally suited for SuccessFactors® users worldwide, Plum ensures effortless scalability and seamless integration. It empowers organizations of any size to streamline reward redemption, providing employees with a vast range of aspirational and meaningful rewards.

## Benefits of the integration

* ## Employee rewarding made easy

Xoxoday Plum takes care of the redemption process and delivery while helping you save on your precious time.

* ## Help employees save money

Employees are happier when they get to save on their monthly expenses by using various perks and offers on daily usage.

* ## Global catalog to choose from

Xoxoday Plum supports redemption in more than 70 countries which makes for a unified experience for your employees across locations.

* ## Dedicated Support

Xoxoday Plum goes the extra mile to make sure that the redemption process is seamless and non-intrusive. Still, in case of any queries, you can count on us.

* ## Instant Delivery

Instant delivery of vouchers/experiences via email and SMS. All the logistics challenges are taken care of by Xoxoday right from curation to delivery.

* ## Thematic experiences

Experiences that appeal to the users across demographics. Themes like ‘Family Time’ and ‘Solo Travellers’ contain specially curated experiences personalized to delight all employees.

* ## Simple checkout

Finding the right experience or brand voucher is just a search away supported by a simple checkout experience that supports SSO and guest checkout.

* ## Employee rewarding made easy

Understand the effectiveness of the program with in-depth insights on redemption patterns and feedback of employees.

## Getting Started with the Integration

<iframe title="Supademo walkthrough" />Step 1: Administrator Access

* Upon enabling the Xoxoday Plum integration, a reset password link is sent to the registered company email.

* The registered email acts as the administrator account for configuration and management.

**Step 2: Initial Setup**

* Log in and update platform settings, including:

Conversion factor

* Time zone

* Company logo and themes

* Receive the SAP® SuccessFactors® Client API Configuration, which includes:

Company ID

* API Key

* Private Key

* Base API URL

* Upload IDP Metadata (one-time process) to enable Single Sign-On for employees.

**Step 3: Configuration Verification**

* Verify the setup by checking the configuration module’s status report.

**Step 4: Employee Access**

* Employees can redeem points collected in SAP® SuccessFactors®.

* Single Sign-On redirects them to Plum, where they can choose from the reward catalog to redeem points.

**Step 5: Availability**

* The Xoxoday Plum rewards app is listed on the SAP® App Center.

* Contact our rewards consultants to explore the Xoxoday-SuccessFactors® integration.

## Redemption procedure

* Log in to your SAP SF account.

* On the Home tab, click '**Compensation'.**- See your points accumulation and click\*\*'Redeem'.\*\*

* Get redirected on [stores.xoxoday.com](https://docs.xoxoday.com/docs/stores.xoxoday.com), you can see point balance sync here.

* Select your Country & click on Gift Vouchers, experiences, or any other classification of your choice.

* Select an option to checkout.

* Select the denomination, and quantity and then click  **“Add to Cart”.**

* On the payments page, click on Use xoxo points and then place the order. You may use a debit/credit card to pay additional points.

Reach out to [cs@xoxoday.com](mailto:cs@xoxoday.com) for any questions or feedback.


# Survey Incentive Management with MRBuddies
Source: https://help-plum.xoxoday.com/integrations/survey-incentive-management-with-mrbuddies

See how the Plum-MrBuddies integration lets you manage and automate survey incentive distribution to respondents at scale.

*Learn more about integrating MRBuddies with Plum*

## About MRBuddies

MRBuddies (by TechBuddies) is a market research project management ERP that streamlines the entire research lifecycle—from client and project management to supplier coordination and panelist engagement. It helps organizations reduce costs, eliminate redundancies, and accelerate outcomes with integrated tools for sales, fraud detection, and engagement.

## Why Connect MRBuddies with Xoxoday Plum?

Integrating MRBuddies with Xoxoday Plum automates survey incentive distribution within a unified platform. Researchers can efficiently manage projects and instantly reward participants from Plum’s global catalog of 26,000+ options, while ensuring seamless workflows from recruitment to fraud screening.

## Key Benefits of the Integration: MRBuddies + Xoxoday Plum

* **Automated & Unified Incentive Management** \*\* Automatically trigger reward campaigns upon survey completion and manage survey invitations, tracking, and incentive distribution from a single dashboard—eliminating manual tracking or spreadsheets.

* Configurable Reward Logic & Fraud Protection\*\* \*\* Set dynamic reward rules based on completion rate, region, or project type, while MRBuddies’ FraudCop and Plum’s secure APIs ensure only verified participants receive rewards.

* Personalized & Seamless Reward Experience\*\* \*\* Deliver branded reward notifications instantly via email or WhatsApp, with access to Xoxoday’s global catalog of 26,000+ options across 5,000+ brands for richer redemption experiences.

* Real-Time Tracking & Insights\*\* \*\* Monitor reward dispatch, redemption status, and engagement metrics through integrated dashboards and analytics—enabling better visibility and ROI measurement.

* Global Reach with Local Compliance\*\* \*\* Run multi-country campaigns effortlessly with built-in currency conversion, taxation compliance, and localized redemption options.

## Benefits for Your Business

* Boost Response Rates and Data Quality Automated, fraud-proof incentives motivate genuine participation, improving survey completion rates and ensuring higher-quality, more reliable data.

* Save Time with End-to-End Automation Seamless integration between MRBuddies and Xoxoday Plum eliminates manual reward tracking, enabling instant payouts and streamlined operations for market research teams.

* Deliver Instant Gratification Globally Reward respondents, vendors, and panelists instantly across 100+ countries with Plum’s vast digital catalog—ranging from e-gift cards to travel and lifestyle experiences.

* Increase Engagement and Loyalty Personalized, flexible rewards drive sustained respondent engagement, vendor satisfaction, and stronger long-term relationships across your market research ecosystem.

* Gain Real-Time Visibility and Control Comprehensive dashboards provide insights into project performance, budget utilization, and reward redemption—empowering data-driven business decisions.

## How Xoxoday Customers Benefit

As a valued Xoxoday customer, you can now access MRBuddies’ advanced market research automation and data management solutions at exclusive rates. This collaboration helps you:

* Automate survey operations and panel management

* Reward respondents instantly through integrated Xoxoday Plum payouts

* Enhance data accuracy with real-time fraud detection

* Streamline vendor and project workflows from one unified dashboard

Together, Xoxoday and MRBuddies empower research-driven organizations to move from manual processes to intelligent, reward-linked automation—driving faster insights, higher participation, and improved ROI.

## Get Started

Discover how MRBuddies can transform your research automation journey. Contact [cs@xoxoday.com](mailto:cs@xoxoday.com) to learn more.


# Anonymous Survey Automation
Source: https://help-plum.xoxoday.com/integrations/surveymonkey/anonymous-survey-automation

Learn how to automate rewards for anonymous SurveyMonkey respondents using the Plum integration, without collecting identifying data.

*Learn all about automating rewards for anonymous surveys,*

## How does it work?

For Anonymous surveys in SurveyMonkey, Xoxoday uses the contact email of a SurveyMonkey respondent(s).

**​Pre-requisites**

* Integration Setup: Ensure that Xoxoday is already connected with SurveyMonkey. If not, follow the integration guide to complete the setup.

* Campaign Creation: Verify that a campaign has been created in Xoxoday to align with your SurveyMonkey survey.

**Feature Specification:** Only the ones who are part of the Email collectors in SurveyMonkey will be eligible to redeem their rewards, anyone apart from that will not have access.

# Steps to send rewards to Anonymous surveys

## Step 1: Create Anonymous Automation

Click ‘Create New Automation’ and select the ‘Anonymous’\*\* option modal.

<img alt="" />

## \*\*Step 2: Accept Guidelines

Read the guidelines mentioned in the modal and accept it by clicking to select option ‘I understand the above guidelines’ and click ‘Continue’.

<img alt="" />

<img alt="" />

## Step 3: Setup your Automation

Select the survey of your choice and set Reward settings by setting Manual or Automatic approval. You can also set the automation start date and end date with a limit on rewards sent.\*\*​

<img alt="" />

## Step 4: Save and Launch

Once automation is launched, the settings cannot be changed.\*\*​

<img alt="" />

Step 5: Add Reward URL in Survey End Page
Copy the reward claim page URL >> In SurveyMonkey, select the Email Collector\*\*>> then, click 'options' and select\*\*'Survey End Page >> Select Redirect a URL >> Paste the reward URL\*\* here. Copy the given link.

<img alt="" />

## \*\*Refresh Email Collector

By Refreshing the Email Collector, our system will fetch new collectors and emails added to this survey. The new email address will be added to Eligible list for rewards. Only emails added in eligible list can receive rewards.

Go to the details page of Automation.
​

<img alt="" />

Select the ‘Refresh Email Collector’\*\* button.


# Public Survey Automation
Source: https://help-plum.xoxoday.com/integrations/surveymonkey/public-survey-automation

See how to automate rewards for respondents of public SurveyMonkey surveys through the Plum integration as soon as they submit.

*Learn how to send rewards to public surveys.*

## How does it work?

For Anonymous surveys in SurveyMonkey, Xoxoday uses the contact email of a SurveyMonkey respondent(s).

* ​**Integration Setup**: Ensure that Xoxoday is already connected with SurveyMonkey. If not, follow the integration guide to complete the setup.

* **Campaign Creation**: Verify that a campaign has been created in Xoxoday to align with your SurveyMonkey survey.

Feature Specification: Only the ones who are part of the Email collectors in SurveyMonkey will be eligible to redeem their rewards, anyone apart from that will not have access.

# Steps to send rewards to public surveys

## Step 1: Create Public Automation

Click **‘Create New Automation**’ and select the\*\*‘Public’\*\* option modal.

<img alt="" />

Step 2: Select a Survey
Select a Survey that you want to send rewards through. To collect email addresses to send rewards, please select the question in your surveying 'Choose a existing Question' where respondents will enter their email.

If you don't have a question that collects email addresses, you can add the question in survey by selecting 'Create a new Question' and add a Question.

This question will appear as the last question in survey.

<img alt="" />

## Step 3: Setup your Automation

Select the survey of your choice and set Reward settings by setting Manual or Automatic approval. You can also set the automation start date and end date with a limit on rewards sent.

<img alt="" />

## Step 4: Save and Launch

Once automation is launched, the settings cannot be changed.

<img alt="" />

<img alt="" />


# SurveyMonkey and Qualtrics Integration
Source: https://help-plum.xoxoday.com/integrations/surveymonkey/surveymonkey-overview

Get an overview of the Plum-SurveyMonkey integration and how it automates reward distribution to survey respondents.

*Learn all about integrating Survey Monkey and Xoxoday Plum*

### Introduction

Building a strong panel for your survey to collect insights that are accurate, insightful, and meaningful takes a lot of effort. But that’s definitely not the end of it. The success of the survey depends on how many of these people actually respond to the survey.

A Low response rate is one of the biggest challenges that most marketers face while conducting a survey.

So how do you encourage people to respond to your surveys? How can you improve the response rate to get better insights?

One of the most widely adopted, and not-so-secret motivator that nudges respondents to complete surveys is instant rewards, incentives, and benefits.

Xoxoday Plum, with SurveyMonkey, has integrated to empower organizations to significantly improve survey response rates by engaging the respondents with automated digital rewards and benefits.

The seamless integration between the platforms ensures a superior user experience by eliminating any kind of manual gift-code management. You can now simply create a reward automation campaign on Xoxoday Plum to automatically send rewards to all respondents who complete the survey.

## Highlights of the Integration

Once the integration between the two platforms is enabled, you no more have to juggle between spreadsheets to track or manage reward campaigns, or manually procure and distribute rewards. Xoxoday Plum not only simplifies the rewarding process, but also brings a host of value addition to the integration. Here are some of the key highlights:

## Automated Rewards on Completion of Survey

The integration allows you to set up Reward automation Campaigns on Xoxoday Plum and send out rewards respondents to complete the survey. Not just that, the survey respondents can choose gifts, perks, and experiences of their choice from Xoxoday’s extensive global catalog.

You can also restrict the number of rewards sent out based on criteria like - campaign time range, Maximum Reward count, etc.

## Built-in Approval Workflows

Integration with Xoxoday allows you to have complete control over who among your respondents to send the rewards to. The built-in approval system lets you review and approve respondents individually or in bulk. This ensures that there are no repeat claims that take place.

## Customized Communication Templates

Survey rewards can be sent to respondents through customized email templates to represent your organizational DNA - with your own logo, messaging, and images so they are instantly recognized and don’t get lost in their inbox.

## Extensive Global Catalogue

Xoxoday’s storefront offers an extensive global catalog of 5000+ experiences, 3000+ gift vouchers, and 12000+ perks for your users to choose from. Plum also offers a wide range of reward distribution modes like sending bulk vouchers via emails, SMS, WhatsApp, generation of bulk voucher codes, and distribution through APIs.

## Dedicated Redemption Support

Our API integrations ensure that the redemption process is seamless and non-intrusive for your users. Further to this, we also offer global support for all your user queries during redemption.

## How does the Integration Works?

Follow the step-by-step guide to set up the integration between Xoxoday Plum and SurveyMonkey, and create & run reward campaigns.

## Step 1: Go to SurveyMonkey App Marketplace → Search for Xoxoday Plum

<img alt="" />

## Step 2: Click on the “Install” button to connect with Xoxoday Plum.

Step 3: Now, you will be redirected to the Xoxoday app registration process
Log in/Sign-up to your Xoxoday account with admin credentials to access to Xoxoday admin dashboard.

## Step 4: Fill in the details

* Company Name: It will be used for customer communication and invoicing purposes.

* Currency: The currency selected will be used for all your transactions

* Tax ID: The company Tax ID will be used to issue the invoices for your transactions

* Password: You will be asked to create a password

<img alt="" />

## Step 5: Create Public Survey Automation

* Click 'Create New'\*\* on the Automation page.

* Select Public Surveys and click **'Continue'.** ​

<img alt="" />

## Step 6: Select Survey

Select the Survey from the list of SurveyMonkey surveys that you want to use to provide rewards.
​

<img alt="" />

​
​

In the survey, one should have a question type as email type or enter the question as email type in the campaign

## Step 7: Setup Rewards Settings

* Select a Campaign.

* Link Expiry- Select an end date when the links will expire.

* Manage Approval method: Manual or Auto.

* Click the "Customize Email" option.

* Automation Date range

* Reward Limit and

* Repeating rewards.

<img alt="" />

​Step 8: Save and Launch Automation
Click 'Save and Launch' and confirm '**Yes, Launch'.**

<img alt="" />

**The Xoxoday Plum rewards application is now available on SurveyMonkey's app marketplace.** **[Get in touch](https://www.xoxoday.com/book-a-demo) with our experts to know more about how the Xoxoday-SurveyMonkey integration works**

For any feedback or questions reach out to us at [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Overview
Source: https://help-plum.xoxoday.com/integrations/typeform/typeform

Get an overview of the Plum-Typeform integration and how it automates reward distribution to respondents who complete your forms.

*Learn about the Xoxoday Plum integration with Typeform.*

## How the Xoxoday Plum and Typeform Integration works?

**Send personalized rewards, incentives, and gift cards to your respondents to increase the survey response rate with Xoxoday Plum**

i. Instant Gratification -Provides a sense of fulfillment for the user on completion of a particular task, leaving behind a good taste of the application or platform used.**ii. Automated workflows**- You can set up custom workflows and triggers to automate the complete process of sending, tracking, and managing rewards, incentives, gift cards, etc.**iii. Hassle-free Rewarding**- Provides a hassle-free method for organizations to reward users based on specific triggers.**iv. Approval Workflows**- Eliminate any duplicate or multiple reward claims by using Xoxoday’s robust built-in approval process. Scrutinize all claims before approving or rejecting them.**v. Extensive Global Catalogue** - Xoxoday’s storefront offers an extensive global catalog of 5000+ experiences, 3000+ gift vouchers, and 12000+ perks for your users to choose from.

No-code setup - No human intervention or technical support is needed. No code workflow set up with a step-by-step walkthrough.

## Getting started with the Xoxoday Plum ↔ Typeform Integration

Follow the step-by-step guide to set up the integration between Xoxoday Plum and Typeform.

**Step 1**

Go to [Typeform](https://admin.typeform.com/login) → Apps and Integrations→ Search for Xoxoday Plum

<img alt="" />

**Step 2**

Click on the “Xoxoday” card to connect with Xoxoday Plum.

**Step 3**

Now, you will be redirected to the Xoxoday app registration page.

**Log in/Sign-up** to your Xoxoday account with admin credentials to access the Xoxoday admin dashboard.

<img alt="" />

Step 4 Click on the **Recharge option** on the Sidebar to Recharge your Plum Account to kickstart your campaign.

Complete your KYB before doing the recharge, as you will be able to recharge only up to INR 10000 until your account is verified.

**Step 5**- Click on **Add Funds** and Proceed with the Payment.

* ​[Click here](/getting-started/for-admins/wallet-management/wallet-management-overview) to know more on how to recharge your account.

The recharged amount will now be reflected in your Xoxoday Wallet.

\*\*​Step 6 \*\*Once you have enough funds in your Xoxoday account, click **Campaign** Tab to Create a new Reward automation campaign.

<img alt="" />

Step 7

* Now, click 'Create Reward Code/Reward Link Campaign'.

* You will now be redirected to a page where you can customize reward automation details like **Reward Amount, Reward Recurrence, Start Date, End Date, email templates to be sent, etc.**- Now, click on the\*\*"Create Campaign"\*\* button.

<img alt="" />​

Step 8

* Now, go to **Typeform** Integration from the sidebar.

* Click on "**Create new"** automation

* You will now be prompted to “Select a Survey” for your Typeform Reward Automation.

* Further to this, before launching your reward automation, you can also change;

Reward trigger settings to either automatically send rewards or have an approval process to manually approve rewards.

* You can also set up a reward distribution logic based on a Custom time range or Maximum Reward count.

* Now, click on the **"Launch"** button to activate the Typeform Reward automation.

<img alt="" />​

<img alt="" />

Select Survey

Step 9

Navigate through the various Reward Automations → click on any specific Reward automation to take action like changing Reward Automation status (active to inactive), track the number of rewards distributed, etc. from your Typeform integration page on Xoxoday Plum.

<img alt="" />

Talk to our expert to know more about how you can improve survey response rates by integrating with [Xoxoday Plum](https://www.xoxoday.com/book-a-demo).
​

For any questions or feedback contact us at [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Zapier + Plum
Source: https://help-plum.xoxoday.com/integrations/zapier-plum

Learn how to connect Plum with Zapier to automate reward workflows across thousands of apps without any custom code.

## SurveyMonkey + Zapier + Xoxoday Plum

Integrate SurveyMonkey with Xoxoday Plum to send a gift card to respondents on SurveyMonkey.

**​Benefits of this integration**

* Saves time – Seamless and automated workflow triggered by just a few clicks.

* No human intervention or Technical support needed - No code workflow set-up with a step-by-step walkthrough.

* Ease of workflow creation improves Customer Experience.

* Provides a hassle-free method for organizations to reward and recognize people.

* Instant Rewarding/Gratification - Provides a sense of fulfillment for the user on completion of a particular task, leaving behind a good taste of the application or platform used.

**​To integrate SurveyMonkey with Zapier follow the following steps:**

* Create a Zap workflow by first choosing an online app (HubSpot, Salesforce, SurveyMonkey, Slack, Google sheets, SurveySparrow, etc.) and then choose a trigger, such as ‘when a survey submission is completed by the user’. Test the trigger to Find data.

* Next, pick Xoxoday Plum as the "Action" application to send rewards in the form of e-gift cards automatically as a response to the "Trigger".

* Sign in to the Trigger App. Next, to sign into the Action App, complete the self-serve set-up of Xoxoday Plum.

Below are the steps to register:

## Signup or Sign In on Plum(if you already do not have a plum account)

If you are new to Xoxoday Plum, click on the “Signup” button. You can learn how to set up a Plum account here. It's recommended that you use the email registered with HubSpot to signup with Plum as well.\*\*​

<img alt="" />

If you are an existing user, use your xoxoday credentials to log in to the admin dashboard.

Congrats, you have successfully installed the application.

## Click on the Recharge option on the Menu bar to Recharge your Plum Account for the Reward automation campaign

<img alt="" />

## **Recharging the account**

* Click on Add Funds and Proceed with the Payment.

\*\*​Step 5:\*\*Now authorize your Zapier account with the Plum account for seamless data sync.**​Now you are successfully registered with Xoxoday Plum.**

**Already existing customer: Sign in using your existing user ID and password.**

## ​Authorize your account

Now you are successfully registered with Xoxoday Plum.

* Once signed into Plum, click Continue and start Customising your reward, fill up all the fields depending on the use-case of the Action you have set. Double-check everything. For example, the Recipient Email field is important if the gift card(s) need to be sent to the user via email.

* Click Continue. You may now test it for review or proceed to the next step.

* Turn on Zap to complete the workflow.

\*\*Congrats! You have successfully created the Zap.

As a result, whenever a respondent completes the selected Survey on SurveyMonkey, he will instantly receive the customized Gift Card from Xoxoday Plum!

Could this process of workflow creation get any simpler?!

# Salesforce + Zapier + Xoxoday Plum

Integrate Salesforce with Xoxoday Plum to send a gift card to new Prospects/leads added to your Salesforce account

​To integrate Salesforce account with Zapier follow the following steps:

\*\*​Step 1:\*\*Select Salesforce as the Trigger application, the Trigger, in this case, is “when a new lead(a record) is added”. First, log in to your Salesforce account and Test the trigger to Find data.\*\*​Step 2:\*\*Next, pick Xoxoday Plum as the Action application to send rewards in the form of e-gift cards automatically as a response to the Trigger, i.e. to a new record added on Salesforce.**​Step 3**: After DIY set-up or log in as a registered user of Xoxoday Plum.\*\*​Step 4:\*\*Click Continue and begin Customizing the Reward. Fill up all the fields depending on the use-case of the Action you have set. Double-check everything. For example, the Recipient Email field is important if the gift card(s) need to be sent to the user via email.\*\*​Step 5:\*\*Test and Review or Continue.**​Congrats! Your Zap is now ready.**

As a result of this integration, whenever a new record is added to Salesforce, the user receives Xoxoday Plum’s customized Gift Card via email.

​

​

​
​
​

​
​
​


# Automation: Workflow Rules
Source: https://help-plum.xoxoday.com/integrations/zoho-crm/automation-workflow-rules

Learn how to set up automation workflow rules for sending rewards automatically in Zoho CRM using the Plum integration.

*Learn all about automating Workflow Rules*

Workflow rules allow you to perform certain automatic actions on specific records based on filter criteria. Using Workflow Automation, you can automate reward sending based on your rules.

## STEP 1: NAVIGATE TO AUTOMATION WORKFLOW RULES

Visit **Setup > Automation > Workflow Rules** for setting workflows.

<img alt="" />

## STEP 2: CREATING A REWARD WORKFLOW RULE

Click **'Create Rules'** button.

<img alt="" />

Set the Module for which you want to automate rewards. Add a name to your rule indicating the purpose of reward via name and description.\*\*​

<img alt="" />

<img alt="" />

STEP 3: SET RULES FOR REWARDING
This rules rewards sales representative for winning a deal within a closing date.
​

<img alt="" />

STEP 4: SET PLUM REWARDS AS ACTION
Select **Instant Actions > Choose Plum Rewards** (PlumrewardsbyXoxoday).

<img alt="" />

Select the reward Automation that you created in Xoxoxday Plum.\*\*​

<img alt="" />

<img alt="" />

After selecting the automation, Name your custom action.

<img alt="" />

Click on ‘Save’\*\* to save the rule.

<img alt="" />

By default, the rules are not active. Click on **‘Activate’** to start your rewarding workflow rules.

<img alt="" />


# Send 1-1 rewards
Source: https://help-plum.xoxoday.com/integrations/zoho-crm/send-1-1-rewards

See how to send an individual one-to-one reward directly from Zoho CRM using the Plum integration, without switching tools.

*Learn how to integration Zoho CRM with Xoxoday Plum*

# Integrating Zoho CRM and Plum

## STEP 1: Connect with Zoho CRM

Go to Xoxoday Plum Admin Dashboard and click 'Integrations' and search for Zoho CRM. Click **"Connect"**, and you will land on ZohoPeople’s App Marketplace.

<img alt="" />

## STEP 2: Install Xoxoday Rewards for Zoho CRM App

Click on the Install button.

<img alt="" />

On Install, accept the terms and conditions and click 'Install'.

# Sending Rewards to Leads and Contacts

## STEP 3: Select the Contact or Lead you want to send Rewards.

After the Xoxoday Plum App installation, click ‘Plum Rewards’ on the Leads and Contacts detail page.​

<img alt="" />

STEP 4: Open Xoxoday Plum Rewards Widget and Select Reward Campaign
**Prerequisites**

Zoho CRM users who need access to 1-1 rewards widget should be added as a user in Xoxoday Plum with Admin or Super admin access as required.\*\*Click on the ‘Plum Rewards’ button to open our rewards Widget. Via this widget, you can select the desired reward Campaigns that you already created in Xoxoday Plum.\*\*​

<img alt="" />

Click on Next

## STEP 5: Customize Reward Email

\*\*Now you can customize your reward Email. You can change the Email Subject and Message to send personalized rewards to your contact or lead.
​

<img alt="" />

STEP 6: Change the Email Banner
Click on Email Banner to open up available banners for different gifting occasions.

Select the desired banner and click 'Use Image'\*\*.

<img alt="" />

<img alt="" />

## \*\*STEP 7: Preview your Reward Email

Click 'Preview your email'\*\* below the banner to check how your reward email will look to your rewardee.

<img alt="" />

## STEP 8: Send Reward

Congratulations! You have sent a reward to your contact or lead. Continue sending reward emails to win more deals and manage relationships with your customers for choosing you.
​

<img alt="" />


# Zoho CRM Integration
Source: https://help-plum.xoxoday.com/integrations/zoho-crm/zoho-crm-overview

Get an overview of the Plum-Zoho CRM integration and how it connects CRM workflows to automated reward disbursal.

*Learn more about Zoho CRM and Xoxoday Plum integration.*

# Zoho CRM + Xoxoday

Zoho CRM is a customer relationship management (CRM) software that helps businesses of all sizes to manage their sales, marketing, and customer support processes in a centralized platform. With Xododay Plum Rewards App in Zoho CRM, rewarding has never been so easy. Include rewarding in your sales Funnel and manage relationships with customers by rewarding them for choosing you.

# Why Integrate with Zoho CRM

* **Create campaigns** Take complete control of your reward delivery process, create and personalize your reward campaign with nuances like reward type (cash, gift card, voucher, etc.), reward mode (automated/ manual), communication templates, and more.

* Send rewards to Prospects

Xoxoday Plum extends the capabilities of Zoho CRM by allowing multi-dimensional rewards to be performed from the workflow. You can generate meetings, sustain post-demo contact with the POC, and re-engage with lost prospects with tailored one-time rewards.

* **Assign workflows**

While creating workflows in Zoho CRM, set up automatic triggers to send out rewards, incentives, and gift cards to your customers. Define campaign process goals such as lead conversion, webinar registrations, etc. to set the triggers.

* **Analyze rewards**

Get a unified view of all reward-automation campaigns set up in Zoho CRM directly. Create and Navigate through various campaigns to check the active/inactive statuses and more


# Zoho People
Source: https://help-plum.xoxoday.com/integrations/zoho-people

Get an overview of the Plum integration with Zoho People and how it automates HR-driven employee reward distribution.

Effortlessly recognise, reward, and delight your employees — all without leaving Zoho People. The Xoxoday integration enables you to award points directly from an employee profile and lets employees redeem them on a curated global rewards catalogue, all in just a few clicks.

This guide walks you through everything you need to know: from setting up the integration and assigning points, to exploring the employee redemption experience.

## Overview

The Xoxoday + Zoho People integration seamlessly connects your HR platform with your rewards ecosystem. With this integration, you can:

* **Automate recognition** — Award reward points directly from Zoho People profiles.
* **Streamline redemption** — Employees redeem points from Xoxoday's global rewards catalogue without leaving Zoho People.
* **Deliver a seamless experience** — Users are logged in automatically when redeeming — no extra steps or logins required.

This helps HR and business leaders create a culture of appreciation while keeping the entire recognition journey inside the tools teams already use.

## Prerequisites

Before you get started, make sure you have:

* An active **Xoxoday Plum** account with admin access.
* Admin or HR privileges in **Zoho People**.
* Sufficient reward points or wallet balance in your Xoxoday account.
* (Optional) A list of locations or employee types for whom the program will be applicable.

***

## Step 1: Set Up Integration

### 1. Navigate to Integrations

Go to your Xoxoday Plum Admin Dashboard and click on **Integrations**.

### 2. Connect Zoho People

Find Zoho People in the integrations list and click **Connect**.

### 3. Activate in Zoho Marketplace

You'll be redirected to the Zoho People Marketplace. Click **Activate** to enable the integration.

### 4. Log in and Confirm Activation

Log in with your Zoho People credentials and accept the terms and conditions to complete activation.

***

## Step 2: Configure Integration Settings

Once activated, you can customise how the integration behaves for your organisation.

### 1. Define Applicability

Choose which locations and **employee types** are eligible to receive rewards. This ensures that only relevant users are part of your recognition program.

### 2. Save Settings

Click **Save** to finalise your preferences.

***

## Step 3: Award Points to Employees

Once setup is complete, awarding points is seamless and can be done directly from Zoho People.

### 1. Go to an Employee Profile

Navigate to the profile of the employee you want to reward.

<Note>
  Only administrators and **reporting managers** can award points.
</Note>

### 2. Click on "Reward Points"

Here, you'll see:

* **Total available points** — your organisation's wallet balance.
* **Employee's current points** — how many they already have.
* **Points to be awarded** — how many you want to give.
* **Awarded For** — add a note or reason for recognition.

### 3. Assign Points

Click **Assign Points** to complete the process. The employee will receive the points instantly, along with an email notification.

***

## Step 4: Employee Redemption Experience

Here's what the experience looks like from an employee's perspective.

### 1. Redeem from Zoho People Home

Employees can view their available points in the Xoxoday widget on their Zoho People homepage. Clicking **Redeem Points** starts the redemption journey.

### 2. Seamless Access to Storefront

Clicking **Redeem Points** takes them directly to the Xoxoday storefront — no extra login required, thanks to a secure single sign-on (SSO) flow handled in the background.

### 3. Browse and Choose a Reward

Employees can explore a wide range of **gift cards, merchandise, experiences, and vouchers**.

### 4. Add to Cart and Checkout

Once they select a reward, they can add it to the cart, proceed to checkout, and confirm. Their reward points will be automatically applied.

***

## Frequently Asked Questions

**Who can award points?**

Only administrators and reporting managers with the required permissions can award points.

**Do employees need a separate Xoxoday account?**

No. The integration uses secure SSO, so employees are automatically signed in when redeeming points.

**What if I don't have enough points?**

Admins will be prompted to top up their points wallet before completing the award.

**Can I restrict the program to certain locations or teams?**

Yes. Applicability can be configured by location and/or employee type in the integration settings.

***

<Check>
  You're all set to run a seamless recognition and rewards program directly inside Zoho People — with zero manual work, zero extra logins, and maximum delight.
</Check>

Want to see it in action? Check out the step-by-step walkthrough for the Zoho People integration.

<iframe title="Supademo walkthrough" />


# Approvals - Overview
Source: https://help-plum.xoxoday.com/offers-management/approvals/approvals-overview

Get an overview of the approvals workflow for offers submitted in Plum's Offers Management portal before they go live.

*Learn more about the Approval module*

## Accessing the Approval Page

To manage pending approvals for offers or redemptions, follow these steps:

* **Navigate to the Left Menu** — From your dashboard, locate the navigation panel on the left side of the screen.

* **Click on "Approval"** — Select Approval from the menu. This will direct you to the Approval Management page.

***

## Approval Management Page

The Approval module is built on a maker-checker workflow, ensuring all changes undergo review before going live. Any action requiring approval will appear in the task list of admins assigned the role of checker or approver.

***

## What You Can Do on the Approval Management Page:

* **View Pending Change Requests** — See a comprehensive list of changes that require review and approval.

* **Check and Approve Requests** — Review the details of each change and approve or reject them with a single click.

* **View Rejection Reasons** — For any previously rejected requests, you can view the rejection reason for better context and tracking.

* **Export Approval Logs** — Download the entire list of change requests, including their approval status, for audit or record-keeping purposes.

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Managing Approvals
Source: https://help-plum.xoxoday.com/offers-management/approvals/managing-approvals

Learn how to review, approve, or reject pending offer approvals in Plum's Offers Management portal before they go live.

*Learn more about managing approvals on Loopr*

## View the List of Change Requests

On the Approval Management Page, you'll find a list of all pending change requests that require review.

Each entry in the list shows:

* The feature or function being changed

* The type of change requested

* The current status of the request (Pending, Approved, Rejected)

<Frame>
  <img alt="" />
</Frame>

***

## View Details of a Change Request

To inspect a specific request:

* Click on the "View" button beside the change item.

* This opens a detailed view of the requested changes for review.

<Frame>
  <img alt="" />
</Frame>

***

## Check / Approve or Reject a Change Request

To review and act on a request:

* Click "**Approver**" next to the change request.

* A detailed overlay will appear showing:

  * What feature/function is being changed

  * Who made the request

  * Time and date of the request

  * Summary of changes

* To proceed:

  * Click "**Approve**" to accept the request.

  * Click "**Reject**" to decline the request.

<Frame>
  ![](https://xoxoday-cc4bb9b9ac3a.intercom-attachments-1.com/i/o/qgtvujy1/1873199183/cdfb1e2830d55e6c459789de6eb4/207ad1d9a6c4c1de65db8da89d1f2a73e2a3389a297d79416bbca251f3c71285-Screenshot_2025-07-09_at_6_20_56_PM.png?expires=1776816000\&signature=95d4af4de365952587b5eb6f07a1a51a215522f72b3c42256199810693d9d034\&req=dSggFch3lIBXWvMW3nq%2BgeIzP6f%2BUHALQCKimPTmJg0qwOQvQfGTV5jdHmuo%0AzrhIhFnXzfY6mMQIkC9WvXPPm8Q%3D%0A)
</Frame>

***

## View the Reason for a Rejected Request

To understand why a request was rejected:

* Click "Rejected Reason" beside the rejected change request.

* An overlay will appear displaying the rejection note or feedback.

<Frame>
  <img alt="" />
</Frame>

***

## Export the rejected list of change request

* Admins can export all approval requests—including pending, approved, and rejected—by clicking the "Export Report List" button.

* This generates a downloadable report for tracking and auditing purposes.

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Dashboard
Source: https://help-plum.xoxoday.com/offers-management/dashboard

Get an overview of the Offers Management dashboard, where you can track merchant offer performance at a glance.

This article outlines the key components and modules on the modules Admin Portal, helping administrators navigate the system effectively.

## Dashboard Overview

Upon successful login, the admin is presented with a Dashboard summarising key insights and statuses.

***

## 1.1 Merchant Information (Pie Chart)

* Displays a breakdown of merchants by countries

* Helps track the geographic distribution of partner merchants

***

## 1.2 Vouchers Information (Pie Chart)

* Shows a breakdown of vouchers by offer type

* Useful for understanding which types of offers are most common

***

## 1.3 Web Portals

* Offer Apps

<Frame>
  <img alt="" />
</Frame>

***

## 1.4 Important Reminder Section

Stay on top of urgent or pending actions with this live summary:

* Expired Merchants – List of merchants whose validity has lapsed

* Expiring Merchants in 30 days – Merchants nearing their expiration date

* Expired Offers – Offers that are no longer active

* Expiring Offers in this year – Offers set to expire in the current year

* To Be Reviewed – Offers or merchants pending admin review or approval

<Frame>
  <img alt="" />
</Frame>

***

## Platform Modules

The intuitive interface is organized into core modules that help you efficiently manage your tasks, based on your user role. Each module is accessible through the left-hand navigation menu and is tailored for a streamlined workflow.

* **Merchants: Manage merchant accounts and profiles. Admins use this module to onboard, approve, and monitor merchants.**

  * Add and edit merchant details

  * Track merchant activity and status

  * Assign offers and stores to merchants

* **Offers: Create and manage promotional offers and discounts. Merchants and Admins can customize, schedule, and monitor offers here.**

  * Create new offers with templates

  * Customize branding, validity, and types

  * Track active, expired, and upcoming offers

* **Customers: View and manage customer profiles, engagement, and redemption histories.**

  * Access customer details and preferences

  * Monitor offer redemptions and activity

  * Segment customers for targeted promotions

* **Stores: Manage physical and online store locations linked to merchants and offers.**

  * Add and update store information

  * Link offers to specific stores for localized promotions

  * Manage store operational details

* **History: Track past activities, transactions, and offer redemption logs for auditing and review.**

  * View detailed logs of offer redemptions

  * Monitor customer interactions over time

  * Review activity history

* **Reports: Access comprehensive analytics and performance data to optimize campaigns and measure ROI.**

  * Generate reports on offer performance

  * Analyze customer engagement trends

  * Export data for deeper insights

* **Web Portals: Configure customer-facing portals where offers are displayed and redeemed.**

  * Customize portal appearance and branding

  * Publish offers across portals and regions.

  * Manage portal access and navigation

* **Approvals: Manage workflow approvals for offers based on the user roles – Admin, Checker and Maker.**

  * Review and approve new offers

  * Track approval status and history

* **Settings: Configure account, user roles, subscription, user feedback and password.**

  * Manage user roles and access control

  * Configure subscription and password


# Dashboard Overview
Source: https://help-plum.xoxoday.com/offers-management/for-customers/dashboard-overview

Get an overview of the customer dashboard within Plum's Offers Management portal and what customers can see there.

*This article will take you through the dashboard overview on Loopr*

Offers are organized into multiple sections to help you easily find and manage them.

<Frame>
  <img alt="" />
</Frame>

***

## Favourite Offers

* This section displays all the offers marked as favourites.

* Use the filters and search icon to narrow down the list.

* Great for quick access to offers you're most interested in.

<Frame>
  <img alt="" />
</Frame>

<Frame>
  <img alt="" />
</Frame>

***

## Offer Wallet

* The Offer Wallet contains all the offers you've added for future redemption.

* It's divided into two subsections:

**Added Offers:** Lists all offers that you've currently added to your wallet but haven't redeemed yet.

<Frame>
  ![](https://xoxoday-cc4bb9b9ac3a.intercom-attachments-1.com/i/o/qgtvujy1/1873347442/09c78a17fb7a2f6f4036aa2bd67e/cecc9d59261a0888cbb91dd64db2739132f379902d18c73f30260abce562aa2b-Screenshot_2025-08-05_at_2_17_36_PM.png?expires=1776816000\&signature=b74eb9c3bf7ce97f95dd3bd0c410d095f22f046f6850aa313f30148902dbcd59\&req=dSggFcp6moVbW%2FMW3nq%2BgSCNh7bNUySrrgvtNyopue2nkwChBYRH6nuy1uat%0A1TTLGv3iEyMJLXoLHsbjw6kmUH8%3D%0A)
</Frame>

**Redeemed Offers:** Displays a history of all offers you've already redeemed.

<Frame>
  ![](https://xoxoday-cc4bb9b9ac3a.intercom-attachments-1.com/i/o/qgtvujy1/1873347457/f5aa87238354bbb7d9f0ac76ba66/c52d7b228e71ba9d6732bbe9b86b717811a2c0aa2641118a9eaa8bdf385481dc-Screenshot_2025-08-05_at_2_18_23_PM.png?expires=1776816000\&signature=42124185db47a223230294c3c96316b4a90a1a958bf225f5cd034881e41c0f38\&req=dSggFcp6moVaXvMW3nq%2BgcFbKy3Xsm7U7S0xdS0fi%2BmDiD4a36N1YZUTuNy%2B%0ANR2uYvU3E4s48Ln8FfvrhNuPmFk%3D%0A)
</Frame>

Use filters and the search icon here as well to quickly find what you need.

For any questions or feedback reach out to us at [cs@xoxoday.com](mailto:cs@xoxoday.com).

Looking to drive loyalty, boost sales performance, or enhance employee engagement? [Explore Xoxoday's product suite here!](https://www.xoxoday.com/get-a-demo)


# Listing of Offers
Source: https://help-plum.xoxoday.com/offers-management/for-customers/listing-of-offers

Learn how customers browse the full listing of available offers within Plum's Offers Management customer portal.

*Learn about the different ways a offer is listed on the Loopr platform.*

**1.1 Offer in categories**

* Offer categories and subcategories can be created and managed from the admin portal.

* Category image can be uploaded to show in the portal.

* Sorting of the categories can be configured.

* The number of offers in each of categories can be shown.

* A "Near Me" category can be supported to display offers based locations.

* The location parameter (1km, 5km or 10km) can be defined from the backend.

<Frame>
  <img alt="" />
</Frame>

***

**1.2 Offers in Carousels**

* Multiple carousels can be shown to display different subsets of offers, for marketing and campaign purposes

***

**1.3 Offers by Brands and Merchants**

* Offers under the same brand can be listed in the brand page

* "Top brands" can be configured in the admin portal

* Offers under the same merchant can be listed in the merchant page

***

**1.4 Search and Filter**

* Search and Filter can be always accessed in any offer listing pages and as well as the landing page

* Key words searching is supported in all offer fields, including title, brand, merchant name, description, location, terms and conditions

* Filtering is based on category and subcategory and locations

<Frame>
  <img alt="" />
</Frame>

* Sorting support recency and A-Z (Z-A)

<Frame>
  <img alt="" />
</Frame>

***

**1.5 Map View**

* Offers can be shown in the map based on the store locations

<Frame>
  <img alt="" />
</Frame>

* Map is supported by Google Map

* An offer carousel displays all offers under the shown area

* Zooming out the map, pins will form clusters which display the number of offers in an area

* Zooming in to the clustered pin to show all offers within the area

* Clicking "Get Directions" will jump to a Google Map URL

* Display distance only if location permission is allowed

<Frame>
  <img alt="" />
</Frame>

For any questions or feedback reach out to us at [cs@xoxoday.com](mailto:cs@xoxoday.com).

Looking to drive loyalty, boost sales performance, or enhance employee engagement? [Explore Xoxoday's product suite here!](https://www.xoxoday.com/get-a-demo)


# Offer Management for Customers - Logging In
Source: https://help-plum.xoxoday.com/offers-management/for-customers/offer-management-for-customers-logging-in

Learn how customers can log in to Plum's Offers Management portal so they're able to browse and redeem available offers.

*Learn how to log in to the customer portal app*

<Steps>
  <Step title="Navigate to the Portal">
    Go to the Customer Portal using your preferred web browser.
  </Step>

  <Step title="Sign In">
    * Enter your **registered email address and password.**

    * Click on the **Sign In** button to access your account.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Access Your Dashboard">
    Once logged in, you'll land on your Dashboard.

    Here, you can:

    * View Recommended Offers curated just for you

    * Track your recent activity

    * Access personalized insights and updates
  </Step>
</Steps>

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Personalized and Trending Offers
Source: https://help-plum.xoxoday.com/offers-management/for-customers/personalized-and-trending-offers

Discover how personalized and trending offers are surfaced to customers within Plum's Offers Management portal.

*Learn about personalized and trending offers.*

This section highlights a variety of offers curated for customers, organized into different segments for easier discovery:

* **Top Picks for You:** Handpicked offers based on your preferences and activity.

<Frame>
  <img alt="" />
</Frame>

* **Offers That Might Interest You:** Suggested deals tailored to your interests.

<Frame>
  <img alt="" />
</Frame>

* **Offers Others Are Interested In:** Popular offers that are gaining attention from other users.

<Frame>
  <img alt="" />
</Frame>

* **Trending Now:** Time-sensitive and high-demand offers are currently trending on the platform.

<Frame>
  <img alt="" />
</Frame>

* **Top Brands:**

<Frame>
  <img alt="" />
</Frame>

* Favourite any of the offers by clicking on the star next to the offer.

For any questions or feedback reach out to us at [cs@xoxoday.com](mailto:cs@xoxoday.com).

Looking to drive loyalty, boost sales performance, or enhance employee engagement? [Explore Xoxoday's product suite here!](https://www.xoxoday.com/get-a-demo)


# Redemption & Validation
Source: https://help-plum.xoxoday.com/offers-management/for-customers/redemption-validation

Learn how offer redemptions are validated for customers within Plum's Offers Management portal and platform overall.

*Learn how to redeem an offer on Loopr app.*

Customers can browse and redeem a wide variety of offers available on the Loopr portal. Here's how the redemption process works:

***

## Offer Redemption

A variety of offers are available on the portal, and customers can select and redeem any offer of their choice. On the offer redemption page, three key sections are presented:

* **Offer Details:** This section displays all relevant information about the offer. Customers are encouraged to review the details before proceeding with redemption.

<Frame>
  <img alt="" />
</Frame>

* **Location/Contact:** This section provides the location details of the stores offering the deal, helping customers know where to redeem it. A "Map View" button is available clicking it shows the store's location and directions for easier navigation.

<Frame>
  <img alt="" />
</Frame>

* **Terms and Conditions:** This section outlines all the terms and conditions for redeeming the offer. Customers should read these carefully before proceeding with redemption.

<Frame>
  <img alt="" />
</Frame>

***

Offers can be redeemed in two ways: by selecting "**Redeem Now**" for immediate use, or by choosing "**Add to Wallet**" to save the offer for future redemption.

* **Redeem Now:** When customers click this button, the offer code becomes visible. This code should be presented to the retailer to receive the discount.

<Frame>
  <img alt="" />
</Frame>

<Frame>
  <img alt="" />
</Frame>

For any questions or feedback reach out to us at [cs@xoxoday.com](mailto:cs@xoxoday.com).

Looking to drive loyalty, boost sales performance, or enhance employee engagement? [Explore Xoxoday's product suite here!](https://www.xoxoday.com/get-a-demo)


# Creating and Managing Offers
Source: https://help-plum.xoxoday.com/offers-management/for-merchants/creating-and-managing-offers

Learn how merchants create and manage their offers within Plum's Offers Management portal, from setup to publishing.

*Learn all about creating offers on Loopr merchant portal*

The Offers module in the merchant portal enables admins to create, customize, and manage a wide range of promotional offers.

## Creating Offers

To create a new offer:

<Steps>
  <Step title="Click Create Offer">
    Click the "**Create Offer**" button.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Select the offer type">
    * Discount (percentage-based)

    * Fixed-value (e.g., \$10 off)

    * Free-format (custom offer format)

    * Product (physical or digital product)

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Fill in all required fields">
    After selecting the offer type, fill in all required fields across the following sections:

    * Time Zone

    * Brand Name

    * Display Title

    * Face Value (use drop-down menu to select)

    * Offer Image

    * Description

    * Voucher Code Info

    * Redemption Info

    <Frame>
      <img alt="" />
    </Frame>

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Click Create">
    Once all the details are filled in, click the "**Create**" button to save the offer.
  </Step>
</Steps>

***

## Managing Offers

The Offers module in the Loopr Merchant Portal allows you to create, manage, and optimize promotional offers. Once offers are created, you can manage them using several built-in tools and actions.

### 1. Search & Filter Offers

The Loopr Merchant Portal makes it easy to find specific offers with the help of a powerful search bar and filter system.

You can apply one or more filters to narrow down your offer list based on various attributes.

### Available Filters:

* **1.1 Offer Title** — Enter keywords or the full title of the offer to search directly by name.

* **1.2 Store** — Use the drop-down menu to select a specific store associated with the offer.

* **1.3 Location** — Filter offers by their associated location using the location drop-down list.

* **1.4 Web Portals** — Select one or more web portals through which the offer is published.

* **1.5 Offer Type** — Choose from the following types:

  * Discount

  * Fixed Value

  * Free Format

  * Product

* **1.6 Status** — Filter offers based on their current status:

  * Published

  * Unpublished

  * Publishing

  * Expired

  * Draft

* **Expiry Date** — Use the calendar UI to select a date or range for when the offer is set to expire.

<Frame>
  <img alt="" />
</Frame>

***

## 2. Actions Available for Each Offer

For every offer listed, the following actions are available:

### 2.1 View

* Navigate to the offer and click on **View** next to the offer.

<Frame>
  <img alt="" />
</Frame>

<Frame>
  <img alt="" />
</Frame>

### 2.2 Edit

* Modify offer content, validity, T\&Cs, images, or any associated settings.

* Navigate to the offer and click on the **pencil icon** next to the offer.

<Frame>
  <img alt="" />
</Frame>

* Edit the details and click "**Save**" to proceed.

<Frame>
  <img alt="" />
</Frame>

### 2.4 Delete

* Remove an outdated or inactive offer from the platform.

* Navigate to the offer. Click on the **delete icon** next to the offer.

<Frame>
  <img alt="" />
</Frame>

* A confirmation pop-up will appear. Click "**Confirm**" to permanently delete the offer.

<Frame>
  <img alt="" />
</Frame>

<Info>
  Note: Deletion may require confirmation and cannot be undone.
</Info>

### 2.5 Detail

* Navigate to the Offers Module — From the dashboard, go to Offers.

* Click on the "**Detail**" Button — Next to the offer you want to analyze, click "Detail" to open the offer performance page.

<Frame>
  <img alt="" />
</Frame>

* Once inside the detail view, you'll see a complete breakdown of the offer's activity, including:

  * Claimed – Number of times the offer was claimed

  * Redeemed – Number of times it was successfully redeemed

  * Favourited – How many users marked it as a favorite

  * User Feedback – Comments or ratings submitted by users

* You can also filter this data by:

  * Source (e.g., Web, App, Partner Portal)

  * Customer ID

  * Status (e.g., Claimed, Redeemed, Expired)

  * Claimed Time (using the calendar filter)

<Frame>
  <img alt="" />
</Frame>

* **Exporting the Offer Data** — To export the tracked data: Scroll to the bottom of the page. Click on the **Download icon** to export the list as a report.

<Frame>
  <img alt="" />
</Frame>

### 2.6 Share

Generate a shareable link or code to distribute the offer through your desired marketing channels.

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Customer Module
Source: https://help-plum.xoxoday.com/offers-management/for-merchants/customer-module

Get an overview of the customer module available to merchants within Plum's Offers Management portal and its features.

*Learn how to Create, View, and Manage Customers*

This section displays a customer list that merchants can use to send offers.

Navigate to **Customers** on the left hand of the dashboard.

<Frame>
  <img alt="" />
</Frame>

***

## Search for customers

The Customers module allows merchants to search, filter, and export customer data. It also enables you to target specific users for personalized offers.

### How to Search for Customers:

* Use the search bar and filters to narrow down the customer list. You can search by:

  * Customer Name

  * Email Address

  * Registered Mobile Number

  * Redemption Date

  * Birthday Start and End Date

This makes it easy to find the right customer or group of customers for communication or promotional campaigns.

***

## Adding a customer

Customers can be added in two ways: manually or through bulk upload.

**Method 1: Manually Adding**

* Click "**Add Customer**" at the top of the Customers page.

<Frame>
  <img alt="" />
</Frame>

* Fill in details (name, email, mobile, birthday). Once done, Click "**Save**".

<Frame>
  <img alt="" />
</Frame>

**Method 2: Upload Customers in Bulk**

* Click the "**Upload Customers**" icon.

<Frame>
  <img alt="" />
</Frame>

<Frame>
  <img alt="" />
</Frame>

* Upload the file. You can also download the sample template for reference.

***

## Managing Customers

In the Customers module, you can view, edit, or delete individual customer records.

**View a Customer**

* Go to the Customers page.

* Find the customer in the list and click the "View" icon next to their name.

<Frame>
  <img alt="" />
</Frame>

* You'll see:

  * Full customer details

<Frame>
  ![](https://xoxoday-cc4bb9b9ac3a.intercom-attachments-1.com/i/o/qgtvujy1/1873252120/25a1caf260bcce4bcc03f41e4386/51e2bd36756d8f4a95d3462001507efdefcceb3d2d48bd71b251bb2a46905b06-Screenshot_2025-07-10_at_11_36_09_AM.png?expires=1776816000\&signature=a97140d3e9a26d676f06715298ed1c30b16cf986c44cdfcd0e01d5325e91fe8e\&req=dSggFct7n4BdWfMW3nq%2BgeC0OKjNwmqxR4kfW4nmtqACyZoiGNh%2FjZm2r%2FL0%0AAUfCt2E9NSta3inZEz8hj%2FkM1gM%3D%0A)
</Frame>

* A tracking section showing offers claimed, redeemed, or favourited by the customer

<Frame>
  ![](https://xoxoday-cc4bb9b9ac3a.intercom-attachments-1.com/i/o/qgtvujy1/1873252138/150e7c50563725e213c9078f6ea8/1d7c568edaf7a3654186bb5222bc775cfc40716ed752658a8f0349d0f4ba7515-Screenshot_2025-07-10_at_11_36_19_AM.png?expires=1776816000\&signature=6e20fac342edd01c3b4ae334aa47a6f18ba2065d6476d3b3e9ff88d38b4ed145\&req=dSggFct7n4BcUfMW3nq%2BgS2YvgfORQU6ihjoWHzJdYcLqmPOHB%2BndrR056tg%0ALWKje92XNEDjjaWLd8hcJ4zJAu8%3D%0A)
</Frame>

**Edit a Customer**

* Click the "**Edit**" icon next to the customer name.

<Frame>
  <img alt="" />
</Frame>

* Update any required details (e.g., email, phone, birthday).

* Click "**Save**" to apply changes.

<Frame>
  <img alt="" />
</Frame>

**Delete a Customer**

* Click the "**Delete**" icon next to the customer name.

<Frame>
  <img alt="" />
</Frame>

* A confirmation pop-up will appear.

* Click "**Confirm**" to delete the customer.

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# History Module
Source: https://help-plum.xoxoday.com/offers-management/for-merchants/history-module

Learn how merchants can view a complete history of their offer activity within Plum's Offers Management portal.

*Learn all about checking history on the Merchant platform.*

The History module allows you to view a detailed record of offer activity, including claims and redemptions.

## How to Access

* From the main menu, click on "**History**" in the left-side navigation panel.

<Frame>
  <img alt="" />
</Frame>

***

## What You Can Do:

Once inside the History module, you can:

**Search & Filter Offer Activity**

Use filters to refine your search results based on:

* Offer Title

* Status

  * Claimed

  * Redeemed

<Frame>
  ![](https://xoxoday-cc4bb9b9ac3a.intercom-attachments-1.com/i/o/qgtvujy1/1873258281/631ca57158120c4d575f66d639cf/7a321fa5b458632c3ec740b09d461578b690e8ea9400aea42bc532191b3def67-Screenshot_2025-07-10_at_1_05_53_PM.png?expires=1776816000\&signature=bc709ef399d6aa0feef258f3762f3b9cf5cb84891c8a5b1fdbf4d3c406dbc0c9\&req=dSggFct7lYNXWPMW3nq%2BgT8HGZSUD5%2BwfcpUjepQgSck5sZxZjYCjdwWFCOf%0AGJ7t5m3CA%2FTxvpd%2B1lNgXo%2FMXY0%3D%0A)
</Frame>

* Source

  * Web Portal

  * Merchant

<Frame>
  <img alt="" />
</Frame>

* Stores — Select specific store(s) from the dropdown list

* Voucher Code — Add the particular voucher code

* Offer Type

  * Discount

  * Fixed Value

  * Free Format

  * Product

<Frame>
  ![](https://xoxoday-cc4bb9b9ac3a.intercom-attachments-1.com/i/o/qgtvujy1/1873258303/41ad56d5410199c116c629cf2e27/0682ba3820cead423c3bed338e6de90db9166886c4eff206225a79017e107679-Screenshot_2025-07-10_at_1_06_20_PM.png?expires=1776816000\&signature=ba1a929f1ed34f435d0779b9347fe85856f927d1fbf3b0787f781e92d8cd8a9a\&req=dSggFct7lYJfWvMW3nq%2BgaH6447TLTdhpI%2B2I7G5bHHK%2BN7TR5hg98kbSul8%0AJK09afYa%2B%2FUtNBu6nEyJsGk6sy0%3D%0A)
</Frame>

* Date and Time — Select the date and time using the calendar.

Use multiple filters together for more specific results.

**View History Records**

* Browse the list of activity logs showing the time, user, store, and offer details.

* Each record provides visibility into how and where an offer was claimed or redeemed.

<Info>
  This helps merchants track campaign performance and customer engagement across channels.
</Info>

**Export History**

Click on "**Export List**" to download the list.

<Frame>
  <img alt="" />
</Frame>

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Overview
Source: https://help-plum.xoxoday.com/offers-management/for-merchants/offer-management-for-merchants

Get an overview of the Offers Management portal from a merchant's perspective, covering the key features available.

*Learn how to login to the merchant dashboard*

## Accessing the Merchant Portal

Follow the steps below to log in and navigate through the main dashboard of the Merchant Portal.

## Steps to Log In:

<Steps>
  <Step title="Navigate to the Merchant Portal">
    Open your browser and go to the Merchant Portal URL.
  </Step>

  <Step title="Enter Admin Credentials">
    * Input your username and password

    * Click "Sign In"

    <Info>
      Upon successful login, you'll be directed to the Dashboard.
    </Info>

    <Frame>
      <img alt="" />
    </Frame>
  </Step>
</Steps>

***

## Dashboard Overview

Once on the dashboard, you'll see the following key elements:

## Language & Notifications

* Language Dropdown: Located at the top right, allowing you to switch between supported languages.

<Frame>
  <img alt="" />
</Frame>

* Notification Icon: Also at the top right, to view important updates and alerts.

***

## Module Access Buttons

You'll find quick-access buttons for different modules such as:

* Home

* Offers

* Customers

* Stores

* History

* Reports

* Approvals

* Settings

* Redemptions

And more, depending on your permissions.

Each module provides tools for managing specific parts of your merchant operations.

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Account Settings
Source: https://help-plum.xoxoday.com/offers-management/for-merchants/settings/account-settings

Learn how merchants manage their account settings and preferences within Plum's Offers Management merchant portal.

Merchants can easily manage their personal or business account information from the Account Settings section.

## How to Access

* Go to "**Settings**" from the left-hand menu.

* Click on the "**Account**" tab from the dropdown.

<Frame>
  <img alt="" />
</Frame>

***

## View Account Details

* Your account details (name, email, business info, etc.) will be displayed for review.

***

## Edit Account Information:

* Click "**Edit Account**" on the top right.

<Frame>
  <img alt="" />
</Frame>

* Make the necessary changes to your personal or business details.

<Frame>
  <img alt="" />
</Frame>

<Frame>
  <img alt="" />
</Frame>

* Once done, click "**Submit Approval**" to save the updates.

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Overview
Source: https://help-plum.xoxoday.com/offers-management/for-merchants/settings/settings

Get an overview of all the settings and configuration options available to merchants within Plum's Offers Management portal.

*Learn how to manage Settings*

The Settings module allows Admins to efficiently manage account details, subscription preferences, and password security.

It includes three key sub-sections:

1. Account

   * To manage your profile information

2. Subscription

   * To view and manage your subscription plan

3. Password

   * To update your login credentials securely

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Subscription
Source: https://help-plum.xoxoday.com/offers-management/for-merchants/settings/subscription

Learn how merchants can view and manage their subscription plan and billing details within Plum's Offers Management portal.

The Subscription section provides visibility into all active and past subscription records tied to your budget and usage. Merchants can manage multiple packages based on their needs.

## How to Access

* Navigate to **"Settings**" from the left-hand menu.

* Click on **"Subscription"** from the dropdown.

<Frame>
  <img alt="" />
</Frame>

***

## View All Subscription Records

See a list of all your active and historical subscriptions, along with their current status (active, expired, etc.)

***

## Select a Package

* At the top of the page, click on the "**Packages**" dropdown.

<Frame>
  <img alt="" />
</Frame>

* Choose from the available subscription packages as per your business needs.

<Frame>
  <img alt="" />
</Frame>

<Info>
  This helps manage budgets and optimize platform usage effectively.
</Info>

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Stores Module
Source: https://help-plum.xoxoday.com/offers-management/for-merchants/stores-module

Learn how merchants manage individual store locations and their details within Plum's Offers Management portal.

*Learn all about setting up, maintaining and updating store information*

This section allows you to **create, view, edit, and manage** all store-related information from one place.

## Accessing Store Management

Navigate to "Stores" from the left menu on the dashboard.

* On the Stores page, you can:

  * Search for stores

  * Create new stores

  * Edit store details

  * View store profiles

  * Update store PINs

<Frame>
  ![](https://xoxoday-cc4bb9b9ac3a.intercom-attachments-1.com/i/o/qgtvujy1/1873254240/002626711c3c28deef960b452328/6bd0a18e8c46043c0d2f1cadfd5bcbdc60b035dc561fd26e8f55e8cd24a27da0-Screenshot_2025-07-10_at_12_03_51_PM.png?expires=1776816000\&signature=dc51658ca97a691eb78905316beeb11b29a1ba6f8e440621816b974cd8ebb268\&req=dSggFct7mYNbWfMW3nq%2BgbUHNxvtOgZxDQ8RDO4rG%2FjPahT8vNJ3VwA2SuB5%0Acq2vKBRklvCaRMrsOHR%2FZ2aiH1g%3D%0A)
</Frame>

***

## Search for a Store

* Use the search bar at the top to look up a store by name.

<Frame>
  <img alt="" />
</Frame>

***

## Create a New Store

* Click "Create Store" at the top left of the Stores page.

<Frame>
  <img alt="" />
</Frame>

* Fill in the following fields:

  * Store Name

  * Address

  * Email Login

  * Email

  * Phone Number

  * Opening Hours

  * Website (optional)

  * Facebook (optional)

<Frame>
  ![](https://xoxoday-cc4bb9b9ac3a.intercom-attachments-1.com/i/o/qgtvujy1/1873254265/de3893dea26b0652aa8070769168/af735b2ac2eb58ce564d5f6e01ddf80c5b5cd58d4415f8457d8ab688bcf33d2e-Screenshot_2025-07-10_at_12_04_31_PM.png?expires=1776816000\&signature=fbb8512eb3044fbf5d0b35f50cd20447c710cbed7811e47e2fe098b3e293f794\&req=dSggFct7mYNZXPMW3nq%2BgQ6C8kaA0V%2Bx0HwwXyCWWUxk6E9ClVILSo5EReUG%0AaH0s4qGzgf968daIS2%2BfteYfU3k%3D%0A)
</Frame>

<Frame>
  <img alt="" />
</Frame>

* Click "Create" to add the new store to the list.

<Info>
  The store will now be visible and available for offer mapping and tracking.
</Info>

***

## Managing Stores

**View a Store**

* Find the store in the list.

* Click the "View" icon next to it to see full details like address, contact info, opening hours, and linked accounts.

<Frame>
  <img alt="" />
</Frame>

**Edit Store Details**

* Click the "Edit" icon beside the store name.

<Frame>
  <img alt="" />
</Frame>

* Update the required fields (e.g., address, phone, email).

<Frame>
  <img alt="" />
</Frame>

* Click "Save" to confirm changes.

**Update Store PIN**

* Click "**Update PIN**" next to the store.

<Frame>
  <img alt="" />
</Frame>

* Enter the new PIN and click "**Confirm**."

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Viewing Reports
Source: https://help-plum.xoxoday.com/offers-management/for-merchants/viewing-reports

Learn how merchants can view detailed performance reports for their offers within Plum's Offers Management portal.

*Learn to view reports on the merchant portal*

Merchants can access detailed offer performance insights through the Reports section.

## Accessing Reports

* Go to "**Reports**" from the left-hand side (LHS) menu.

<Frame>
  <img alt="" />
</Frame>

***

## Overview

The report overview displays:

* Offers Claimed

* Offers Redeemed

* Redeemed vs. Claimed (with a graphical comparison chart below)

***

## Date Range Options

* Select from:

  * Today

  * Yesterday

  * Last 7 Days

  * This Month

<Frame>
  ![](https://xoxoday-cc4bb9b9ac3a.intercom-attachments-1.com/i/o/qgtvujy1/1873260694/575111c2beeb303663969709c036/1afc127dc47d7ce2593c03cf4a8303ea15372f0a46450e24f9fa0ac8fbbd52b4-Screenshot_2025-07-10_at_7_12_51_PM.png?expires=1776816000\&signature=8ba4b04a209f9aac6315313df4b89bc9814e4fabde1ab25f6d3d674907972038\&req=dSggFct4nYdWXfMW3nq%2BgRYnY1F82Vr%2BNhNBST%2FIn6RqVdZXSMrqMYzPo2C9%0ApnIDmxdAW6wlkujK2IUtjhQavX4%3D%0A)
</Frame>

***

## Redeemed Vs Claimed

The data for Redeemed Vs Claimed is also depicted as a graph

<Frame>
  <img alt="" />
</Frame>

* Use the Available Filters — You can filter the report data by:

  * Date – View by day or month using the drop down which can be either month or day.

<Frame>
  <img alt="" />
</Frame>

* Offers – Filter for all offers or select specific ones

<Frame>
  <img alt="" />
</Frame>

* Source – Choose between Web Portal or Merchant

<Frame>
  <img alt="" />
</Frame>

* Store Name – Select a specific store from the list

<Frame>
  <img alt="" />
</Frame>

<Info>
  Filtered data is reflected in both the numeric summary and the graphical view below for deeper analysis.
</Info>

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# History
Source: https://help-plum.xoxoday.com/offers-management/history

Learn how to view the history of actions taken in Plum's Offers Management portal, useful for audits and troubleshooting.

*Learn how to view, export and sort Offer History*

Follow the steps to view, export and sort offer history:

* Navigate to **History tab** on the LHS of the dashboard.

<Frame>
  <img alt="" />
</Frame>

***

## To access and manage the list of offers, follow these steps:

### Access Redemption History

<Steps>
  <Step title="Click on History">
    Click on "**History**" from the left-hand side (LHS) menu. This will take you to the Offer History page.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>
</Steps>

***

## What You Can View

On the Offer History page, you can view details for each redeemed offer, including:

* Offer Name

* Redemption Date

* Offer Type

* Voucher Code

* Web Portal

* Merchant Name

* Status

<Frame>
  <img alt="" />
</Frame>

***

## Filter the History List

You can narrow down the results using the following filters:

* Web Portal

* Merchant Name

* Offer

* Voucher Code

* Customer ID

* Offer Type

* Status

* Time Range

After selecting the relevant filters, click **Search** to view filtered results.

<Frame>
  <img alt="" />
</Frame>

***

## Export the Report

To download the redemption history:

* Click on the **"Export Report"** button (see below image, if applicable).

* The report will be downloaded as an Excel file.

<Info>
  Use the export feature for record-keeping, audits, or further analysis.
</Info>

<Frame>
  <img alt="" />
</Frame>

***

## Sort Listing

**To sort the list of offers:**

* Locate the column header you want to sort by (e.g., Offer Name, Date, Status).

* Click on the **up/down arrow** icon next to the column header.

* On click, the list will be sorted in ascending or descending order, based on the selected column.

* Click the arrow again to toggle between ascending and descending order.

* This helps you quickly organize data for better visibility and analysis.

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Logging in
Source: https://help-plum.xoxoday.com/offers-management/logging-in

Learn how to log in to the Plum Offers Management portal, including what to do if you run into any login or access issues.

*Learn how to log in to the dashboard*

This guide provides step-by-step instructions for logging into the Offer Management modules Admin Portal as an administrator.

<Steps>
  <Step title="Access the Admin Portal">
    Open your preferred web browser and go to the **Admin login URL:** [https://stage.giift.com/giiftbox/GiiftBoxewards/admin/#/landing](https://stage.giift.com/giiftbox/GiiftBoxewards/admin/#/landing)
  </Step>

  <Step title="Enter Login Credentials">
    On the login screen, enter your **administrator credentials:**

    **Email Address:** [name.admin@giift.com](mailto:name.admin@giift.com)

    * Password: 123456 (example password)

    <Info>
      Please Note: Ensure you use your actual admin credentials provided by the system administrator. The above is just a sample.
    </Info>
  </Step>

  <Step title="Click Sign In">
    After entering your credentials, click the "**Sign In**" button to access the admin dashboard.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Troubleshooting Tips">
    * Forgot Password? Use the "Forgot Password" option to reset.

    * Security Tip: Never share your login credentials with unauthorized users.

    * Need Help? Contact your system administrator or [cs@xoxoday.com](mailto:cs@xoxoday.com) for any issues.
  </Step>
</Steps>

Looking to drive loyalty, boost sales performance, or enhance employee engagement? [Explore Xoxoday's product suite here!](https://www.xoxoday.com/get-a-demo)


# Merchants
Source: https://help-plum.xoxoday.com/offers-management/merchants

Learn how to manage merchant records within the Plum Offers Management portal, including adding and updating merchant details.

*Learn how to create and manage merchants on Offer Management module*

This module allows Admins to efficiently onboard, manage, and organize merchants and their associated stores.

## Overview

The Merchants module empowers admins to:

* Create new merchants

* View, search, and filter existing merchants

* Edit merchant details

* Export merchant lists

* Manage merchant stores

***

## Accessing the Merchant List

Admins can access a full list of onboarded merchants from the Merchants module. Here, they can:

* Search for merchants using filters (e.g., name, country, status)

* Edit merchant details directly

* Export the complete list in CSV or Excel format

<Frame>
  <img alt="" />
</Frame>

***

## Creating a New Merchant

To create a new merchant:

<Steps>
  <Step title="Click Create Merchant">
    Click the "Create Merchant" button.

    <Frame>
      <img alt="" />
    </Frame>

    Fill in the required fields in the form:

    * Merchant Name

    * Country

    * Contact Information

    * Business Category, etc.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Click Create">
    Click "Create" to onboard the merchant.

    Once saved, the merchant will appear in the list.
  </Step>
</Steps>

***

## Managing Stores Under a Merchant

To manage stores:

<Steps>
  <Step title="Click on a merchant's name">
    Click on a merchant's name and under it under actions click on the details:

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Navigate to the Store Details section">
    From here, you can:

    * View existing stores

    * Edit store information

    * Update Store PINs

    * Create new stores

    <Frame>
      <img alt="" />
    </Frame>
  </Step>
</Steps>

***

## Creating a Store

* Click the "**Create Store**" button.

<Frame>
  <img alt="" />
</Frame>

* Fill in the required store details:

  * Store Name

  * Address

  * Store PIN (if applicable)

  * Country/Location and more

<Frame>
  <img alt="" />
</Frame>

* Click "**Save**" to add the store.

<Frame>
  <img alt="" />
</Frame>

The store will now be listed under the merchant and available for further actions.

***

## Store Management Actions

In the Store Action Table, you can:

* View full store information

* Edit store details

* Update store PINs securely

<Frame>
  <img alt="" />
</Frame>

<Info>
  Tip: Regularly update store PINs for improved security.
</Info>


# Offer Management
Source: https://help-plum.xoxoday.com/offers-management/offer-management-product-tour-videos

Watch a collection of product tour videos covering the features and workflows of Plum's Offers Management portal.

Overview: Manage the entire ecosystem from a single dashboard. This walkthrough demonstrates how administrators can oversee merchant onboarding, configure platform-wide settings, and access high-level analytics to monitor program health and performance.

<iframe title="Supademo walkthrough" />

***

## Merchant Experience

Overview: See how merchants can self-serve and drive their own growth. This video covers the end-to-end merchant workflow, including:

* Creating Offers: Designing custom vouchers and setting redemption rules.

* Campaign Management: targeting specific customer segments and sending offers.

* Performance Tracking: Viewing claim history, redemptions, and detailed reports.

<iframe title="Supademo walkthrough" />

***

## Customer Experience

Overview: Understand the user journey from discovery to redemption. This demo shows how customers interact with the platform to browse available offers, claim rewards, and seamlessly redeem them at the point of sale using their digital vouchers.

<iframe title="Supademo walkthrough" />

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Create an offer
Source: https://help-plum.xoxoday.com/offers-management/offers/create-an-offer

Learn how to create a new merchant offer in Plum's Offers Management portal, from initial setup through publishing it live.

*Learn how to create offers*

The Offers module in the admin portal enables admins to create, customize, and manage a wide range of promotional offers.

## Creating Offers

To create a new offer:

<Steps>
  <Step title="Click Create Offer">
    Click the "**Create Offer**" button.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Select the offer type">
    * Discount (percentage-based)

    * Fixed-value (e.g., \$10 off)

    * Free-format (custom offer format)

    * Product (physical or digital product)

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Fill in all required fields">
    After selecting the offer type, fill in all required fields across the following sections:

    * Time Zone

    * Brand Name

    * Display Title

    * Face Value (use drop-down menu to select)

    * Offer Image

    * Description

    * Voucher Code Info

    * Redemption Info

    <Frame>
      <img alt="" />
    </Frame>
  </Step>
</Steps>


# Offers - Overview
Source: https://help-plum.xoxoday.com/offers-management/offers/offers-overview

Get an overview of how merchant offers are managed within Plum's Offers Management portal, from creation to tracking.

*The Offers module allows admins to create, search, and manage offers within the admin portal.*

## Key Capabilities on the Offers Page

## 1. Create Offers

## 2. Search & Filter Offers

## 3. Manage Offers

Once offers are listed, you can perform the following actions from the Action Table:

* **Edit:** Update any offer details

* **View:** See full offer information

* **Delete:** Remove an offer permanently

* **Details / Track Offer:** View offer performance, usage metrics, and status history

For any questions or feedback reach out to us at [cs@xoxoday.com](mailto:cs@xoxoday.com).

Looking to drive loyalty, boost sales performance, or enhance employee engagement? [Explore Xoxoday's product suite here!](https://www.xoxoday.com/get-a-demo)


# Search and Filter Offers
Source: https://help-plum.xoxoday.com/offers-management/offers/search-and-filter-offers

Learn how to search and filter offers within Plum's Offers Management portal to quickly find the one you're looking for.

*Learn how to search and filter offers*

The Search Status Card allows you to filter and search for specific offers using the following filters:

* **Offer Name** — Enter the name of the offer you wish to search for.

* **Merchant Name** — Select from a list of merchants using the dropdown icon.

* **Areas** — Filter offers based on location.

* **Web Portals** — Choose the relevant web portal associated with the offer.

* **Offer Type** — Select the type of offer (e.g., Fixed, Percentage, etc.).

* **Status** — Filter by offer status:

  * Unpublished

  * Unpublishing

  * Published

  * Publishing

  * Expired

  * Draft

* **Expiry Before** — Use the calendar icon to select a date and filter offers expiring before that date.

<Frame>
  <img alt="" />
</Frame>


# Password
Source: https://help-plum.xoxoday.com/offers-management/password

Learn how to reset or update your password in Plum's Offers Management portal if you're locked out or want to change it.

*Learn how to reset password*

## Password Management

Admins and users can update or reset their passwords through the Password section in the Settings module. This helps ensure secure access to the platform and maintain data integrity.

***

## To Update or Reset Your Own Password:

<Steps>
  <Step title="Navigate to the Password Page">
    Click "**Password**" from the left-side menu under Settings.
  </Step>

  <Step title="Enter Password Details">
    * Current Password: Input your existing password

    * New Password: Enter a new password

    * Confirm New Password
  </Step>

  <Step title="Click Save">
    Once all fields are filled correctly, click "**Save**" to reset your password.

    <Frame>
      <img alt="" />
    </Frame>

    Your password will be updated successfully.
  </Step>
</Steps>

***

## Admin-Initiated Password Reset

* For security purposes, Admins can reset any user's password. This ensures continued access and protects the system from unauthorized use.

<Info>
  Note: It's recommended to set a strong password with a mix of uppercase, lowercase, numbers, and symbols.
</Info>

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Reports Overview
Source: https://help-plum.xoxoday.com/offers-management/reports/reports-overview

Get an overview of the reporting features available in Plum's Offers Management portal, including what each report covers.

*Learn all about the reports module*

Loopr provides comprehensive reporting to help you track and analyze your offers and portal activity.

* Click on "**Reports**" from the left-hand side menu.

<Frame>
  <img alt="" />
</Frame>

***

## On the Reports page, you can:

* **Quick Sort** — Quickly sort reports by Most Recent to see the latest activity at a glance.

* **Filter by Time Frame** — Select a specific date range to view data for that period.

* **Filter by Offer** — View detailed data for an individual offer to track performance.

* **Filter by Web Portal** — Access data for each web portal separately to monitor portal-specific engagement.

Offer Management's reporting tools empower you to make data-driven decisions and optimize your campaigns.

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Viewing Reports & Insights
Source: https://help-plum.xoxoday.com/offers-management/reports/viewing-reports-insights

Learn how to view reports and performance insights in Plum's Offers Management portal to track offer effectiveness.

*Learn how to view reports and insights*

## Report Types Available

Loopr offers three key types of reports to help you track user engagement and campaign effectiveness:

* **Redeemed vs. Claimed Report** — Compare how many offers have been claimed vs. how many have been redeemed. This helps you identify which offers are being acted upon and which might need attention.

* **Anonymous Click Report** — Track clicks from users who have interacted with the offers but haven't logged in or provided identifiable details. Useful for measuring interest from new or guest users.

* **User Landing Page Report** — Understand how users are landing on your offer pages. This gives insight into traffic sources and campaign reach.

<Frame>
  <img alt="" />
</Frame>

***

## Filters & Customization Options

To help you zero in on specific insights, Reports come with powerful filtering options:

### Date Filters

You can select from the following predefined time ranges:

* Today

* Yesterday

* Last 7 Days

* This Month

You can also select a custom date or specific day to analyze targeted periods.

<Frame>
  <img alt="" />
</Frame>

### Filter Parameters

Further refine your data using the following filters:

* Day / Month

* Offer Name

* Source (e.g., Web Portal, Merchant, Campaign)

* Merchant Name

This flexibility allows Admins to view data based on campaign type, origin, or time period—giving a clear picture of what's working and where optimizations are needed.

***

## How to Use the Reports Section

<Steps>
  <Step title="Navigate to Reports">
    Navigate to **Reports** from the dashboard.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Choose the type of report">
    Choose the type of report you want to view (**Redeemed vs. Claimed, Anonymous Clicks, or User Landing Page**).
  </Step>

  <Step title="Apply the date range">
    Apply the **date range** from the top filter panel.
  </Step>

  <Step title="Use dropdown filters">
    Use dropdown filters for Offer Name, Source, Merchant, or specific Days/Months.
  </Step>

  <Step title="View or export the data">
    View or export the data as needed. Click "**Export Report**".

    <Frame>
      <img alt="" />
    </Frame>
  </Step>
</Steps>

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Activate a deactivated user
Source: https://help-plum.xoxoday.com/offers-management/settings/roles/activate-a-deactivated-user

Learn how to reactivate a previously deactivated user in Plum's Offers Management portal and restore their access.

*Learn how to activate a deactivated user*

Admins can bring back access for users who were previously deactivated.

## Steps to Reactivate an Existing User:

<Steps>
  <Step title="Click the Active Button">
    Click "**Active**" next to the user's name.
  </Step>

  <Step title="Confirm Reactivation">
    A confirmation pop-up will appear. Click "**Confirm**" to proceed.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>
</Steps>

### User Reactivated

* The user's status will change to "Active", and they will regain access to the platform.

<Info>
  Note: Only users with a "Disactive" status can be reactivated.
</Info>

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Add a new user
Source: https://help-plum.xoxoday.com/offers-management/settings/roles/add-a-new-user

Learn how to add a new user to Plum's Offers Management portal and assign them the appropriate role and access level.

*Learn how to add users & assign roles*

Easily create new user accounts and assign them appropriate roles such as Admin, Checker, or Maker to manage platform access.

Admins can add new users to the platform through the **Settings > Roles section**.

## Steps to Add a New User:

<Steps>
  <Step title="Navigate to the Roles Landing Page">
    Go to the Settings module and click on Roles.
  </Step>

  <Step title="Click Add User">
    On the top right of the Roles page, click the "**Add User**" button.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Fill in User Details">
    A form will appear. Enter the following required information:

    * **Name**: Full name of the user

    * **Password**: Set a secure password for login

    * **Role**: Select a role from the dropdown (e.g., Admin, Approver, Maker)

    User role currently available for selection: Admin, Checker, Maker

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Save">
    Once all fields are filled, click "**Ok**" to create the new user account.
  </Step>
</Steps>

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Deactivate existing user
Source: https://help-plum.xoxoday.com/offers-management/settings/roles/deactivate-existing-user

Learn how to deactivate an existing user in Plum's Offers Management portal without permanently deleting their account.

*Learn how to deactivate an existing user*

Admins can deactivate users who no longer need access to the platform. This helps maintain security and ensures only relevant users have active access.

## Steps to Deactivate a User:

<Steps>
  <Step title="Navigate to the Roles Landing Page">
    Go to Settings > User
  </Step>

  <Step title="Find the User to Disable">
    Locate the user with "**Active**" status in the user list.
  </Step>

  <Step title="Click Deactivate">
    Click the "**Disable**" button next to the user's name.
  </Step>

  <Step title="Confirm Action">
    A confirmation pop-up window will appear. Click "**Confirm**" to proceed.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>
</Steps>

### User Deactivated

* The user's status will be updated to "Inactive", and they will no longer be able to log in.

<Info>
  Note: Only users with "Active" status can be deactivated.
</Info>

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Delete a user
Source: https://help-plum.xoxoday.com/offers-management/settings/roles/delete-a-user

Learn how to permanently delete a user from Plum's Offers Management portal, removing their access entirely and for good.

*Learn how to delete a user*

Admins can permanently delete a user from the system when they no longer require access or if the account is no longer needed.

## Steps to Delete a User:

<Steps>
  <Step title="Navigate to the Roles Landing Page">
    Go to Settings > Roles.
  </Step>

  <Step title="Locate the User">
    Find the user you wish to delete from the user list.
  </Step>

  <Step title="Click Delete">
    Click the "**Delete**" button next to the user's name.
  </Step>

  <Step title="Confirm Deletion">
    A confirmation pop-up will appear. Click "**Confirm**" to proceed.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>
</Steps>

## User Deleted

* The user will be permanently removed from the platform

<Info>
  Note: Deletion is irreversible. Only users no longer in use should be deleted.
</Info>

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Edit a User
Source: https://help-plum.xoxoday.com/offers-management/settings/roles/edit-a-user

Learn how to edit an existing user's details, role, and permissions in Plum's Offers Management portal settings.

*Learn how to edit a user*

Admins can edit a user by editing their status.

## Steps to Reactivate a User:

<Steps>
  <Step title="Click the Edit Button">
    Click "**Edit**" next to the user's name.
  </Step>

  <Step title="Edit and Save">
    Edit the Name and Role and click on **"Ok"**

    <Frame>
      <img alt="" />
    </Frame>
  </Step>
</Steps>

For any questions or feedback reach out to us at [cs@xoxoday.com](mailto:cs@xoxoday.com).

Looking to drive loyalty, boost sales performance, or enhance employee engagement? [Explore Xoxoday's product suite here!](https://www.xoxoday.com/get-a-demo)


# Roles Landing Page
Source: https://help-plum.xoxoday.com/offers-management/settings/roles/roles-landing-page

Get an overview of the user roles available in Plum's Offers Management portal and what each role is permitted to access.

*Learn about the Roles Landing Page*

## Accessing Roles:

* To access the user role management page, click "Role" on the left menu

* On clicking "Role" on the left menu, directs to the user role management page

***

## For user role management page:

* View user roles and their access

* View listing of existing user

* Create new user

* Edit existing user

* Disable existing user

* Delete existing user

* Activate disabled user

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Viewing User Roles and Access Permissions
Source: https://help-plum.xoxoday.com/offers-management/settings/roles/viewing-user-roles-and-access-permissions

Learn how to view existing user roles and their associated access permissions in Plum's Offers Management portal settings.

The Roles Landing Page allows Admins to view all user roles and understand the permissions assigned to each role.

## Steps to View User Roles:

<Steps>
  <Step title="Go to the Roles Landing Page">
    Navigate to the Settings module and select Roles from the sidebar.
  </Step>

  <Step title="Click View Roles">
    On the Roles page, click the "View Roles" button.
  </Step>

  <Step title="View Role Details">
    A list of all available user roles will be displayed. For each role, you can see:

    * Role Name (e.g., Admin, Approver, Maker)

    * Features and Functions Accessible under that role

    * Access Type (View/Edit/Approve/Reject)

    This helps Admins manage platform security and assign the right level of access to each user based on their responsibilities.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>
</Steps>

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Settings - Overview
Source: https://help-plum.xoxoday.com/offers-management/settings/settings-overview

Get an overview of the settings available in Plum's Offers Management portal, covering roles, feedback, and configuration.

*Learn how to manage platform configurations, users, and security preferences efficiently.*

The Settings module allows Admins to manage platform configurations, users, and security preferences efficiently.

***

## 1. Roles Landing Page

Manage user roles and permissions to control who can access and perform specific actions on the platform.

Key Actions:

* View existing roles

* Add new roles

* Assign or modify permissions for each role

* Delete or update roles

***

## 2. User Feedback Landing Page

Capture and manage user feedback to improve platform experience and functionality.

Key Actions:

* View submitted feedback from users

* Filter feedback by date, type, or status

* Mark feedback as addressed or in-progress

* Export feedback reports

***

## 3. Password Landing Page

Set up and manage password policies to ensure secure access to the platform.

Key Actions:

* Define password strength and expiry rules

* Set up multi-factor authentication options (if applicable)

* Reset user passwords

* View login history and password change logs

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Add new user feedback
Source: https://help-plum.xoxoday.com/offers-management/settings/user-feedback/add-new-user-feedback

Learn how to add new user feedback in Plum's Offers Management portal to capture and track input from your team.

*Learn how to add a new user feedback*

Admins can easily add new feedback options to better capture user insights and sentiments.

## Steps to Add a New Feedback Option:

<Steps>
  <Step title="Navigate to the User Feedback Page">
    Go to Settings > User Feedback from the left menu.
  </Step>

  <Step title="Click Add Feedback Content">
    On the User Feedback Management Page, click the "**Add Feedback Content**" button.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Fill in the Feedback Details">
    A pop-up or overlay window will appear with input fields.

    * **Input the Feedback:** Type the content of the feedback option (e.g., "Great experience", "Needs improvement").

    * **Set Sorting Sequence:** Enter a number to define the order in which this option will appear in the list (e.g., 1, 2, 3...).
  </Step>

  <Step title="Click Save">
    Once the information is entered, click "**Save**" to add the new feedback option to the system.

    <Frame>
      ![](https://xoxoday-cc4bb9b9ac3a.intercom-attachments-1.com/i/o/qgtvujy1/1873224055/394c674ddeb599d110fdeffa2144/ab1ac36bf1eb708a338826d49d6feaa802c357632deaa0a74d777bf773116e5d-Screenshot_2025-07-09_at_7_14_13_PM.png?expires=1776816000\&signature=d52548c43e12c172eedbab32f9aa9e95c169fbee542d78ccb1e7465f97e8c1fc\&req=dSggFct8mYFaXPMW3nq%2BgYJIXNko2thpq4uFNeR7Z7luFID5AIu8PMIRc1zW%0Af%2Fxvh9xCIaYXtxYgUcj%2FiSjMzxY%3D%0A)
    </Frame>

    The new feedback option will now appear in the user feedback list.
  </Step>
</Steps>

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Edit or Delete User Feedback
Source: https://help-plum.xoxoday.com/offers-management/settings/user-feedback/edit-or-delete-user-feedback

Learn how to edit the details of, or permanently delete, existing user feedback in Plum's Offers Management portal.

*Learn how to edit or delete a User feedback*

## Editing an Existing Feedback Option

To update a feedback option:

<Steps>
  <Step title="Locate the Feedback Option">
    On the User Feedback Management Page, find the feedback you want to edit.
  </Step>

  <Step title="Click Edit">
    Click the "**Edit**" button beside the selected feedback.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Update and Save">
    An edit overlay window will appear, allowing you to update the feedback content. Make the necessary changes and click "**Save**" to apply the updates.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>
</Steps>

***

## Deleting a Feedback Option

To remove a feedback option permanently:

<Steps>
  <Step title="Locate the Feedback Option">
    On the User Feedback Management Page, find the feedback you want to delete.
  </Step>

  <Step title="Click Delete">
    Click the "**Delete**" button next to the selected feedback option.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Confirm Deletion">
    A confirmation pop-up may appear. Confirm to delete the feedback option.
  </Step>
</Steps>

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# User Feedback - Overview
Source: https://help-plum.xoxoday.com/offers-management/settings/user-feedback/user-feedback-overview

Get an overview of the user feedback feature in Plum's Offers Management portal and how submitted feedback is used.

*Learn more about User feedback*

Admins can access and manage all user feedback options through the User Feedback section in the Settings module.

## How to Access the User Feedback Page:

* **Navigate to the Left Menu** — From the dashboard, click on "**User Feedback**" under the Settings module.

* **Open the Feedback Management Page** — Clicking on "User Feedback" will direct you to the User Feedback Management Page, where you can view and manage feedback options.

<Frame>
  <img alt="" />
</Frame>

***

## What You Can Do on the User Feedback Page:

* **View Feedback Options** — See a list of all existing user feedback options currently available on the platform.

* **Edit Feedback Option** — Modify the content or category of any feedback option by clicking the "**Edit**" button.

* **Add New Feedback Option** — Click "**Add**" to create a new user feedback option. Enter the required details and save.

* **Delete Feedback Option** — Remove outdated or irrelevant feedback options by clicking "**Delete**" next to the corresponding item.

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Add category or sub-category
Source: https://help-plum.xoxoday.com/offers-management/web-portal/add-category-or-sub-category

Learn how to add a new category or sub-category to a web portal in Plum, helping organize offers for customers.

*Learn how to add a category or a sub-category*

To add a new group (category/sub category):

<Steps>
  <Step title="Navigate to the Web Portal">
    * Go to the Web Portals tab from the left-hand side menu.

    * Click on the desired web portal from the list.

    * Once the selected portal loads, the categories and sub-categories will be displayed on the left panel.
  </Step>

  <Step title="Open the Add Category/Sub-Category Overlay">
    * Click on the "+" icon located near the categories panel.

    * This will open the Add Category/Sub-Category overlay.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Add Group Details">
    Fill in the following fields in the overlay:

    * Group Name

    * Father Group (select parent category if it's a sub-category)

    * Show Location

    * Sort Order

    * Group Image

    Once all details are filled in, click "Save" to create the new category or sub-category.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>
</Steps>

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Add Offers
Source: https://help-plum.xoxoday.com/offers-management/web-portal/add-offers

Learn how to add offers to a specific web portal within Plum's Offers Management module so they become visible to customers.

*Learn to add offers on the web portal*

Follow the steps to add offers on the web portal:

<Steps>
  <Step title="Open the Add Offers Overlay">
    * Navigate to the Web Portals tab from the left-hand side menu.

    * Click on the web portal you want to add offers to, and then click **"View"** under the selected offer.

    * On the portal details page, click "**Add Offers**" located at the top right corner.

    * This will open the Add Offers overlay window.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Select and Add Offers">
    * Browse or search the list of available offers in the overlay.

    * Click on the offers you want to add — selected offers will be highlighted.

    * Once your selection is complete, click "**Confirm Adding**" to add the selected offers to the web portal.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>
</Steps>

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Brand Management
Source: https://help-plum.xoxoday.com/offers-management/web-portal/brand-settings/brand-management

Learn how to manage brand settings for a web portal in Plum's Offers Management module, including adding and editing brands.

*Learn to manage brands on the Loopr dashboard*

Follow these steps to update or change a brand for a specific web portal:

<Steps>
  <Step title="Navigate to the Web Portal tab">
    Navigate to the Web Portal tab and select the relevant portal. Click the "**Brand**" button to open the Brand Management page.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Click Change on the brand">
    On the specific brand you want to change, click the "**Change**" button below it. An overlay will appear showing all available brands.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Select and submit the brand">
    You can either search for a brand or select one by simply clicking on it. Once selected, click Submit to save your changes.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>
</Steps>

The updated brand will now reflect on the selected web portal.

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Brand Search
Source: https://help-plum.xoxoday.com/offers-management/web-portal/brand-settings/brand-search

Learn how to quickly search for a specific brand within Plum's Offers Management web portal settings and configuration.

*Learn how to search for a brand on the particular web portal*

Follow these steps to search and update a brand on a specific web portal:

<Steps>
  <Step title="Navigate to Web Portals > Brand">
    Navigate to Web Portals > Brand.
  </Step>

  <Step title="Click Change">
    Click on "**Change**" under the brand name you want to update.
  </Step>

  <Step title="Search for the brand">
    In the search bar, type the name of the brand you're looking for.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>
</Steps>

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Overview
Source: https://help-plum.xoxoday.com/offers-management/web-portal/brand-settings/brand-setting

Learn how to configure individual brand settings for a specific web portal within Plum's Offers Management module.

*Learn to manage brand setting on the Loopr platform*

Follow the steps below to manage brand visibility on a selected web portal:

<Steps>
  <Step title="Navigate to the Web Portal tab">
    Navigate to the **Web Portal** tab on the left-hand side (LHS) menu.
  </Step>

  <Step title="Click the Brand button">
    Click on the "**Brand**" button for the desired web portal. On click, the Brand Management Page for the selected web portal will open.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Add brands">
    You can add up to 8 brands per web portal.

    <Info>
      Use this section to control which brands are highlighted or featured on each portal.
    </Info>
  </Step>
</Steps>

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Categories and sub-categories of the web portals
Source: https://help-plum.xoxoday.com/offers-management/web-portal/categories-and-sub-categories-of-the-web-portals

Learn how categories and sub-categories are structured within Plum's web portals to help customers browse offers.

*Learn how to view categories and sub offers*

<Steps>
  <Step title="View Categories and Sub-Categories">
    The categories and sub-categories of the selected web portal are displayed on the left panel of the page.
  </Step>

  <Step title="View Offers Under a Category">
    **Click on a category or sub-category** on the left panel. The offers added under the selected category will be displayed on the right panel.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>
</Steps>

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Delete offer from the selected web portal
Source: https://help-plum.xoxoday.com/offers-management/web-portal/delete-offer-from-the-selected-web-portal

Learn how to permanently delete an offer from a selected web portal in Plum's Offers Management module and settings.

*Learn how to delete an offer from the web portal*

Follow these steps to delete an offer from a selected sub-category in the web portal:

<Steps>
  <Step title="Go to Web Portals and navigate to the sub-category">
    Go to **Web Portals** and select the desired portal. Navigate to the specific sub-category where the offer is listed.
  </Step>

  <Step title="Remove the offer">
    Locate the offer you want to remove and click "**Remove**" next to it.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Confirm the removal">
    A confirmation prompt will appear asking: "Are you sure you to remove the offer?" Click "**Confirm**" to proceed.

    <Frame>
      <img alt="" />
    </Frame>

    Once confirmed, the selected offer will be permanently deleted from the sub-category.
  </Step>
</Steps>

<Info>
  Note: Deleted offers cannot be recovered. Please double-check before confirming.
</Info>

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Edit a category or sub-category
Source: https://help-plum.xoxoday.com/offers-management/web-portal/edit-a-category-or-sub-category

Learn how to edit an existing category or sub-category within a Plum web portal to keep your offers well organized.

*Learn how to edit a category or a sub-category*

Follow the steps to edit a category or a sub category on the webportal.

<Steps>
  <Step title="Navigate to the Web Portal">
    * Go to the Web Portals tab from the left-hand side menu.

    * Select the web portal where you want to edit a category or sub-category.

    * Click "View" to open the portal details page.
  </Step>

  <Step title="Open the Edit Category/Sub-Category Overlay">
    * Click on the desired category or sub-category from the left panel.

    * Click the "Edit" (pencil) icon next to the selected item.

    * This will open the Edit Category/Sub-Category overlay.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Edit and Save">
    * Update the required category or sub-category information in the overlay fields.

    * Click "Save" to apply and update the changes.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>
</Steps>

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Publish or Unpublish offers in the selected web portal
Source: https://help-plum.xoxoday.com/offers-management/web-portal/publish-or-unpublish-offers-in-the-selected-web-portal

Learn how to publish or unpublish offers within a selected web portal in Plum, controlling what customers can see.

*Learn how to publish or unpublish offers in the selected web portal*

To manage offer visibility on your selected web portal, follow the steps below:

## Publishing Offers

<Steps>
  <Step title="Go to the Web Portals section">
    Go to the Web Portals section from the admin dashboard. Select the desired web portal to view its details.
  </Step>

  <Step title="Publish the offer">
    On the selected portal's page, scroll down to the Offer Cards section. Click "**Publish**" on the offer you want to make live. It will ask you to "**Confirm**" your selection.
  </Step>

  <Step title="Offer published">
    Once you click **Publish**, the offer will be published to the selected web portal. The offer status will automatically update from "Unpublished" to "Published."
  </Step>
</Steps>

***

## Unpublishing Offers

<Steps>
  <Step title="Locate the published offer">
    In the Offer Cards section of the web portal, locate the published offer. Click "**Unpublish**" on the offer you want to remove.
  </Step>

  <Step title="Offer unpublished">
    After clicking **Unpublish**, the offer will be removed from the selected web portal. The status will change from "Published" to "Unpublished."
  </Step>
</Steps>

<Frame>
  <img alt="" />
</Frame>

<Frame>
  <img alt="" />
</Frame>

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Search/Filter for Offers in Web Portal
Source: https://help-plum.xoxoday.com/offers-management/web-portal/searchfilter-for-offers-in-web-portal

Learn how to search and filter offers within a Plum web portal to quickly locate the specific one you need to manage.

*Learn how to search/filter offers in the web portal*

<Steps>
  <Step title="Navigate to Web Portals">
    Go to the left-hand side (LHS) menu and click on "Web Portals."
  </Step>

  <Step title="Filter Offers">
    Admins can filter offers using multiple options available above the offer listing table.

    <Frame>
      <img alt="" />
    </Frame>

    ## Available Filter Options:

    * **Offer Name:** Enter the name of the offer in the search bar and click Search.

    * Select the type of offer (e.g., Discount, Fixed Value).

    <Frame>
      <img alt="" />
    </Frame>

    * Filter offers based on their status (Active, Inactive, etc.).

    <Frame>
      <img alt="" />
    </Frame>

    * Select the merchant linked to the offer.

    <Frame>
      <img alt="" />
    </Frame>

    * **Date:** Select a specific date or a range to filter offers by date of creation or availability.

    <Frame>
      <img alt="" />
    </Frame>

    * **Area**

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Click Search">
    Click the **Search** button to view matching results.
  </Step>
</Steps>

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Track the offers of the selected web portal
Source: https://help-plum.xoxoday.com/offers-management/web-portal/track-the-offers-of-the-selected-web-portal

Learn how to track the ongoing performance of offers within a selected web portal in Plum's Offers Management module.

*Learn to track offers*

Steps to track offer transactions in a Web Portal:

<Steps>
  <Step title="Locate the Offer">
    * Navigate to the Web Portals tab.

    * In the list of offers, locate the offer you want to track.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="View Offer Transactions">
    * Click "**Detail**" next to the selected offer.

    * The Track Offers Detail page will be displayed, showing a list of transactions related to that offer.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>
</Steps>

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# View offer information
Source: https://help-plum.xoxoday.com/offers-management/web-portal/view-offer-information

Learn how to view detailed information about a specific offer within a Plum web portal, including its status and settings.

*View information relating to an offer on Loopr*

To view Offer Information in a Web Portal:

<Steps>
  <Step title="Locate the Offer">
    * Navigate to the Web Portals tab and click "View" for the desired web portal.

    * In the list of offers displayed for that portal, locate the offer you want to view.
  </Step>

  <Step title="Open Offer Information Page">
    * Click "View" next to the selected offer.

    * This will open the Offer Information page, where you can see all the details related to that offer.

    <Frame>
      <img alt="" />
    </Frame>

    <Frame>
      <img alt="" />
    </Frame>
  </Step>
</Steps>

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Overview
Source: https://help-plum.xoxoday.com/offers-management/web-portal/web-portal

Get an overview of the web portal feature within Plum's Offers Management module and how offers are surfaced to customers.

*Learn how to manage the web portal*

<Steps>
  <Step title="Navigate to Web Portals">
    In the left-hand menu, click on "Web Portals."

    <Frame>
      <img alt="" />
    </Frame>

    This will take you to the Web Portal Management page, where you can manage offers, categories, and visibility settings for different portals.
  </Step>
</Steps>

***

## What You Can Do on the Web Portals Page

Once you're on the Web Portals management page, you can perform the following actions:

**Manage Categories & Sub-Categories**

* Create/Edit Main Categories: Set up broad-level offer categories (e.g., Travel, Electronics).

* Create/Edit Sub-Categories: Organize offers under sub-groups for better navigation (e.g., Flights under Travel).

* Show/Hide Categories & Sub-Categories: Choose which categories or sub-categories should be visible or hidden on specific web portals.

**Manage Offers on Web Portals**

* Add/Delete Offers: Add offers to or remove offers from specific web portals as needed.

* Publish/Unpublish Offers: Control the live status of offers on your web portals.

* View Offer Details: Click on an offer to see more information, such as offer name, description, and validity.

* Track Offer Listings by Web Portal: View all offers assigned to a specific portal to keep track of what's currently being displayed.

***

<Info>
  **Pro Tips**

  * Use filters to quickly find offers or categories you need to manage.

  * Always save changes before navigating away to avoid losing updates.

  * Unpublished offers will not appear on the end-user portal until published again.
</Info>

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Web Portals Management
Source: https://help-plum.xoxoday.com/offers-management/web-portal/web-portals-management

Get an overview of managing multiple web portals within Plum's Offers Management module from a single central place.

*Learn how to manage the Web Portal*

<Steps>
  <Step title="Navigate to Web Portals">
    Go to the left-hand side (LHS) menu and click on "Web Portals."
  </Step>

  <Step title="View Details of a Web Portal">
    * Select a web portal from the list.

    * This will redirect you to the corresponding Web Portal Management page.

    * Click on the "View" button next to the portal you want to explore.

    <Frame>
      <img alt="" />
    </Frame>

    On the portal details page, you can view:

    * The categories and sub-categories of the selected web portal.

    <Frame>
      <img alt="" />
    </Frame>

    * The offers that have been added to this web portal.
  </Step>
</Steps>

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Virtual PayPal International
Source: https://help-plum.xoxoday.com/prepaid-cards/virtual-paypal-international

Learn how to send and redeem virtual PayPal international prepaid cards through Plum, including where recipients can use them.

Cross-border transfer of rewards across geographies made easy with Paypal rewards.

PayPal is an online payment system that makes paying for things online and sending and receiving money safe and secure. PayPal is the faster, safer way to send and receive money or make an online payment worldwide.

Whether you’re shopping, splitting expenses, or getting paid for sales, Paypal makes it as easy as possible to spend or transfer money from your Paypal wallet for online purchases across the globe.

# Getting Started

## How to transfer money to a Paypal wallet

Steps for an admin to send money to a Paypal wallet:

**Step 1:** Log in to your Plum account

<img alt="" />

Step 2: Recharge your Plum wallet by clicking on the ‘Recharge’ option from the navigation bar and adding your desired amount.\*\*​

<img alt="" />

Step 3:\*\* Click on ‘Plum Pro’ from the left panel to transfer money to your Paypal wallet

Step 4:You have the option to send money to the Paypal wallet to a few recipients or to multiple recipients in bulk.

# Sending money to a Paypal wallet to a single or a few recipients

Select the ‘Send to few’ tab and follow these steps:

* Under ‘Select a country for brand vouchers’ choose the recipients’ country from the drop-down list.

* In the ‘Add a Recipient’ section, add the full name of the recipient.

* For the next box, select ‘Paypal International’ from the drop-down menu

* Select the denomination of the voucher from the drop-down list

* Add the quantity of brand vouchers

* Add the recipient’s phone number (optional)

* Add the PO number (optional)

* Add a personalized message for the recipient

* Click ‘Add another recipient’ to add more recipients and repeat steps 1 to 8 listed above.

<img alt="" />

* Once you are done click on ‘Send Reward.’

## Send money to Paypal wallets in bulk to multiple recipients

Select the ‘Bulk Upload’ tab and follow these steps:

* To know the required format for uploading data in bulk, download a sample file by clicking on ‘CSV/XLSX template’ under ‘Add your recipients in bulk.’ You may skip this step if you already have a CSV/XLSX file with data in the required format.

* Once you’ve filled in the details correctly, click ‘Add CSV/XLSX file’ to upload and verify the data.

* Add the correct details for each column from the CSV sheet to upload the recipients’ information in bulk.

* Click on ‘Verify file’ at the bottom

* Click on ‘Yes, continue’ in the pop-up box to verify the file.

* Once you verify the file, click ‘Generate & Send’ to transfer the amount to the recipients’ wallets.

# How to Redeem?

## Here’s the step-by-step process for the recipient to redeem the reward:

Step 1: You will receive an email with the details of your Paypal amount. Click on ‘Redeem’.**Step 2:** Once you click on ‘Redeem’, you will be redirected externally to claim the reward. Now, click on ‘Redeem’ again.

<img alt="" />

Step 3:\*\*Choose your country and click on the Paypal icon below as shown in the screenshot \*\*Step 4:\*\*Now, enter your registered email address with Paypal to transfer the amount to your Paypal wallet.\*\*​

<img alt="" />

Step 5:\*\* Once you initiate the transfer to your Paypal wallet, you will receive an email notifying you of the same to your registered email address and the date of the payment initiated.

<img alt="" />

Step 6:\*\* On the next screen you can track the delivery status of the money transferred to your Paypal wallet by clicking on the ‘Track Status’ button and review the transferred amount.

<img alt="" />

Step 7:\*\*Finally, you will receive a confirmation email from Paypal to your registered email address to notify you of the successful transaction.\*\*​

<img alt="" />

About the Paypal card usage:

* Claim the amount transferred to your Paypal account within 1 month or it will be returned to the sender.

* Once claimed & amount added to your Paypal account, it cannot be canceled.

* Please input your name & registered PayPal account email on the page.

* Your funds should be available in your PayPal account within 1 day.

* Actual amount will be added based on the Forex exchange on a daily basis to your Paypal Account.

* Paypal amount can be used online only wherever it is applicable.

* This Paypal product can only be issued for employee rewards/channel incentives/consumer campaigns/loyalty programs.

* This Paypal product cannot be issued for Facebook advertising payments, cannot be procured for business-related payments, or any program that is not part of a reward/incentive use case.

* Paypal Terms & Conditions will be applicable- [https://www.paypal.com/us/webapps/mpp/ua/legalhub-full?locale.x=en\_US](https://www.paypal.com/us/webapps/mpp/ua/legalhub-full?locale.x=en_US)

* TAT for delivering the amount to your Paypal account is between 7-10 working days.

* For any queries & issues, please reach out [cs@xoxoday.com](mailto:cs@xoxoday.com)

​

​

​

​

​

​

​

​

​

​

​

​

​


# Virtual Visa Card
Source: https://help-plum.xoxoday.com/prepaid-cards/virtual-visa-card

Learn how to send and redeem virtual Visa prepaid cards through Plum, including where and how recipients can spend them.

Cross-border transfer of rewards using Virtual Visa prepaid cards.

Visa rewards are great because they give your recipients the flexibility of using them at online stores of their choice.

Unlike regular gift cards, Visa prepaid cards cannot be used in combination with other payment methods. This means that the recipient must have enough money on the card to cover the full cost of their purchase.

The funds on a Visa prepaid card must be utilized within the validity timeline from the date of issue.

# Getting Started

## Steps for an admin to send virtual prepaid cards

Step 1: Log in to your Plum account\*\*​

<img alt="" />

Step 2:\*\*Recharge your Plum wallet by clicking on the ‘Recharge’ option from the left panel and adding your desired amount.\*\*​

<img alt="" />

​Step 3:\*\*Click on ‘Plum Pro’ from the left panel to send Visa prepaid cards **Step 4:** You have the option to send Visa prepaid cards to a few recipients or to multiple recipients in bulk.

## Sending Visa prepaid cards to a single or a few recipients

Select the ‘Send to few’ tab and follow these steps:

* Under ‘Select a country for brand vouchers’ choose the recipients’ country from the drop-down list.

* In the ‘Add Recipients’ section, add the full name of the recipient.

* For the next box, select ‘Prepaid Virtual Visa International Card USD’ from the drop-down menu

* Select the denomination of the voucher from the drop-down list

* Add the quantity of brand vouchers

* Add the recipient’s phone number (optional)

* Add the PO number (optional)

* Add a personalized message for the recipient

* Click ‘Add another recipient’ to add more recipients and repeat steps 1 to 8 listed above.

* Once you are done click on ‘Generate & Send.’\*\*​

<img alt="" />

Send Visa prepaid cards in bulk to multiple recipients

Select the ‘Bulk Upload’ tab and follow these steps:

* To know the required format for uploading data in bulk, download a sample file by clicking on ‘CSV/XLSX template’ under ‘Add your recipients in bulk.’ You may skip this step if you already have a CSV/XLSX file with data in the required format.

* Once you’ve filled in the details correctly, click ‘Add CSV/XLSX file’ to upload and verify the data.

<img alt="" />

* Add the correct details for each column from the CSV sheet to upload the recipients’ information in bulk.

<img alt="" />

* Click on ‘Verify file’ at the bottom.

<img alt="" />

* Click on ‘Yes, continue’ in the pop-up box to verify the file.

<img alt="" />

* Once you verify the file, click ‘Generate & Send’ to send prepaid cards to the recipients. The recipient receives an email with the details of their prepaid card and a link to claim the reward.

How to Redeem?

## Steps for the recipient to redeem a reward

* You will receive an email with the details of your Visa prepaid card. Click on ‘Click Here To Redeem’ to claim the reward.

* Click on ‘Redeem’ to claim the reward.

* Enter your first and last name in the box, go over the E-Sign Disclosure, Cardholder Agreement, and Privacy Policy, tick the two checkboxes to indicate your agreement, and click ‘Activate card.’

<img alt="" />

​

* On the next screen you can see the details of your Visa prepaid card.

<img alt="" />

​

* Post activation, if you’d like to opt for notifications for your Visa prepaid transactions, select either SMS or email, and add your phone number and email address to receive transaction-related messages.

* You’ll now receive a link in your email inbox to view your prepaid card and redeem it
  ​

<img alt="" />

About the Prepaid Virtual Visa International USD card usage\* (for the rest of the world)

* A Visa prepaid card gives you the flexibility to shop anywhere around the world where Visa debit cards are accepted.

* The funds on your Visa prepaid card must be accessed within 6 months from the date it was issued.

* This card cannot be redeemed in a country where there is a USA sanction.

* This card cannot be redeemed in India.

* The funds on the card cannot be cashed or transferred/added to Google Pay, Apple Pay, or any other wallet.

* This virtual visa card can only be used for online purchases where it is acceptable.

* This card cannot be redeemed in any country where there is a USA sanction.

* This card cannot be redeemed in India.

* This card can only be issued for employee rewards, channel incentives, consumer campaigns, and loyalty programs.

* This card cannot be issued for Facebook advertising payments, procured for business-related payments, or any program that is not part of a reward or incentive use case.

* This card is a one time use card and is non reloadable in nature.

* The card issuer does not charge any currency conversion costs, but in some regions, it's possible that a merchant where the card would be swiped could charge a fee if the USD Virtual Visa International card is used to make a purchase in a non-USD currency.

* Transactions with the following merchants are prohibited:

* Money transfer services business

* Firearm-related businesses

* Tobacco businesses

* Marijuana-related businesses

* Money services from non-financial institutions (including cryptocurrency)

* Securities brokers/dealers

* Dating services

* Massage parlors

* Government-owned lotteries

* Government-licensed online casinos and online gambling

* Government-licensed horse/dog racing

* Betting, including lottery tickets, casino gaming chips, off-track betting, and wagers at race tracks

This card can be redeemed in the following countries:

Albania, Algeria, American Samoa, Andorra, Angola, Anguilla, Antarctica, Antigua and Barbuda, Argentina, Armenia, Aruba, Ascension Island, Australia, Austria, Azerbaijan, Bahamas, Bahrain, Bangladesh, Barbados, Belgium, Belize, Benin, Bermuda, Bhutan, Bolivia, Botswana, Bouvet Island, Brazil, British Indian Ocean Territory, Brunei Darussalam, Bulgaria, Burkina Faso, Cambodia, Cameroon, Canada, Cape Verde, Cayman Islands, Chad, Chile, China, Christmas Island, Cocos (Keeling) Islands, Colombia, Comoros, Congo, Republic of the, Cook Islands, Costa Rica, Cote d'Ivoire, Croatia, Cyprus, Czech Republic, Denmark, Djibouti, Dominica, Dominican Republic, East Timor, Ecuador, Egypt, El Salvador, Equatorial Guinea, Eritrea, Estonia, Falkland Islands (Malvinas), Faroe Islands, Fiji, Finland, France, French Guiana, French Polynesia, French Southern Territories, Gabon, Gambia, Georgia, Germany, Ghana, Gibraltar, Greece, Greenland, Grenada, Guadeloupe, Guam, Guatemala, Guernsey, Guinea, Guinea-Bissau, Guyana, Haiti, Heard Island and McDonald Islands, Honduras, Hong Kong, Hungary, Iceland, Ireland, Isle of Man, Israel, Italy, Jamaica, Japan, Jersey, Jordan, Kazakhstan, Kenya, Kiribati, Korea, Republic of, Kuwait, Kyrgyzstan, Lao People's Democratic Republic, Latvia, Lesotho, Liberia, Liechtenstein, Lithuania, Luxembourg, Macao, Macedonia, the Former Yugoslav Republic of, Madagascar, Malawi, Maldives, Malta, Marshall Islands, Martinique, Mauritania, Mauritius, Mayotte, Mexico, Micronesia, Federated States of, Moldova, Republic of, Monaco, Mongolia, Montenegro, Montserrat, Morocco, Mozambique, Namibia, Nauru, Nepal, Netherlands, New Caledonia, New Zealand, Niger, Nigeria, Niue, Norfolk Island, Northern Mariana Islands, Norway, Oman, Palau, Palestine, State of, Paraguay, Peru, Pitcairn, Poland, Portugal, Puerto Rico, Qatar, Reunion, Romania, Rwanda, Saint Kitts and Nevis, Saint Lucia, Saint Vincent and the Grenadines, Samoa, San Marino, Sao Tome and Principe, Saudi Arabia, Senegal, Serbia, Seychelles, Sierra Leone, Singapore, Slovakia, Slovenia, Solomon Islands, South Africa, South Georgia and the South Sandwich Islands, Spain, Sri Lanka, Saint Helena, Saint Pierre and Miquelon, Suriname, Svalbard and Jan Mayen, Swaziland, Sweden, Switzerland, Taiwan, Province of China, Tajikistan, United Republic of Tanzania, Togo, Tokelau, Tonga, Trinidad and Tobago, Tunisia, Turkey, Turkmenistan, Turks and Caicos Islands, Tuvalu, United States Minor Outlying Islands, United Arab Emirates, United Kingdom, Uruguay, Uzbekistan, Holy See (Vatican City State), Vietnam, British Virgin Islands, US Virgin Islands, Wallis and Futuna, Western Sahara and Zambia.

## About the prepaid virtual Visa Card usage(for the US region only)

A Visa prepaid card gives you the flexibility to shop anywhere around the world where Visa debit cards are accepted.

* This card must be used within 6 months from the date of issuance.

* This card is only valid for online/virtual purchases.

* This card can only be issued as part of employee rewards, channel incentives, consumer campaigns, and loyalty programs.

* This card cannot be issued for Facebook advertising payments, business-related payments, or any program that is not part of a reward/ incentive use case.

* This card is a one time use card and is non reloadable in nature.

* Transactions with the following merchants are prohibited:

Money transfer services business

* Firearm-related businesses

* Outbound telemarketing

* Tobacco businesses

* Marijuana-related businesses

* Money services from non-financial institutions (including cryptocurrency)

* Securities brokers/dealers

* Dating services

* Massage parlors

* Government-owned lotteries

* Government-licensed online casinos and online gambling

* Government-licensed horse/dog racing

* Betting, including lottery tickets, casino gaming chips, off-track betting, and wagers at race tracks\*\*​

* This US Visa prepaid virtual card can be added to digital wallets like Apple Pay and Google Pay.

Terms & Conditions are subject to change as advised from time to time by the card issuers.

​
​
​
​


# Plum Product Roadmap - 2026
Source: https://help-plum.xoxoday.com/product-roadmap/plum-product-roadmap-2026

See what's coming next for Plum in the 2026 product roadmap, including upcoming features and platform improvements.

*Learn about the upcoming features and improvement*

Plum is designed to provide an intuitive, effective platform for managing rewards and incentives, helping you manage them with ease.

Our roadmap reflects our ongoing commitment to innovation and continuous improvement. It highlights our commitment to delivering innovative solutions that empower businesses to drive engagement and achieve measurable results.

## View the Roadmap

[Open](https://giftxoxo.atlassian.net/jira/discovery/share/views/dba185f5-db75-4095-8c32-3fd32f5f6caf)

<img alt="" />

Thank you for taking the time to explore our roadmap. We're committed to continuously enhancing Plum to deliver a straightforward and effective rewards and incentives platform.

## Request another feature

We add features to our roadmap based on the shared customer feedback. You can share your ideas at [cs@xoxoday.com](mailto:cs@xoxoday.com).


# June 2026
Source: https://help-plum.xoxoday.com/product-updates/june-2026

Read the Plum product update for June 2026, covering new features, improvements, and fixes shipped that month.

Over the past month, we introduced new reward categories that help users unlock greater savings, along with enhancements across authentication, merchandise checkout, and reporting visibility. These updates are designed to create a smoother user experience while giving teams greater control, flexibility, and oversight in managing reward programs.

## Here's what's new:

### 01 — Login to Rewards Hub with OTP

End users and admins can now log to the platform in using OTP as a primary authentication method, alongside the existing password flow.

This is especially useful for programs operating across shared devices, frontline teams, partner networks, or geographies where SMS-based authentication is the operational norm.

The result is a faster login experience with lower friction for users and fewer password reset dependencies for support teams.

<Frame>
  <img alt="Image" />
</Frame>

### 02 — Two-Factor Authentication for Xoxo Points users

Xoxo Points accounts now provides two-factor authentication at login, adding an extra layer of protection beyond the password.

After entering their password, users verify a one-time password (OTP) sent to their email or mobile. This ensures that a leaked password alone is not enough to access an account, significantly reducing the risk of account takeover.

<Frame>
  <img alt="Image" />
</Frame>

### 03 — Benefit Codes — One Code, A World of Savings

Plum Rewards Hub introduces Benefit Codes — send a single code to your users and they get access to discounted gift cards and curated offers from top brands. No account creation, no onboarding, no fulfillment overhead.

Recipients unlock discounted gift cards and exclusive offers of up to 75% off across 1,000+ partner brands — spanning shopping, dining, travel, wellness, and more. The best part: savings are powered by our brand partners, so you hand out high-value benefits at near-zero cost.

<Frame>
  <img alt="Image" />
</Frame>

***Why it matters:***

Benefit Codes give organizations a low-cost, high-value benefit that drives repeat engagement. Recipients return regularly to redeem offers across categories they care about, building the stickiness and sustained program participation that directly improves loyalty and retention metrics.

***Where it works best:***

Banks rewarding cardholders, community managers thanking members, HR teams running employee perks, and channel managers keeping partners engaged, any program where you need to deliver high-value benefits quickly, at scale.

### 04 - Custom Reports in Rewards Hub

Rewards Hub now supports the creation of role-based reports that can be shared with specific users. Super admins can define precisely which data each team is able to view, ensuring that sensitive commercial information remains restricted to authorized personnel.

A Super Admin can enable Custom Reports under Platform Preferences, create a report by selecting which columns to include (order ID, product name, delivery status, cost, margin, and so on), and shares it with chosen users.

***Where it works best:***

This capability provides controlled, role-appropriate access to data. Finance teams may be granted visibility of cost and margin columns, while customer support teams are limited to order and delivery information.

<Frame>
  <img alt="Image" />
</Frame>

### 05 — Quantity visibility added to Reports

Reports now include a dedicated QTY column for orders involving multiple quantities of the same product.

This gives finance and operations teams clearer visibility into order-level transactions and simplifies reconciliation workflows where value alone was previously not enough.

<Frame>
  <img alt="Image" />
</Frame>

### 06 — Payment gateway charges now visible on invoices

Payment gateway charges are now shown as a separate line item on invoices instead of being absorbed within the total amount.

This gives finance teams clearer visibility into transaction costs and reduces the manual effort required during reporting.

### 07 — Self-Rewards links now replaces file attachments

Self-Rewards distribution has moved away from Excel and CSV file attachments to secure, access-controlled reward links.

Recipients are authenticated before they can view or redeem, while operations teams get better visibility into who accessed what and when.

This improves access control, reduces the risk of unintended sharing and fraud, and creates a cleaner redemption experience for users.

<Frame>
  <img alt="Image" />
</Frame>

### 08 — Expanded gift card coverage across Saudi Arabia and Middle East

The Xoxoday catalogue now includes deeper gift card coverage across Saudi Arabia and nearby Middle East markets.

For clients running regional reward programs, this expands access to more locally relevant brands and improves redemption relevance for users in the geography.

<Frame>
  <img alt="Image" />
</Frame>

### 09 — Saved delivery addresses for faster merchandise checkout

Logged-in users are now able to save and reuse delivery addresses during merchandise checkout, removing the need to enter their full address details for every physical order.

Users may save up to three addresses, each with a recognisable label such as "Home" or "Office", and select a saved address with a single click at checkout.

For users who redeem physical rewards frequently, this removes repetitive address entry and makes checkout significantly faster and smoother.

<Frame>
  <img alt="Image" />
</Frame>

### 10 — Address Locking on Merchandise Orders

Organizations can now restrict merchandise deliveries to a set of approved addresses, ensuring that physical rewards can only be shipped to locations sanctioned by the company — such as office branches or warehouses — rather than to addresses entered freely by recipients at checkout.

When redeeming a reward, the recipient is presented with a dropdown of the administrator's pre-configured addresses and selects one. The control applies only to physical merchandise; digital rewards such as vouchers are unaffected.

<Frame>
  <img alt="Image" />
</Frame>

### 11 — Delivery status to merchandise orders

Merchandise orders now also reflect actual fulfilment progress instead of being marked delivered instantly. Users can track accurate order statuses throughout the delivery journey, creating a more transparent and reliable redemption experience.

### 12 — More control over catalogue visibility in Rewards APIs

Rewards API clients can now exclude specific products from catalogue responses using filter IDs.

This gives teams more flexibility in shaping what end users see, without needing to maintain separate exclusion lists or implement additional filtering logic on their side.

## Upcoming features: Self-serve storefront white labelling

We are introducing a self-serve brand identity experience within Plum Admin. Clients will soon be able to configure logos, brand colours, CTA styling, favicons, and storefront titles with live preview support.

The new flow will also support preview-before-publish and one-click rollback for safer brand updates.

Questions or feedback? Reach out to your Customer Success Manager or write to us at [support@xoxoday.com](mailto:support@xoxoday.com)


# August 2026
Source: https://help-plum.xoxoday.com/product-updates/june-2026-2



The last months have brought a strong set of updates to Xoxoday Plum, with a focus on giving you greater control over your storefront, making rewards more secure, expanding redemption options, and strengthening compliance capabilities.

Here's what's new:

### 01 — Self Serve Storefront Customization - Logo, Favicon & Brand Color

Admins can upload  brand logo and favicon directly from the Rewards Hub, with a live preview and reset option. They can also select a brand color using a color picker or HEX code and instantly apply it across buttons, links, and highlights throughout the storefront.

Previously, admins had to raise a request with our team to make these changes. None of these controls were self-serve, so even a small brand update could mean waiting on support or engineering. All three can now be configured directly within Plum Admin.

<Frame>
  <img alt="01" />
</Frame>

### \*\*02 — White-Labelled Reward Points Icon \*\*

The points balance in the storefront header can now be customized with your own **points icon**. 

Previously, this was a fixed Xoxoday coin icon. With this update, the points balance can now be branded alongside your logo, favicon, and storefront colors, creating a more consistent, white-labelled experience. 

<Frame>
  <img alt="02" />
</Frame>

**03 — Extended Japan Brand Catalogue**

The **Japan brand catalogue** is now extended with wider brand options, expanding reward coverage for customers and programs operating in the Japanese market.

Customers can now **discover, order, and fulfil Japan-based brand rewards end to end**, creating a more seamless experience for program administrators and recipients.

**04 — Shop, Save & Earn with Cashback**

A new **Cashback** category is now available in the marketplace, expanding the range of products and savings opportunities available to users. It also creates a new reason for users to return to the marketplace for everyday shopping, driving repeat engagement while giving admins a new category to configure, manage, and monetize. 

Once credited, **Cashback Points** can be redeemed at checkout, used independently, or combined with payment gateway transactions and product discounts. Refunds are also supported throughout the journey.

<Frame>
  <img alt="04" />
</Frame>

\*\*05 — Airmiles Added to the Reward API Catalogue \*\*

**Airmiles categories is** now available through the Reward API catalogue, with support across products, brands, currencies, denominations, and countries. 

This expands the range of reward options available through API integrations, giving customers and partners more flexibility to offer travel rewards across markets. 

<Frame>
  <img alt="03" />
</Frame>

**06 — Expanded Perks with Paid Options**

A new **Paid Perks** category is now available alongside Free Perks in the Marketplace Offers section. 

Users can browse and purchase perks and offers using accumulated points, codes, or the payment gateway. This gives users more choice beyond free offerings, while giving businesses another way to introduce premium perks and expand their rewards proposition. 

The checkout journey follows the same experience as gift vouchers, keeping the experience familiar and seamless. 

\*\*07 — Reward Campaign Management for API Customers \*\*

API-rewarding customers can now customize **reward catalogue options and email communication settings directly within Rewards Hub**, giving them greater control over campaign configuration, catalogue selection, and recipient communications. This makes it easier to manage and update reward campaigns without relying on manual support or engineering assistance. 

These catalogue and email settings are now consolidated under **API Settings**, creating a cleaner, more focused admin experience for API-first accounts. 

<Frame>
  <img alt="06" />
</Frame>

**08 —End-to-end Withholding Tax Handling**

The Xoxoday Marketplace now supports **end-to-end withholding tax handling** at the point of reward redemption. 

For redemptions above a configurable annual threshold, the platform can display, calculate, and deduct the applicable taxation details based on the country and client program. Tax type, rate, threshold, and recipient identifier requirements can be configured to reflect local regulations. 

The platform also supports tax reporting, helping retailers, dealers, and channel partners meet applicable tax obligations while giving enterprise clients greater control and visibility over compliance across their distribution networks. 

**09 — Enhanced Darwinbox Integration for Multi-Currency and Multi-Region reward programs**

We've enhanced our Darwinbox integration to support multi-currency, multi-region reward programs, enabling HR teams to run global campaigns while delivering a localized experience to every employee.

The integration now captures each employee's regional currency from Darwinbox and dynamically maps it to the appropriate catalog and point value. US employees, for instance, receive rewards in USD, while employees in India are rewarded in INR, all through a single, unified setup.

**10 — Configurable Redemption Limits across categories**

Admins can now configure **daily, weekly, and monthly redemption limits** across all categories. 

This is particularly useful for **high-value reward categories**, where program owners may want to set clear limits to manage budgets, control exposure, and prevent unusually high redemption activity.

\*\*11 — Brand Filter on Merchandise Stores \*\*

A new **Brands** filter is now available on merchandise stores. 

Brands are automatically populated from the catalogue and displayed alphabetically, making it easier for users to discover products from their preferred brands, especially across larger catalogues with a wide variety of products. 

<Frame>
  <img alt="10" />
</Frame>

\*\*12 — “Buy Now” Direct Checkout \*\*

The new **Buy Now** flow lets users purchase a single product directly without going through a shared cart. 

Each order remains within a single category, creating a simpler and faster checkout experience for users while reducing the fulfilment complexity that can come with mixed-category orders. 

Keeping up with the new features is the first step. The next, and more important step, is to see their impact on your reward strategy in action.


# March 2026
Source: https://help-plum.xoxoday.com/product-updates/march-2026

Read the Plum product update for March 2026, covering new features, improvements, and fixes shipped that month.

Over the past month, we've added a new redemption category, built stronger spending and redemption controls for admins, and improved reporting with deeper visibility into categories, discounts, and travel transactions. Each update is built around one goal: making the reward experience easier to manage for your team and more valuable for your users.

### 01 - Let channel partners and influencers cash out points directly to a bank account

Users can now redeem their reward points to cash, via direct bank transfer, prepaid card, e-wallet or UPI through a new cashout category on the storefront.

For programs where unredeemed points and catalog relevance have been a persistent concern, particularly in channel incentives, influencer rewards, survey panels or refund credits this gives users a tangible cash-out option.

Users get real value of the rewards regardless of geography or preference. Xoxoday catalogue now supports 20+ payout options globally.

| Type          | Top options                                                       |
| :------------ | :---------------------------------------------------------------- |
| Prepaid cards | Visa · Mastercard · Swype · Rewarble · Nexon                      |
| Wallets       | PayPal · Venmo · PhonePe · GoPay · GCash · Touch n Go · ShopeePay |
| Bank transfer | *ACH, DBT*                                                        |
| Others        | UPI, Push to Cards (Master/Visa)                                  |

### 02 — Category-level spending controls

Admins can now configure daily or monthly redemption limits on specific reward categories, starting with gift cards and merchandise. Category-level spending controls are enforced on the backend, without altering the catalog experience for the user.

Here is what this means for Xoxoday Storefront integration customers:

* **Predictable budget control:** Keeps spending in check at the category level and ensures your monthly reward budget doesn't get exceeded.

* **Balanced catalog experience:** Prevents one category from getting overused while others are ignored. Popular rewards don't run out too quickly, so the catalog stays complete and consistent for all users.

* **Misuse prevention:** Limits how much can be redeemed from a category, helping prevent misuse or fraud without needing manual checks.

* **Better ongoing engagement:** Monthly limits encourage users to come back and redeem over time, instead of using all their points at once.

### 03 — Send multiple denominations in one transaction

The "Send Individually" flow now supports multiple denominations of the same brand for a single recipient in one transaction.

For teams managing high-volume gifting, seasonal rewards, sales incentives, bulk disbursements, this removes the need to create separate transactions for different value variants. Fewer steps, fewer errors, and faster fulfilment.

<Frame>
  <img alt="Image" />
</Frame>

### 04 — Dedicated travel report

A single report now ties every hotel and flight redemption to the relevant member, including booking reference, route or hotel name, points debited, cash amount, and transaction date. Filterable by category, member, status, and date range.

For reward programs where travel is a significant part of the redemption mix, this replaces referencing across multiple reports. One audit-ready view for tracking utilization, managing budgets, and reporting program ROI to stakeholders.

### 05 — Product category column in redemption reports

Redemption reports now include a Product Category column showing whether users redeemed gift cards, merchandise, experiences, or lounge access. This is available in your dashboard as well as CSV exports.

Clients who can see category-level redemption patterns are better positioned to understand popular categories that drive engagement, retire low-performing categories, and run promotions that drive the outcomes they want.

*Available for storefront integration customers.*

<Frame>
  <img alt="Image" />
</Frame>

### 07 — Custom support contact across communications

Clients can now choose to display a dedicated support contact across the reward marketplace and outbound communications.

When users need assistance, they now see your team's contact details instead of a generic default. This ensures they reach the right team directly, rather than navigating through incorrect channels.

<Frame>
  <img alt="Image" />
</Frame>

## Other Improvements

### 01 — Hotel confirmation numbers delivered automatically

User can now receive their hotel confirmation number via email as soon as it is available after booking. The platform monitors each confirmed booking and triggers the notification automatically.

### 02 — Passenger name validation on travel bookings

Real-time validation on passenger name fields now flags errors before the user confirms a booking, for both domestic and international travel.

Catching these errors before the user hits confirm means fewer failed bookings.

<Frame>
  <img alt="Image" />
</Frame>

### 03 — Discount amount tracking in reports

Discount amounts now appear as a dedicated column in reports, displayed in your account's base currency.

*Available for Rewards API customers.*

## Coming soon

* **Multi-language storefront** — Support for English, Hindi, Marathi, Malayalam, and Tamil, bringing a localised experience across regions.

* **Milestone-based lounge access** — Cardholders will be able to earn a complimentary airport lounge visit upon reaching a defined spend threshold.

* **Offer code discounts** — Unique discount codes for distribution, letting users apply savings directly at checkout on the Plum storefront.

Questions or feedback? Reach out to your Customer Success Manager or write to us at [support@xoxoday.com](mailto:support@xoxoday.com)


# Product Updates - May 24
Source: https://help-plum.xoxoday.com/product-updates/product-updates-may-24

Browse a further set of Plum product updates from May 2024, covering additional features and enhancements shipped.

In recent weeks, we’ve introduced an array of exciting features designed to enhance the user experience. These include the launch of our Points API, which empowers personalized engagement and seamless integration, automated reminder emails to ensure the success of your campaigns, and the introduction of the Payment Report API, providing detailed transaction histories. But that’s not all – we're offering you an exclusive sneak peek at the features slated for release in the coming months.

# Launch of Points API

<img alt="" />

## Feature Overview

We are thrilled to announce the launch of our latest feature, the Points API, designed to elevate customer engagement strategies to new heights. This powerful API empowers customers to enable a points engine inside their mobile and web applications, creating dynamic point-based engagement programs tailored to their specific needs, including loyalty programs, employee engagement initiatives, channel partnerships, and influencer collaborations.

## Key Functionality

* Seamless Integration: The Points API facilitates the effortless sending of points and retrieval of point balances, allowing customers to seamlessly incorporate a points engine directly into their mobile and web applications.

* Versatile Applications: With the Points API, customers can leverage its functionality across a wide range of engagement initiatives, unlocking new opportunities to connect with their audience and drive participation.

* Personalized Engagement: By incorporating point-based rewards and incentives, customers can deliver personalized experiences that resonate with their audience, fostering stronger connections and lasting relationships.

​Security:To ensure enhanced security, the Points API features robust oAuth 2.0 authentication and IP address whitelisting. These measures are implemented to safeguard customer data and protect against unauthorized access, providing peace of mind for both customers and end-users.\*\*Redemption Opportunities:\*\*Points issued to end-users can be redeemed on Xoxoday's Global marketplace, offering thousands of brands across 90+ countries. This extensive marketplace makes the offering very lucrative, providing users with a diverse range of options to redeem their points and enjoy rewards that suit their preferences.**​Benefits:**

* Enhanced Engagement: The Points API enables customers to engage with their audience in a more streamlined and efficient manner, driving participation and fostering stronger connections.

* Flexibility and Efficiency: Customers can now create and manage robust engagement programs with ease, thanks to the flexible and efficient capabilities of the Points API.

* Improved Customer Satisfaction: By delivering value and rewards in a personalized and seamless manner, customers can enhance customer satisfaction and loyalty, ultimately driving business growth.

​Availability:The Points API feature is now available to all customers, enabling them to unlock new possibilities in customer engagement. For more information on how to get started with the Points API, please refer to the documentation or contact our support team for assistance.We are excited to see how our customers will leverage the Points API to create innovative and impactful engagement programs, and we look forward to supporting them on their journey to success.

# Reminder Email For Clients

<img alt="" />

This feature aims to send periodically reminders to all end users who have active rewards waiting to be redeemed.

It empowers clients with automated reminder emails ensuring better success rates of campaigns being run by the clients and that the rewards are redeemed by the intended recipients.

# Introducing Payment Report API

<img alt="" />

Reward API customers can now fetch the entire transaction history of an account. Transaction history data includes information on fund additions, deductions and refunds. This will help integrate with reporting tools and assist finance team during the monthly reconciliation process.

# Standardizing Order Delivery Status Events in Webhooks

Currently, Reward API customers have the option to select "Delivered" or "Cancelled" events for an order delivery. With our new update, Order Delivery Status events will be standardized. These events will be enabled by default if the Webhook Status is enabled. We will send all events related to Order Delivery Status to the Callback URL listed.

# Order Delivery Status Events to Now Include Refund Information

We have enhanced the webhook functionality by including refund information in the payload. Along with "Delivered" and "Cancelled" status events, we'll now include a 'refundStatus': 'Refunded' key in the payload. This event will be posted only when a refund is successfully added to the admin wallet.

# Notifications if Webhook Status is disabled

Admins can now get notified if the Webhook status is auto disabled if the Callback URL is not functioning, which will allow them to check the URL status and take further actions to rectify the issues. Immediate actions taken to rectify the URL will help users to receive the Order delivery status change events that they are dependent on to take actions related to order delivery in their user journey.

# Upcoming Features

## IP whitelisting via Admin Dashboard

Super admins will be able to add / update and delete the IPs from the Admin Dashboard to access the APIs and avoid the manual process.

## Merchandise via Xoxo Links

Admins will be able directly send a selection of merchandise for the users to choose from that will be delivered to the end users address.

## New improved DIY flow

The upcoming new DIY flow simplifies the process of creating an account and getting started with sending rewards. There is no separate business activation as it has been integrated as a part of the send rewards flow.

## Enhanced Email Capabilities

Admins will be able to format, add links in the messages and add a personal footer sent to the end users with the new email editing capabilities. They will also be able to set templates as default such that they do not have to make changes every time they login.

## Minimum Balance Notifications

To ensure smooth redemption of rewards, we will have automated notifications to the admins ensuring there is sufficient balance in the wallet for redemption.

## Enhancements in Reward API Reports

Super admins can now know which super admin / admin has sent the rewards. This helps the users to have visibility in their operations and reconciliation process.

## Track Order in Marketplace

Users in the marketplace will now track their orders by providing necessary information. They can view order details, check the order status, and access other relevant information.

## Enabling WhatsApp for Verification Process

We are introducing WhatsApp as a secondary channel for delivering verification OTP messages to users. This addition aims to enhance delivery rates, expand coverage across various regions, and optimize costs.


# Release April 2020
Source: https://help-plum.xoxoday.com/product-updates/release-april-2020

Read the Plum product update for April 2020, covering new features, improvements, and fixes shipped that month.

*Plum Product Enhancements: April 2020*

In the April 2020 update to our Rewards and Redemption platform, Plum focused on adding some innovative ways to distribute its extensive catalog and improving some existing features. Let's have a look at what Plum's April 2020 update has to offer.

## Simplified URL-Based Rewarding

The latest update simplifies the user's reward redemption experience on Xoxoday Plum. With this new rewarding method, the user is provided with a URL, from where s/he can choose from a defined range of rewards and claim it in a single click.

This removes the cumbersome multi-step process of checkout, making the journey from selection to reward to redemption much simpler especially on a mobile device.

**URL-based rewarding: Video guide**

The journey is seamless, and the user does not have to access any external website or system to redeem rewards. This removes the inconvenience for users of filling out a lot of information as the unique URL will have the following pre-stored information:

* Value (Mandatory)

* Catalog (Mandatory) - This will guide which brands to show

* Name of User (Optional)

* User E-mail (Optional)

* User Phone (Optional)

Upon clicking the URL, the user will be shown the brands that s/he eligible to procure. The four-step process goes like this:

* The user clicks on the unique URL

* The listed brands are displayed

* Users can take their pick and click 'Redeem'

* The brand voucher is displayed, from where the user chooses the reward and receives the code!

<Frame>
  <img alt="" />
</Frame>

<Frame>
  <img alt="" />
</Frame>

## Plum-Pro Updates

Now procure an extensive catalog of vouchers from different brands from a choice of interfaces:

* Web Interface for small quantities/single brand vouchers

* The Plum-Pro API for bulk purchases

* The Plum-Pro catalog can be expanded with easy integrations rather than approaching different vendors for a catalog of multiple vouchers.

* The new APIs for Plum Pro are more robust, more secure, faster response and have a backward-compatible version as well.

These result in:

* Seamless handling of errors with correct HTTP codes

* Easy migration from old APIs to new

* Improved API design and a modern tech stack

* Formidable uptime along with a faster response time

* Easy customer query resolution

* Supports future enhancements and new features

* An enhanced reports API to keep track of all requests

## Admin Journey Revamp for Xoxo Codes & Points

The Xoxo Code and Points journey have been revamped in order to make it simpler for the admin. For the user, here-to-fore mandatory steps are also minimized and the journey is now just a single page send.

Campaigns have also been streamlined. In the new journey, all the information about campaigns and the email template is pre-selected and ready. The admin only has to select new field notes for reference. In addition, personalized messages can be sent to recipients.

<Frame>
  <img alt="" />
</Frame>

## Enhancements for Administrators

With the new update, it is possible for the super-admin to edit the list of admins i.e. add and/or delete another super admin.

This is crucial in cases when the responsibilities of handling the rewards change hands and the Super-Admin can add or edit the list of super admins.

Also, now it's possible to add another admin and register the same person as a user simultaneously. No need to add the person to the overall user list first and then make him/her the admin from the existing list.

Now the organization's super-admin has the power to manage admins entirely.

## Guest Checkouts

Xoxoday Plum now supports checkouts by all site visitors. Anyone can explore thousands of offers, experiences, vouchers, deals, and more on the Xoxoday Store.

Previously, Xoxo Codes or Points were required to shop from the Xoxoday Store, typically by an employee recipient. Any site visitor can browse as a "guest" and buy, on registration of an email address, with a payment method of their choice.

<Frame>
  <img alt="" />
</Frame>

## The 'How to Use' Section

The users can decide on the basis of redemption procedures. The unique steps to redeem for each brand are represented individually just under the voucher listing.

To address the user's frequently asked questions and increase redemptions we display redemption steps and options for each brand just under the voucher listing.

<Frame>
  <img alt="" />
</Frame>

## Globally Expanded Catalog

Our extensive catalog of 2000+ vouchers just got even better. We have added three new catalog vendor-partners (via API integrations), expanding the Xoxoday catalog to further reaches of the globe.

That's all for the Plum Product Enhancements launched in April 2020. If you have any specific questions, feel free to [contact us](https://www.xoxoday.com/company/contact-us), or [book a demo](https://www.xoxoday.com/book-a-demo). Until then, [stay safe and stay home!](https://www.xoxoday.com/)


# Release April 2023
Source: https://help-plum.xoxoday.com/product-updates/release-april-2023

Read the Plum product update for April 2023, covering new features, improvements, and fixes shipped that month.

With this release, we have added a feature in Xoxo reward links: admins can now include up to 50 brands in a campaign, giving users access to a wider selection of brands for more customized and targeted campaigns. This opens up new opportunities to showcase products and services to potential customers.

<Frame>
  <img alt="" />
</Frame>

## Customize your Catalog with Xoxo Points

We've added a new feature that allows admins to customise the rewards catalog when sending Xoxo points. With Catalog Customisation, customers can create a tailored catalog of options that suit each recipient's interests and needs, taking their reward-giving experience to the next level.

<Frame>
  <img alt="" />
</Frame>

## Integration with Forsta

We're excited to announce our integration with Forsta (previously Decipher) - an enterprise-grade survey tool. This integration allows Forsta users to automate survey rewards and incentives directly within their environment, based on triggers like geography and denominations. With a quick and easy setup, customers can now reward their survey respondents seamlessly, saving time and effort.

<Frame>
  <img alt="" />
</Frame>

## Email domain authentication

Our latest feature simplifies the process of sending reward emails via a client's domain. Previously, clients had to raise a CS ticket to authenticate their domain, but now Super Admins can do it themselves in just three easy steps. Users can customize their Sender email from settings, giving them greater control over the reward-giving experience.

<Frame>
  <img alt="" />
</Frame>

## Showing the creator of Automation

Super Admins can now identify the creators of Automations, enabling them to better monitor and manage ownership and administration of specific Automations. This increased visibility can ensure effective implementation.

## Introducing variable denomination

Variable denomination options are now available in Storefront, Plum PRO Dashboard, and Xoxo links. Admins can enter their desired denomination for certain brands and products during checkout or campaign creation, providing greater flexibility.

<Frame>
  <img alt="" />
</Frame>

<Frame>
  <img alt="" />
</Frame>

<Frame>
  <img alt="" />
</Frame>

## Download all link options in Xoxo Links (Generate to Self)

All links across all batches can be downloaded at a single click as against downloading each batch separately from the download option under reports.

## New Sample CSV files

Previously, the sample file format in Xoxo points, codes and links were having test email addresses and was not matching the persona of HR and the rewarding use-cases. This is revamped completely in the current version which comes along with how to use the sheet instructions.

## New DIY Flow and home page with Zero States for all pages

A new flow has been made live that prominently highlights to the user to submit business verification and also allows them to navigate across all pages and features explicitly mentioning the features that require verification.

## Timestamp in Reports is now in UTC format

In Admin Reports, users will now be able to see the Order Sent & Delivered Date and time in UTC format. This will help them get data in UTC format than in IST format which was followed earlier.

## Automated the amazon global brand KYB

Now Admins can apply for a global amazon brand voucher from plum admin. The xoxoday team will take care of the approval and update with the status. This helps admins fast track the brand KYC approval process and reward quicker.


# Release April 2024
Source: https://help-plum.xoxoday.com/product-updates/release-april-2024

Read the Plum product update for April 2024, covering new features, improvements, and fixes shipped that month.

We have a ton of collective knowledge to share with you! In the past few weeks, we've added new features to our Plum platform, including new invoice download functionality, expanded japan catalog and many other improvements for the admins. But that's not all we have revealed the new features expected in the upcoming months.

## New Invoice Download Functionality

The admin dashboard now includes a convenient invoice download option. Users can directly access and download their invoices, streamlining the process and improving accessibility to essential documentation.

<Frame>
  <img alt="" />
</Frame>

## Optimized Mobile Number Validation

Improvements have been made to the mobile number validation process during reward issuance. The system will now promptly notify users for corrections when entering recipient details, enabling immediate rectification. Additionally, the "Are you Sure?" prompt has been removed, redirecting administrators directly to the mobile number edit page or back button for a more efficient workflow.

<Frame>
  <img alt="" />
</Frame>

## Expanded Japan Catalog

To better serve our Japanese customers, we have significantly expanded our product catalog by introducing a wider range of premium brands and offerings tailored to their preferences.

<Frame>
  <img alt="" />
</Frame>

## Enhanced User Experience in Catalog Browsing

The catalog page has undergone a redesign to deliver an intuitive and user-friendly experience. Customers can now easily locate product discounts and compare pricing plans across various options, facilitating informed decision-making.

## Upcoming Features

### IP Whitelisting Made Convenient

Administrators will now have the ability to whitelist IP addresses directly from the Admin Dashboard. This feature will enable seamless access to APIs without the need for manual whitelisting processes, streamlining your workflow and enhancing operational efficiency.

### Account Setup Simplified

We understand the importance of a smooth account setup process. To facilitate this, we are streamlining the account verification flow by providing pre-filled business information details. This enhancement will save you valuable time by eliminating the need to manually enter tax numbers and other details, allowing you to complete your account setup effortlessly.

### Personalized Reward Communications

In our continuous effort to provide personalized experiences, we are introducing new customization options for reward email templates. You will now have the ability to add custom messages in the email body and include a footer at the end of the email. This feature will enable you to tailor reward communications to your specific needs, enhancing brand recognition and improving recipient engagement.


# Release August 2020
Source: https://help-plum.xoxoday.com/product-updates/release-august-2020

Read the Plum product update for August 2020, covering new features, improvements, and fixes shipped that month.

*Release Aug' 20: Digital Rewards Management Easier than Ever*

The Xoxoday Store comes up with a handful of new features in August. Along with handy admin capabilities, ease of redemption for users, digital rewards management, and global guest checkout, here's how the new features released in August look like at Xoxoday Plum.

## Manage different organizational wallets hierarchically with hierarchy capability in reward administration

<Frame>
  <img alt="" />
</Frame>

Even though the multi-admin capability helped different admins of an organization manage their separate wallets with full functionalities, it was tough to track and control the organization level rewarding functions and reward administration. With the new admin hierarchy feature, a super-admin can manage separate wallets hierarchically under a common wallet - across all distribution methods.

Super admin(s) can now set thresholds for admins while they distribute points as well as send out brand vouchers. The common wallet can be recharged and admin-wise spending patterns can be tracked by the super admin. This provides a holistic view of rewarding patterns throughout the organization and helps in reward administration.

**NOTE: To know more about how to enable this feature on your existing Xoxoday Plum platform, please talk to your Account Manager or wave to us at [cs@xoxoday.com](mailto:cs@xoxoday.com). We'll be happy to run you through.**

## Multi-admins of non-hierarchical accounts can now transfer funds amongst each other

<Frame>
  <img alt="" />
</Frame>

When a reward program admin leaves an organization, **they previously could not transfer their balance points to another admin**, disrupting the balance availability. With this release, program admins who are being relieved from the company can readily transfer the amount in their wallet to another admins' account. **An admin can either transfer their share of points to existing admins before leaving their roles, or they can add another admin and transfer the points** - according to what works best for them. This capability makes reward management especially the reward points management seamless for the organization. Xoxoday Plum has made employee reward management an easy task. That's the reason why it is considered one of the best employee reward management software worldwide.

<Frame>
  <img alt="" />
</Frame>

<Frame>
  <img alt="" />
</Frame>

[Book a demo now to talk to our experts>>](https://www.xoxoday.com/book-a-demo)

## Anyone can shop at Xoxoday Plum! the Global Guest Checkout desk is live

The Xoxoday Store is home to thousands of employee perks and benefits, experiences, vouchers, and surprises. With the new guest checkout, anyone can now check into the Xoxoday Store and shop through a wide catalog of options. In other words, **a user who does not have Xoxo codes, Xoxo points, or even a Plum user account can go ahead and purchase gift cards and experiences** that they have laid their eyes on.

Customers can browse through the Xoxoday Store, add items to cart and check out as a guest via email. With payment options safe and secure, the users can complete transactions seamlessly. In essence, customers no longer need a Xoxo Code or need to have xoxo points to purchase an item of their choice from Plum.

<Frame>
  <img alt="" />
</Frame>

<Frame>
  <img alt="" />
</Frame>

## First-time users, know the Store when you visit with the Redemption Walkthrough

Learn how to redeem gift cards, points, and Xoxocodes on your first visit with a short redemption walkthrough. There's a step-by-step process to understand how to redeem via gift card codes and via Xoxo points. To know more about Xoxocodes and XoxoPoints redemption, check out the given link.

In addition to that, the customers can also check the validity and balance of their Xoxo Code right from the home screen along with the link to 'How to Redeem' that will be always accessible from the Plum site header.

<Frame>
  <img alt="" />
</Frame>

## Admins, keep track of the rewarding context with the Notes feature

There are countless instances of rewarding at Xoxoday Plum and keeping track of each is not possible without a brief detail from the rewarder. In the reports section, the rewarder can give a description of why they are rewarded as it helps get a clear picture of the digital rewarding activity. With that, the admins can adjudicate on the context of reward(s) and their utility.

<Frame>
  <img alt="" />
</Frame>

<Frame>
  <img alt="" />
</Frame>

[Start free trial today to avail the benefits of Xoxoday Plum>>](https://stores.xoxoday.com/admin/signup)

## Users can now receive Xoxocodes and Xoxopoints via SMS

To help reward program admins deliver digital rewards to even remote users, Plum has now enabled Xoxocode, Xoxopoint, and Gift voucher delivery via SMS. The end users now receive notifications via SMS when the points, codes, and gift voucher credentials are sent. This SMS includes the redemption codes and a URL to Plum stores or the respective brand catalog where the digital rewards codes and vouchers can be redeemed. This makes digital rewards program management easy.

## Users can clear all queries with FAQ Help-bot

With the new FAQ Prime assistant, users and shoppers can get all their grievances answered with the given FAQ guide. In case the problem is left unresolved, the user can switch to live chat or raise a ticket.

<Frame>
  <img alt="" />
</Frame>

This solves all the user problems then and there meanwhile if the solution to the issue can't be found, it can be taken up in real-time.

## The Xoxoday Store is Optimized and Quicker than ever

Considerable improvements were made in the engine room that improved the page and image loading speed to make the Xoxoday Plum experience smoother for the end-users.

## New Additions to the Xoxoday Stores in employee perks and benefits

Last but not least we have the addition of various [employee perks and benefits](https://www.forbes.com/pictures/56b3b990e4b062f6b5994e8b/the-top-10-employee-perks/?sh=280b152c64c3).

<Frame>
  <img alt="" />
</Frame>

[Explore all Perks>>](https://stores.xoxoday.com/us-marketplace-demo/vouchers?category_id=1271)

<Frame>
  <img alt="" />
</Frame>

[Explore all Gift Cards Option>>](https://stores.xoxoday.com/us-marketplace-demo/vouchers?category_id=1271)

That's all for this month's new features at Xoxoday Plum. Missed the last update in features? Check it out here.


# Release August 2023
Source: https://help-plum.xoxoday.com/product-updates/release-august-2023

Read the Plum product update for August 2023, covering new features, improvements, and fixes shipped that month.

We have a ton of collective knowledge to share with you! In the past few weeks, we've added new features to our Plum platform, including inbuilt templates, integrations, recommended products and many other improvements for the admins. But that's not all we have revealed the new features expected in the upcoming months.

## A new tab for email templates

A new tab has been introduced with pre-defined templates for the admin user to pick from while sending rewards. This eases the process of sending rewards as the admin need not create email template modifications from scratch.

<Frame>
  <img alt="" />
</Frame>

## 12 months historical report

Admins will now be able to see records of the last months 12 months instead of 6 months. Thus all the rewards sent that have not yet expired will be available for the users.

<Frame>
  <img alt="" />
</Frame>

## Punchout Integration

Xoxoday is now fully punchout integrable with all major Procurement ERPs, allowing for a seamless rewards procurement experience like never before. Whether you use SAP Ariba, Coupa, Oracle Procurement Cloud, or any other procurement system, Xoxoday can easily incorporate it into your existing workflow.

<Frame>
  <img alt="" />
</Frame>

## Option for a minimum threshold for redemption

The admins, while sending Xoxo points, will be able to set a minimum threshold for redemption such that the end users would need to accumulate points until they have more than the threshold value set in order to continue with redemption.

## Reference ids on generate to self

On xoxo link, generate to self, admins will now be able to generate links along with the reference id making it easier to identify and track a specific link across different reports.

## Stores/Marketplace Checkout Validations

For stores checkout there are validations being introduced where based on the user reward information and the payment method they would use like: Xoxo Reward Code user would be asked for additional OTP verification.

## Improvement in the Experience Catalog

Showcase only product enriched sub-categories in experience for respective countries on storefront.

## Introducing Partial delivery information in Xoxo Rewards API Reports

With partial delivery information Admins can now have information

* Delivered Quantity: This allows the users to know the number of vouchers that are delivered to the recipient.

* Pending Quantity: This allows users to know the pending quantity to be fulfilled.

* Canceled Quantity: This allows users to know the quantity that is Canceled and refund has been initiated.

**In Plum Status Page:** Now customers can now subscribe to the Status page and get notified at instances when there is a unplanned / planned downtime with Xoxoday system which involves Rewards APIs, Storefront and Admin Dashboard.

## Upcoming Features

### Reporting & Analytics For Admin

Get powerful insights and reports. Admins will soon be able to analyze their order patterns on Plum Admin dashboard.

### Auto debit Functionality

No more hassles of loading your wallet. The upcoming auto debit functionality will auto recharge your wallet when it goes down below a specified threshold value.

### Email & SMS Customisation in Xoxo Rewards API

This feature will help you send impactful campaigns and save development efforts. It will help you create and customize email templates in a jiffy.

That's all for this month's new features at Xoxoday Plum. Missed the last update in features? [Check it out here](/product-updates/release-june-2023).


# Release August 2025
Source: https://help-plum.xoxoday.com/product-updates/release-august-2025

Read the Plum product update for August 2025, covering new features, improvements, and fixes shipped that month.

*Learn all about product updates in Xoxoday Plum*

## Latest from our world of Rewarding

Here's a quick look at what's new in Xoxoday Plum this month. We've made discounts on gift cards easier to spot, introduced hotel bookings to the storefront, strengthened security with Reward code restrictions. Plus, we're working on exciting new features like cashout options, cashback products, and gamification to make rewarding more engaging and valuable.

## Here's what's new:

### 1. Gift Card Discounts on Homepage

We've made it easier for customers to spot deals immediately.

Discounts on gift cards are now displayed directly on the homepage, so users can find savings without navigating through multiple categories or checkout pages. This simple enhancement not only improves the user experience but also boosts conversions by highlighting deals at the first touchpoint.

<Frame>
  <img alt="" />
</Frame>

### 2. Hotel Bookings on Storefront

Xoxoday Plum now offers a seamless travel booking experience with the new Hotels category.

Customers can search, compare, and book hotels directly on the storefront, alongside their usual rewards shopping. By combining travel and rewards in one place, this feature adds convenience for users and expands the value of the platform, making it a more comprehensive marketplace.

<Frame>
  <img alt="" />
</Frame>

### 3. Reward Code Locked to One Verified User

To enhance security and prevent fraudulent redemptions, each Reward code is now locked to a single verified user after its first use.

This change ensures codes cannot be shared or reused, providing a trustworthy and seamless experience for users while giving businesses confidence that codes are used exactly as intended. By protecting both customers and the platform, this update strengthens the integrity of reward redemptions.

## Upcoming features:

### Cashout Option

Users will be able to convert their points into cash payouts giving them more freedom on how they use their rewards.

### Cashback Products

We're adding Cashback Products to the Xoxoday Marketplace! Shop from your favourite brand websites, enjoy exclusive deals, and earn cashback that can be redeemed on your next purchase, making every transaction more rewarding.

### Gamification

Admins will soon be able to launch interactive games like Spin the Wheel and Scratch & Win, seamlessly embedded into the marketplace to drive higher engagement in campaigns, loyalty programs, and giveaways.


# Release December 2020
Source: https://help-plum.xoxoday.com/product-updates/release-december-2020

Read the Plum product update for December 2020, covering new features, improvements, and fixes shipped that month.

The year concluded with a new array of updates on the Xoxoday Plum platform. As we gear up to become better in the coming year, here is the list of things that rolled out in December. Ranging from changes in the Xoxo Link-based redemption to major changes in campaign management for admins, let’s check them all out.

## Now create and distribute Xoxo Links to individual recipients directly from the Admin Portal

Sending out rewards as Xoxo Links to multiple users earlier came with a process of generating the links in batches, which you had to manually distribute from the given batch. These laborious efforts have now been reduced. With the new release, distribute Xoxo Links directly to your recipients via email or SMS from the Admin Portal along with a personal message.

This change reduces the manual work involved in rewards distribution and keeps the element of personal touch intact with a message to go with every reward you send via Xoxo Link.

## New customer? Now avail a seamless onboarding experience and get a grip of everything in Plum.

It's never too late to begin to reward and recognize the Xoxo-way, and now it's simpler than ever. New Xoxoday Plum customers can now sign up through the given instructions which would be thoroughly walked through in a welcome email. Follow all the given instructions and get started with rewarding without any manual intervention. Need our help? Get all the necessary resources and if there's anything needed in particular, simply [contact Xoxoday](/product-updates/release-december-2020) and address your query.

## Users can now get redirected to campaigns linked to their Xoxo Code(s) by checking the details

For every campaign run and batches of Xoxo Codes sent, there's a particular URL attached on which the campaign can be accessed. To fix the problem of users not being able to find the correct URL linked to the campaign, now the users can check their Xoxo Code details and get redirected to the specific campaign attached to their Xoxo Codes.

This would make the user journey simpler as they'll just need to match up to their codes and visit the URL, reducing the manual intervention from Xoxoday's end to search for the campaign URL, and reducing complaints in the admin's kitty for the very problem.

## Admins can now check the discounts and surcharges for brands while setting up campaigns.

Xoxoday Plum comes with an added fiscal advantage wherein the organization saves a sliver of cost while distributing gift vouchers through Plum. To analyze the benefits, admins can now check and identify any discounts and surcharges on brands and their vouchers. With this level of transparency, your organization would get a tangible idea of the Xoxoday Plum advantage, while the campaigns can be set up accordingly.

## Advanced protection against risk and malpractice with new Alert Rules

Xoxoday Plum is a secure haven for clients, users, and customers alike and we keep making it safer and airtight with every release. This time out, multiple alert rules have been introduced to identify the minutest risks of potential risk, suspicious activity, or any digital malpractices. From analyzing questionable user behavior to other digital breaches, the new alert rule engines will keep a stern eye out for anything out of the way.

## Now buy Prepaid Cards seamlessly with simplified procedures and OTP registration.

On buying prepaid MasterCard/Visa from Xoxoday Plum, seamlessly process your purchase and get your OTP delivered on your contact unlike before, wherein the OTP had to be delivered from Xoxoday's end. This results in a smooth journey from adding to the cart to procuring the card.

That's all for this feature release in Xoxoday Plum. Have a question? [Talk to us](https://www.xoxoday.com/book-a-demo)


# Release December 2021
Source: https://help-plum.xoxoday.com/product-updates/release-december-2021

Read the Plum product update for December 2021, covering new features, improvements, and fixes shipped that month.

This December, we have undergone a few major changes on both the plum admin side and the integration side.

We have come up with a cleaner UI for email customisation in the new update. This includes UI for editing, banner selection, etc. Admins will now be able to do bulk cancellation and resend mail confirmation in xoxo links, going forward we have standardized the email which will be used for all the communication ([notifications@xoxoday.com](mailto:notifications@xoxoday.com)).

On the integration side, we have come up with improved campaign automation, admins will now be guided throughout the process with step-by-step instructions, suggestions, and informational pop-ups flow. Admins will now be able to reactivate any existing automation created in the admin portal. Now the admin can also reactivate/deactivate any automation based on the requirement.

Here are more details about the latest update:

## Rewarding Email Improvements

In this release, we have enhanced the email templates sent with Xoxo Code and links either from the platform or integration. This includes cleaner UI for editing and selecting banner and logo, customizing the message at a campaign level, and previewing the email on both desktop and mobile. Admins can send a personalized message now, which will overwrite the default message. The email elements can now be customized while editing the campaign with this new edition. The reward communication has also been made crisp.

<Frame>
  <img alt="" />
</Frame>

## Bulk Selection and cancellation in Xoxo Links

With this release, admins can select records in bulk, resend the reward details or cancel multiple rewards at a single click in Xoxo Links. Rewards details can be sent from the platform or triggered through integration and accessible under Reports > Xoxo Links. The system would also guide them through what actions are possible as shown below.

<Frame>
  <img alt="" />
</Frame>

## Email domain for notifications

We have noticed non-synchronous emails, which led to confusion among admins and end-users. Events such as Low balance, product updates, welcome/setup emails got notified using [accounts@xoxoengage.com](mailto:accounts@xoxoengage.com), [notifications@xoxoday.com](mailto:notifications@xoxoday.com), [hr@xoxoday.com](mailto:hr@xoxoday.com) emails, respectively. With this release, all emails sent would be sent from [notifications@xoxoday.com](mailto:notifications@xoxoday.com) to help you get alerted systematically.

<Frame>
  <img alt="" />
</Frame>

## Threshold Feature and used amount in common wallet type companies

We have introduced the ability for super admins to reset the threshold counter. They can allow admins to reward up to the threshold limit and then reset it periodically without updating the threshold every time. The super admins will also increase or decrease the threshold limit without affecting the **"used amount."**

The admins will always be able to view the threshold limit and how much they have reached in all rewarding screens, making it easier for them to plan out their rewarding.

<Frame>
  <img alt="" />
</Frame>

## Newly Improved Integration Automation Setup flow

With the latest update, admins will now be guided throughout the process with step-by-step instructions, suggestions, and informational pop-ups for all the integrations such as SurveyMonkey, Hubspot, and others. There has been an improvement in the interface and the user journey experience.

<Frame>
  <img alt="" />
</Frame>

## Ability to disconnect/reconnect integrations

With the current release, the admins will now be able to disconnect/reconnect any integration based on the requirement. This will assist them in connecting another account, removing an account, exiting an existing integration, etc.

<Frame>
  <img alt="" />
</Frame>

## Ability to deactivate/activate integration automations

Earlier, there was no ability to reactivate any existing automation created in the admin portal. Now the admin can reactivate/deactivate any automation based on the requirement. This helps admins to use the old campaign for a new survey instead of creating a new one from start.

<Frame>
  <img alt="" />
</Frame>


# Release December 2022
Source: https://help-plum.xoxoday.com/product-updates/release-december-2022

Read the Plum product update for December 2022, covering new features, improvements, and fixes shipped that month.

We're back again to share some significant feature upgrades that have happened on the 'Plum Admin' side over the weeks, and we can't wait to share about this newly revamped avatar.

The revamp project is a massive step in making our platform stand at par with the other recognised global SaaS players. This is no less than a milestone in having a common design language for all products of Xoxoday.

## Highlights of the newly upgraded 'Plum Admin':

* Enhanced UI: The dashboard is cleaner, easier, and sleeker, with an improved look and more intuitive interface.

* Easy navigation: The navigation is now standardised and much more organized to help you quickly find and accomplish tasks from the dashboard.

* Simplified UX: Sending rewards (across all modes of distribution: Code, Links, and Points) to your recipients is as easy as a single click.

* Better reward tracking: View the total number of rewards sent, redeemed, and cancelled (monthly/yearly) from the dashboard's homepage. Click on **'View reports'** to have a bird's-eye view of all the transactions done, along with other data insights.

<Frame>
  <img alt="" />
</Frame>

<Frame>
  <img alt="" />
</Frame>

## Payments

Our platform now integrates with 'Payoneer,' a payment processor to manage international currencies (except EURO and GBP) and help businesses to do a wallet recharge (in any currency) in real-time via credit or debit cards (VISA/MasterCard).

Clients can do a wallet recharge of up to USD 1000 per transaction.

<Frame>
  <img alt="" />
</Frame>

<Frame>
  <img alt="" />
</Frame>


# Release December 2024
Source: https://help-plum.xoxoday.com/product-updates/release-december-2024

Read the Plum product update for December 2024, covering new features, improvements, and fixes shipped that month.

*Latest from our world of Rewarding*

We've recently rolled out several exciting features to enhance the user experience. These include a new Perks category on the marketplace making it easier for users to access perks-based products, and an improved DIY sign-up process, streamlining registration for better efficiency and user engagement. These updates and many others are designed to create a seamless, secure, and efficient experience for admins and users.

## Here's what's new:

### 1. New "Perks" Category in Storefront

A new "Perks" category has been introduced to enhance the user experience on Plum's storefront. This exciting addition offers a curated selection of deals and discounts from popular brands, making it easier than ever to explore exclusive perks. This update simplifies navigation, giving users quick and easy access to a wide range of perks-based products.

**Key Features:**

* Dedicated "Perks" Category: Products related to perks are now grouped together for easier discovery.

* Improved Navigation: Users can quickly find and explore perks-based products with a more streamlined interface.

<Frame>
  <img alt="" />
</Frame>

### 2. Improved DIY Sign-Up Flow

We've enhanced the DIY sign-up flow to improve user engagement and usability.

**Key Improvements:**

* Better User Experience: Optimized flow for smoother sign-up.

* Additional Validations: More checks are added to ensure accurate data.

* Optimized Submission: Streamlined form submission for quicker processing.

These changes aim to make the sign-up process faster and more efficient.

<Frame>
  <img alt="" />
</Frame>

<Frame>
  <img alt="" />
</Frame>

### 3. Introducing Perks as a New Category in Rewards API

Customers can now access the list of Perks and expand their redemption options through the existing Rewards API. To enable this feature for your account, please contact your account manager.

<Frame>
  <img alt="" />
</Frame>

### 4. Email and SMS Activity in Rewards API Reports

We've added Email and SMS activity tracking to the Rewards API Reports, enabling you to monitor and analyze the communication activities related to rewards distribution.

Keeping up with the new features is the first step. Next, and more important step, is to see their impact on your reward strategy in action.

<Frame>
  <img alt="" />
</Frame>

## Upcoming features:

### Flight Booking on the Marketplace

Soon, you will be able to book flights directly through the marketplace. This will allow users to find and book flights easily alongside other rewards, streamlining the travel booking process.

### Gamification on the Marketplace

We're introducing exciting gamification features like Spin the Wheel and Scratch and Win to the marketplace. Admins can customize the rewards and prizes, allowing users to redeem their points for a chance to win. This feature adds a fun, interactive layer to the reward process, making it more engaging and enjoyable for users to earn and claim rewards.

### Airmiles Point Exchange on the Marketplace

Airmiles Point Exchange is coming to the marketplace, allowing you to redeem reward points or codes for miles with major airlines worldwide. This feature will support all leading airlines and miles programs, turning rewards into travel opportunities.

### Benefits & Offer Marketplace

A new Benefit & Offer Marketplace is on its way, designed to enhance reward programs focused on user engagement. Featuring popular deals, discounted products, and gift cards, it will support purchases with or without points redemption. It is ideal for clients in FMCG, consumer, and employee domains to drive more effective reward engagement.

## Want to request a feature on Xoxoday?

Get in touch with our customer success team at [cs@giift.com](mailto:cs@giift.com)


# Release - December 2025
Source: https://help-plum.xoxoday.com/product-updates/release-december-2025

Read the Plum product update for December 2025, covering new features, improvements, and fixes shipped that month.

*Get updates on Xoxoday Plum.*

**Latest from our world of Rewarding!**

We've rolled out new updates to make your experience smoother and more versatile. This month, we are introducing enhanced administrative controls for our enterprise partners and high-capacity distribution features to scale your engagement efforts effortlessly.

## Here's what's new:

### 1. Flexible Billing Address Management

Managing multiple legal entities just got easier. You can now choose, add, edit, or remove billing addresses directly while recharging your Xoxoday Plum account. The selected address is automatically reflected in both proforma and final invoice PDFs, giving your finance team full control and eliminating manual follow-ups.

<Frame>
  <img alt="" />
</Frame>

### 2. API Rate Limits for Improved Reliability

To ensure platform stability and consistent performance for all integrations, we've introduced per-client rate limits across key APIs. This prevents accidental traffic spikes and keeps response times predictable, ensuring your standard business workflows remain uninterrupted.

### 3. Issue up to 999 Gift Cards in One Go

Speed up your large-scale distributions! You can now issue up to 999 gift cards in a single action directly from the Plum admin dashboard. This is perfect for high-volume seasonal incentives and one-time payouts—no more breaking bulk sends into multiple batches.

<Frame>
  <img alt="" />
</Frame>

### 4. Enhanced Rewards Points APIs

We've upgraded our Rewards Points APIs for deeper transparency.

* **Reversals:** Cancel issued points directly via API using a unique transaction ID.

* **Detail:** Responses now provide recipient-level status and accurate success/failure indicators.

* **Real-time:** Track partial outcomes and troubleshoot issues as they happen.

## Upcoming features

### Payment Gateway Support for Point-Priced Storefronts

Users will soon be able to complete purchases using an online payment gateway if their available points are insufficient, ensuring a smooth checkout experience.

### Category-Level Redemption Limits

Gain finer control over your budget by setting redemption limits on specific marketplace categories, aligning user behavior with your program goals.

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Release Feb 2025
Source: https://help-plum.xoxoday.com/product-updates/release-feb-2025

Read the Plum product update for February 2025, covering new features, improvements, and fixes shipped that month.

*Latest from our world of Rewarding*

We've rolled out exciting new features to enhance your Plum experience, starting with flight booking on the Plum Storefront—making travel more rewarding than ever! Plus, enjoy a smoother currency conversion UI, accurate admin tracking for refunds, new payment notifications for Super Admins, and expanded gift voucher options in Argentina. These updates are designed to make your experience more seamless, secure, and efficient.

## Here's what's new:

### 1. Flight Booking Functionality

We're excited to announce that flight booking functionality is now live on the Plum Storefront!

With this update, users can seamlessly book flights using their reward points and codes making travel more accessible and rewarding. This enhancement expands the redemption options, offering greater flexibility and convenience for users looking to maximize their rewards.

**What's New?**

* Seamless Flight Booking – Browse and book flights effortlessly.

* Flexible Redemption – Use reward points to book flights with ease.

* Enhanced User Experience – Smooth, intuitive interface for a hassle-free booking process.

Start exploring and book your next journey today!

<Frame>
  <img alt="" />
</Frame>

### 2. Dynamic Currency Conversion for Points

We've introduced an enhancement to improve currency conversion when users transfer points across regions.

* Hover Functionality: Users can now hover over their points balance to see the equivalent value in local currency.

* Real-Time Conversion: Points value updates automatically when switching regions, reflecting the latest exchange rates.

* Seamless Checkout: Users can use points based on their local currency without needing to understand the full currency conversion, streamlining the purchasing process.

**Benefit:** This ensures smoother, region-specific point redemption without confusion.

<Frame>
  <img alt="" />
</Frame>

### 3. Personalize Reward Emails with Recipient Names

We've made it easier to personalize reward emails! A new "Name" field has been added when sending rewards to individual recipients or through bulk uploads in Gift Card section. This allows you to include the recipient's name in the email. The email will greet the recipient with "Hi" if no name is provided.

<Frame>
  <img alt="" />
</Frame>

### 4. Payment & Wallet Notification for Super Admins

To improve visibility and ensure smooth operations, we've enhanced the payment and wallet notification system:

* Fund Addition Notification: All super admins will receive an email notification whenever funds are successfully added.

* Low Balance Notification: If the wallet balance drops below the threshold set by a super admin, an email notification will be sent to all super admins, including the account name.

This ensures that all super admins are notified promptly about fund additions and low balances, streamlining the fund allocation process.

<Frame>
  <img alt="" />
</Frame>

### 5. Order Fulfilment Notifications

Previously, users could not know when their pending orders were ready for fulfilment.

**What's New?**

* Users will now receive an email notification as soon as their order is successfully fulfilled and ready for delivery.

* This update applies specifically to Storefront orders, ensuring timely communication.

**Benefit:** Better transparency, reduced uncertainty, and fewer support requests.

<Frame>
  <img alt="" />
</Frame>

### 6. Expanded Reward Options in Argentina & India

We're enhancing the reward experience by introducing new redemption options in two regions:

**New Gift Card Editions in Argentina:** Users in Argentina can now access a wider selection of gift cards, making it easier to redeem rewards that suit their preferences.

<Frame>
  <img alt="" />
</Frame>

**New Merchandise Category for India:** Merchandise catalogue has expanded for India stores, expanding product choices and giving users more variety when selecting rewards.

<Frame>
  <img alt="" />
</Frame>

**Benefit:** These updates provide more flexibility, better accessibility, and an improved shopping experience for users in both regions.

### 7. Tag Filter for Order History API

We've added support for Tag Filtering in the orderHistory API, making it easier to manage and retrieve order data.

**What's New?**

Users can now filter and view orders based on specific tags.

This improves searchability and helps organize order history more efficiently.

**Benefit:** Saves time by streamlining order tracking and data management.

<Frame>
  <img alt="" />
</Frame>

## Upcoming Features

* **Charity Category on Marketplace:** The Marketplace will add a new category for charitable donations, allowing users to support causes they care about.

* **Customize Catalog in Campaigns in Rewards API:** The Rewards API will allow you to customize the reward catalog in campaigns, offering a more personalized and tailored selection for your users.

* **Email Triggers for Merchandise Status & Tracking:** Automated emails will notify you about the status and tracking of your merchandise, keeping you updated at every step.

* **WhatsApp for Reward Messages:** Soon, you be able to send rewards via WhatsApp, providing faster and more convenient communication.


# February 2026
Source: https://help-plum.xoxoday.com/product-updates/release-feb-2026

Read the Plum product update for February 2026, covering new features, improvements, and fixes shipped that month.

*Learn about the latest updates on Xoxoday Plum*

Hi,

We've rolled out new updates to make your experience smoother and more versatile. This month, we are focusing on reducing manual errors in bulk uploads and giving you significantly more control over your reward communications and API integrations.

## Here's what's new:

### 1. Fully Customizable Email Greetings & Fields

Reward emails are the final touchpoint with your recipients, but generic templates can fail to capture your unique brand voice or professional tone.

**We Upgraded:** The email configuration settings to allow full control over greetings (switch "Hi" to "Hello," "Dear," or "Hey") and made recipient names optional for all sends.

**How it helps you:** Your reward emails will feel natural and professional, ensuring your communications are perfectly aligned with your brand voice.

<Frame>
  <img alt="" />
</Frame>

### 2. Clear Denomination Visibility for Variable Gift Cards in Bulk Reward Uploads

Bulk reward uploads require high precision to ensure variable-value products are processed correctly without manual verification.

**We Upgraded:** The CSV bulk upload template to now explicitly indicate the Denomination Type and display the allowable range for variable products directly within the file.

**How it helps you:** This provides clearer instructions for your team, ensuring a much smoother, error-free upload experience and reducing manual corrections.

### 3. Expanded Denomination Range for Campaign Creation

As incentive programs scale, we recognized the need for greater flexibility when creating high-value campaigns and enterprise-level payouts.

**We Upgraded:** The platform's core limits by removing these caps and raising the maximum allowable limit to 50,000,000.

**How it helps you:** You now have total flexibility to handle high-value payouts and scale your incentive programs exactly as your business requires.

<Frame>
  <img alt="" />
</Frame>

### 4. View "Discount Amount" in Gift Card Reports

To provide greater financial transparency for our Gift Card API customers, we've made it easier to instantly distinguish between discount values and final charged amounts.

**We Upgraded:** The reporting dashboard by adding a dedicated Discount Amount column, reflecting exactly how much was discounted in your account's base currency.

**How it helps you:** This makes accounting faster and more transparent by providing a clear, line-item view of your savings versus your gross expenditure. This enhancement is for our Gift Card API customers.

### 5. Passport Expiry Validation for International Travel

To ensure a seamless international travel experience, we've introduced proactive checks to help travelers stay compliant with global entry requirements.

**We Upgraded:** The system with an automatic validity check that ensures a passenger's passport is valid for at least 6 months beyond the travel date.

**How it helps you:** This prevents avoidable booking issues, ensuring a compliant and stress-free journey for your international travelers.

<Frame>
  <img alt="" />
</Frame>

### 6. Consolidated Redemption Report for Banking Clients

Banking partners frequently had to manually merge data from Loyalty Programs and the Plum Marketplace, which was time-consuming and error-prone.

**We Upgraded:** Our reporting engine to merge these data streams into a single, unified report for all reward categories (excluding Flights and Hotels).

**How it helps you:** It simplifies reconciliation by allowing you to track Member IDs, points, and cash usage in one central place without manual file merging.

### 7. Email Proforma Invoices to Colleagues

Super Admins often face administrative delays when manually downloading and forwarding proforma invoices to finance teams to initiate fund transfers.

**We Upgraded:** The "Add Funds" page to allow Super Admins to email invoices directly to up to 10 colleagues within their organization's domain.

**How it helps you:** This streamlines internal finance coordination and significantly speeds up the payment and funding process.

<Frame>
  <img alt="" />
</Frame>

### 8. Simplified Quantity Selection on Storefront

For users managing bulk or multi-voucher orders, we recognized that the traditional checkout flow could be further optimized to match the speed of high-volume purchasing.

**We enhanced:** The storefront UI with a clear quantity counter directly on the product page, allowing adjustments before adding to the cart.

**How it helps you:** This aligns with modern e-commerce standards, allowing users to buy in bulk with fewer clicks and a much faster checkout experience.

<Frame>
  <img alt="" />
</Frame>

### 9. Powerful API Enhancements

We've upgraded our developer experience for better reliability and control:

* **Reward Points Control:** You can now cancel reward points programmatically via API and track success/failure status at an individual recipient level for easier reconciliation.

* **Mobile Top-Up Accuracy:** New endpoints allow you to fetch and validate mobile operators before placing an order, significantly reducing transaction failures.

Keeping up with the new features is the first step. The next, and more important step, is to see their impact on your reward strategy in action.

## Upcoming features

### Improved Quantity Selection on Storefronts

We're introducing a cleaner interface for the gift card category page. Users will soon be able to increase or decrease quantities seamlessly before adding items to the cart. This means fewer clicks and a faster checkout experience, especially for users purchasing in volume.

### Share Proforma Invoices Instantly

Super admins will soon be able to email proforma invoices to multiple colleagues directly from the Add Funds page. This streamlines finance coordination and speeds up payment processing by eliminating the need to download and forward files manually.


# Release February 2022
Source: https://help-plum.xoxoday.com/product-updates/release-february-2022

Read the Plum product update for February 2022, covering new features, improvements, and fixes shipped that month.

This February, we have undergone a few major changes on both the plum admin side and the integration side.

We have come up with an enhanced low balance notification, ease of sending xoxo links directly through the API. Improved email design will now enable admins to communicate more efficiently. Scroll below to learn more about these and much more.

On the integration side, we have improved Hubspot integration now Xoxoday plum passes reward automation campaign activities into Hubspot CRM via Custom events into Hubspot CRM, there is now ability with the admins to edit any existing automation created by the admin for the integration rewarding.

Here are more details about the latest update:

## Low balance notification enhancements

With this release, the low balance notification will get triggered immediately after the balance reaches the threshold balance as set by the admin. This enables the admin to immediately take action and hence reduce the probability of redemption failing or other admins not being able to reward.

We have also enabled these notifications for companies that use the 3rd party reserve fund as well - eg, accounts connecting through Darwin Box, SAP. Disperz etc.

<Frame>
  <img alt="" />
</Frame>

## Xoxo Link API for directly sending links to emails

Up until now, the Generate xoxo link API ([https://xoxoday.gitbook.io/plum/developer-resources/xoxo-link-apis](https://xoxoday.gitbook.io/plum/developer-resources/xoxo-link-apis)) allowed for the user to only specify "Campaign ID" and "Links quantity" as a part of the request. The user would receive Xoxo links as a part of the response which they can further distribute.

With this release, in addition to the above, the user can also use the Generate xoxo link API to directly distribute links to the recipient email IDs and also set an expiry link for the Links generated as per their choice.

<Frame>
  <img alt="" />
</Frame>

## Cleaner and Sleek email design

In this release, we have enhanced the email templates sent with Xoxo Points and Plum Pro from the platform. This includes a cleaner UI for editing and selecting banners and logos, customizing the message while sending, the inclusion of a default message for the user, and previewing the email on both desktop and mobile. Admins can send a personalized message now, which will overwrite the default message.

Improvements made in templates for first-time Xoxo Points recipients detailing the steps to login and in templates of Xoxo Codes and Plum Pro where the quantity of Xoxo codes / Brand vouchers are more than 5.

<Frame>
  <img alt="" />
</Frame>

## Auto registration of new admins

A super admin while adding a new admin into the system, would not have to separately register the admin into the system now. This step has been eliminated from the user's journey and is taken care of automatically in the backend.

<Frame>
  <img alt="" />
</Frame>

## Updated Payment Gateway

We have changed the international payment gateway partner from PayPal and it is now PayU as for our domestic accounts. Also, a Transaction Charge of 1.8% of the total value of recharge (as levied by PayU) will be applicable to all INR recharge transactions.

## Auto-refund of a failed recharge

If the recharge fails, until now the refund has to be manually initiated by our team, and once done, the funds will be put back into the wallet. This created a delay in the overall rewarding activity. Now the refund process in case of recharge failure has been automated which means the amount will be added back to the client's wallet as soon as the recharge fails and the client can try again to continue rewarding.

## Expiry Data Updates

With this sprint, the expiry of each individual reward will be visible under 'View details' of the record only. This will no longer be available as a separate column to filter out and the status of the rewards will be "delivered" if not "redeemed".

## Pre-Paid cards as a separate option in Xoxo Links

While creating xoxo Link campaigns, all available gift cards and prepaid cards were shown up as in the same single list. This is resulting in a readability issue in the drop-down as multiple currencies and a large list of denominations got listed out. We have now separated out the different categories of available products into "Gift Cards" "Prepaid" giving the user a clear picture to narrow down their brand's selection.

## Increased character limit of Name field

The character limit for the name field while sending rewards (Points, Codes, Links, and Plum Pro) both in single send or by bulk upload has been increased from 30 to 70 to make accommodations for longer recipient names.

Other smaller admin improvements: The PO number is now made a part of the plum pro reports. The input fields for Xoxo code have been renamed to "Value of Codes" and "No. of Codes" instead of "Denomination" and "Quantity" as this has previously led to the erroneous distribution of rewards due to confusion of the terms.

## Integrations

### Improved Hubspot Integrations

Hubspot Improvements - With this release, Xoxoday plum passes reward automation campaign activities into Hubspot CRM via Custom events into Hubspot CRM so that customers can view reward activity & status directly inside the Hubspot timeline for each rewarded contact (in Contact page) and use Xoxoday reward activity and attributes inside a workflow to segment lists, and build RoI reports within Hubspot CRM.

<Frame>
  <img alt="" />
</Frame>

### Ability to edit integration automation

Earlier there was no ability to edit any existing automation created by admin for the integration rewarding. Now the admin can edit details like: end-date, reward expiry any automation based on the requirement.

<Frame>
  <img alt="" />
</Frame>

### Get notified with integration automation updates

The latest update has added notifications and alerts for the integration automations as well. Now you will be notified with important updates like: when is automation ending, how many rewards remaining, reward success/failure updates etc.

## Storefront

### Newly improved gift voucher descriptions

With the latest release, we have improved the gift vouchers pages layout to provide a better rewarding experience. Clear and sleek instruction for redemption.

<Frame>
  <img alt="" />
</Frame>

## Plum Rewards API

### New Pricing Structure for Reward API

Offering new pricing plans for all our rewards API clients to get better discounts on popular vouchers across the globe. Increase your horizon of rewards with xoxoday's rewards API platform to deliver more delight from our vast and existing gifting catalog.

## Upcoming Features

### Mobile number-based rewarding

We're adding mobile-based rewarding options for admins to reward users who only have a phone number and no email. This aims to offer a well-connected experience for a diverse set of end-users receiving rewards.

### New Native Integration with Medallia

Our native integration with Medallia will let you incentivize surveys using Xoxo links. You can set up reward automation campaigns and distribute rewards based on 'survey completion and feedback collection' from the Medallia CX platform itself.

### A brand new perks with discounted gift vouchers

In the next release, we're introducing a brand new vouchers catalog with inclusive deals and discounts on vouchers, popular brands' exclusive coupons, and exciting cashback.

### Qualtrics SDK extension

You can set up and manage rewards within the Qualtrics dashboard without leaving the platform. The extension SDK allows you to manage rewards and the status, such as delivery and redemption, and the data is automatically synced back to Qualtrics for easier reporting.

### On-Demand and one on one email rewarding within Hubspot

Introducing on-demand emails in Hubspot: Your sales reps can use Plum to send on-demand emails from the 'Contacts' tab, allowing them to engage with prospects without navigating between multiple applications.

### A Classic redesign for Admin and storefront platform

Plum's new look is coming soon, the UI of the admin platform and storefront is getting a redesign and will be more intuitive and accessible for you to use your favorite features.

### Consumer Promotions

We are launching gamified consumer promotions with unique rewards distributed via QR code-based solutions, Reply to SMS, and IVR-based solutions. Gamifying promotions such as Scratch and Win, Spin the Wheel, Peel to Reveal, Sweepstakes, Price Drop, Quiz contests, refer and earn and many more and due to release in the upcoming month.


# Release February 2023
Source: https://help-plum.xoxoday.com/product-updates/release-february-2023

Read the Plum product update for February 2023, covering new features, improvements, and fixes shipped that month.

Sending rewards globally on Plum is always exciting—but currency conversion issues can sometimes be a hassle. To make things simpler, we've changed the system to provide admins and recipients with the applicable exchange rates for cross-border conversions, creating transparency in the financial systems.

## How is this going to help the Customers?

This will allow customers to know the actual value being charged in their base currency, where there is an exchange rate applicable for their daily orders if any of them are transacting cross-currency products. This also helps create transparency in the Customer's audits.

## Multi-lingual reward links

With this release, we have introduced multilingual capabilities in Xoxo Links. The recipient of a Xoxo Link will be able to choose a language in which they would like to view the options presented in the Links. We have enabled this feature for a few specific customers as a BETA version.

<Frame>
  <img alt="" />
</Frame>

## Improved Journey of Marketplace Redemption

We have made it easier for recipients to redeem rewards by customizing the storefront according to the reward they received. This not only speeds up redemption but also eliminates confusion.

<Frame>
  <img alt="" />
</Frame>

## Changes in the Plum Pro APIs

**getVouchers API Response**

The "isPhoneNumberMandatory" field is added in the API response which shows True/False in response. This allows you to know if the product requires Phone number while placing the order.

**getOrderDetails API Response**

We have added the timestamp information in the "orderDate" field which was earlier showing only date.

* Before: `"orderDate": "2023-01-24"`

* After: `"orderDate": "2023-01-24 13:19:58"` in GMT +5:30

This allows user to know the exact time the order is placed which can be used as reference during internal audit.

## Integrate rapidly with any tool

In this release, we worked to optimize our integration architecture and have added capabilities to integrate with over 100+ leading SaaS platforms from popular CRMs, to Marketing Automation, and support ticket systems to referral platforms and everything in between!

With this new optimized architecture in the Xoxoday back-end, you can connect with any tools you already use to send rewards based on the trigger criteria that fit your imagination or your business logic. Also, as an added advantage, you can tweak and customize the nature of the integration—as long as the other tool provides us with an API for that feature!

**Tools you may be already using (to name a few):**

**CRM**

* Freshsales: Robust Yet Easy-To-Use CRM Software from the stable of FreshWorks.

* Salesforce: World's #1 CRM. The integrated platform, AI, app development, and best-in-class apps.

* HubSpot: Flexible and easy-to-use CRM and Marketing Automation tool!

* Pipedrive: Pipedrive is an easy-to-use CRM tool.

* CloseCRM: Close is the inside sales CRM for startups and SMBs.

**Marketing Automation**

* Oracle Eloqua: A best-in-class B2B marketing automation solution, Oracle Eloqua Marketing Automation offers campaign design and advanced lead scoring.

* Marketo: Marketo is Software-as-a-Service (SaaS)-based marketing automation software owned by Adobe.

* Salesforce Pardot: A full suite of B2B marketing automation tools from Salesforce.

* Constant Contact: With Constant Contact, you can create effective email marketing and other online marketing campaigns to meet your business goals


# Release February 2024
Source: https://help-plum.xoxoday.com/product-updates/release-february-2024

Read the Plum product update for February 2024, covering new features, improvements, and fixes shipped that month.

## Effortless App Navigation & Enhanced Help Access

We've polished up the look and smoothened your navigation through the app, bringing simplicity to the forefront. Our detailed Help section is now just a tap away in the Rewards section that explains more about a specific distribution mode. The right-hand panel includes a new progress stepper showing exactly which step of the journey you're on.

<Frame>
  <img alt="" />
</Frame>

## Customizable Reward Email Templates

Elevate your reward emails with our newly refined email templates. Choose your favorite one and set it as your default template with ease. Each template now includes a customizable subject line, ensuring every message carries your unique touch, elevating your engagement with recipients.

<Frame>
  <img alt="" />
</Frame>

## Streamlined Funding & Organized Transaction Tracking

We've enhanced the admin experience by directly integrating the "Add Funds" feature on the "Send Rewards" page, informing you of the available balance before dispatching rewards. We've also repositioned the "Transaction History" (formerly known as "Payment Reports") into the "Payments" section to align logically with the funds added to the system.

<Frame>
  <img alt="" />
</Frame>

## Seamless Bank Transfer with Domestic Wire for USD account

You can now effortlessly add funds directly from the Admin Dashboard to accounts with base currency set as USD, bypassing the need for emails to the Xoxoday Finance team to add funds after initiating the bank transfers. Choose between domestic wire transfers powered by Stripe for an efficient and secure way to add funds.

<Frame>
  <img alt="" />
</Frame>

## Unlock Precise Rewarding with Decimal Denominations

Admins will now have the flexibility to send rewards with lower decimal values, like $0.01, $0.1, \$0.5, etc., to their users. Ideal for gaming companies, this update supports nuanced user engagement and retention strategies by rewarding users with fractional values for in-game task completion, leveling up, and hosting events for the game community.

## Upcoming Features

### Consumer Engagement Features

Revolutionize your promotional activities with Xoxoday's engaging consumer promotion features: spin the wheel, scratch cards, and sweepstakes. These fun, interactive engagement boosters help increase participation rates and enrich user experience.

### Upgraded Email Templates for Enhanced Personalization

New email templates with advanced personalization capabilities, including a drag-and-drop email creator and content editor. Ideal for rewards announcements, celebrations, or promotions, these templates ensure your emails drive higher engagement and response rates.

### Revamped Integration Module

A streamlined integration process to offer a simple and intuitive user experience while setting up reward automation with your favorite platforms. This approach will ensure quick and seamless integration, enhancing the user experience and efficiency of reward distribution.

### Teams and Budgets

Superadmins can streamline team management by creating groups of admins and assigning dedicated reward budgets to each team. This feature enhances incentive distribution control, fostering targeted engagement and motivation within teams.


# Release January 2025
Source: https://help-plum.xoxoday.com/product-updates/release-january-2025

Read the Plum product update for January 2025, covering new features, improvements, and fixes shipped that month.

*Latest from our world of Rewarding*

We've recently introduced several new features to enhance your Plum experience. The Plum Reward API is live on Postman's Public API Network, enabling seamless discovery, testing, and integration. Product Whitelisting simplifies catalogue configuration, while our improved recommendation engine delivers tailored suggestions for UK and Indian customers. These updates and other enhancements are designed to provide a seamless, secure, and efficient experience for admins and users.

## Here's what's new:

### Plum is Live on Postman's Public API Network

The Plum Reward API is now live on Postman's Public API Network, the largest collection of public APIs globally. This makes it easier for developers to:

* Discover and explore the API's capabilities.

* Test it directly within the Postman environment.

* Access detailed documentation to get started quickly.

This launch simplifies integration and enhances the developer experience.

<Frame>
  <img alt="" />
</Frame>

### Product Whitelisting

Introducing the Product Whitelisting feature! You can now configure catalogs to make specific products visible to selected accounts or marketplaces, ensuring tailored visibility while hiding them from others.

### Tailored Recommendations

* For UK Customers: Our new recommendation engine now provides UK-specific suggestions for products and gift cards, helping you discover the most relevant and popular options effortlessly.

<Frame>
  <img alt="" />
</Frame>

* For Indian Customers: We've revamped our catalog to deliver enhanced merchandise recommendations tailored to the Indian market.

<Frame>
  <img alt="" />
</Frame>

### Amazon Prime Fulfillment & Flexible Integrations Available on Plum

Plum now offers Amazon Prime fulfilment for all products in the US, ensuring fast, reliable delivery with no markups.

Plum provides two flexible integration options:

* Not Using Your Company Amazon Account: Plum facilitates purchases directly from Amazon, allowing you to set up a rewards program without needing your Amazon account.

* Using Your Company Amazon Account: Plum sets up the rewards program using your Amazon account with restricted access. This gives you control over your account while Plum handles the reward processing.

Both options offer no markup and ensure quick, efficient delivery for your employees' rewards.

### Enhanced Gift Voucher Catalog Across Countries

We've expanded our Gift Voucher catalogue with exciting new brands in multiple countries. Now, you can enjoy more choices and seamless redemptions.

Explore the Plum marketplace.

* New additions to GV in the Americas region - 129

<Frame>
  <img alt="" />
</Frame>

* New additions to GV in the UK - 88

<Frame>
  <img alt="" />
</Frame>

* New additions to GV in Europe - 84

<Frame>
  <img alt="" />
</Frame>

* New additions to GV in Bangladesh - 23

<Frame>
  <img alt="" />
</Frame>

Keeping up with the new features is the first step. Next, and more important step, is to see their impact on your reward strategy. Try it out

## Check out these new features

## Upcoming features:

### Customize Global Catalog for Rewards API Customers

You'll soon be able to:

* Select and deselect products directly from the Admin Dashboard.

* Instantly view updates in the Rewards API.

### Catalog Change Updates via Webhooks

You can receive real-time updates on product changes through webhooks, such as enabling/disabling status and denomination adjustments. Simply list your callback URL to stay informed.

### Flights in the Reward Marketplace

We're expanding our offerings! Flights will soon be available in the Reward Marketplace, giving your users more travel redemption options.

### Send Rewards via WhatsApp

You can send rewards directly via WhatsApp, making the gifting experience more seamless and convenient.

### Airmiles

A new Airmiles reward category is on the way, allowing users to list, send, and redeem them for travel benefits.

### Charity & Lounge Categories

Support for Charity and Lounge Categories is coming soon. This will enable users to donate to causes and enjoy premium lounge access, enhancing reward flexibility and user experience.


# Release July 2021
Source: https://help-plum.xoxoday.com/product-updates/release-july-2021

Read the Plum product update for July 2021, covering new features, improvements, and fixes shipped that month.

*July 2021: Distribute links seamlessly, multilingual storefront, + more*

This spring, we have several updates for admins and end-users.

The admin dashboard has been revamped completely to enable admins to distribute gifts seamlessly. For the end-users, the storefront is now multilingual, thus enabling non-English users to redeem rewards easily.

Here are more details about the latest update:

## For Admins

### Xoxo Links

**Update #1**

**Admins can now select gift vouchers from any country while creating Xoxo links.**

It was previously not possible for admins to select all geographies while creating a new campaign.

In the latest release, the distribution mode has been rebuilt to function in any geography and scale. The admin can now select any product from the wide variety of real-time brands we have from 100+ countries while creating a new campaign.

They would also be able to choose from an array of new denominations that were previously not available.

<Frame>
  <img alt="" />
</Frame>

**Update #2**

**Admins now possess the ability to generate and send Xoxo links to self in bulk.**

It was earlier not possible for admins to generate links en masse. With the latest release, Admins will now be able to generate up to 1000 links at once. They can choose to distribute this later in the distribution mode of their choice.

Xoxoday will send the links generated to the admins in an excel format attached with an email. Admins can also track the redemption status of the batch separately.

**Update #3**

**Reward Redemption is even more delightful now, as the user interface for Xoxo links has been revamped.**

The Xoxo link redemption process has been revamped while retaining the sleekness and simplicity in the redemption process to solve distributing Xoxo links in scale.

Admins will now have white-labeling options to add their company logo on the header of the redemption link.

On the distribution side, the "Sending to few" and "Sending in bulk" options have been separated and made similar to the other modes of distribution, thus bringing more clarity while distributing links.

**Update #4**

**Admins of Common Wallet Companies can now distribute Xoxo links.**

The admins of "Common Wallet Companies" were previously unable to distribute Xoxo Links. With the latest release, the super admins and the admins of a company can view and send Xoxo links from the admin console.

**Update #5**

**Better Reporting for Reward sent using links.**

The new report section for Xoxo links includes the entire order history of the rewards distributed from the platform, details to whom the admin sent the link, redemption status at an individual link level, the campaign, and the value of a link. The section also can cancel any specific link, or resend the reward link to the recipient.

This elevates the Xoxo Link distribution experience to a whole new level and eliminates the dependency on the Plum team for manual reports.

The records can also be filtered by any of the above-mentioned parameters and downloaded in an excel format.

## For Storefront Users

**Update #6**

**Multi-Lingual Support on Plum Storefront has been enabled.**

We have now enabled localization support on the Plum Storefront for different languages and geographies. An end-user such as an employee or a consumer can now choose a preferred language and experience the complete redemption journey in the selected language.

The 12 Languages enabled in the current sprint are English, German, Polish, Hebrew, Chinese Traditional, Chinese Simplified, Portuguese, Spanish, Thai, Japanese, Italian, and French.

Xoxoday will enable this solution only on request from a Plum Admin from the dashboard.

**Update #7**

**Admins can now select and customize any brand color on the Plum Storefront.**

The admins of Plum can now customize the storefront background color from "Platform Preferences" in the admin console and choose from an array of options available or by directly putting in the color code that they want the storefront to reflect.

## Plum Pro

**Update #8**

**Ability to resend Plum Pro rewards and add 'tag /notes' in the reports section.**

The ability for admins to resend a reward confirmation email has been introduced in the "Plum Pro" mode of distribution thus eliminating the need for admins to reach out to Xoxoday to resend rewards.

Admins can now resend Plum Pro Rewards by clicking on "Reports" and then navigating to "Plum Pro History" and clicking on the action against the individual reward sent.

The 'Tag'/ 'Notes' column that allows capturing essential information about a reward has also been made visible under each reward in the reports section. This has been made available in all distribution modes.

<Frame>
  <img alt="" />
</Frame>

**Update #9**

**Response changes in Plum Pro API**

In Plum Pro API, all the endpoints have been updated with new error messages so that the end-users can easily recognize & take action. We have introduced a new flag for all products which will tell about the product type.

Whether it's a real-time or non-real-time product, the user can use this flag in the API request to make a call and pull the relevant set of products.

**Other Admin Updates**

**Update #10**

**Email customization in bulk upload**

While sending brand vouchers in bulk to multiple recipients, the email sent, and the reward can now be previewed and customized in terms of the subject, content, banner image.

A personal message to the recipient can also be added while sending rewards.

**Update #11**

**DIY Journey Enabled to get Client ID, Secret ID, Access Token & Refresh Token.**

Generating Client ID/Secret ID is now easy with the DIY process. From the Plum Pro Stores Frontend, Plum Pro Admin can generate Client ID & Secret ID by clicking on "Generate Client ID," Post generating the client ID, Admins will have the option to generate "Access Token" & "Refresh Token."

Admins would have to just log in to Storefront, click on "Admin Dashboard," go to "Settings," visit "Platform Preferences," and select "Rewards API."

**Update #12**

An email notification will be sent if a product is enabled/disabled or when a denomination changes.

It was earlier very tedious for admins to track changes in the product catalog.

Plum will trigger notification emails to all super admins of Plum Pro users detailing product and denomination updates with this release.

Triggered every 24 hours, we will share the list of products and other changes in the notification email. This will keep the admins informed of any changes in the catalog on a near real-time basis.

**Update #13**

**Automated Notification for Scheduled Rewards that were canceled.**

For any scheduled reward that now gets canceled because of a low balance or threshold limit breach for an admin, the admin/super admin will get a notification detailing the rewards that have been canceled.

This will enable them to take immediate corrective action and ensure that the rewarding experience is smooth for end-users.

**Update #14**

**Admin Dashboard has been revamped.**

The admin management screens for both the "Common Wallet" and "Individual Wallet" companies have been improved, thus introducing visibility into the entire list of both super admins and admins present in an account.

A super admin can now see all the admins and their respective threshold values on a single page. They can also modify any other admin/super admin access or even delete another admin.

This feature was previously unavailable and took considerable back and forth with Plum to remove the admins from the system.

<Frame>
  <img alt="" />
</Frame>

**Update #15**

**Enhancements in the Recharge Section**

Paypal has now been added as a payment gateway for base currency such as USD, Euro, and SGD.

OTP validation for recharge has been introduced, and the discount/markup at a client level will now be transparently visible to the admins and the breakup on the recharge page.

That is all for this product release! Have a question? Reach out to us [here](https://support.xoxoday.com/support/tickets/new)

To set up a demo with a Plum Specialist, please sign up [here](https://www.xoxoday.com/book-a-demo)


# Release July 2022
Source: https://help-plum.xoxoday.com/product-updates/release-july-2022

Read the Plum product update for July 2022, covering new features, improvements, and fixes shipped that month.

## New & improved product experience to send the first reward

As an admin, you will now be able to seamlessly send the first reward under a threshold capacity without undergoing the KYB submission and verification process. Once the reward is sent, the admin can do the documentation process. This enhances the overall user experience and navigation of the product.

The admin user will be able to add recipients and 'proceed to checkout to directly send rewards using a preferred mode of payment.

<Frame>
  <img alt="" />
</Frame>

<Frame>
  <img alt="" />
</Frame>

## Seamless wallet recharge flow for super admins in case of low balance

When the super admins are in the middle of sending rewards, they might run into a low balance in their wallet. Now they do not have to separately recharge and repeat the process of adding recipients to reward. With this release, they can continue rewarding by adding the balance amount to the same screen without adding the recipients again.

<Frame>
  <img alt="" />
</Frame>

## Instant notifications of threshold updates and changes

The admin will now get a notification whenever the super admins update the threshold limit, and the amount used is reset to zero. This helps the admin keep track of changes to their reward limits and usage.

<Frame>
  <img alt="" />
</Frame>

## In case of cancellation of rewards, the amount will be added back to the admin's threshold capacity

When an admin sends a reward, the reward amount gets updated under that admin's name. Now in case of cancellation of the reward as well, this amount will get appropriately updated in the individual admin's threshold capacity and used amount.

## Unsubscribe from 'catalog update notifications' directly from the email

Every time our catalog is updated, an email is sent to every admin to notify what's new with the gift catalog. However, if you don't want to receive these daily emails, you don't have to go through the hassle of reaching out to our team. You can simply unsubscribe directly from the email to discontinue.

<Frame>
  <img alt="" />
</Frame>

## View the reward delivery status sent via email and SMS

See the Email and SMS delivery status for the brand vouchers you send to your gift recipients on the Plum Pro dashboard. Download them as reports to make data-driven decisions for your business every time. Navigate to 'Reports' under Plum Pro to see your email and SMS delivery status.

<Frame>
  <img alt="" />
</Frame>

## Integrations

### Add a link to email CTAs to reward multiple recipients at once in HubSpot

Previously, Hubspot customers using Xoxoday Plum's mail merge could not hyperlink or add any CTA's with reward links. Also, the user had to refresh every time for dynamic lists to load and enrich new entries.

Now, the users can generate a one-to-many link and add it to their branded, rich HTML templates on Hubspot. These links support dynamic lists as well as automated drip campaigns in Hubspot. All you have to do is create the Xoxolink campaign with one-to-many automation on Hubspot. Copy-paste the generated reward link to your CTAs in the email template.

<Frame>
  <img alt="" />
</Frame>

<Frame>
  <img alt="" />
</Frame>

### Reward anonymous survey respondents in SurveyMonkey

Survey Monkey customers can now include reward incentives for anonymous surveys on their Platform. This is one of the most secure features available in the market, where Xoxoday validates the recipient's authenticity directly by calling SurveyMonkey APIs.

<Frame>
  <img alt="" />
</Frame>

## Payments

### Integrated a new payment processor - RazorPay, to recharge your wallet

Our platform is now integrated with RazorPay, a highly secure payment processor that enables domestic clients to recharge their wallets seamlessly. Customers can now load wallets in real-time using Internet banking by paying flat (INR 20) charges instead of paying 1.7% as transaction fees.

## Reward Catalog

### Send experiential rewards to delight your gift recipients

Experiential rewards go beyond transactions to create brand advocacy. We have added 150+ 'experiences' as a separate category to our storefront, which you can book across India, Dubai, and Singapore.

<Frame>
  <img alt="" />
</Frame>


# Release July 2024
Source: https://help-plum.xoxoday.com/product-updates/release-july-2024

Read the Plum product update for July 2024, covering new features, improvements, and fixes shipped that month.

In the recent weeks, we've introduced an array of exciting features designed to enhance the user experience. Among the notable additions are the multi-factor authentication, low balance notification, notifications for Scheduled rewards.

But that's not all – we're offering you an exclusive sneak peek at the features slated for the release in coming months.

## Here's what's new:

### Launch of Multi-Factor Authentication

Multi-Factor Authentication adds an extra layer of security to your account by requiring two forms of identification to log in.

* Mobile OTP: Receive a time-sensitive code via SMS

* Authenticator App: Generate a code using apps like Google Authenticator

Multi-Factor Authentication offers several crucial advantages for your Xoxoday account. By requiring two forms of identification, it significantly enhances your account's security, making it far more challenging for unauthorized users to gain access. This added layer of protection gives you peace of mind, knowing that your sensitive information is better safeguarded against potential cyber threats. MFA also provides flexibility, allowing you to choose between SMS-based OTPs or authenticator apps, catering to your personal preferences and convenience.

<Frame>
  <img alt="" />
</Frame>

### Proactive Low Balance Alerts for Admins

We've implemented a new system to keep your rewarding process smooth and uninterrupted. Admins will now receive timely notifications when the account balance falls below the total value of unredeemed rewards. This preemptive measure ensures you're always prepared to fulfill pending redemptions, eliminating potential disappointments due to insufficient funds.

<Frame>
  <img alt="" />
</Frame>

### Enhanced Security Measures

We've fortified our platform's security to protect your organization and reward recipients:

* Reward Distribution Safeguard: Our system now prevents rewards from being sent to disposable or temporary email addresses, ensuring your rewards reach legitimate recipients only.

* Admin Access Control: New admin accounts can only be created using verified work email addresses, maintaining the integrity of your administrative team.

* Transparency in Admin Privileges: Whenever an admin's access threshold is modified, both the admin in question and the super admin will be notified, keeping all parties informed of important changes.

<Frame>
  <img alt="" />
</Frame>

### Smart Scheduling for Rewards

Planning ahead? Our new notification system for scheduled rewards has got you covered:

* Weekly Fund Forecasts: At the beginning of each week, admins will receive a notification if any scheduled rewards are at risk due to insufficient funds.

* Detailed Fund Requirements: These alerts will include specifics on the additional funds needed to ensure all scheduled rewards are distributed without a hitch.

These updates reflect our ongoing commitment to improving your Xoxoday experience, combining enhanced security, smarter notifications, and proactive management tools. We're excited for you to explore these new features and welcome your feedback!

<Frame>
  <img alt="" />
</Frame>

### Enhanced Reward Code Transparency

We're excited to unveil a new feature that brings more clarity to your reward code management. When checking your reward code balance on the marketplace, you'll now have access to expanded information about each code, including:

* Redemption Status: Easily see which codes have been used

* Redeemer Details: Identify who has redeemed each code

If you're juggling several reward codes, this feature helps you keep track of each one's status. For codes you don't use immediately, you can now verify their status at any time. This update is designed to give you greater control and insight into your rewards, making the entire process more transparent and manageable.

<Frame>
  <img alt="" />
</Frame>

### Introducing Get Link Status API

Users can now fetch reward link status to know if the link is redeemed or not by just passing the unique Link ID. This helps users to know the status of the link so that they can automate their operations process and user experience.

<Frame>
  <img alt="" />
</Frame>

### Introducing Phone Number Support in Send Link API

* Users can now send links to the recipient's phone number by passing the phone number information in the API request.

* This allows users to send the links to their recipients via an additional channel besides email.

* User can then fetch the link Id unique to the recipient to get the redemption and delivery status of the link.

<Frame>
  <img alt="" />
</Frame>

**Note:** The API information will be available in our API reference document shortly.

## Upcoming features:

### Perks Launch in Marketplace

The new category of perks and benefits is being introduced into reward marketplace. Avail amazing offers and deals of your favorite brand and the instant discount

### Improved User Experience for Mobile Marketplace

Enhacing the user experience of the mobile version of marketplace to allow users have more delightful rewarding redemption journey.

### Configurable reminder email system

Admins will be able to configure the intervals and frequency of the redemption reminder emails to be sent to the clients.

### Rewarding through WhatsApp

End users will be able to redeem their rewards using OTP delivered via Whatsapp or SMS whichever is more convenient for them.

### Email and SMS delivery status in reports

Admins will soon be able to see the exact status of the email and SMS delivery and the reason in case of failure so that it can be actioned upon appropriately.


# Release July 2025
Source: https://help-plum.xoxoday.com/product-updates/release-july-2025

Read the Plum product update for July 2025, covering new features, improvements, and fixes shipped that month.

*Learn all about the latest releases in Xoxoday Plum*

Here's a quick roundup of what's new, improved, and coming soon on Xoxoday Plum. From adding new redemption options like company swag and expanded travel rewards to giving admins more control over voucher management, we're continuing to build features that make rewarding easier, flexible, and more meaningful for your users.

## Here's what's new:

### 1. Add Company Swag to Your Marketplace

Want to let your users shop for company swag?

You can now add your own branded goodies, like T-shirts, mugs, bags, or jackets, directly to the rewards marketplace. Your team can redeem points for cool company merch!

<Frame>
  <img alt="" />
</Frame>

### 2. Enhanced Shopping Experience with Redemption Filters

Shopping just got easier and more personal. Users can pick product options like color, size, or storage directly from the product page in the merchandise section.

This means less hassle and more clarity when choosing your perfect reward.

<Frame>
  <img alt="" />
</Frame>

### 3. Simplify Gift Card Selection with Redemption Filters

Users can filter gift cards by how they can be redeemed, Online or In-Store (Offline). This gives them a clear idea of where they can use each card before redeeming, making the process smoother and stress-free.

It's all about helping users make faster, smarter decisions when choosing their rewards.

<Frame>
  <img alt="" />
</Frame>

### 4. Enhance Voucher Control by Setting Custom Expiry Dates

Admins now have the option to set an exact expiry date for vouchers giving more control and flexibility, allowing you to align voucher validity with campaign timelines, special events, or business needs.

<Frame>
  <img alt="" />
</Frame>

### 5. New APIs That Unlock More Rewarding Experiences

We're introducing three powerful APIs to help you offer more real-world, meaningful rewards, seamlessly integrated into your platform.

* Mobile Top-up API: Empower users to recharge their mobile phones instantly, anytime, across the globe. The Mobile Top-up API enables seamless prepaid and postpaid recharges across major telecom operators in multiple countries.

* Charity API: The Charity API is your gateway to enabling meaningful impact through seamless charitable giving. It empowers users to donate to verified NGOs and causes directly, making social good a part of everyday interactions. With the Charity API, you can design your own user interface while leveraging a curated catalog of global charitable organizations and initiatives.

* Lounge API: The Lounge API lets users effortlessly discover and book premium airport lounges across the globe. Whether they're business travelers, frequent flyers, or holidaymakers, elevate their journey with access to top-tier lounge experiences, complete with gourmet food, Wi-Fi, and more. Integrate the Lounge API to create a seamless lounge booking experience directly within your platform, tailored by location, airport, and travel needs.

[View API References here](https://e.customeriomail.com/e/c/eyJlbWFpbF9pZCI6ImRnVEI4UWdEQVBQME9fTDBPd0dZVUg3TndxYVN0M0FDcmYxN2VaND0iLCJocmVmIjoiaHR0cHM6Ly9kZXZlbG9wZXJzLnhveG9kYXkuY29tL3JlZmVyZW5jZT91dG1fY2FtcGFpZ249QWRtaW4lMkZTdXBlcitBZG1pbnMrLStQcm9kdWN0K1VwZGF0ZXMrLStKdWx5KzIwMjVcdTAwMjZ1dG1fY29udGVudD1Qcm9kdWN0K1VwZGF0ZXNfSnVseSsyNVx1MDAyNnV0bV9tZWRpdW09ZW1haWxfYWN0aW9uXHUwMDI2dXRtX3NvdXJjZT1jdXN0b21lci5pbyIsImludGVybmFsIjoiYzFmMTA4MjBmMmE4MDFmM2Y0M2IiLCJsaW5rX2lkIjoxNzM1fQ/3260a77a6f4e7f41eaec8a55220d8db1dac988ee58b46fef66f91c24a88c774c)

## Upcoming features:

### Hotel Booking in the Storefront

Soon, users will be able to redeem points for hotel stays directly from the marketplace. This feature will make travel rewards even more accessible and exciting.

### Lounge Access with QR Codes

Lounge vouchers will include a QR code in the delivery email, allowing users to easily enter lounges without needing an app or printed voucher.

### Cashout Option

Users will be able to convert their points into cash payouts giving them more freedom on how they use their rewards.

### Gamification in Xoxoday

We're adding gamification features to help drive more engagement. Look out for interactive elements that make rewards more exciting.

Looking to drive loyalty, boost sales performance, or enhance employee engagement? [Explore Xoxoday's product suite here.](https://e.customeriomail.com/e/c/eyJlbWFpbF9pZCI6ImRnVEI4UWdEQVBQME9fTDBPd0dZVUg3TndxYVN0M0FDcmYxN2VaND0iLCJocmVmIjoiaHR0cHM6Ly9iaXQubHkvM0g4U0hWaj91dG1fY2FtcGFpZ249QWRtaW4lMkZTdXBlcitBZG1pbnMrLStQcm9kdWN0K1VwZGF0ZXMrLStKdWx5KzIwMjVcdTAwMjZ1dG1fY29udGVudD1Qcm9kdWN0K1VwZGF0ZXNfSnVseSsyNVx1MDAyNnV0bV9tZWRpdW09ZW1haWxfYWN0aW9uXHUwMDI2dXRtX3NvdXJjZT1jdXN0b21lci5pbyIsImludGVybmFsIjoiYzFmMTA4MjBmMmE4MDFmM2Y0M2IiLCJsaW5rX2lkIjoxNzM2fQ/8abdfac11152f012fc442db627affd602a8e24328c84ba7cd325e33baed295e6)

Want to request a feature on Xoxoday Plum?

Get in touch with our customer success team at [cs@xoxoday.com](mailto:support@emplus.io?utm_campaign=Admin%2FSuper+Admins+-+Product+Updates+-+July+2025\&utm_content=Product+Updates_July+25\&utm_medium=email_action\&utm_source=customer.io)


# Release June 2020
Source: https://help-plum.xoxoday.com/product-updates/release-june-2020

Read the Plum product update for June 2020, covering new features, improvements, and fixes shipped that month.

*Plum New Features Release: June 2020*

Xoxoday Plum, our exclusive rewards platform, brings a handful of upgrades with this release. There's a new link-based API for redemption, front-end improvements, nudges on points-expiry, and bring-your-own-products feature, along with other changes. Let's go through them all.

## Generate URLs for Link-based Redemption with the API

Link-based redemption has proved to be a fruitful tool for admins to distribute vouchers through URL, which can be redeemed in just a click. However, the link-based redemption process for admins involved going to the platform and choosing vouchers from the catalog and then redeeming the links.

With the new Link-based Redemption API, all admin has to do is create campaigns once, after which they can use the API to generate links. This can be done so by sending campaign codes and the number of links to be generated, and they shall be delivered via email.

The admins won't have to visit the platform and go through the whole process of campaign creation. All it'd take is the campaign code to generate the links, making the link-based redemption process quicker than before.

## Automated Refund Process on Cancellation with PayU

Our integration with the PayU payment gateway was mentioned in May features release, and with the global payment gateway, we have automated refunds on canceled orders and purchases from Xoxoday Stores. In times before PayU Payment gateway, refunds were immaculately processed by the support team, but with automation, the process can easily be tracked via the PayU portal.

<Frame>
  <img alt="" />
</Frame>

## "Can't find what you're looking for? You might also like…"

For the ones using the link-based redemption option on the Xoxoday Store, improvements have been made on the front-end wherein they can shop for suggested vouchers in their points-range in case the voucher they were looking for goes out of stock.

The suggestions come as a replacement to the error-screen which was showcased when the offered voucher wasn't available. With this fix, users can explore the given options in Xoxoday's catalog of the same or different denominations.

<Frame>
  <img alt="" />
</Frame>

## Send Users a Nudge when Xoxocodes/Points are Near-Expiry

**This is a customizable feature. Please connect with [cs@xoxoday.com](mailto:cs@xoxoday.com) or your POC for details.**

The users are notified via email when their Xoxocodes and/or points are near to the date of expiry. Xoxo Codes and points are valid for one year from the date they're credited to the user's account. It's crucial to keep the users in the loop when the date of expiry comes near.

The users can check the validity of their Xoxocodes and points from the profile drop-down menu. But in order for them to make the most of it and not waste their points, nudges will be sent out.

This is a premium feature that our support team will be happy to walk you through. Please connect with your point of contact or write to us at [cs@xoxoday.com](mailto:cs@xoxoday.com) to know more.

## Admins, Reward Every User with a Personalized Wish

While rewarding users with Xoxo Codes and points, the admins can include a personalized wish for each and every one of them. This can be done via a bulk upload through CSV file or simply on the campaign screen.

Earlier, the admins could pen down a single message for sending out rewards to multiple people, but with this update, they can keep it personal with the messages. The process is simple:

* Download the template

* Input your personalized message in every user's row

* Upload the CSV file back to the campaign menu.

Another way to do it from the campaign menu is to enter every personalized message beneath the user's name and email.

<Frame>
  <img alt="" />
</Frame>

## Admins can Retrieve and Resend Lost Codes to Users

With the rise in cases of lost Xoxocodes from users' ends, we've passed the front-end control to the admins so that they can retrieve and resend the codes. There were increased cases of lost emails, texts, and code numbers and now admins can assist the users from their end in sending the codes back.

The codes can only be retrieved and resent from the admin's end within 15 days of the issue. In case of further delay, feel free to approach your point of contact or [cs@xoxoday.com](mailto:cs@xoxoday.com).

In the Admin menu, go to Reports > Xoxocode. Click on Action and Resend the code to the designated user(s).

This feature is only available for organizations with a single admin, the multi-admin compatibility of this feature shall be live soon; stay tuned.

<Frame>
  <img alt="" />
</Frame>

## Create Your Own Branded Store & show your SWAG!

Who doesn't love some Souvenirs, Wearables, and Gifts (SWAG) from the workplace? Now showcase your own catalog of products on the Plum storefront. With the add-your-merchandise feature, organizations can add their own merchandise, perks, benefits, SWAG, and vouchers in their storefront along with Xoxoday's catalog. All the users have to do is upload the images and a short description of what the merchandise is about and it'll be live in the catalog.

<Frame>
  <img alt="" />
</Frame>

Be it a coffee with your brand ambassador, lunch at the high table or simply tees, portable chargers, pens, and notebooks, showcase it all on the Plum Storefront, and let your people take their pick.

All the orders received on the merchandise will be automated. The admin(s) will get a report of orders placed on the same day so that the orders can be managed in real-time by the organization.

## Learn how to Redeem with the Points Redemption Walkthrough

The users can go through the points redemption guide and clear any queries that they have. Find the answer to all your question in the document.

[Here's the points redemption walkthrough >>](https://docs.xoxoday.com/login?dest_url=L2RvY3MvaG93LXRvLXJlZGVlbS1wb2ludHM=)


# Release June 2023
Source: https://help-plum.xoxoday.com/product-updates/release-june-2023

Read the Plum product update for June 2023, covering new features, improvements, and fixes shipped that month.

## Reports Improvements

With this release, all reports have been changed to optimize performance. The records available in the portal have been restricted to the last six months to reduce instances of timeouts and incorrect numbers. To access records before six months, the admin has an option to send them across over to their email.

In addition to this, we have implemented a filter that will allow the admins to view 'records by 'redemption date'.

The admins of Xoxo Links will be able to view a link wise report in the 'Generate to self' tab as well.

A Reference ID has been added to each report (Payment, Xoxo Point, Xoxo Code, Xoxo Link, Plum Pro). This is to make it easy for the admin for recon and to have one unique identifier for each reward sent.

<Frame>
  <img alt="" />
</Frame>

## Launched Templates

A new tab has been introduced that has pre-defined templates that the admin user can pick from while sending rewards. This eases the process of sending rewards as the admin need not create email template modifications from scratch. Each predefined template comes with an appropriate banner and personalized message that the admin can just pick and send out.

<Frame>
  <img alt="" />
</Frame>

## Recommended Products

While selecting products on creating a campaign, the admin will be able to see a new section that will show recommended products to be selected in that country and for the selected denomination.

<Frame>
  <img alt="" />
</Frame>

## Change in Reward Module Names

The reward modules are updated to:

* Xoxo Points -> Xoxo Reward Points

* Xoxo Code -> Xoxo Reward Code

* Xoxo Link -> Xoxo Reward Link

* Plum PRO -> Xoxo Rewards API

<Frame>
  <img alt="" />
</Frame>

## Stores/Marketplace

### Introduction tag for recommended products

With this release, we have introduced a new tag called 'Recommended' on the storefront. This tag aims to assist our users in identifying and purchasing the most popular products available in our catalog.

By labeling certain products as 'Recommended,' we ensure that our users can easily discover and access the most sought-after items.

<Frame>
  <img alt="" />
</Frame>

### Improved UI of Reward API catalog page with more filters and sorting

With the release, the user experience for the reward API catalog page is improved and more readable for the usage of sales team and API clients to know more about latest updated products and other details.

<Frame>
  <img alt="" />
</Frame>

### Xoxo Rewards API (Previously Plum PRO)

**APIs:**

* In getVouchers API response, tatInDays for the Delayed delivery products have been changes to " 2 - 7 " of value type String from " 0 " which was of value type String. This is introduced for improved accuracy in representing turnaround time that can help build user experience accordingly.

* Added new prince ranges in the Price Filter (getFilters API) - This will help Admins/Super Admins to filter products with ranges that were not available earlier and use it based on their use case.

* Included "access\_toke\_expiry" and "refersh\_token\_expiry" information in the token API response. Now this will allow users to get the information from the API response than going to the dashboard to know the information.

**Xoxo Rewards API Dashboard**

* Order Cancellation Notification for Plum Pro customers - Now Super Admins and Admins of the account will get a consolidated list of all the canceled orders of a day to their emails.

**Webhooks**

**Webhook Payload:** deliveryStatus for delivered orders is changed from "Delivered" to "delivered". This is done to maintain sanity with the response users receive in Plum Pro APIs.


# Release June 2024
Source: https://help-plum.xoxoday.com/product-updates/release-june-2024

Read the Plum product update for June 2024, covering new features, improvements, and fixes shipped that month.

In the recent weeks, we've introduced an array of exciting features designed to enhance the user experience. Among the notable additions are the new and quick sign in, launch of direct bank transfer and RuPay prepaid cards in India, order tracking for your customers, and email template customisation for your reward campaigns.

The new and quick sign in process streamlines account access. Direct bank transfers and RuPay Prepaid cards offer a convenient payment option for your channel partners. Order tracking empowers your customers with visibility into their purchases. Email template customisation elevates reward campaign personalisation.

But that's not all – we're offering you an exclusive sneak peek at the features slated for the release in coming months.

## Here's what's new:

### Launch of Direct Bank Transfers and RuPay Prepaid cards in India

<Frame>
  <img alt="" />
</Frame>

We're proud to introduce two powerful new payout methods - direct bank transfers and RuPay prepaid cards. These localized solutions are tailored to provide convenience, flexibility, and a superior channel partner experience.

Direct bank transfers eliminate delays and enhance transparency by allowing you to disburse incentives seamlessly into your partners' bank accounts for a nominal surcharge. RuPay prepaid cards, on the other hand, offer a secure digital wallet, empowering your partners with instant access to their well-deserved rewards.

### The New DIY Flow

<Frame>
  <img alt="" />
</Frame>

Introducing the sleek and intuitive new DIY (Do It Yourself) Flow, designed to enhance the onboarding experience. We've minimized the information required for account creation, allowing users to breeze through the process effortlessly. But that's not all – we've also streamlined the rewarding journey, enabling users to submit business details, set a redemption URL, and add a rewarding base currency, all without disrupting the flow. Moreover, users can now explore the platform's features and functionalities, except for transactions, even before business verification.

### Delight Your Customers with Seamless Order Tracking

<Frame>
  <img alt="" />
</Frame>

Elevate the shopping experience for your end customers with our new "Track Order On Storefront" feature. Empower them to stay informed throughout their purchase journey by allowing real-time order status tracking. With just an Order ID and contact details, your customers can effortlessly monitor every stage of their order, from processing to shipment to delivery, right from your storefront.

### Craft Personalised Communications

<Frame>
  <img alt="" />
</Frame>

Now, you have the power to craft personalized email content that truly resonates with your audience. Go beyond templated messages and unleash your brand's unique voice by editing the email body, subject lines, adding links and more. Whether you're sharing updates, fostering customer relationships, or launching campaigns, this innovative addition allows you to infuse your distinct tone and messaging into every interaction. A dedicated custom footer allows you to reinforce your brand with every email. With complete control over creating personalised interactions that resonate with your audience, this feature elevates your brand communication to new heights.

### Gain Deeper Insights into Bulk Rewarding

<Frame>
  <img alt="" />
</Frame>

Rather than relying on a simple "100% Processed" status, you can now effortlessly track and update the status of individual records within bulk operations. Gain visibility into successful disbursements and failed transactions, empowering you to take proactive measures, reduce manual efforts, and make data-driven decisions to enhance your overall rewarding experience.

### Increased Transparency in Reward Redemption

<Frame>
  <img alt="" />
</Frame>

Now, when sharing reward links with your recipients, you can provide them with clear visibility into the expiration dates and validity periods. This added transparency empowers your users to plan their redemptions effectively, eliminating any confusion or missed opportunities.

## Upcoming features

### Launching Perks on Marketplace

Explore a brand-new category on our Marketplace – Perks and Benefits! Get ready to unlock exclusive deals and discounts from popular brands and products. Admins can easily configure and manage this exciting category from the admin panel, ensuring a seamless experience for users.

### Xoxocode Balance Insights

Gain deeper insights into your Xoxocode balance. Users will be able to access comprehensive information about the status of their Xoxocodes, including who redeemed them. This improved transparency provides better visibility and control over your rewards.

### Two-Factor Authentication for Admins

Super admins and admins can now enable two-factor authentication via mobile OTP or an authenticator app, adding an extra layer of security to their accounts.

### Bulk Resend for Reward API Customers

Reward API customers can now resend rewards in bulk by multi-selecting the rewards, streamlining the process for efficient reward management.

### Multiple Admin Enhancements

Get ready to embrace a wave of enhancements across the admin panel. Look forward to new low balance email notifications and customizable threshold settings, keeping you informed about your rewards balance. Additionally, enjoy streamlined notifications for scheduled rewards, ensuring you never miss an important update. We've also revamped our bulk template file management, making it easier than ever to handle large volumes of data efficiently.


# Release June 2025
Source: https://help-plum.xoxoday.com/product-updates/release-june-2025

Read the Plum product update for June 2025, covering new features, improvements, and fixes shipped that month.

<Frame>
  <img alt="" />
</Frame>

<Frame>
  <img alt="" />
</Frame>

<Frame>
  <img alt="" />
</Frame>


# Release March 2020
Source: https://help-plum.xoxoday.com/product-updates/release-march-2020

Read the Plum product update for March 2020, covering new features, improvements, and fixes shipped that month.

The March 2020 Plum release brings with it a handful of advanced features to help organizations get the best out of the [reward platform](https://www.xoxoday.com/plum), like white labeling, better customization, readable campaign URLs, proforma invoicing, resending brand vouchers, viewing multiple items in one single order, multi admin and SMS delivery of points. Let's understand them one by one.

## Customize Plum as per your brand with White labeling

White labeling Plum as per your brand helps you:

* Building brand credibility

* Strengthening customer loyalty

* Saving time and money

Having your brand name on logins and messages that are sent to customers helps in building brand awareness, a sense of credibility, and trust with the client.

**White labeling feature in Plum**

<Frame>
  <img alt="" />
</Frame>

<Frame>
  <img alt="" />
</Frame>

They can also choose the name of their rewarding units (e.g. xoxopoints), email name through which rewards are sent.

<Frame>
  <img alt="" />
</Frame>

It gives them the flexibility to enable/disable payment options, set the first level of support and communication.

<Frame>
  <img alt="" />
</Frame>

Campaign email settings

* They can now enable SMS delivery of points and vouchers to the recipients

## Readable Campaign URLs

The admin will now be able to create a campaign with a URL that is more relevant and readable to the user. It will be of the format `https://stores.xoxoday.com//`

The objective is to make it easier for the end-user to read and also for future similar campaigns.

## Proforma Invoicing

<Frame>
  <img alt="" />
</Frame>

A Plum admin will now have an option to generate the proforma invoice before they make a payment for recharges. They can submit the invoice for finance approval before making the actual payment and at any point of time access the specific transaction and complete it from the Reports section.

## Resending Brand Voucher

<Frame>
  <img alt="" />
</Frame>

To give more flexibility to the end-users, Plum has the option to resend brand vouchers they purchased from their order history. This feature can come in very handy when a user loses their original voucher or order confirmation. The user can also resend the brand voucher to an alternate email - it can be their mail id, or they can use the email id of their family member or friend. All they need to do is to enter an alternate email in the box provided.

## Viewing Multiple items in a single order

<Frame>
  <img alt="" />
</Frame>

Keeping up with the practice of giving more flexibility to the end-users, they can now see the details that include the delivery status of every individual voucher of a particular order. Earlier it wasn't possible as they were restricted to see the details of the entire order as a whole.

## Multiadmin (Earlier Releases)

<Frame>
  <img alt="" />
</Frame>

With the new product release features, our primary focus was to make our product as flexible as possible for our clients and their end-users. With this new feature, We have added the multi-admin feature which will allow the admin to add other people as the admins of Plum Dashboard so that they can Send Xoxo Points, Xoxo codes and check reports by themselves.

It, in turn, helps in the decentralization of the reward allocation process to subordinates involved. Having shared access leads to faster transactions and more efficiency.

This is how it would work:

* The person who created the client's account in Xoxoday Plum acts as the super admin of the company.

* The super admin can add/remove other people as admin and grant them access to rewarding.

* The super admin can set up a maximum reward limit for each admin such that they cannot go beyond the threshold limit.

* The admins are permitted to send Xoxo codes, Xoxo points, and check reports.

## SMS for Xoxo points

<Frame>
  <img alt="" />
</Frame>

We have simplified the process of redeeming rewards by introducing SMS for Xoxo points and vouchers. The end users can now receive xoxo points, xoxocodes and brand vouchers on their mobile numbers, along with a redemption link that will redirect them to a specific page where they can redeem their reward as shown in the above image.

The focus on this month's product release has been flexibility and simplification of Plum such that both our clients and their end-users are happy. We have introduced seven features to make our rewarding platform faster and more efficient. Hope it helps you in delighting your end-users.


# Release March 2021
Source: https://help-plum.xoxoday.com/product-updates/release-march-2021

Read the Plum product update for March 2021, covering new features, improvements, and fixes shipped that month.

This March, we have six major updates for our users. This product release is well balanced in terms of improvements to our end-user storefront and the admin rewards dashboard. We hope these improvisations will help you deliver rewards effortlessly, and deliver on your business goals.

**Here are more details about the updates:**

## Improved user experience in the admin dashboard

Concerning Xoxoday Points and Xoxoday Codes, users mentioned a clunky & cluttered-looking form that had a lot to put in before they could get started, and it sometimes made a simple process seem overwhelming.

We couldn't keep ourselves calm knowing that! We have introduced a new dialog box (shown in the image below) wherein all the information for a single user is collected, allowing to focus on the information put in, and there is room for description for each input field with an ability to edit the information at any time.

With the new update, The UI/UX for the aforementioned sections in the admin dashboard has been revamped to reduce clutter and make it easier for Reward Admins to distribute rewards.

## New Feature: Scheduling Rewards Distribution

Earlier, you might have faced some issues in terms of scheduling Xoxo Codes and Xoxo Points from the dashboard. With the new update, The scheduler functionality has been reintroduced for both bulk and single sending. It is now easier than ever to schedule rewards via Xoxo Codes and Xoxo Points. Now, you can distribute rewards for single/multiple recipients at a later date by selecting the date from the calendar. If left unchecked during the campaign, the rewards will be distributed instantly.

## It is now easier to distribute Xoxo Links en masse

As more and more users are exploring Xoxo Links, requests were pouring in for bulk uploading recipients to send out Xoxo links. With the new update, there are no more restrictions when it comes to uploading recipients in the Xoxo Links section. You can now upload the entire list of recipients using the prescribed CSV template and deliver Xoxo Links en masse. The functionality also allows you to send a personalized message for each recipient by adding the CSV file message and uploading it in the section as shown in the image below.

## Sleek and revamped look for the Storefront

For end-users who sometimes had a hard time navigating through the cart and felt the UI was a bit clunky, this update is for you. The upgraded look for the Storefront aims to provide a much better user experience for the end-user. The changes include an updated representation of the gift voucher section, landing page, a cleaner listing of categories, removal of the perks section, and simplifying the header and footer options. It is also easier for end-users to now checkout directly from the cart.

## Scheduled Rewards have a new home

If you had to navigate multiple sections in the admin dashboard to check the reports for scheduled Xoxo points and Xoxo Codes, we have made it simpler for you to view the data.

The Xoxo points and Xoxo codes that were scheduled can now be viewed in the respective reports section. This allows you to check the reports in a single destination and understand the usage patterns easily.

## Users who have integrated Plum with third-party tools can distribute rewards via links

For Plum users who have integrated with third-party platforms, now you can send rewards in the form of links embedded in the recipient email.

A preview of the email and reward redemption page with link-based redemption is shown in the image below. With the latest update, distribute rewards via link-based redemption on the platform of your choice.

That is all for this product release! Have a question? Reach out to us [here](https://support.xoxoday.com/support/tickets/new)

To set up a demo with a Plum Specialist, please sign up [here.](/product-updates/release-march-2021)


# Release March 2022
Source: https://help-plum.xoxoday.com/product-updates/release-march-2022

Read the Plum product update for March 2022, covering new features, improvements, and fixes shipped that month.

This March, we have undergone a few major changes on both the plum admin side and the store.

On the integration side, we have improved Hubspot integration now Xoxoday plum passes reward automation campaign activities into Hubspot CRM via Custom events into Hubspot CRM, there is now with the admins to edit any existing automation created by the admin for the integration rewarding.

Here are more details about the latest update:

## Mobile Only rewarding

The admins now will be able to reward only on the mobile number of the recipients without having to input a mandatory email ID. This adds a lot of flexibility while rewarding across all modes of distribution (Xoxo Points, Xoxo Codes, Xoxo Links, and Plum Pro). In the case of Xoxo Points and Xoxo Codes, the same number/email can be rewarded from multiple accounts. In case of non-delivery, the reward can be resent as well to the same mobile numbers from under reports.

<Frame>
  <img alt="" />
</Frame>

## SMS Delivery Status in reports and resending to only mobile

With integration with our SMS service partner Kaleyra, we now are able to show the delivery status of individual rewards for Xoxo Points and Xoxo Codes via SMS. This brings in transparency to the entire rewarding experience and is critical for admins to understand the status of their rewards sent.

<Frame>
  <img alt="" />
</Frame>

## Download high volume of records

Up until now, when the admin tries to download reports, if the number of records is high, it would take a long time to process and the download to complete. There was also a possibility of the process getting timed out due to large volumes. We have now optimized the process so that the admins do not have to wait around for the downloaded data. If the number of records is more than 10K, an email is triggered to the admin with the downloaded data attached as excel.

## Revamped Plum Pro report

It's convenient for clients to do reconciliation as:

* new fields have been added - **Discount (%), Amount charged, Quantity, Product ID, Delivered Date**

* user can filter reports by newly added fields

* Downloaded report contains numeric fields in a separate column from currency making it easier to do calculations.

## Other Improvements

Admins now have the ability to sort across reports by various columns like last redeemed date, sent date, Recipient Name etc. We also follow a consistent number system across the admin portal.

## Storefront

### Mobile login

Earlier email ID was mandatory for logging in to the storefront in order to redeem points or codes. After this release users will be able to create accounts/log in with their mobile numbers with OTP verification. This is a big step towards expanding the reach of the Xoxoday redemption audience.

<Frame>
  <img alt="" />
</Frame>

## Integration

### Improved Signup Journey

The signup journey for integration was earlier long and had multiple steps. Now the integration sign-up journey is improved and made more interactive for the new clients getting onboarded from the respective integrations like HubSpot, Qaultrics, Zapier, etc.

Qualtrics SDK: In the release, developed a custom plugin to interact with the Qualtrics product using the Extension SDK. We are using 'Actions SDK' that can be part of a Qualtrics workflow, wherein a customer can easily set up a 'Reward automation' by selecting 'Xoxoday Plum Extension' workflow, within the Qualtrics UI.

This SDK release aims to bring the following advantages, XM Extension benefits to Xoxoday and our customers:

* Discoverability: Qualtrics users can discover your XM Extensions either in the Qualtrics marketplace or within XM OS itself.

* Seamless UX: XM Extensions are embedded into, making set-up and management intuitive easy, and accessible directly inside the Qualtrics environment.

* Retain customers via building more native features, rewarding solutions, and increased product usage.


# Release March 2025
Source: https://help-plum.xoxoday.com/product-updates/release-march-2025

Read the Plum product update for March 2025, covering new features, improvements, and fixes shipped that month.

*Latest from our world of Rewarding*

We've rolled out new features to enhance your Plum experience! Now, you can enjoy lounge passes on the Plum Storefront, making travel more rewarding than ever. We've also introduced easy order tracking for merchandise, so you'll always know where your orders are. Plus, our smoother, faster checkout experience ensures every transaction is effortless. And don't miss our new Salesforce authentication integration, designed to provide seamless, secure, and efficient access. These updates are all about giving you a smarter, more rewarding experience with Plum!

## Here's what's new:

### 1. Easy Order Tracking on Merchandise

It is simpler to track your merchandise orders now! A new order status has been added to keep you updated on your shipments. For select orders, you'll now receive a direct tracking link so you can easily check the real-time status of your delivery. This means quicker and more convenient shipment updates, all at your fingertips!

<Frame>
  <img alt="" />
</Frame>

### 2. Salesforce Authentication Integration

We've implemented Salesforce authentication to enhance system security and streamline API communication. This feature allows the storage of access and refresh tokens and includes a mechanism to automatically refresh the access token before making Salesforce API calls. This ensures seamless, uninterrupted access to Salesforce data, enhancing overall performance and security.

### 3. Enhancing the Checkout Experience with Cross-Currency Insights

We've improved the checkout process by adding notifications for cross-currency transactions. Users with a lower point balance than needed for a specific currency will be notified to complete the remaining amount with points or alternative payment methods.

<Frame>
  <img alt="" />
</Frame>

### 4. Access Airport Lounges with Ease!

Lounge Passes are now available for all major airports on the Plum marketplace. You can purchase lounge access based on your flight departure date and preferred lounge by redeeming reward points. Enjoy a comfortable and premium pre-flight experience with seamless booking—making travel more convenient and rewarding.

<Frame>
  <img alt="" />
</Frame>

## Upcoming features

### Airmiles - A New Way to Redeem Rewards

Get ready for a new category on the Plum marketplace featuring popular air miles programs. Soon, you'll be able to seamlessly transfer miles by redeeming your reward points—making it easier than ever to turn your rewards into travel opportunities.

### WhatsApp for Reward Distribution

We will be adding WhatsApp as a new channel for reward distribution on Plum! Alongside Email and SMS, businesses will be able to seamlessly send rewards directly via WhatsApp.

### Charity on the Reward Marketplace

We'll introduce Charity as a new category on the Plum reward marketplace. This feature will allow users to donate their reward points to a charity of their choice.


# Release May 2020
Source: https://help-plum.xoxoday.com/product-updates/release-may-2020

Read the Plum product update for May 2020, covering all the new features, improvements, and fixes shipped that month.

*Enhance Your Rewarding Process With May 2020 Plum Release Features*

The May product update from Xoxoday Plum comes with handy upgrades to make the rewarding process seamless. With simplified user flows, new integrations, new email templates, and beyond, this Plum release offers a better user experience for both platform admins as well as end-users.

## All-new Campaign Dashboard for monitoring the rewarding process

Managing reward campaigns was previously a disconnected experience for the admins with having to navigate between different screens to view campaign details. With an intuitive redesign of the campaign dashboard, now the Plum admins can monitor the status of their reward campaigns seamlessly from a single interface. The dashboard displays the voucher redemption rates, status, and actions of every campaign that they have run.

<Frame>
  <img alt="" />
</Frame>

## An Improved Campaign Creation Interface

The new Xoxoday Plum campaign creation user interface helps admin users to quickly select catalog categories. The interface provides category tags and checkboxes to easily configure reward campaigns and thus quicken the campaign creation process. This UI improvement allows admins to easily verify their campaign selection to configure it more accurately and efficiently.

<Frame>
  <img alt="" />
</Frame>

## Customize The Reward Campaign Emails

With this release, Plum admins are given the option to configure the campaign email template as per their requirements. From the earlier standard email template that sent out the voucher codes to recipients, the admin can now tailor-make these emails with personalized messages and designs. This customization capability helps admins make the rewards more meaningful and personal to the recipients thus making it more effective.

<Frame>
  <img alt="" />
</Frame>

## Integration With Payu Payment Gateway Made Seamless

[PayU, a global payment gateway](https://payu.in/) that provides an array of payment options is now available seamlessly during purchase to Plum end-users. PayU offers one of the industry's highest security and payment success rates, multiple payment options, and round-the-clock support. This update helps users use the robust PayU gateway to make their purchases through the payment mode of their choice.

<Frame>
  <img alt="" />
</Frame>

## Integration With Webengage For Push Notifications

Xoxoday Plum integrates with WebEngage to engage the end-users better and help them stay updated on the new catalog offering. From having to scroll through a catalog of 21,000+ offerings, now the users are informed of new listings based on their interest through web and email push notifications. The integration aims to enhance the user experience of discovering a highly relevant offering for reward redemption.

<Frame>
  <img alt="" />
</Frame>

## Paypal As A Payment Option Is Live

Xoxoday Plum users now have an option to pay via Paypal, one of the world's leading online payment portals for easy checkouts and fast processing. PayPal offers one-account mobility which can be used all around the globe - thus helping the users have a seamless redemption experience.

## Improved Admin Experience While Generating Xoxo Redemption Links

Xoxoday Plum admins can now create and send out rewards with link-based redemption options to recipients from a quick-to-use interface. This interface gives the user the option to quickly choose the reward campaign, recipients, and authentication methods. The link-based redemption feature helps in the easy distribution of rewards and perks, making Xoxoday Plum versatile for various rewarding use cases.

<Frame>
  <img alt="" />
</Frame>

## Catalogue Expansion With New Global Offerings

Just like every new release, the Plum Storefront catalog keeps expanding to foray into new geographies and demographics. We work to constantly work towards improving our catalog offering with global vendor partnerships - to enrich the global redemption options for our end-user.

Here's a list of additions in the Xoxoday Plum catalog in the month of May:

<Frame>
  <img alt="" />
</Frame>

<Frame>
  <img alt="" />
</Frame>

[To make the most of these additions, access our vast Catalogue at the Xoxoday Storefront>>](https://stores.xoxoday.com/marketplace/vouchers)

To see the Plum May 2020 feature updates live, [book a demo](https://www.xoxoday.com/book-a-demo) or contact us now!

<Frame>
  <img alt="" />
</Frame>


# Release May 2021
Source: https://help-plum.xoxoday.com/product-updates/release-may-2021

Read the Plum product update for May 2021, covering all the new features, improvements, and fixes shipped that month.

This May, we have several updates for admins and end-users. For admins, the entire platform has been upgraded with several UI/UX changes.

An expanded catalog and a new user interface for the Storefront users make it easier for them to redeem rewards seamlessly.

Here are more details about the new update:

## Seamlessly upload recipients en masse in the admin dashboard

Admins told us that they were not getting feedback on the status of the file uploaded or what percentage of the records were being processed.

With the latest release, the bulk upload process has been revamped, helping admins understand what went wrong with the upload. Admins can upload up to 10000 records in a single file and rectify the errors before sending the file to processing. They can also track real-time status on the percentage of successful uploads in the contact list.

The added checkpoints such as "Uploaded File Name Check," "Bulk Upload Progress," etc., will ensure that the entire process is as smooth as possible.

## Enhanced UI for admins

With this release, the entire "Settings" section has been overhauled to make it easier for admins to distribute rewards. Earlier, there were multiple sections present for admin settings, making it hard to navigate. There is now proper segregation in Platform Preferences into "Profile," "Storefront," and "Rewarding and communication."

The option to move to the Storefront and view profile details can now be accessed by clicking on the Account Name on the top right corner.

A single section now defines the platform's usage for admins and manages multiple admins in the dashboard. The default landing page and "Wallet Balance" section have also been remodeled to make it easier for the admins to view and send rewards.

## Ability to customize SMS in the "Xoxo Points" and "Xoxo Codes" section

It was earlier not possible for admins to view the SMS sent along with the reward.

The latest update lets an admin preview the SMS before it is sent to the end-users; he/she can also customize and add a personalized message to the recipient when the SMS is delivered. The admin can also tailor the message as per the campaign.

In the "Reports" section, the SMSes can be resent at any point in time. The status of the distributed rewards via SMS can be viewed by just searching for the phone number here.

## Updates under "Platform Settings"

The new update lets the super admins choose to make the overall balance of the company wallet visible/hidden to the other admins. This feature was a request from multiple enterprise clients running large reward programs, with each admin responsible for their reward budget.

A Tax ID form and the option to reconfirm the details have been introduced to enable error-free Tax ID update in the platform. It is mandatory to fill in tax ID for a recharge or rewarding transaction in the platform and is a one-time setting essential for billing purposes.

"Reset to last save" feature enables the admin users to make changes and revert if need be.

The overall organization and grouping of each setting for admins have been made more intuitive.

## Easier checkout with enhanced UI for Storefront Users

Storefront users told us that they were adding products unintentionally while checking out.

With the latest update on adding a product to the cart, the user is directed to the "Go to Cart" button making the user's overall redemption journey more conversational.

This also reduces the possibility of the user adding multiple quantities of the same product unintentionally.

## Expanded Catalog in the Storefront

With four new additional vendor integrations, Storefront users can now enjoy access to a broad catalog covering new brands and geographies.

Plum marks its presence in Canada and China with this release. Plum has also expanded its US and New Zealand presence with 100s of gift vouchers and incentives across categories.

## Xoxo Link personalization

Earlier, it wasn't possible to customize the email when the admin ran the campaign under the "Xoxo Links" section.

With the new release, the admin user can modify the Sender Name, Email, and Footer of the email to customize the campaign as per his/her needs.

That is all for this product release! Have a question? Reach out to us [here](https://support.xoxoday.com/support/tickets/new)

To set up a demo with a Plum Specialist, please sign up [here](https://www.xoxoday.com/book-a-demo)


# Release May 2022
Source: https://help-plum.xoxoday.com/product-updates/release-may-2022

Read the Plum product update for May 2022, covering all the new features, improvements, and fixes shipped that month.

This May, we have undergone a few major changes on the plum admin side.

On the integration side, we have improved Migration of our Hubspot app to granular CRM scopes, 'Preview Module' for ZohoCRM and Salesforce etc.

Here are more details about the latest update:

## Plum Admin

### Collection of user redemption details with Xoxo Links

With the new release, clients will now have the option to collect the recipient's email ID/phone number during redemption. This gives immense value to those running marketing campaigns and consumer promotions, as they can now have complete insight into who has redeemed the reward. This data is available in reports for both rewards sent directly through the platform, via integrations, or by generating many links for the admin and sending them out later.

<Frame>
  <img alt="" />
</Frame>

<Frame>
  <img alt="" />
</Frame>

<Frame>
  <img alt="" />
</Frame>

### New Campaign Page

We have completely redesigned the campaign page by taking a completely different approach that optimizes to show precisely what brands are available and gives the user a clear indication of the country selected, the categories selected, and the number of products chosen, all on a single screen. This new campaign feature works with Xoxo Codes and Links.

<Frame>
  <img alt="" />
</Frame>

### Status integration of Xoxo Link reports

The new reporting filters were added to give complete insights into the reward redemption process to the users running marketing campaigns or consumer promotions via Plum. You can view the details under Reports > Xoxo Links > Individual Link > View details.

<Frame>
  <img alt="" />
</Frame>

### Unsubscribe for low balance notifications

We have added an unsubscribe notification in the emails. The link is generally visible at the bottom of the notification email. If you don't want to receive a particular notification, you can choose to unsubscribe from all the low balance notification emails.

### Editing sender's email ID

In many instances, the reward emails were going to spam or not delivered when the sender's email ID was changed. Now we have restricted the sender email ID to be [notifications@xoxoday.com](mailto:notifications@xoxoday.com) by default (for new accounts), and if it needs to be edited, the admin needs to reach out to Xoxoday.

### KYB restrictions for admins

To reduce a load of tech architecture and incidents of security issues, for all non-KYB verified accounts, we have now restricted the rewarding to a maximum of 100 recipients, five campaigns, and the addition of any other admin to the account up until the KYC is verified.

### Extensive account verification process in plum admin

In order to further optimize the KYB verification process and reduce KYB rejections, we have added new details like website domain, mobile number verification, and some other information in the verification process. Furthermore, any rejected account can not access their plum admin account.

### Other admin improvements

There have been improvements in payment report statuses, stopping the expired rewards resend and a few smaller issues.

## Integrations

### SAP Customers: Ability to set country-specific budget

Xoxoday now supports a smart multi-account architectural feature for users using SAP SuccessFactors. This feature enables the ability to:

* Manage wallets and budgets in a decentralized manner for employees in different geographies.

* Plum accounts can be created for each geography, wherein the different admins can be assigned to manage wallets and budgets independently.

* Employees can redeem vouchers from their assigned geography.

### Changes to Existing Qualtrics Flow

We have improved the Qualtrics user flow to allow public survey creation from the Plum admin account.

### Migration of our Hubspot app to granular CRM scopes

We have migrated all the legacy contact APIs to newer ones with this release.

### 'Preview Module' for ZohoCRM and Salesforce

With our native integration with Zoho CRM, we released updates to the preview page within the Zoho CRM and Salesforce CRM applications. Now the preview page gets a consistent view with what is there in the Plum admin account to maintain consistency between integration and admin accounts.

### Automation Settings

The advanced settings (like Set maximum reward count, Set automation date range, and Allow repeat rewarding) were also made available for the 'manual' approval type.

### Extra fields in storefront Integration

This feature release works for SAP (country attribute) and Workjam for EmployeeID and BadgeID. We store this information from the TPD data and display it in the redemption history report.

### StoreFront Integration

This process is now seamless, and the client's developer team will be able to generate keys from the admin dashboard. Earlier, they would have to contact CS to do so, which leads to a significantly higher lead time to integration.

### Supply-side

Amazon direct integration for the US and Canada along with KYB is live. This would lead to margin improvement for Xoxoday. This won't impact existing clients as they can procure Amazon products as usual as KYB is already done with Amazon for them, and new clients can initiate KYB via the Admin dashboard.


# Release May 2024
Source: https://help-plum.xoxoday.com/product-updates/release-may-2024

Read the Plum product update for May 2024, covering all the new features, improvements, and fixes shipped that month.

In recent weeks, we've introduced an array of exciting features designed to enhance the user experience. These include the launch of our Points API, which empowers personalized engagement and seamless integration, automated reminder emails to ensure the success of your campaigns, and the introduction of the Payment Report API, providing detailed transaction histories. But that's not all – we're offering you an exclusive sneak peek at the features slated for release in the coming months.

## Launch of Points API

### Feature Overview

We are thrilled to announce the launch of our latest feature, the Points API, designed to elevate customer engagement strategies to new heights. This powerful API empowers customers to enable a points engine inside their mobile and web applications, creating dynamic point-based engagement programs tailored to their specific needs, including loyalty programs, employee engagement initiatives, channel partnerships, and influencer collaborations.

### Key Functionality

* Seamless Integration: The Points API facilitates the effortless sending of points and retrieval of point balances, allowing customers to seamlessly incorporate a points engine directly into their mobile and web applications.

* Versatile Applications: With the Points API, customers can leverage its functionality across a wide range of engagement initiatives, unlocking new opportunities to connect with their audience and drive participation.

* Personalized Engagement: By incorporating point-based rewards and incentives, customers can deliver personalized experiences that resonate with their audience, fostering stronger connections and lasting relationships.

* Security: To ensure enhanced security, the Points API features robust oAuth 2.0 authentication and IP address whitelisting. These measures are implemented to safeguard customer data and protect against unauthorized access, providing peace of mind for both customers and end-users.

* Redemption Opportunities: Points issued to end-users can be redeemed on Xoxoday's Global marketplace, offering thousands of brands across 90+ countries. This extensive marketplace makes the offering very lucrative, providing users with a diverse range of options to redeem their points and enjoy rewards that suit their preferences.

**Benefits:**

* Enhanced Engagement: The Points API enables customers to engage with their audience in a more streamlined and efficient manner, driving participation and fostering stronger connections.

* Flexibility and Efficiency: Customers can now create and manage robust engagement programs with ease, thanks to the flexible and efficient capabilities of the Points API.

* Improved Customer Satisfaction: By delivering value and rewards in a personalized and seamless manner, customers can enhance customer satisfaction and loyalty, ultimately driving business growth.

**Availability:** The Points API feature is now available to all customers, enabling them to unlock new possibilities in customer engagement. For more information on how to get started with the Points API, please refer to the documentation or contact our support team for assistance.

We are excited to see how our customers will leverage the Points API to create innovative and impactful engagement programs, and we look forward to supporting them on their journey to success.

## Reminder Email For Clients

This feature aims to send periodically reminders to all end users who have active rewards waiting to be redeemed.

It empowers clients with automated reminder emails ensuring better success rates of campaigns being run by the clients and that the rewards are redeemed by the intended recipients.

## Introducing Payment Report API

Reward API customers can now fetch the entire transaction history of an account. Transaction history data includes information on fund additions, deductions and refunds. This will help integrate with reporting tools and assist finance team during the monthly reconciliation process.

## Standardizing Order Delivery Status Events in Webhooks

Currently, Reward API customers have the option to select "Delivered" or "Cancelled" events for an order delivery. With our new update, Order Delivery Status events will be standardized. These events will be enabled by default if the Webhook Status is enabled. We will send all events related to Order Delivery Status to the Callback URL listed.

## Order Delivery Status Events to Now Include Refund Information

We have enhanced the webhook functionality by including refund information in the payload. Along with "Delivered" and "Cancelled" status events, we'll now include a 'refundStatus': 'Refunded' key in the payload. This event will be posted only when a refund is successfully added to the admin wallet.

## Notifications if Webhook Status is disabled

Admins can now get notified if the Webhook status is auto disabled if the Callback URL is not functioning, which will allow them to check the URL status and take further actions to rectify the issues. Immediate actions taken to rectify the URL will help users to receive the Order delivery status change events that they are dependent on to take actions related to order delivery in their user journey.

## Upcoming Features

### IP whitelisting via Admin Dashboard

Super admins will be able to add / update and delete the IPs from the Admin Dashboard to access the APIs and avoid the manual process.

### Merchandise via Xoxo Links

Admins will be able directly send a selection of merchandise for the users to choose from that will be delivered to the end users address.

### New improved DIY flow

The upcoming new DIY flow simplifies the process of creating an account and getting started with sending rewards. There is no separate business activation as it has been integrated as a part of the send rewards flow.

### Enhanced Email Capabilities

Admins will be able to format, add links in the messages and add a personal footer sent to the end users with the new email editing capabilities. They will also be able to set templates as default such that they do not have to make changes every time they login.

### Minimum Balance Notifications

To ensure smooth redemption of rewards, we will have automated notifications to the admins ensuring there is sufficient balance in the wallet for redemption.

### Enhancements in Reward API Reports

Super admins can now know which super admin / admin has sent the rewards. This helps the users to have visibility in their operations and reconciliation process.

### Track Order in Marketplace

Users in the marketplace will now track their orders by providing necessary information. They can view order details, check the order status, and access other relevant information.

### Enabling WhatsApp for Verification Process

We are introducing WhatsApp as a secondary channel for delivering verification OTP messages to users. This addition aims to enhance delivery rates, expand coverage across various regions, and optimize costs.


# Release May 2025
Source: https://help-plum.xoxoday.com/product-updates/release-may-2025

Read the Plum product update for May 2025, covering all the new features, improvements, and fixes shipped that month.

*Learn about Product Updates for May 2025*

**Latest from our world of Rewarding**

Here's a quick roundup of what's new, what's improved, and what's coming soon on Xoxoday Plum. From better control over rewards to new ways of sending them, we've been building features that help you create more impactful reward experiences.

## Here's what's new:

### 1. Charity is now on the reward marketplace.

We're excited to introduce Charity as a new category on the Xoxoday Plum reward marketplace! Users can now donate their reward points to a cause they care about, supporting verified charities across different geographies.

Here's how it works:

* Choose the charity you want to support

* Decide how much you'd like to donate

* The equivalent reward points will be deducted automatically

<Frame>
  <img alt="" />
</Frame>

### 2. Campaign management in Rewards API

Managing product catalogues just got easier.

Admins can manage catalogues by category and campaign without fetching the entire list using the Get Voucher API. Instead, they can retrieve updates for only the selected products included in a campaign, reducing effort, improving performance, and giving more control over the reward experience.

<Frame>
  <img alt="" />
</Frame>

### 3. Tazapay payment gateway for SEA region

Smoother, localized payments are now live for Southeast Asia.

We've integrated Tazapay, a localized payment gateway for SEA users for smoother payments for Southeast Asia.

With Tazapay, users get

* Multi-wallet support

* Local currency transactions

* A frictionless redemption experience

## Upcoming features:

### Mobile top up as a marketplace category

Users will soon be able to recharge mobile numbers by selecting preferred plans and paying seamlessly using reward points.

### WhatsApp as a reward distribution channel

Alongside Email and SMS, businesses will soon be able to send rewards directly via WhatsApp.
No extra steps—just faster delivery right where your users are.

### Custom expiry dates for rewards

Admins will have the ability to set custom expiry dates for rewards.
No more fixed timelines—just more flexibility to align with your campaign.


# Release November 2021
Source: https://help-plum.xoxoday.com/product-updates/release-november-2021

Read the Plum product update for November 2021, covering new features, improvements, and fixes shipped that month.

This November, we have undergone a major revamp of the reports section on the plum admin portal.

Admins will now be able to send rewards confirmation mails and cancel rewards in bulk which saves their time and energy in doing the process one by one earlier.

Admins will now be able to filter the reports according to their own requirements which helps them understand the ROI of the reward program more efficiently.

**Here are more details about the latest update:**

## Bulk Cancellation of rewards

Now admins will be able to cancel the reward in bulk. Select all the users for whom you want to cancel the rewards and click on the Cancel reward button as shown below:

<Frame>
  <img alt="" />
</Frame>

## Resend confirmation mail in bulk

Now users will be able to resend the reward email in bulk. Select all the users you want to send the confirmation mail again and click on the **Resend details** button as shown below:

<Frame>
  <img alt="" />
</Frame>

## Filtering the report section according to your own requirements

* You can filter the entire report based on **recipients name, email, phone, reward sent, sent by** and other fields in the table.

* You can apply the filter and then view the specific reports according to your requirements which helps you understand the **ROI of the reward program** much better.

* The filtered report can also be downloaded and sent to super admin email id and shared internally.

<Frame>
  <img alt="" />
</Frame>


# Release November 2025
Source: https://help-plum.xoxoday.com/product-updates/release-november-2025

Read the Plum product update for November 2025, covering new features, improvements, and fixes shipped that month.

*Get updates on Xoxoday Plum*

**Latest from our world of Rewarding!**

We've rolled out new updates to make your experience smoother and more versatile. This month, we are introducing high-frequency utility payments to drive user engagement, alongside specialized governance tools for our enterprise partners.

## Here's what's new:

### 1. Pay essential bills with the new Utility Category on Xoxoday Plum Pro API

The Utility category is now live! Your users can now pay essential bills such as electricity, water, gas, internet, and mobile postpaid directly using the Xoxoday Plum Pro API. With real-time bill fetch and instant payment confirmation, businesses can offer seamless monthly bill payments without adding new integrations or operational overhead. This brings a practical and high-frequency use case into your rewards ecosystem.

### 2. Strengthen governance with Maker-Checker workflow

For organizations that require stringent audit trails, we have introduced a Maker-Checker workflow on the Xoxoday Plum platform to enforce stronger governance. This workflow is currently enabled for select critical flows including User Management, Catalogue Management, and Discount Voucher Management. In these areas, any key admin action requires secondary approval. This ensures compliance, reduces risk, and prevents unauthorized or accidental changes.

This capability is currently available to select Enterprise Pilot partners and will be rolled out more broadly in upcoming phases.

<Frame>
  <img alt="" />
</Frame>

### 3. Run smart promotions with Dynamic Voucher Management

Marketing teams can now independently create and run Discount Coupon Campaigns by distributing coupons to select customers or prospects. This module provides granular control over discount types, usage limits, and campaign validity. It allows marketing teams to tailor each promotion to the right audience within Xoxoday Plum. The dashboard enables teams to configure and deploy agile promotions instantly without relying on backend support for voucher creation

This feature is currently available to select Enterprise Pilot partners and will be rolled out to wider audiences in upcoming phases.

<Frame>
  <img alt="" />
</Frame>

## Upcoming features

### Rate limiting for Xoxoday Plum Pro APIs

We'll be implementing rate limiting across key Xoxoday Plum Pro APIs to improve stability, prevent abuse, and ensure fair usage. This enhancement will apply client-based limits managed through MongoDB for flexibility and better performance control.

### Real-time gift card catalog updates

We'll be implementing webhooks for Xoxoday Gift Card APIs to notify customers in real time about product updates such as enable/disable status, denomination changes, and other catalog modifications.

Need help? Reach out to your support team or [cs@xoxoday.com](mailto:cs@xoxoday.com).


# Release October 2021
Source: https://help-plum.xoxoday.com/product-updates/release-october-2021

Read the Plum product update for October 2021, covering new features, improvements, and fixes shipped that month.

This Holiday Season, we have several new updates for Xoxoday admins, and most importantly for the Storefront users.

For admins, they can now easily customize messaging, classify data more easily, and get a more DIY-friendly experience.

There are also other updates including an expanded catalog and a better reward redemption experience.

## For Admins

### A New Campaign Landing Page for Xoxo Code and Xoxo Links

It was earlier not possible for admins to create a custom landing page and customize the messaging.

With the latest update, Admins will now be able to include a landing page along with their Xoxo Code or Xoxo Link rewards. End-users can redeem their rewards from the landing page directly.

This feature is also particularly useful during the festive season to offer a tailored branding experience and help administrators take control of the user experience. Admins can also choose to design the landing pages as they deem fit, and they are optimized across devices. They can also choose to remove the landing pages if need be.

### Xoxo Code Listing in Xoxo Links

We received feedback from a lot of firms asking us to include a Xoxo Code (unique reward code) whenever a reward link was sent across. This was because it was not possible for end-users in different geographies to redeem rewards with a link.

We heard you! With the latest update, admins can choose to include a Xoxo code along with every reward link sent.

This allows recipients from all geographies to redeem the Xoxo code by using our Storefront and purchase any product with the denomination and country of their choice.

### Bulk Selection and Cancellations in Xoxo Codes and Xoxo Points

With the latest release, Admins will be able to select multiple entries for Xoxo Points and Codes and take action on them together with a single click.

### Plum Pro SMS Customization

In alignment with our larger goal of letting admins customize their reward experience for the end-user, we are now letting Plum Pro users customize their SMSes that accompany rewards.

The SMSes sent along with a Plum Pro reward can now be customized to include tailored messages for the recipient. This feature is available both in single and bulk rewarding.

### Create advanced filters in the Plum Pro report section

It was earlier not possible for admins to set up advanced filters within Plum Pro to classify the products.

With the latest release, a new set of flexible filters have been introduced which allow the admins to specifically drill down to any set of data within the records listed - by date range, by product, by reward value, by the recipient, or a combination of any of these.

### Introducing email delivery status of rewards

For the first time, the admins will now be able to directly get insights on the delivery status of emails for each individual recipient.

This will enable them to take the action of resending the email or canceling the rewards based on the delivered status. This also significantly reduces the need for manual intervention by Xoxoday's team to check the email delivery status and report back to the customer that has requested it.

### Digital invoices can be downloaded from the platform

To enable admins to download the invoice directly from the platform, we have now introduced the feature to let admins download a digitally signed copy of the invoice generated after every recharge of the Xoxoday Plum wallet, either vis-a-vis the platform or through sales orders.

An immediate acknowledgment is also sent to the client whenever a recharge is done.

### New banners have been introduced across different rewards modes

Keeping in mind the upcoming festive season, a plethora of new banners have been added to the admin portal. All the banners have also been optimized to render without stretching/distortions across all browsers and devices.

### Improvements in Integration Automation Flow

The latest update has upgraded the integration flow for 3rd party integrations such as SurveyMonkey, Hubspot, and others. There has been an improvement in terms of experience and the user journey.

Admins will now be guided throughout the automation process with appropriate steps, suggestions, and informational pop-ups.

### Improvements in DIY onboarding journey

With the new release, the 3 step Xoxoday DIY admin sign-up process is made more interactive and smoother. Improvements here include auto-redirect after a step is a complete, correct balance on the dashboard, and improvements to the KYB workflow.

## API Updates

### Multiple PayTM products can now be added to the cart

We had a quantity restriction for Paytm products in storefront & API, allowing users to only purchase one quantity at a time. With the latest update, this restriction has been removed for mobile browsers as well.

### Plum Pro API: Error message for Duplicate PO is now updated

In Plum Pro API, place order endpoints update the existing error message for Duplicate PO with new meaningful errors so that developers can easily recognize what went wrong & take corrective measures.

### Plum Pro API: Introducing the ability for admins to get order history by using tags

We have introduced a new filter in Plum pro Order History API, this will allow users to filter the order data by "Tags".

### Exchange rate information can be accessed via GET VOUCHER API

Some clients wanted to get access to the information on the real time exchange rate that we use.

Hence, we have introduced a new filter in Plum Pro Get voucher API, to know the active exchange rate which Xoxoday uses for product cost calculations. These exchange rates can be used by clients to know the true cost of the product which they are going to purchase.

### Other improvements

A few other minor improvements in the API section include - handling of unknown special characters on the product description from vendor API, option to map multiple SKU for Giftery, and the ability to blacklist certain products for specific clients.


# Release October 2022
Source: https://help-plum.xoxoday.com/product-updates/release-october-2022

Read the Plum product update for October 2022, covering new features, improvements, and fixes shipped that month.

## Tracking opens for reward emails

With this feature, our Hubspot customers that use Workflow or 1-1 reward emails that are sent from Xoxoday will be able to see the 'open' events within Xoxoday and as well as inside their Hubspot's timeline for that contact. Furthermore, customers will be able to use these events inside their workflow and or list segmentation for additional 'actions' (such as triggering a follow-up, scoring, or internal notifications).

<Frame>
  <img alt="" />
</Frame>

## Tracking clicks for reward emails

With this feature, our Hubspot customers that use Workflow or 1-1 reward emails that are sent from Xoxoday will be able to see the 'Clicks' events within Xoxoday and as well as inside their Hubspot's timeline for that contact. Furthermore, customers will be able to use these events inside their workflow and or list segmentation for additional 'actions' (such as triggering a follow-up, scoring, or internal notifications).

<Frame>
  <img alt="" />
</Frame>

<Frame>
  <img alt="" />
</Frame>

## Plum Admin

### Ability for the super admin to edit any campaigns

The Super admin will now be able to edit all the campaigns that are there in the account giving the flexibility to the super admin to be able to use any campaign even if the actual creator of the campaign is not available.

### Campaign improvements

Minor improvements in the campaign creation process has been included that gives clarity to the admin user on the brands, countries and denominations selected for the campaign.

### Xoxo link background customization

While creating a campaign admin will be able to customize the Xoxo Link to have any background color to reflect their branding needs by either picking from the options presented or by specifying the hex code. This was previously restricted to four predefined colors.

<Frame>
  <img alt="" />
</Frame>

### Improvement in payment section of reports

Added reason for Deduction/Addition of Funds giving more clarity of movement of money.

<Frame>
  <img alt="" />
</Frame>

### Enabled new payment processor

Enabled new payment processor for International currencies (except EURO and GBP), which would enable clients to do a wallet recharge in preferred currencies in real time via credit and debit cards (VISA/MasterCard) provided the cards are 3DS enabled.

<Frame>
  <img alt="" />
</Frame>

## Catalog

### Experience Category launch

With this release we have now launched 700+ experiences across 30+ geographies across the world through direct experience vendor integrations. New experience added can be viewed [here](https://stores.xoxoday.com/marketplace/vouchers), under "Experiences" Tab.

## Plum Stores/Supply

### Amazon Merchandise launch on the Xoxoday catalog store (Only for India)

Now your end users can redeem their Xoxo points and codes on Amazon merchandise to buy products like electronics, accessories, appliances, and more. Admins can enable/disable the merchandise categories or specific products from campaigns under Plum Admin.

<Frame>
  <img alt="" />
</Frame>

### Experience launch on stores marketplace

On Xoxoday stores, experiences have been re-launched with new global catalog categories. Anyone can use their Xoxo points or Xoxo codes to book experiences like adventurous sports, city tours, and many more. Admin can also manage (turn on/off) the experience category from the campaigns page in Plum Admin. In the experience section, Admin can also choose which products to show or hide.

<Frame>
  <img alt="" />
</Frame>

<Frame>
  <img alt="" />
</Frame>


# Release October 2023
Source: https://help-plum.xoxoday.com/product-updates/release-october-2023

Read the Plum product update for October 2023, covering new features, improvements, and fixes shipped that month.

We have a ton of collective knowledge to share with you! In the past few weeks, we've added new features to our Plum platform, including integrations, category and many other improvements for the admins. But that's not all we have revealed the new features expected in the upcoming months.

## Xoxo Reward Link Authentication

To enhance the security of Xoxo Reward Links sent from the platform, we will now send an OTP to the email ID / phone number to which the link was originally sent to, on redemption. This will ensure that only the intended recipient is able to access the reward.

This is applicable to all rewards directly sent to the recipient from the platform including the ones triggered via CRM / survey tools integration.

For Xoxo Reward Links that are "generated for self" by the admin to be distributed later, these links will not be tied to the specific email ID it is sent to, however the recipient will need to enter a phone number and verify with an OTP before redemption.

## Xoxo Reward Code Redemption options

While sending Xoxo Reward Code, now the admin can choose who can redeem the code: Either the recipient the code is sent to, any user with the same domain as the user, or anyone who has the code. This gives the admin the flexibility to choose who can redeem the rewards they send while enhancing security.

## Points-Based Marketplace

Introducing the ability to convert the reward marketplace into a points based marketplace. End users can now browse the catalog and checkout in the form of points. Businesses can set their own currency-to-points ratio, making the entire marketplace available for transactions in points. This feature is ideal for loyalty reward programs, allowing businesses to offer rewards in the form of points rather than currency. For example, if a business defines a 1:10 ratio, a product worth INR 10 on the marketplace can be purchased for 100 points.

## New Filters and Sorting in Storefront

We have added new filters and sorting options to the gift card category, enhancing the redemption experience for all storefront users. Now, users can easily filter and sort products based on their preferences.

<Frame>
  <img alt="" />
</Frame>

## Enhancements to the Marketplace Interface

We've improved the overall look and feel of the marketplace to make it more user-friendly and aligned with e-commerce standards. This includes introducing new brand colors, enhancing navigation for better visibility, and more.

<Frame>
  <img alt="" />
</Frame>

## Changes in getBalance API

As part of the standardization process, we have removed the "points" parameter from the getBalance API response as it was redundant and caused confusion during the integration process.

## Rewards API Report

To simplify the reconciliation process for the Finance / Business Team, we have now removed the currency symbol from the "Downloaded Report". This will help the admins to now just download the report and get a consolidated value without spending additional time in structuring the report to achieve the consolidated values.

## Invoices

All the Non-INR customers trying to make offline bank transactions for wallet recharge had to go through a manual process of reaching to request for an invoice by reaching out to the Sales POC / Finance team which would take 2 - 3 hours on average and customers had to follow up or wait during this time.

Now Customer's can generate a Proforma invoice from the Admin Dashboard by entering the value in the "Add Funds" Field.

<Frame>
  <img alt="" />
</Frame>

<Frame>
  <img alt="" />
</Frame>

For Customer's with base currency as Non-INR, who used to request Xoxoday Finance team to remove the company PAN and LUT number from the invoices shared, we have now removed PAN & LUT number fields from the Invoice for all the invoices that are being generated for Non-INR customers.

That's all for the Plum Product Enhancements launched in October 2023. If you have any specific questions, feel free to [contact us](https://www.xoxoday.com/company/contact-us), or [book a demo](https://www.xoxoday.com/book-a-demo).


# Release October - 2025
Source: https://help-plum.xoxoday.com/product-updates/release-october-2025

Read the Plum product update for October 2025, covering new features, improvements, and fixes shipped that month.

*Learn all about new releases on Plum*

## Latest from our world of Rewarding!

We've rolled out new updates to make your experience smoother, smarter, and more personalized. From custom storefronts and flexible redemptions to enhanced reports and secure order management, every update is designed to give you and your users more clarity, control, and engagement.

## Here's what's new:

### 1. Showcase your brand with custom categories in storefront

Make your Xoxoday Plum Storefront reflect your brand.

With the new Custom Category feature, create a dedicated section to display your own products, experiences, or vouchers exclusively for your users. Highlight your brand, run private campaigns, and deliver curated rewards, all within Xoxoday Plum's secure and scalable ecosystem.

<Frame>
  <img alt="" />
</Frame>

### 2. Redeem your rewards as cash

Users can now redeem points as cash via UPI or Direct Bank Transfer (DBT) using the new Cashout Category. It makes the redemption process simple, secure, and fully integrated as users enter their details, choose an amount, and receive funds instantly.

This gives organizations flexibility to offer choice and convenience to employees, partners, and customers, while maintaining transparency and control through the Xoxoday Plum Admin Dashboard.

This feature is currently available in India and will soon be launched for users in the USA and EMEA regions.

<Frame>
  <img alt="" />
</Frame>

### 3. Secure resends with OTP verification

We've added OTP verification to make resending order details more secure.

Earlier, users could request order details without confirming identity. Now, an OTP will be sent to the registered email or mobile, and it must be verified before details are resent.

If the reward was sent to both email and mobile, OTPs will go to both—and both must be verified.

### 4. Dedicated reports for perks and discounted marketplace

Admins can now access a dedicated report under Redemption Reports to track Perks and Discounted Gift Cards. View detailed, filterable, and downloadable insights, including total orders, value, savings, product name, category, discount percentage, savings amount, and redemption status.

This report makes it easy to track savings, measure engagement, and understand the impact of your perks program.

<Frame>
  <img alt="" />
</Frame>

### 5. Enhanced reward-sending experience with use cases and occasions

The Send Rewards flow is now smarter and more intuitive. Admins can filter by Use Cases (HR, Sales, Marketing, and more) and Occasions (New Year, Holiday Gifting and more) to find the most relevant reward types, including Points, Codes, Links, Gift Cards, and Merchandise.

This update makes it easier to select and send the right reward at the right time, improving efficiency and relevance for every campaign.

<Frame>
  <img alt="" />
</Frame>

### 6. PayPal Integration for Reward & Incentive Transfers

Users can now redeem their reward points or claim codes directly via PayPal, or businesses can transfer incentives/rewards to users' PayPal wallets through APIs.

This provides a seamless, secure, and globally recognised payout option alongside existing Xoxoday reward distribution methods.

<Frame>
  <img alt="" />
</Frame>

## Upcoming features:

### Utility category via Xoxoday Plum Pro API

We'll soon be introducing a new Utility category in Xoxoday Plum Pro API, enabling users to make bill payments for electricity, water, gas, internet, and mobile postpaid directly through the API.

### Rate limiting for Xoxoday Plum Pro APIs

We'll be implementing rate limiting across key Xoxoday Plum Pro APIs to improve stability, prevent abuse, and ensure fair usage. This enhancement will apply client-based limits managed through MongoDB for flexibility and better performance control.

### Real-time gift card catalog updates

We'll be implementing webhooks for Xoxoday Gift Card APIs to notify customers in real time about product updates such as enable/disable status, denomination changes, and other catalog modifications.


# Release October/November 2024
Source: https://help-plum.xoxoday.com/product-updates/release-octobernovember-2024

Read the Plum product update for October and November 2024, covering new features, improvements, and fixes shipped.

We've recently rolled out several exciting features to improve the user experience. Key updates include a new flow for Festive Gifting, mobile OTP verification for enhanced security on Xoxo Link rewards, introducing an Intercom chatbot for accessible support, and upgrades to the Plum Marketplace with a refreshed homepage and optimized mobile interface.

These changes and many others are designed to make the experience seamless, secure, and efficient for admins and users.

## Here's what's new:

### New Flow for Gifting with Predefined Campaigns

We created a new, easy journey through Plum designed for clients looking to send festive gifts. It can be accessed right after login. The entire reward redemption journey is just a few clicks without having to select the distribution mode separately, create a campaign, craft emails, etc. All of this is predefined, including curated campaigns containing the most appropriate gifting products. All the admins needs to do is pick a gift selection and choose whom they want to send it to, and it is done.

<Frame>
  <img alt="" />
</Frame>

### Mobile OTP verification for Xoxo Links Distributed via email

Customers can now add an extra layer of security by enabling OTP verification for the recipients' phone numbers when rewards are sent via email or SMS. This ensures that only the intended recipient can access the reward.

### Removed Case Sensitivity in Filters

Case sensitivity has been removed from the name, email ID, and notes fields in the report filters, making it easier for admins to find the specific records they need.

### Implementation of Chatbot In Plum Admin

Admins can use the new chatbot to get quick answers to their questions about Plum. The chatbot provides checklists for tasks like setting up an account, adding funds, sending rewards, and choosing a distribution method. Admins can also contact a team member with one click for further assistance.

<Frame>
  <img alt="" />
</Frame>

### Reminder Email Enhancements

Reminder emails now include more details, like the expiry date, to encourage users to check out and redeem their rewards on time.

### Xoxo Link Order Delivery Improvements

Previously, if an order on Xoxo Link wasn't fulfilled immediately, the user had to remember to refresh the link periodically to check its delivery status. With this release, once the order is confirmed, it will be automatically delivered to the user via email or phone, even if it's in a pending state, eliminating the need to keep checking the status.

### Homepage for Marketplace

The Marketplace now has a new homepage with a better layout, making it easier to see all product categories. Users can easily browse through a variety of attractive products, improving their overall experience.

<Frame>
  <img alt="" />
</Frame>

### Enhanced Interface for Mobile View of the Marketplace

The mobile version of the marketplace has been upgraded with improved pages for listings, products, and more. This update makes the redemption process smoother and convenient for mobile users, enhancing the overall experience.

<Frame>
  <img alt="" />
</Frame>

### Improved Listing Pages on Web Interface

The product listing pages on the web interface have been improved to show more products in a single view, helping users make better choices and easily explore the full catalog. Filters and sorting options are now conveniently located in the top-right corner for easy navigation.

<Frame>
  <img alt="" />
</Frame>

### Support to Collect Personal Information (PI) of End Users for B2C Brands

As per Indian regulations, it is now mandatory to collect personal details such as the recipient's first name, last name, phone number, and email address to process orders. This information is required to track redemptions for security purposes.

Applicable brands: B2C use cases, especially Amazon shopping and Amazon Pay vouchers.

### Bulk Resend Rewards for the Gift Card Module

Super admins can now resend rewards in bulk by selecting multiple orders from the report, saving time and eliminating the need to resend individual rewards.

<Frame>
  <img alt="" />
</Frame>

### New Payment Options

We have now enabled PayPal and Mastercard prepaid cards as additional options.

Note: The Mastercard prepaid card requires additional KYB details to be enabled for your account.

<Frame>
  <img alt="" />
</Frame>

<Frame>
  <img alt="" />
</Frame>

## Upcoming features:

### Email and SMS Delivery Tracking

Admins will soon be able to track the delivery status of Emails and SMS with timestamps for each transaction. Resend activity will also be logged, providing full visibility to help better plan and manage reward resends.

### Wallet Recharge Alerts for Super Admins

Super admins will get instant notifications for successful wallet recharges, keeping them informed and ready to take action when needed.

### Reward API to support Airmiles and Perks

The Reward API will soon include Airmiles and Perks as redemption options, offering users more choices beyond gift cards. Admins can also process transactions via the API and track them in reports by category.

### Perks and Deals Category in Marketplace

We'll soon be launching a Perks and Deals category in our Marketplace, offering exclusive offers to enhance engagement programs and boost user participation.

### Currency Conversion Info for Stores

Users will soon see detailed currency conversion for their point balances when shopping in different regions, ensuring clear and transparent reward values across geographies.

## Want to request a feature on Xoxoday?

Get in touch with our customer success team at [cs@giift.com](mailto:cs@giift.com)


# Release September 2020
Source: https://help-plum.xoxoday.com/product-updates/release-september-2020

Read the Plum product update for September 2020, covering new features, improvements, and fixes shipped that month.

*Release Sep'20: Reward Automation, Email Templates & More*

This release of Xoxoday Plum comes with major features of scheduling reward campaigns, nudges and reminders on low balance, a brand-new customized email template, and much more. Read away.

## Admins can schedule automated rewards for a future date for timely rewarding

With Reward Automation, Admins can schedule rewards for a future date. These scheduled rewards can be managed in the "Scheduled Points/Codes" section in the Plum console. Automating a reward workflow substantially reduces the workload and ensures that the organization doesn't miss out on events and milestones. This feature makes Xoxoday Plum one of the best reward management software.

To take an example, admins can now schedule rewards for birthdays, wedding and work anniversaries, and other recurring milestones. In case there's a change in the schedules or recipients, they can choose the rewards that need to be canceled - before the date the reward was scheduled for. There's no need to keep the wallet filled from the day, rewards are scheduled, but these should be recharged before the scheduled date arrives - else the reward automatically gets canceled.

<Frame>
  <img alt="" />
</Frame>

## Setting up Reward Automation

One can choose to either individually upload the list of email IDs while scheduling automated rewards or use the bulk upload option to choose recipients. The rewards can be automated for both Xoxo Points and Xoxo Codes and they will be automatically sent to the uploaded emails on the scheduled date without further work from the admin's behalf.

**Conditions**

One can schedule automated reward campaigns irrespective of the number of points in their wallet—as long as they recharge their wallets before the scheduled rewards are sent out. In cases where there's a lack of point balance and the scheduled time arrives; the rewards will automatically be canceled.

**Cancelling Scheduled Rewards**

**Admins can cancel the scheduled rewards at any time from the "Scheduled Points/Codes" section.** In case the scheduled rewards get canceled due to insufficient balance in the wallet, the admins will be notified via email. This brings us to the next feature added with this release:

## Get reminders to recharge the wallet & prevent bottlenecks in rewarding

With the new release, **Xoxoday Plum will send out notifications reminding the admins to recharge their company wallets on zero balance to ensure a seamless flow of reward redemption.** A low wallet balance severely interrupts the rewarding process - especially in cases where the rewards have already been sent out or scheduled.

<Frame>
  <img alt="" />
</Frame>

The reminder notification will be sent again every three days in case the wallet isn't recharged to ensure there's no break in rewarding.

## New customized email templates gives every reward a personal touch

This month's Plum's improvisation includes customized email templates which bring about major changes in the way rewards are sent out to the users as the admins now have the full capability to communicate with their desired level of personalization. The new email even highlights the key purpose of why the reward is being given to the recipient. One can create a subject line that is relevant to their audience and add a short personal message.

<Frame>
  <img alt="" />
</Frame>

The new email also hands out clear instructions for recipients as to how to use the reward, a reward description as well as terms of use, making it a handy piece of communication.

## Multi-admins of non-hierarchical accounts can now themselves add new admins, transfer funds & more

As introduced over our previous releases, Plum non-hierarchical accounts have reward wallets and distributions that are managed independently by multiple admins under the same organization.

In the previous feature's release, a non-hierarchical admin was given the capability of transferring their balance points to another from their company. **As an add-on capability, with this release, they can even in turn add and register a new admin on Xoxoday Plum.**

**For example, if an organization wants to add a new admin to take care of rewarding duties, any existing one can add them if they're registered on the organization's list.** Post addition, the current admin can even transfer their reward balance to the newly added one and they can delete their own accounts.

<Frame>
  <img alt="" />
</Frame>

The operation, which was earlier taken care of from Xoxoday's end - speeds up the handover process.

## Users will only see the relevant catalog offerings for every demography for a smooth experience

To offer a definitive user experience at the Plum Stores, users will only see categories that offer options in the selected country. **Xoxoday Plum is a global platform with a unique gift catalog offering options from hundreds of countries.** For a few of these countries, our offerings are limited - while we are in pursuit of adding more catalog options.

<Frame>
  <img alt="" />
</Frame>

If you have any options to suggest in your geography, feel free to talk to us at [cs@xoxoday.com](mailto:cs@xoxoday.com).

## Admins can toggle brands while setting up campaigns to avoid missing out

The new release offers a significant UI improvement in the gift catalog selection screen, making it much easier for admins to select, deselect, and view the brands chosen for a particular campaign while sending it over.

<Frame>
  <img alt="" />
</Frame>

This improvement aims to help admins avoid errors during brand selection.

## End-users can check their Xoxo Code balance while checking out with an improved payment flow

When end-users check out and pay by Xoxo Codes, they can now use multiple Xoxo Codes for every transaction. Previously, however, there was no indication as to how much balance was left in every Xoxo Code before it was exhausted. **The Xoxo Codes balance can now be redeemed partially until it's fully exhausted and for every transaction, up to 10 Xoxo Codes can be used.**

<Frame>
  <img alt="" />
</Frame>

With these improvements, the user will have better visibility of their Voucher and Xoxocode balances and also use multiple vouchers at one go.

## Other Storefront Improvements with this Release

With every release, Xoxoday tries to make the Plum Stores better than before for users and admins. Users can now view their Xoxo Points on the top right as soon as they log in. We have included selection highlights for the store categories. Many small and significant UI changes have been made for smoother user flows in Xoxoday Plum Store helping enrich the user experience. **Users can browse through all categories of the Xoxoday Plum catalog with the "View All" option straight from the homepage.** This helps them view the complete bouquet of offerings that the Store has to offer.

<Frame>
  <img alt="" />
</Frame>

With the "How to Redeem" page, users can get all the information they need to use the Xoxoday Plum Store. With a step-by-step walkthrough guide of redemption, checkout, and Xoxo Codes, Xoxo Points, and delivery, users can get answers to all their questions here.

That's all for this features release in Xoxoday Plum. Have a question? [Talk to us.](https://www.xoxoday.com/book-a-demo)


# Release September 2021
Source: https://help-plum.xoxoday.com/product-updates/release-september-2021

Read the Plum product update for September 2021, covering new features, improvements, and fixes shipped that month.

Send anonymous rewards, change the shelf date for Xoxo Codes, and access a revamped Storefront UI.

This September, we have several new updates for Xoxoday customers and Storefront users.

For admins, the recharge flow has been completely revamped and comes with added security measures. They can also change the expiry date of Xoxo Codes depending on the use case.

For Storefront users, it is now possible to avail anonymous rewards and access a revamped Storefront.

Here are more details about the latest update:

## For Admins

### New Recharge Flow With Options Including PayPal

The earlier recharge workflow didn't include security measures such as OTP Verification and a Paypal payment gateway for international payments.

With the new release, we have completely revamped the recharge process and added multi-factor authentication to ensure that the process is safe. We have also added a Paypal payment gateway processing fee of 2% for international customers and the markup or discount % specific for that customer.

Customers will also be notified of the option of direct bank transfer on the screen itself.

In addition to these changes, a new requirement has made it mandatory for customers to submit a billing address and Tax ID for recharge above the threshold level and for any invoice generation.

### Variable Expiry Date For Xoxo Codes

A lot of customers requested the ability to change the expiry date of Xoxo Codes, especially when running time-bound campaigns.

With the latest update, customers sending Xoxo Codes as a mode of reward can now set an expiry to the Xoxo code as they choose. The options currently include one, three, six, and twelve months after the date of sending the reward.

These options are also applicable for Xoxo Codes that are scheduled to be delivered at a later date. This was previously not possible as Xoxo codes had a default expiry date of 1 year from the date of generation.

### Banner Customization

Admins had difficulties earlier when customizing the banner image of the reward emailers.

With the latest update, customizing reward emails while sending rewards has become much easier with the new banner selection screens. The admin will now be able to search for a particular banner, be it a holiday or a personal milestone, drill down into a particular category and explore several options.

They can also choose to upload their own images, which will be available with the filename in a separate folder for easier access.

### Admins Can Create/Edit Other Campaigns In The Organization

Earlier, it was not possible for different admins across the account to view, edit or access the details of each other's campaigns. This was a drawback especially when the customer was running an organization-wide campaign.

With this release, all admins will be able to view and select all campaigns available in the account. The campaigns also are completely editable in terms of allowing for product additions, product removals until redemption starts by the admin who has created the campaign.

## For End Users & Admins

### Anonymous Survey Rewarding

In the survey and market research industry, a lot of surveys are conducted in an anonymous fashion. While recipient rewards for anonymous surveys are very common, our earlier process didn't enable anonymous rewards for admins.

With the latest release, the anonymous survey rewarding feature has been introduced for Qualtrics ↔ Xoxoday integration, thus allowing an option to set up a Xoxo Link reward campaign without the need for providing any information on the survey. Admins can also set up a reward email collection landing page with basic customization.

### IP based selection of country code

The Storefront and admin dashboard has been revamped to enable IP-based selection of country code based on the feedback received from customers.

Both in Storefront checkouts as well in the admin portal, the country code will be automatically populated whenever there is a phone number entry required. This reduces the time in filling out details and faster completion of the checkout and reward setup process.


# Release September 2022
Source: https://help-plum.xoxoday.com/product-updates/release-september-2022

Read the Plum product update for September 2022, covering new features, improvements, and fixes shipped that month.

## Upload records in Bulk

With new-and-improved bulk upload capabilities, admins can save time and check the real time records as they gets processed. It's now easier than ever to upload the maximum records in a single file with fewer failures than ever before.

<Frame>
  <img alt="" />
</Frame>

## Send global code in Xoxo links

The global xoxo code feature makes it quicker and easier for global companies to offer international catalog for end-users to choose from based on their local currency. You can combine the global xoxo code when sending Link-based campaigns, and end users can redeem it without worrying about conversion hassles.

<Frame>
  <img alt="" />
</Frame>

## Admin Reports and Campaign improvements

A number of smaller improvements with both UI and the functionality for admin facing reports and the campaign creation page has been carried out along with the sprint that makes the admin journey smoother.

## Send direct-to-wallet rewards

Reach and engage users with the right reward at the right time by sending direct-to-wallet options in the reward catalog. Admins now have the freedom to reward how they want - with gift cards, with experiences, with direct-to-wallet options; you name it. You can now send the Paytm, and other direct-to-wallet options with Xoxo Link campaigns, which end users can then redeem after a successful verification.

<Frame>
  <img alt="" />
</Frame>

## Track deeper insights with advanced reporting

For Plum PRO customers we have enabled report archival where the admins will be able to view all the records upto the last 6 months. If they wish to have data beyond 6 months, we have provided means for them to raise a request and the requested data will be sent over to their email id without any manual intervention. This is done to optimize the performance of the reports section. For non multi admin types of companies, we have also tweaked the reports to permanently address issues reported by clients on the data mismatch. We are currently showing the overall wallet balance as well to the admins accessing the reports section.

<Frame>
  <img alt="" />
</Frame>

## Integrations

### Send 1 to 1 reward from HubSpot

Building the pipeline and acquiring the customers often feels like sales teams now need superhuman speed just to keep up. We are bringing one of the core HubSpot features to help drive sales growth.

Now, the HubSpot users can send the 1-to-1 rewards emails to the prospect within HubSpot. Our native HubSpot integration makes it easy for sales reps to send rewards directly from the contacts page and focus on effective conversations without any clutter getting in the way.

<Frame>
  <img alt="" />
</Frame>

<Frame>
  <img alt="" />
</Frame>

### Plum is available at Salesforce AppExchange

Embed rewards & incentives to your Salesforce CRM and grow your sales pipeline

* Send one-to-one rewards

* Automate rewards with triggers and workflows

* Powerful reporting and insightful analytics

## Catalog

### Stores Design Revamp

The overall layout and design of Xoxoday plum stores has been given a complete new overhaul to enhance redemption experience for all our end-users. Enhancements have been done to the mobile version, product pages and overall checkout flow.

<Frame>
  <img alt="" />
</Frame>

## Payments

### New payment infrastructure for EU and UK regions

With the recent product release, we have integrated with a new and local payment processor "EMP" to ease the online payments and provide the best customer experience for EURO and GBP currencies. A new payments infrastructure enables admins to load funds into the wallet in real time using various credit/debit payment cards.

In Stores admin recharge section we introduced offline payment, which will help users to make offline payment & recharge their accounts automatically.

<Frame>
  <img alt="" />
</Frame>

<Frame>
  <img alt="" />
</Frame>


# Release September 2023
Source: https://help-plum.xoxoday.com/product-updates/release-september-2023

Read the Plum product update for September 2023, covering new features, improvements, and fixes shipped that month.

We have a ton of collective knowledge to share with you! In the past few weeks, we've added new features to our Plum platform, including integrations, category and many other improvements for the admins. But that's not all we have revealed the new features expected in the upcoming months.

## Xoxo Reward Code and Xoxo Reward Link verification

To make sure that the xoxo reward code is redeemed by only the intended recipients while keeping the current redemption flows just as seamless as possible, we have introduced an OTP verification sent to the recipient email ID/mobile number at checkout in the storefront.

In case of Xoxo Reward Link, for all links sent, an email ID or phone number will be collected mandatorily before the voucher can be redeemed.

## Bulk processing notification

A notification will be sent to the admin after a bulk file (for all modes: xoxo reward point, xoxo reward codes, Xoxo reward link, Xoxo rewards API) is processed, with the summary of records that are processed and the list of records that were unable to be processed, if any.

## PDF generation for Rewards API (Dashboard)

Admin users can now choose to generate a PDF form of the reward along with the email while sending brand vouchers directly from the platform.

This is highly useful when the vouchers are distributed in hand to the customer. We have built the capability for the brand voucher links to be rendered as QR codes. The user will be able to scan the QR code and quickly redeem the voucher removing all of the hassle of having to physically type it out / access the link to redeem.

Use cases like distribution of brand vouchers at the time of purchase in a retail outlet, or at an event in the actual venue can be made highly seamless with this.

<Frame>
  <img alt="" />
</Frame>

<Frame>
  <img alt="" />
</Frame>

## Pass Order details on Update Redemption API

Earlier, we required a lot of requirements from clients to also pass the order details that contained what products (along with other details) were redeemed. So, for that our backend is now ready to pass order data if required by the client on the Update Redemption API. So any Storefront clients who want Order data on Update Redemption API can create APIs accordingly.

Note: This is new standardization for Storefront Integration.

More details given in Integration doc: [/API-PLAYGROUND/Storefront-Integration-API/api-endpoints-1/update-redemption-api](/API-PLAYGROUND/Storefront-Integration-API/api-endpoints-1/update-redemption-api)

## New Category Launches: Lounge and Bike Voucher in India

The Marketplace has two new categories launched named lounges and bike voucher in india. Users can buy these products using reward points and codes.

Lounges are launched for India customers for cities such as Hyderabad, Chennai, Kochi, Bangalore, Mumbai and Delhi

Bike Vouchers are launched for India region and can be helpful for admins to send gifts to their employees and customers on different milestones. The brands added are TVS and Honda.

<Frame>
  <img alt="" />
</Frame>

## Improvement in Admin Reports

Enhanced Payment Report & Rewards API Report that will allow users to have more transparency while reconciliation.

The Customers referring to the data in both Payment & Rewards API Report will see the data matching to their Internal reports and now can share the Admin access to their Finance team which will allow them to download the Rewards API report for reconciliation purpose without any delay.

## Invoice Generation

Admins can now request for Proforma Invoice from the Admin Dashboard and receive a digitally signed Proforma Invoice to their email.

This will help the admins to get the invoice immediately and initiate fund transfer without reaching out to the Xoxoday Finance Team, thereby reducing the time taken to get a Proforma Invoice from 3 hours to less than a minute. By this process the fund addition to the Customer wallet will be much faster.


# Release - September 2025
Source: https://help-plum.xoxoday.com/product-updates/release-september-2025

Read the Plum product update for September 2025, covering new features, improvements, and fixes shipped that month.

*Learn about the latest product updates on Xoxoday Plum*

**Latest from our world of Rewarding!**

We've introduced several updates to make your experience smoother, smarter, and more personalized. From easier invoice reconciliation and seamless order communications to customizable reward displays and branded emails, these enhancements are designed to give you and your users greater clarity, control, and engagement.

## Here's what's new:

### 1. Easier Invoice Reconciliation with PO Dates

Invoice reconciliation is now simpler and more accurate. Admins can manually select a PO date during invoice generation, ensuring alignment with the corresponding Purchase Orders. The selected date is stored in the system and displayed clearly on the invoice template, giving finance and procurement teams the visibility they need for smooth tracking and reporting.

<Frame>
  <img alt="" />
</Frame>

### 2. Seamless Order Communications for Charity and Lounge

We've introduced key API improvements to make order transactions smoother and more transparent for both Charity and Lounge.

* Charity: The placeOrder API now includes an email field, ensuring that delivery emails are sent for every transaction.

* Lounge: Customers now receive delivery emails with dynamically generated QR codes, available both within the email and as PDF attachments for easy access.

These updates provide greater clarity, consistency, and convenience, enhancing the experience for both your team and your customers.

<Frame>
  <img alt="" />
</Frame>

### 3. Custom Naming for Points is Here!

Admins can now personalize how points appear on the Xoxoday storefront. Whether you call them "Ace Points," "Coins," or "Credits," the platform will display your chosen terminology consistently across balances, redemption summaries, and confirmations.

This update ensures branding consistency and delivers a more engaging and familiar experience for your users.

<Frame>
  <img alt="" />
</Frame>

### 4. Personalize Reward Emails with Your Brand Colors

Admins can now customize the background color of reward emails, aligning them with your brand identity. This added flexibility helps create a more engaging and visually consistent experience for recipients.

<Frame>
  <img alt="" />
</Frame>

## Upcoming features:

### Cashout Option

Users will be able to convert their points into cash payouts giving them more freedom on how they use their rewards.

### Cashback Products

Users will be able to earn Reward points when they buy from partner offers, giving them rewards on every purchase.

### Reports for Discounted Marketplace

Admins will be able to view and download a dedicated report for perks and discounts, with filters and search options.


# Refer and Earn
Source: https://help-plum.xoxoday.com/referral-program/overview

Introduce a decision-maker at a new company to Xoxoday and earn cash rewards when the referral turns into a real deal — up to $10,000 per referral.

As an existing Plum customer, you can make a warm, professional introduction to a decision-maker at a company that doesn't yet use Xoxoday. Rewards are tied to real sales milestones — never to sign-ups — so a genuine introduction to the right person is all it takes to start earning.

<Info>
  You earn **\$100 in cash** when your referral completes a proper product demo, plus **10% of the deal's first-year value** (minimum \$250, maximum \$10,000) when they sign — up to **\$10,100 per referral**.
</Info>

## How to refer

Submitting a referral takes under two minutes.

<Card title="Refer now" icon="arrow-up-right-from-square" href="https://share-na2.hsforms.com/15_ZVMD2tSye1LnB9OUcQmg3vlbe">
  Open the referral form and submit your introduction in a couple of minutes.
</Card>

When you submit, you'll receive a confirmation email and a **Referral ID** — a numeric ID (for example, `528606047984`) issued the first time you refer. If you've referred before, your existing Referral ID is reused: it identifies you as the referrer, not a single referral, so all your referrals are tracked under it. You then make the warm introduction over email, LinkedIn, or a shared meeting. The person you refer must agree to be contacted before our Sales team reaches out.

### What you need to provide

You only share what you already know — our team handles all further qualification.

<Columns>
  <Card title="Required">
    * Company name
    * Contact name
    * Work email or LinkedIn profile
    * Product of interest
    * Your relationship with the contact
  </Card>

  <Card title="Optional">
    * Job title
    * Phone number
    * Notes or business context
    * Preferred introduction method
  </Card>
</Columns>

## How the referral works

<Steps>
  <Step title="Submit your referral">
    You submit the referral and receive a Referral ID and confirmation email.
  </Step>

  <Step title="Make the warm introduction">
    You bridge Xoxoday and your contact. The referral moves forward once the contact agrees to connect.
  </Step>

  <Step title="Proper demo — you earn $100">
    The prospect sees the product in a genuine demo led by our Product or senior Sales team. Once confirmed, your **\$100** is released.
  </Step>

  <Step title="Proposal and negotiation">
    Solution design, security, procurement, and legal move ahead. No payout at this stage — we keep you updated by email.
  </Step>

  <Step title="Deal signs — you earn 10%">
    When the MSA or first order is signed, you earn **10% of the first-year deal value** (minimum \$250, maximum \$10,000), on top of the \$100.
  </Step>
</Steps>

## What you earn

Your reward has two parts:

* **\$100** in cash for a qualified meeting (a proper demo). This is paid once the demo is confirmed and is **not** clawed back if the deal later doesn't close.
* **10% of the deal's first-year contract value** once it signs — with a **minimum of \$250** and a **maximum of \$10,000** on this portion.

Rewards are paid in cash by invoice or bank transfer. The deal must sign **within 6 months** of your submission to qualify for the 10% payout; the \$100 is yours either way.

### Worked examples

| Scenario                     | First-year deal size | Demo (\$100) | Signing (10%, min/max) | Total reward |
| ---------------------------- | -------------------- | ------------ | ---------------------- | ------------ |
| Mid-size deal, signs on time | \$50,000             | \$100        | \$5,000                | **\$5,100**  |
| Small deal (minimum applies) | \$1,500              | \$100        | \$250 (minimum)        | **\$350**    |
| Large deal (maximum applies) | \$200,000            | \$100        | \$10,000 (maximum)     | **\$10,100** |
| Deal signs after 6 months    | \$50,000             | \$100        | \$0 (missed deadline)  | **\$100**    |
| Deal never closes            | —                    | \$100        | \$0                    | **\$100**    |

<Note>
  **What counts as a "proper demo":** a genuine walkthrough of the product's core capabilities, led by our Product team or a senior Sales representative — not a casual intro or a scheduling call. Our team confirms the demo was substantive before the \$100 is released.
</Note>

## Who can refer, and who you can refer

<AccordionGroup>
  <Accordion title="Who can refer">
    Existing Xoxoday customers who actively use the product, are in good standing, and have a genuine professional network. Typical referrers include Procurement, Finance, and Rewards leaders (Plum), HR leaders (Empuls), and Marketing, Loyalty, and CX leaders (Loyalife).
  </Accordion>

  <Accordion title="Who you can refer">
    A referral qualifies only when the referred organization is:

    * a **new company** — not a current Xoxoday customer on any product,
    * **500+ employees**,
    * **not already in an active Xoxoday opportunity**, and
    * represented by an appropriate decision-maker or influencer for the product.
  </Accordion>

  <Accordion title="What doesn't qualify">
    Existing customers, accounts already in an active opportunity, duplicate submissions, companies within your own corporate group, your own employer, self-referrals, and referrals where no genuine relationship exists.
  </Accordion>
</AccordionGroup>

## How your referral is tracked

You get **one Referral ID**, issued the first time you refer and reused for every referral you make afterward — it identifies you, not an individual referral. If you submit several referrals over time, they're all tracked under that same ID and distinguished by the referred company and contact. Each one progresses and pays out independently.

Every referral moves through these stages:

**Submitted → Introduction accepted → Demo completed → Proposal → Negotiation → MSA signed → Reward released**

There's no self-serve dashboard yet. You stay informed two ways:

* **Email updates** — we notify you proactively as each of your referrals advances, including at both reward milestones.
* **Support lookup** — contact Xoxoday support with your Referral ID any time to check the status of any or all of your referrals.

## Essential rules to know

* **Rewards gate on outcomes, never sign-up.** You earn \$100 on a qualified demo and 10% once the deal signs (within 6 months).
* **New companies only.** The referred company must not be a customer or already in an active opportunity.
* **First introduction wins.** If the account is already in our pipeline, or someone introduced it first, the referral doesn't qualify. A roughly 90-day lookback applies.
* **The person must opt in.** Your contact consents before Sales makes contact — this keeps it a warm introduction, not cold outreach.
* **Genuine relationships only.** No self-referrals and no referring within your own corporate group.
* **One Referral ID per referrer.** If you refer several companies, they all share your single Referral ID — each referral is still tracked, qualified, and rewarded separately.

### If your employer doesn't allow cash rewards

<Note>
  If your company's policy doesn't allow you to personally accept a cash referral reward, you still have options. You can:

  * **decline** the reward entirely,
  * **donate** the value to a charity of your choice, or
  * **apply it as credit** — if your company is an existing Xoxoday customer, use it as a discount on your next SaaS renewal or as a wallet-recharge credit.

  **Tell us your preference before the first payout** (at the demo milestone). This choice covers both the \$100 and the 10% payout, and it can't be changed after the first payout has been made.
</Note>

***

For the complete rules, eligibility criteria, attribution, tax, and payout terms, see the [referral program terms and conditions](/referral-program/terms).


# Referral program terms and conditions
Source: https://help-plum.xoxoday.com/referral-program/terms

The complete terms of the Xoxoday customer referral program — eligibility, attribution, reward payout, taxes, fraud, and program changes.

These terms govern the Xoxoday customer referral program for existing customers of Empuls, Plum, and Loyalife. For a plain-language overview of how the program works and how to refer, see [Refer and Earn](/referral-program/overview).

<Info>
  **Reward in brief:** a flat **\$100** cash for a qualified meeting (proper demo), plus **10% of the deal's first-year contract value** once the MSA is signed — with a **\$250 minimum** and **\$10,000 maximum** on the 10% portion. The deal must sign within **6 months** of submission to qualify for the 10% payout; the \$100 is kept regardless. Submission alone earns nothing.
</Info>

## Summary of key clauses

* **Eligibility** — the referrer must be an existing customer; the referred organization must be a new company with 500+ employees and an appropriate decision-maker.
* **Attribution** — first successful introduction wins; duplicate referrals are ineligible; a Referral ID is issued once per referrer (not per referral), reused across all of that referrer's referrals, and is non-transferable.
* **Reward and payout** — \$100 cash at the demo milestone, plus 10% of first-year deal value on signing (minimum \$250, maximum \$10,000 on this portion), paid by invoice or bank transfer. The deal must sign within 6 months of submission to qualify for the 10% payout.
* **Fraud prevention** — self-referrals, fake organizations, false contact information, repeat submissions, or attempts to bypass attribution may lead to disqualification or reward revocation.
* **Tax responsibility** — rewards may be taxable in the recipient's jurisdiction; the participant is responsible for compliance.
* **Program changes** — Xoxoday may modify, suspend, or discontinue the program at its discretion; changes do not affect rewards already earned.

## Full terms

### 1. Definitions

* **Referrer** — the existing customer contact submitting the referral.
* **Referred Company / Referred Contact** — the new-logo organization and the decision-maker introduced.
* **Referral ID** — a numeric tracking code auto-generated by HubSpot (for example, `528606047984`), issued once per referrer on their first submission — not once per referral. If the same referrer submits multiple referrals, to the same or different companies, all of them carry that referrer's single Referral ID; individual referrals are distinguished internally by the referred company and contact.
* **Milestone 1 (M1)** — completion of a proper product demo.
* **Milestone 2 (M2)** — signed MSA or first order (Closed Won).
* **Reward Amount** — the total cash reward: a flat \$100 for the qualified meeting (M1) plus 10% of the closed deal's first-year contract value (M2), with that 10% portion subject to a minimum of \$250 and a maximum of \$10,000, calculated per clause 6.

### 2. Who can join

* Must be a current, active customer contact on Empuls, Plum, or Loyalife, in good standing — no unresolved billing disputes and no active contract breach.
* Must have a genuine, pre-existing professional relationship with the Referred Contact, confirmed by a short attestation at submission.
* Xoxoday employees, contractors, and vendor staff are not eligible to participate as referrers, regardless of any personal customer relationship they may separately hold.
* Xoxoday may require proof of the referrer's employment or role at the referring company if reasonably in doubt.
* If a referrer's company policy does not permit participation in referral or incentive programs of this kind at all, the referrer should not submit a referral and may simply disregard this program. This is different from the employer-policy fallback in clause 6, which applies where participation itself is allowed but personally accepting a reward is not.

### 3. Who you can refer

A referral qualifies only if, at the time of submission, the Referred Company is:

* not a current Xoxoday customer on any product;
* 500+ employees;
* not already tracked in an active Xoxoday CRM opportunity, including any opportunity opened in the prior \~90 days (see clause 5 on attribution);
* represented by a person who genuinely holds decision-making or influencing authority for the relevant product (for example, HR leadership for Empuls, Procurement, Finance, or Rewards for Plum, and Marketing, Loyalty, or CX for Loyalife) — job-title claims may be verified.

**Not eligible under any circumstances:** existing customers on any Xoxoday product; companies with an open CRM opportunity; duplicate submissions of the same company or contact; companies within the referrer's own corporate group, parent company, or affiliate structure; the referrer's own employer; self-referrals in any form; and referrals where no genuine relationship exists between referrer and contact.

### 4. Submission requirements

* A submission must include, at minimum: company name, contact name, work email or LinkedIn profile, product of interest, and the nature of the referrer's relationship to the contact.
* A Referral ID (a numeric HubSpot record ID, for example `528606047984`) is issued once per referrer, on their first submission — not once per referral. If the same referrer submits multiple referrals over time, all of them are tracked under that same Referral ID; each individual referral is distinguished internally by the referred company and contact. The Referral ID, and every referral tracked under it, is non-transferable and cannot be reassigned to a different referrer.
* Referrers are fully responsible for the accuracy of everything submitted. Knowingly false, exaggerated, or misleading information voids the referral immediately upon discovery, at any stage — including after a reward has been paid.
* The Referred Contact must give affirmative consent to being contacted (double opt-in) before Xoxoday Sales makes any outreach. If consent is not obtained within a reasonable window, the referral is closed as inactive and does not qualify.
* The referred deal must sign (MSA or first order executed) within 6 months of the referral submission date. If it has not signed within that window, the referral no longer qualifies for the M2 (10% deal-value) payout, even if the deal eventually closes later. This 6-month clock does not affect the M1 \$100 payout, which is earned independently upon a qualified meeting per clause 6.

### 5. Attribution rules

* Attribution is first-touch: the first valid, timestamped submission for a given company is the one credited, regardless of how many other customers later submit the same company.
* A \~90-day lookback applies: if the account was already in active pipeline (via any channel) within 90 days before submission, the new referral is ineligible.
* Where the same referrer submits multiple contacts at the same company, only the first is treated as the qualifying referral for that company.
* Because a referrer's Referral ID is shared across all of that referrer's referrals (see clauses 1 and 4), attribution and reward calculation for each referral are tracked by the referred company and contact pairing, not by the Referral ID alone. A referrer with several referrals in progress sees each one progress and pay out independently under the same ID.
* Xoxoday's CRM timestamp and internal records are the sole and final source of truth for attribution disputes.

### 6. Reward amount, gating, and payout

* Reward Amount = \$100 per qualified meeting, plus 10% of the closed deal's first-year contract value. The 10% deal-value portion is subject to a minimum of \$250 and a maximum of \$10,000; the \$100 is additive and sits outside that floor and cap. Submission alone earns nothing.
* **M1 payout:** a flat \$100 is paid once a proper, qualified demo is confirmed — a genuine walkthrough of core product capabilities, led by the Product team or a senior Sales representative, logged as such in the CRM. A scheduling call or casual intro does not qualify. This \$100 is paid regardless of whether the deal size is known at this stage.
* The \$100 is not contingent on the deal ultimately closing. If the referred deal does not close, or closes after the 6-month deadline in clause 4, the referrer keeps the \$100 — it is not clawed back for that reason. (It may still be clawed back under the fraud provisions in clause 8.)
* **M2 payout:** once the MSA or first order is signed within the 6-month window, 10% of the deal's first-year contract value is paid, subject to the \$250 minimum and \$10,000 maximum on that portion. This is paid in addition to, not instead of, the M1 \$100.
* If the deal signs after the 6-month deadline, no M2 payout is made for that referral, regardless of deal size.
* Each referral tracked under a referrer's Referral ID is rewarded independently. If the same referrer has multiple qualifying referrals in progress, each earns its own M1 and M2 payout on its own timeline, subject to the annual per-referrer cap below.
* If a deal is later unwound, materially reduced, or found to have been misrepresented before or shortly after M2, Xoxoday may withhold or claw back the M2 (10%) portion and recalculate it to match the true deal value. The M1 \$100 is unaffected unless fraud is involved.
* The Reward Amount is paid in cash, by invoice or bank transfer, in the currency and manner Xoxoday's Finance team determines appropriate for the referrer's location.
* **Employer-policy fallback:** where personally accepting a cash reward would breach the referrer's employer policy, the referrer may instead decline or disregard the reward entirely; direct the value to a donation for a nominated charity; or, if the referrer is at an existing Xoxoday customer, apply the value as a discount on that company's next SaaS renewal or as a wallet-recharge credit. This choice must be declared at the M1 stage, before the M1 payout is processed, and applies to both the M1 and M2 payouts — it cannot be selected for the first time at M2 or invoked retroactively after the M1 cash payout has already been made.
* An annual cap per referrer applies (amount set by Finance and Sales Ops ahead of launch) across all referrals credited to that individual within a program year. Rewards in excess of the cap are not paid, deferred, or forfeited, at Xoxoday's discretion.
* Rewards are calculated as of the date each milestone is confirmed; no adjustment is made for later currency fluctuation.

### 7. Taxes

Rewards, and any fallback benefit under clause 6, may constitute taxable income, a benefit-in-kind, or otherwise be subject to tax or reporting obligations under the recipient's (or their employer's) local law. Xoxoday makes no representation, warranty, or guarantee as to tax treatment in any jurisdiction, does not withhold tax unless legally required to do so, and bears no liability for the recipient's or their employer's compliance. This is disclosed to referrers at submission and again at the time of reward.

### 8. Fraud, abuse, and enforcement

Xoxoday may investigate any referral or referrer at its discretion and may disqualify a referral, withhold a pending payout, or claw back a reward already paid (including recovering cash already transferred or requesting return of an equivalent-value benefit) where it reasonably believes there has been:

* a self-referral or referral within the referrer's own corporate group;
* a fabricated company, contact, or relationship;
* false, exaggerated, or materially misleading information at any stage;
* repeated, bulk, or systematic submissions designed to manufacture referral credit;
* collusion between a referrer and a contact at the Referred Company to simulate genuine interest;
* any other attempt to circumvent double opt-in, attribution, or milestone-gating rules.

Xoxoday's determination on eligibility, attribution, and suspected fraud is final and not subject to appeal beyond an internal review requested through Sales Ops. Referrers found to have committed fraud or repeated abuse may be permanently barred from future participation in this or related Xoxoday programs, and Xoxoday reserves the right to pursue recovery of any reward paid in error or bad faith.

### 9. No guarantee of outcome

Submitting a referral, or reaching any stage short of M1 or M2, creates no entitlement to engagement, a specific sales timeline, deal terms, or payout. Xoxoday's Sales and Product teams retain sole discretion over whether and how to pursue any referred opportunity, including declining to engage a Referred Contact for any legitimate business reason. Xoxoday is not liable for any referral that does not progress, regardless of the effort the referrer put into the introduction.

### 10. Data, privacy, and confidentiality

* Information submitted about a Referred Contact or Company is used solely to evaluate, route, and progress the referral, and is handled under Xoxoday's standard privacy practices and applicable law (including India's DPDP Act and, where relevant, GDPR for global referrals).
* Referrers must only submit contact information they are authorized to share, and must not submit information obtained in breach of any confidentiality obligation to a third party.
* Xoxoday will not disclose the referrer's identity to the Referred Company or Contact without the referrer's consent, except as necessary to facilitate the warm introduction itself.
* Program performance data may be shared internally for program evaluation; individual referral details are shared only with teams directly involved in qualification, sales, and reward processing.

### 11. Liability

Xoxoday's total liability to any referrer arising out of or related to this program is limited to the value of the reward that referrer would have been entitled to receive for the specific referral in question, had all conditions been met. Xoxoday is not liable for indirect, incidental, or consequential loss, including any business or reputational impact from an introduction not being pursued, delayed, or declined.

### 12. Program changes, suspension, and termination

* Xoxoday may modify, suspend, or discontinue the program, these terms, reward amounts, thresholds, milestones, or eligibility criteria at its sole discretion, with or without prior notice, and without liability to referrers for doing so.
* Changes do not retroactively affect a reward already fully earned — that is, both M1 and M2 completed — before the change takes effect.
* For a referral where only M1 (or neither milestone) has been completed at the time of a change, the terms in force at the time each milestone is actually reached apply to that milestone's payout.
* If the program is discontinued entirely, Xoxoday will honor rewards for referrals that have already reached the relevant milestone as of the discontinuation date, but is not obligated to allow new referrals to progress toward reward after that date.

### 13. Relationship to other agreements

These terms operate alongside, and do not override, any master service agreement, order form, or other contract between the referrer's employer and Xoxoday. Where there is a direct conflict specifically on a matter of referral-reward eligibility, these terms govern for purposes of this program only; all other aspects of the underlying commercial relationship remain governed by the applicable master agreement.

### 14. Governing law and disputes

Any dispute regarding this program that cannot be resolved through Sales Ops' internal review process will be handled per the governing law and dispute-resolution terms of the referrer's employer's underlying master agreement with Xoxoday. Where no such agreement exists, Indian law applies and disputes are subject to the jurisdiction of the courts in Bengaluru, Karnataka.


# Launch Templates
Source: https://help-plum.xoxoday.com/resources/introduction-to-plum-templates

Get an introduction to Plum's ready-to-use templates for reward communications, campaigns, and recipient messaging.

Introduction

<img alt="" />

Template 2 (Source File)

<img alt="" />

​How to Sign up

<Frame>
  <img alt="Image" />
</Frame>

How to Bookmark Reward storefront

<Frame>
  <img alt="Image" />
</Frame>

Redeem Rewards \
\
How to Redeem Points

<Frame>
  <img alt="Image" />
</Frame>

How to Redeem Codes\\

<Frame>
  <img alt="Image" />
</Frame>

How to Redeem Links

<Frame>
  <img alt="Image" />
</Frame>

​How to Sign up

<Frame>
  <img alt="Image" />
</Frame>

How to Bookmark Reward storefront

<Frame>
  <img alt="Image" />
</Frame>

Redeem Rewards \
\
How to Redeem Points

<Frame>
  <img alt="Image" />
</Frame>

How to Redeem Codes\\

<Frame>
  <img alt="Image" />
</Frame>

How to Redeem Links

<Frame>
  <img alt="Image" />
</Frame>


# Launch Kit
Source: https://help-plum.xoxoday.com/resources/launch-kit

Access Plum's launch kit, a set of resources to help you roll out and communicate your new reward program successfully.

*Turn employees into brand advocates. Setup and reward your employees across the lifecycle. Happy rewarding!*

## What is Plum Launch Kit for HR teams?

* This launch kit consists of video and email template resources for effectively communicating the launch of Plum within the organisation to the employees.

* The launch kit consists of multiple email templates that can be mass sent within the organisation for the announcement and adoption of Plum by Xoxoday.

* All the email templates are attached in the form of a JPG. You can choose to either download the email templates as they are and add them to your mailing tool directly. Or you can use the source file attached and customise it as per your company brand guidelines and own content.

* The artboard with brand colours and typography is also attached for reference.

* You can choose to add your company logos and implement a custom brand system to all the designs.

* Please go through the emails carefully and add the company name wherever the personalisation token is given.

## Video - How to set up your plum account?

## Video - How to redeem your rewards on the storefront?

(Meant for employee distribution)

## How to use the Plum Launch Kit effectively?

* **(Day -10 to Day 0)** - Pre-Launch templates to create the buzz within the organisation and get the employees excited about the upcoming rewards. These can be used before the launch of the platform in the first 10 days before the actual launch date.

* **(Day 1 to 5)-** The Introduction to Plum templates can be used on the actual date of launch and Plum implementation (You can choose to alter the content from source files)

* **(Day 6 to 10) -** How to sign up and bookmark emails can be sent in the coming week of the launch for employees’ education

* **(Day 11 to 15) -** How to redeem emails can be sent within the organisation to iterate on the easy process of redemption of rewards.

## Email templates

​

[Art-board (Colour Scheme and Typography)](https://drive.google.com/file/d/1PB-65INgYZ8pRQRMvL8ArNKZSvpmJJZi/view)​

​

[Pre-Launch Templates](/resources/pre-launch-template)​

​

[Introduction to Plum Templates](/resources/introduction-to-plum-templates)​

​

[How to Sign up on Plum’s reward storefront Template](/resources/introduction-to-plum-templates)​

​

[How to Bookmark Plum’s reward storefront for easy access Template](/resources/introduction-to-plum-templates)​

​

[How to Redeem the Rewards on Plum’s Reward Storefront?](/resources/introduction-to-plum-templates)​


# Pre-Launch Template
Source: https://help-plum.xoxoday.com/resources/pre-launch-template

Download Plum's pre-launch template to help you plan and organize the rollout of your reward program before going live.

Pre-Launch Template 1 (Source File)

<img alt="" />

Pre-Launch Template 2 (Source File)

<img alt="" />

Pre-Launch Template 3 (Source File)

<img alt="" />

Pre-Launch Template 4 (Source File)

<img alt="" />

​


# Airmiles
Source: https://help-plum.xoxoday.com/reward-marketplace/airmiles



The **Airmiles** category lets you convert **Xoxo Points** into airline frequent flyer miles. Miles are credited directly to your airline loyalty account, so you can redeem them with participating airline programs.

## Where Airmiles Is Used

Airmiles is commonly used for redeeming sales and channel incentive payouts, employee recognition and reward programs, loyalty program rewards, referral bonuses, and survey or research incentives — for users who prefer airline miles over gift cards or merchandise.

## Supported Airline Programs

Depending on your organization's reward catalog, you can redeem miles with participating airline loyalty programs, such as:

* Emirates Skywards
* Etihad Guest
* IndiGo BluChip
* SriLankan FlySmiles

Available airline partners may vary by program.

## Redeem Airmiles

<Steps>
  <Step title="Browse Available Airmiles">
    * Open the **Airmiles** category.
    * Browse available airline partners and mile denominations.
    * Select your preferred airline and redemption value.
  </Step>

  <Step title="Enter Loyalty Membership Details">
    Enter your **Airline Loyalty Membership ID** for the selected airline program during checkout. Double-check this number — miles are credited directly to this account.
  </Step>

  <Step title="Review and Confirm">
    Review the redemption details and confirm the order. Once placed:

    * The required Xoxo Points are deducted from your available balance.
    * The order status changes to **Pending** while the transfer is being processed.

    <Note>
      Airmile transfers are processed asynchronously and are not credited instantly. Processing typically takes 2–3 business days, depending on the airline partner.
    </Note>
  </Step>

  <Step title="Redemption Status">
    Once processing is complete:

    * **Successful transfers** are marked **Delivered**, and miles are credited to your airline loyalty account.
    * **Failed transfers** are marked **Failed**, and the redeemed Xoxo Points are automatically refunded.

    A confirmation email is sent once the redemption is complete.
  </Step>
</Steps>

## Cancellation & Refund

Refund eligibility depends on the transfer status:

* **Successful transfer** – Not refundable. Once miles are credited to your airline loyalty account, the transfer is permanent and cannot be cancelled.
* **Failed transfer** – Refunded automatically. The redeemed Xoxo Points are credited back to your balance.
* **Cancelling before processing** – Handled manually. Contact Xoxoday Plum Support to request a cancellation; self-service cancellation isn't available.

For any cancellation request, contact Xoxoday Plum Support via email, the support portal, or your organization's Slack/Teams support channel.

<Note>
  Airmiles cannot be redeemed without a valid airline loyalty membership account. Verify your membership ID before confirming the redemption.
</Note>


# Cash Payouts
Source: https://help-plum.xoxoday.com/reward-marketplace/cash-outs

Learn how recipients can cash out their reward points for direct payouts through Plum's reward marketplace platform.

*Learn how to cash out your reward points directly to your UPI ID or bank account.*

You can cash out your reward points via UPI or Bank Transfer. Follow the steps below.

***

## How to Cash Out via UPI Transfer

<Steps>
  <Step title="Check your points balance">
    Log in and view your available reward points.Under the payout option, select **UPI** as your transfer method.

    <Frame>
      <img alt="1" />
    </Frame>
  </Step>

  <Step title="Enter UPI ID and amount">
    Enter your UPI ID and the amount you want to cash out.

    <Frame>
      <img alt="Gvml Ls ER Lpng C Hr Ho6e Y1" />
    </Frame>
  </Step>

  <Step title="Confirm and proceed">
    Click **Make Transfer**, review your details, then confirm the  details entered

    <Frame>
      <img alt="F8c240jm Daq7e Iutrusoe" />
    </Frame>
  </Step>

  <Step title="Complete the checkout">
    On the checkout page, confirm your **payment option** and **contact details**. Once verified, click **Transfer Now** to successfully make the transfer.

    <Frame>
      <img alt="Fx Nfaj6n Ll5gomcep Lbir" />
    </Frame>
  </Step>

  <Step title="Done">
    Your cashout is complete. You'll get a confirmation via **email and SMS**.
  </Step>
</Steps>

***

## How to Cash Payout via Bank Transfer

Here's how to do it via Bank Transfer.

<Steps>
  <Step title="Check your points balance">
    Log in and view your available reward points. Under the payout option, select **Bank Transfer** as your transfer method.

    <Frame>
      <img alt="Untitled Design (1)" />
    </Frame>
  </Step>

  <Step title="Enter your bank account details">
    Provide your bank account number, IFSC code, and account holder name. Also enter the amount you want to cash out

    <Frame>
      <img alt="Screenshot 2026 07 02 At 11 54 41 AM" />
    </Frame>
  </Step>

  <Step title="Confirm and initiate transfer">
    Sign in to confirm your points, then click here to initiate the transfer.

    <Frame>
      <img alt="Screenshot 2026 07 02 At 12 23 17 PM" />
    </Frame>
  </Step>

  <Step title="Track your status">
    You'll see the transfer status on this screen once initiated.
  </Step>
</Steps>


# Charity
Source: https://help-plum.xoxoday.com/reward-marketplace/charity



The Charity category lets you donate your Xoxo Points to verified NGOs and charitable causes, converting reward points into real-world donations. It gives you an opportunity to support social causes directly from the Plum storefront.

<Note>
  Availability: Available on the Plum storefront for Xoxo Points redemptions only.
</Note>

## Where Charity Is Used

Charity is commonly used for donating employee rewards to charitable causes, supporting CSR and corporate giving initiatives, allowing loyalty program members to contribute to NGOs, and giving users the option to redeem points for social impact instead of personal rewards.

## Redemption Options

Charity donations currently support only Xoxo Points. Xoxo Code, Points + Cash, and Cash Only are not supported for this category.

## Make a Donation

<Steps>
  <Step title="Browse Charities">
    Open the Charity category and browse the available NGOs and causes. Each listing includes the NGO name, cause description, logo/image, and available donation denominations.
  </Step>

  <Step title="Select a Cause">
    Choose the NGO you want to support. The product page displays details about the organization, the cause, and available donation amounts. Click **Donate** to continue.
  </Step>

  <Step title="Confirm Donation">
    Review the donation summary — NGO selected, donation amount, and Xoxo Points to be redeemed — then confirm to place the order.
  </Step>

  <Step title="Order Confirmation">
    Once the donation is confirmed:

    * Xoxo Points are deducted from your balance.
    * A donation order is created.
    * A confirmation email is sent to your registered email address.
    * The donation appears in your Order History.

    The order may initially appear as **Pending** while it's processed by the partner NGO, before updating to **Delivered**.
  </Step>
</Steps>

## Cancellation & Refund

Refund eligibility depends on the donation status:

* **Donation successfully processed** – Not refundable. Donations can't be cancelled or refunded once processed.
* **Order remains pending** – Handled manually. Contact Xoxoday Plum Support for assistance.
* **Self-service cancellation** – Not available. Cancellation can't be done directly from the storefront.

<Note>
  Charity donations are irreversible once the funds have been processed by the NGO. If you experience any issues with your donation, contact Xoxoday Plum Support.
</Note>


# Experiences
Source: https://help-plum.xoxoday.com/reward-marketplace/experiences



The Experiences category lets you redeem rewards for tours, attractions, adventure activities, dining, wellness, and other real-world experiences. Depending on your reward program, experiences can be booked using Xoxo Points, Xoxo Codes, Points + Cash, or Cash (if enabled).

## Where Experiences Is Used

Experiences is commonly used for redeeming employee recognition and reward payouts, sales and channel incentive programs, loyalty program rewards, and referral bonuses — for users who prefer memorable experiences over gift cards or merchandise.

## Redemption Options

Depending on your organization's reward program, experiences can be booked using:

* Xoxo Points
* Xoxo Code
* Points + Cash
* Cash (if enabled)

## Book an Experience

<Steps>
  <Step title="Search for an Experience">
    * Open the Experiences category.
    * Select the Country and City, or browse the available categories.
    * Explore experiences such as tours, attractions, adventure activities, dining, and wellness — and choose your preferred option.
  </Step>

  <Step title="View Experience Details">
    Review the description, what's included, cancellation policy, additional information, price, and available dates. Select your preferred date and number of travellers before proceeding.
  </Step>

  <Step title="Enter Booking Details">
    Provide Title, First/Last name, Email address, and Phone number. Some experiences may require additional details depending on the vendor or activity.
  </Step>

  <Step title="Review and Complete Payment">
    Review the booking summary and pay using Xoxo Points, Xoxo Code, Points + Cash, or Cash (if enabled). If the redeemable value is less than the booking amount, pay the remaining balance online.
  </Step>

  <Step title="Confirm the Booking">
    Once payment completes:

    * A booking reference is generated.
    * A confirmation email is sent with the booking details.
    * The booking is added to your order history.
    * The redeemed Points/Code value is deducted from your balance.

    Depending on the experience, your confirmation may include a booking reference, voucher, barcode, or additional access instructions.
  </Step>
</Steps>

## Cancellation & Refund

Refund eligibility depends on the experience provider's cancellation policy:

* **Cancelling before the experience date** – Depends on the provider's policy. Contact Xoxoday Plum Support to request a cancellation.
* **Experience cancelled by the provider** – Refunded. The applicable refund is processed if the provider cancels the experience.
* **No-show** – Not refundable. Refunds aren't available if you don't attend the booked experience.
* **Venue rejects the booking** – Handled manually. Contact Xoxoday Plum Support for assistance; refund eligibility depends on the reason for rejection.
* **Self-service cancellation** – Not available. Experience bookings can't be cancelled directly from the storefront.

For any cancellation request, contact Xoxoday Plum Support via email, the support portal, or your organization's Slack/Teams support channel.


# Flights
Source: https://help-plum.xoxoday.com/reward-marketplace/flights



The **Flights** category lets you book domestic and international flights directly from the Plum storefront. Choose from 150+ airlines across 100+ countries and pay using your rewards balance.

Depending on your organization's reward program, flights can be booked using **Xoxo Points**, **Xoxo Code**, **Points/Code + Cash**, or **Cash** (if enabled).

<Note>
  Flights is commonly used for redeeming sales and channel incentive payouts, employee milestone or performance reward payouts, loyalty program rewards in B2B2C programs, referral bonuses, and survey or research incentive payouts.
</Note>

## Redemption Options

**Xoxo Points**

Redeem available Xoxo Points in your wallet to pay for flight bookings.

* If points fully cover the fare, the booking completes as **Points Only**.
* If the balance is insufficient and **Points + Cash** is enabled, you can pay the remaining amount online.

**Xoxo Code**

Redeem an Xoxo Code toward a flight booking. The code's value is applied to the fare; if it doesn't cover the full amount, pay the remaining balance online via the available payment gateway.

## How to Book a Flight

<Steps>
  <Step title="Search for Flights">
    * Open the Flights category.
    * Enter Origin, Destination, Travel date(s), Number of travellers, and Cabin class.
    * Click **Search** to view matching flights.
  </Step>

  <Step title="Select a Flight">
    Browse results and select your preferred itinerary. Fare and availability are reconfirmed before checkout.
  </Step>

  <Step title="Enter Passenger Details">
    Provide Title, First/Last name, Gender, Date of birth, Nationality, Email, and Phone number. International bookings also require passport details.
  </Step>

  <Step title="Review and Complete Payment">
    Review the booking summary and pay using Xoxo Points, Xoxo Code, Points + Cash, or Cash (if enabled). If the redeemable value is less than the total fare, pay the remaining balance online.
  </Step>

  <Step title="Confirm the Booking">
    Once payment completes:

    * A PNR is generated confirming your reservation.
    * A confirmation email is sent to your registered address.
    * The booking appears in your order history.
    * The redeemed Points/Code value is deducted from your balance.
  </Step>
</Steps>

## Cancel a Flight Booking

Contact Xoxoday Plum Support via email, the support portal, or your organization's Slack/Teams support channel. The support team will process the cancellation and initiate any applicable refund.

## Refunds

* Xoxo Points used are credited back to your balance.
* Payment-gateway charges are refunded to the original payment method (may take a few business days).


# Hotels
Source: https://help-plum.xoxoday.com/reward-marketplace/hotels



The Hotels category lets you book hotels directly from the Plum storefront using your rewards. Choose from a wide range of properties and redeem toward domestic and international stays. Stays in 50k+ cities, across every major travel destination.

<Note>
  The Hotels category is available only on the Plum Storefront for users redeeming Xoxo Points or Xoxo Codes. It is not available through Xoxo Links or the Plum API.
</Note>

## Where Hotels Is Used

Hotels is commonly used for redeeming employee recognition, milestone, and performance rewards, sales and channel incentive payouts, loyalty program rewards, referral bonuses, and survey or research incentives. Since hotel stays are typically a higher-value redemption, this category is especially popular among users who prefer travel experiences over gift cards or merchandise.

## Redemption Options

Depending on your organization's reward program, hotel bookings can be paid using:

* **Xoxo Points** – Redeem the full booking amount using available points.
* **Xoxo Code** – Redeem the value of an Xoxo Code toward the booking.
* **Points + Cash** – If the reward value doesn't cover the full amount, pay the remaining balance online.
* **Cash** – Pay the full booking amount online, if enabled for your organization.

## Book a Hotel

<Steps>
  <Step title="Search for Hotels">
    * Open the Hotels category.
    * Enter Destination, Check-in/Check-out dates, Number of rooms, and Number of guests.
    * Click **Search** to view available hotels, along with pricing, star ratings, and amenities.
  </Step>

  <Step title="Select a Hotel">
    Browse results and select your preferred property. Choose a room and review the rate plan, inclusions, and cancellation policy before proceeding.
  </Step>

  <Step title="Enter Guest Details">
    Provide Title, First/Last name, Email address, and Phone number. If supported by the hotel, you can add special requests during checkout.
  </Step>

  <Step title="Review and Complete Payment">
    Review the booking summary and pay using Xoxo Points, Xoxo Code, Points + Cash, or Cash (if enabled). If the redeemable value is less than the total booking amount, pay the remaining balance online.
  </Step>

  <Step title="Confirm the Booking">
    Once payment completes:

    * The hotel reservation is confirmed and a booking confirmation number is generated.
    * A confirmation email with the hotel details, check-in/check-out dates, and property address is sent to your registered email.
    * The booking appears in your order history.
    * The redeemed Points/Code value is deducted from your balance.
  </Step>
</Steps>

## Cancel a Hotel Booking

Contact Xoxoday Plum Support via email, the support portal, or your organization's Slack/Teams support channel. The support team will process the cancellation and initiate any applicable refund.

## Refunds

* Xoxo Points used for the booking are credited back to your balance.
* Payment-gateway charges are refunded to the original payment method (may take a few business days).


# Airport Lounge Access
Source: https://help-plum.xoxoday.com/reward-marketplace/lounge



The **Airport Lounge Access** category lets you redeem rewards for airport lounge passes directly from the Plum storefront. Access participating lounges at airports using Xoxo Points, Xoxo Codes, or a combination of rewards and online payment.

<Note>
  Airport Lounge Access is available only on the Plum Storefront for users redeeming Xoxo Points or Xoxo Codes. It is not available through Xoxo Links or the Plum API.
</Note>

## Where Airport Lounge Access Is Used

Airport Lounge Access is commonly used for redeeming employee rewards and recognition, sales and channel incentive payouts, loyalty program rewards, referral bonuses, and survey or research incentives — for users who prefer lounge access over gift cards or merchandise.

## Redemption Options

Depending on your organization's reward program, lounge passes can be redeemed using:

* **Xoxo Points** – Redeem the full amount using available points.
* **Xoxo Code** – Redeem the value of an Xoxo Code toward the booking.
* **Points + Cash** – If the reward value doesn't cover the full amount, pay the remaining balance online.
* **Cash** – Pay the full amount online, if enabled for your organization.

## Book Airport Lounge Access

<Steps>
  <Step title="Search for Lounges">
    * Open the Airport Lounge Access category.
    * Enter Airport, Terminal (if applicable), and Date/time of your visit.
    * Click **Search** to view available lounges, along with amenities and redemption value.
  </Step>

  <Step title="Select a Lounge">
    Browse results and select your preferred option. Review amenities, operating hours, terminal location, and the number of guests allowed.
  </Step>

  <Step title="Enter Guest Details">
    Provide Guest name, Email address, and Phone number. Some lounges may also require flight details during checkout.
  </Step>

  <Step title="Review and Complete Payment">
    Review the booking summary and pay using Xoxo Points, Xoxo Code, Points + Cash, or Cash (if enabled). If the redeemable value is less than the total amount, pay the remaining balance online.
  </Step>

  <Step title="Confirm the Booking">
    Once payment completes:

    * A booking reference or QR code is generated.
    * A confirmation email is sent with the lounge details, airport, terminal, visit date/time, and the booking reference or QR code.
    * The redeemed Points/Code value is deducted from your balance.
  </Step>

  <Step title="Access the Lounge">
    On the day of your visit, present the QR code or booking reference at the lounge reception to gain entry.
  </Step>
</Steps>

## Cancellation & Refund

Refund eligibility depends on how your booking is cancelled:

* **Cancelling before your visit** – Points are refunded, though the cancellation window depends on the lounge vendor's policy.
* **Not showing up for your booking** – Points are not refunded.
* **Lounge closed or unavailable** – A refund is triggered automatically.
* **Payment captured but booking not confirmed** – Points are automatically refunded.

For any cancellation request, contact Xoxoday Plum Support via email, the support portal, or your organization's Slack/Teams support channel.


# Merchandise
Source: https://help-plum.xoxoday.com/reward-marketplace/merchandise



The **Merchandise** category allows users to redeem rewards for physical products across categories such as electronics, home & kitchen, fashion, health & fitness, and more. Depending on the reward program, merchandise can be redeemed using **Xoxo Points**, **Xoxo Codes**, **Points + Cash**, or **Cash** (if enabled).

## Use Cases

The **Merchandise** category is commonly used for:

* Employee recognition and reward programs.
* Sales and channel incentive programs.
* Loyalty program rewards.
* Referral bonus programs.
* Redeeming Xoxo Points or Xoxo Codes for physical products instead of digital rewards.

## Redemption Options

Depending on your organization's reward program, merchandise can be redeemed using:

* **Xoxo Points**
* **Xoxo Code**
* **Points + Cash**
* **Xoxo Code + Cash**
* **Cash** (if enabled)

## Redeem Merchandise

<Steps>
  <Step title="Browse Products">
    1. Open the **Merchandise** category.
    2. Browse products by category or use the search and filters to find a specific item.
    3. Select the product you want to redeem.

    You can filter products by category, brand, price, and other available options.
  </Step>

  <Step title="Review Product Details">
    View the product information, including:

    * Product description
    * Specifications
    * Available variants (such as size or color)
    * Price
    * Availability
    * Estimated delivery timeline

    Select the required variant, if applicable, and add the product to your cart.
  </Step>

  <Step title="Review Your Cart">
    Review the items in your cart and update the quantity if required.

    When you're ready, click **Proceed to Checkout**.
  </Step>

  <Step title="Select a Delivery Address">
    Choose a saved delivery address or add a new one during checkout.

    Some organizations may use **Address Lock**, which provides a pre-filled delivery address that cannot be edited.
  </Step>

  <Step title="Review and Complete Payment">
    Review your order summary and complete the payment using one of the available options:

    * **Xoxo Points**
    * **Xoxo Code**
    * **Points + Cash**
    * **Xoxo Code + Cash**
    * **Cash** (if enabled)

    If the available Xoxo Points or Xoxo Code value is less than the order amount, the remaining balance can be paid online.
  </Step>

  <Step title="Confirm Your Order">
    After the payment is completed:

    * Your order is placed successfully.
    * An order confirmation screen is displayed.
    * A confirmation email is sent to your registered email address.
    * The redeemed **Xoxo Points** or **Xoxo Code** value is deducted from your available balance.
  </Step>
</Steps>

## Track Your Order

You can track your order from **Order History**, where you can view details such as:

* Order ID
* Product name
* Order date
* Order status
* Delivery address
* Points redeemed

Depending on the fulfillment partner, tracking information and the estimated delivery date may also be available.

Typical order statuses include:

* Order Placed
* Processing
* Shipped
* Out for Delivery
* Delivered
* Cancelled
* Refunded

## Cancellation and Refunds

| Scenario                               | Refund     | Details                                                                                                                                |
| -------------------------------------- | ---------- | -------------------------------------------------------------------------------------------------------------------------------------- |
| Order not yet shipped                  | ⚠️ Depends | Contact the Xoxoday Plum Support team to request a cancellation. Approval depends on the fulfillment stage.                            |
| Damaged, incorrect, or missing product | ⚠️ Manual  | Contact the Xoxoday Plum Support team for assistance with a replacement or refund, as applicable.                                      |
| Delivery failed                        | ✅ Yes      | If the order cannot be fulfilled, the applicable refund is processed.                                                                  |
| Self-service cancellation or return    | ❌ No       | Merchandise orders cannot be cancelled or returned directly from the storefront. Contact the Xoxoday Plum Support team for assistance. |


# Mobile Recharge
Source: https://help-plum.xoxoday.com/reward-marketplace/mobile-recharge



The **Mobile Recharge** category lets you redeem rewards for prepaid mobile recharges directly from the Plum storefront. Depending on your reward program, recharges can be completed using **Xoxo Points**, **Xoxo Codes**, **Points + Cash**, or **Cash** (if enabled).

Mobile recharges are powered by **DT One**, supporting 550+ mobile operators across 160+ countries.

## Where Mobile Recharge Is Used

Mobile Recharge is commonly used for redeeming employee rewards and recognition, sales and channel incentive payouts, loyalty program rewards, referral bonuses, and survey or research incentives — for users who prefer mobile recharges over gift cards or merchandise.

## Redemption Options

Depending on your organization's reward program, mobile recharges can be completed using:

* **Xoxo Points**
* **Xoxo Code**
* **Points + Cash**
* **Cash** (if enabled)

## Recharge a Mobile Number

<Steps>
  <Step title="Enter the Mobile Number">
    * Open the **Mobile Recharge** category.
    * Select the country code.
    * Enter the mobile number.
    * Click **Verify**.

    The system automatically detects the telecom operator and region. If needed, you can manually select the operator.
  </Step>

  <Step title="Select a Recharge Plan">
    Browse the available recharge plans for the selected operator. Each plan displays the recharge amount, validity, data allowance, and calling/SMS benefits. Select the plan you want to purchase.
  </Step>

  <Step title="Review and Complete Payment">
    Review the recharge details and pay using Xoxo Points, Xoxo Code, Points + Cash, or Cash (if enabled). If the redeemable value is less than the recharge amount, pay the remaining balance online.
  </Step>

  <Step title="Confirm the Recharge">
    Once payment completes:

    * The recharge request is processed immediately.
    * A confirmation message is displayed.
    * A confirmation email or SMS is sent to your registered contact details.
    * The redeemed Points/Code value is deducted from your balance.
  </Step>
</Steps>

## Cancellation & Refund

Refund eligibility depends on the recharge status:

* **Recharge successful** – Not refundable. Completed recharges cannot be cancelled or reversed.
* **Recharge failed** – Refunded automatically. The redeemed Xoxo Points are credited back to your balance.
* **Recharge sent to the wrong number** – Not refundable. Recharges cannot be reversed once processed — double-check the number before confirming.
* **Recharge stuck as pending** – Handled manually. Contact Xoxoday Plum Support if your recharge remains pending for an extended period.

For any recharge issues, contact Xoxoday Plum Support via email, the support portal, or your organization's Slack/Teams support channel.


# Play & Win
Source: https://help-plum.xoxoday.com/reward-marketplace/play-and-win



The Play & Win category lets you redeem Xoxo Points to play interactive games and win rewards. Depending on the game outcome, you can win gift vouchers, mobile recharges, or other rewards.

<Note>
  Available games may vary depending on your organization's reward program.
</Note>

## Available Games

You may see one or more of the following games:

* **Spin the Wheel** – Spin the wheel for a chance to win a reward.
* **Roll the Dice** – Roll the dice to reveal the outcome.
* **Scratch Card** – Scratch the card to reveal whether you've won.

## How to Play

<Steps>
  <Step title="Choose a Game">
    * Open the Play & Win category.
    * Browse the available games.
    * Review the cost to play and the rewards available.
    * Click **Play Now**.

    The required Xoxo Points are deducted before the game begins.
  </Step>

  <Step title="Play the Game">
    Gameplay depends on the selected game:

    * **Spin the Wheel** – Spin the wheel to reveal your reward.
    * **Roll the Dice** – Roll the dice to determine the outcome.
    * **Scratch Card** – Scratch the card to reveal the result.

    Depending on the outcome, you may win a reward, receive another free attempt (if applicable), or see a "Better Luck Next Time" message.
  </Step>

  <Step title="Claim Your Reward">
    If you win:

    1. Click **Redeem Now**.
    2. Your reward is generated automatically.
    3. A confirmation screen displays your reward details.

    The reward is also added to your Play & Win Order History.
  </Step>
</Steps>

## View Play & Win History

All Play & Win rewards are available under the **Play & Win** tab in Order History. From here, you can view your game history, check the outcome of each game, view reward details, and play again (if the game is still available).

<Note>
  Play & Win rewards are shown separately from your regular reward redemption history.
</Note>

## Cancellation & Refund

Refund eligibility depends on when the issue occurs:

* **Game played successfully** – Not refundable. Once a game has been played, the Xoxo Points used to enter cannot be refunded.
* **Reward claimed** – Not refundable. Claimed rewards cannot be cancelled or exchanged.
* **Technical failure before the game starts** – Refunded automatically. If the game fails to launch after points are deducted, they're refunded automatically.
* **Technical issue during gameplay** – Handled manually. Contact Xoxoday Plum Support if you experience an issue while playing.

For any gameplay issues, contact Xoxoday Plum Support via email, the support portal, or your organization's Slack/Teams support channel.


# Reward Marketplace Overview
Source: https://help-plum.xoxoday.com/reward-marketplace/reward-marketplace-overview

Get an overview of Plum's reward marketplace, where recipients redeem their points for products, vouchers, and experiences.

*Xoxoday Reward Marketplace is a prebuilt, hosted rewards storefront optimized for end-user delight.*

## Introduction to Marketplace

The Storefront is a customizable online marketplace where you can craft a distinct shopping experience for customers or employees. Utilizing white-label settings, you can adjust the appearance and branding to align with your brand identity. Our pre-built marketplace is a ready-to-use rewards storefront designed for the best user experience. Offering branded gift cards, unique experiences, fintech products, and merchandise enables effortless and secure global distribution of rewards and incentives.

Delight, acquire, engage, and retain global audiences with a host of physical and digital reward options across a diverse range of categories.

<img alt="" />

## Catalog Options

One marketplace, with many categories and options — your one-stop-shop for all your rewarding needs.

## Payouts

From mass payouts to meal or fuel card provisions, our fintech partnerships offer comprehensive solutions. Drop us a line at [cs@xoxoday.com](mailto:cs@xoxoday.com) for a tailored demo.

## Brand Giftcard

Extensive catalog of 10,000+ options from brands across 100+ countries if you already know their preferences. Drop us a line @ [cs@xoxoday.com](mailto:cs@xoxoday.com) for a tailored demo.

## Merchandise

Say goodbye to the logistical nightmare and troubles of sourcing and sending hundreds of gifts across countries. Drop us a line @ [cs@xoxoday.com](mailto:cs@xoxoday.com) for a tailored demo.

## Flights

Book domestic and international flights across 100+ countries with access to 150+ airlines including Emirates, Lufthansa, Air India, and more. Recipients can use their reward points directly or pay partially, with real-time pricing and live inventory to ensure a smooth booking experience. Drop us a line @ [cs@xoxoday.com](mailto:cs@xoxoday.com) for a tailored demo.​

## Hotels

Let recipients redeem rewards for stays at 1M+ hotels across the US, UK, India, and beyond — from top luxury brands like Four Seasons, Ritz-Carlton, and Westin to everyday business travel options. Enjoy flexible booking with instant confirmation for both leisure and work trips. Drop us a line @ [cs@xoxoday.com](mailto:cs@xoxoday.com) for a tailored demo.

## Mobile Recharge

Give recipients the gift of instant connectivity. Our utility and top-up catalog allows users to recharge prepaid mobile numbers across a wide range of carriers and countries, making it one of the most practical and universally appreciated reward options. Drop us a line @ [cs@xoxoday.com](mailto:cs@xoxoday.com) for a tailored demo.

## Miles

Allow recipients to convert their reward points into airline miles, adding even more value to travel-focused reward programs. Compatible with leading frequent flyer programs, this option is especially popular with business travelers and high-performers who prefer travel perks. Drop us a line @ [cs@xoxoday.com](mailto:cs@xoxoday.com) for a tailored demo.

## Charity

Give recipients the option to do good with their rewards. Users can donate their points to a cause they care about, from global humanitarian organizations to local nonprofits. A meaningful and increasingly sought-after redemption option that reflects your organization's values. Drop us a line @ [cs@xoxoday.com](mailto:cs@xoxoday.com) for a tailored demo.

## Experience

You have the opportunity to offer an experience tailored to various interests, creating lasting memories. Drop us a line @ [cs@xoxoday.com](mailto:cs@xoxoday.com) for a tailored demo.

## Lounge

Get lounge access at major airports across the country. Drop us a line @ [cs@xoxoday.com](mailto:cs@xoxoday.com) for a tailored demo.

## Offers/Perks

Plum's storefront now features a dedicated "Perks" category, offering curated deals and discounts from top brands for seamless access to exclusive perks-based products. Drop us a line @ [cs@xoxoday.com](mailto:cs@xoxoday.com) for a tailored demo.

<img alt="" />

## For Developers

## Marketplace Integration

Transform your reward points redemption process instantly with our plug-and-play global rewards catalog integration, delivering an exhilarating experience to your users within minutes. Check out the documentation.

## Customize Storefront

### Brand Preference

Customize the storefront to make it your own with a lot of branding option. [Storefront Branding Customization](/account-settings/storefront/storefront-branding-customization)

Feedback or Questions: Email [cs@xoxoday.com](mailto:cs@xoxoday.com)


# Customize Communication
Source: https://help-plum.xoxoday.com/send-rewards/gift-cards/gift-cards-customize-reward-communication

See how to customize the reward communication, including subject lines, messages, and branding, sent alongside gift cards in Plum.

*Learn how to customize Reward Communication to recipients.*

<Info>
  You can use your Xoxoday's Rewards APIs to procure the voucher and front-end the communication yourself. Click here to learn more [About Rewards API](/API-PLAYGROUND/Rewards-API/giftcard-api).
</Info>

***

## Customizing Email

You have the option to customise email and SMS based on your requirements.

<Steps>
  <Step title="Customize email elements">
    <Frame>
      <img alt="" />
    </Frame>

    You can customize the following elements before sending the Gift Cards.

    * The subject line of the email
    * Headline Message
    * Banner Image
    * Personal Message
    * Email footer

    <Frame>
      <img alt="" />
    </Frame>
  </Step>
</Steps>

***

## Customizing SMS

<Steps>
  <Step title="Select Reward SMS tab">
    Select the tab "**Reward SMS**".

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Add your message">
    Add your message in the input field and proceed.
  </Step>
</Steps>

Feedback or Questions: Email [cs@xoxoday.com](mailto:cs@xoxoday.com)


# Send Gift Cards
Source: https://help-plum.xoxoday.com/send-rewards/gift-cards/sending-gift-cards-to-recipients

Learn how to send digital gift cards to one or more recipients using Plum, from selecting a brand to confirming delivery.

*Learn how to send brand vouchers to users from your Admin Dashboard*

## Brand Gift Card (Brand Vouchers)

Instantly send brand gift cards to recipients' inboxes. There are over 8,000 top global brands from Amazon to Walmart and everything in between!

### Best fit if you want to:

* Rapidly distribute gift cards within minutes
* Offer hassle-free redemption with specific brand gift cards, no login or registration required
* Generate a gift card for yourself, shareable via any channel

<Info>
  You can use your Xoxoday's Rewards APIs to procure the voucher and front-end the communication yourself. Click here to learn more [About Rewards API](https://developers.xoxoday.com/reference/about-rewards-api).
</Info>

***

## Step-by-step guide to sending brand vouchers: to a few

<Steps>
  <Step title="Click on the Gift Cards section">
    Click on the **Gift Cards** section under the **Send Rewards** section.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Enter recipient and voucher details">
    On this page, enter the following information to send a voucher:

    **Recipient Details**

    * Email address
    * Phone Number

    **Voucher Details**

    * Select Voucher Country
    * Select Voucher Brand
    * Enter a value of the brand (Note: add a value within the indicated range. This indicated range represents the brands' denomination available).
    * Select the Quantity. You can add upto 999 gift cards in one go.

    Lastly, click '**Add Recipient**'.
  </Step>

  <Step title="Advanced Settings (Optional)">
    <Frame>
      <img alt="" />
    </Frame>

    With advanced settings you can use following:

    * Add a PO Number if you need
    * Add a personal message in the email body for the recipient. The message that you enter here will be sent to all the recipients in the batch. Except otherwise as indicated in the .CSV file in case of bulk.
  </Step>

  <Step title="Customize Reward Email or Reward SMS">
    To customize SMS follow these steps:

    * Select 'Reward SMS' tab and add your desired message.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Preview the details and send the Gift Voucher">
    Preview the details and send the Gift Voucher.
  </Step>
</Steps>

***

## Resend Gift Cards to a contact or in Bulk

<Steps>
  <Step title="Navigate to Reports > Gift Cards">
    Navigate to **Reports > Gift Cards.**

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Select contacts">
    **Select Contacts:** Choose the contacts you want to resend the rewards.
  </Step>

  <Step title="Click Resend">
    **Resend Option:** Click the three dots next to the selected contacts, then click **'Resend'**.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Confirm action">
    **Confirm Action:** A confirmation pop-up will appear. Click **'Yes, Proceed'** to resend the rewards.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>
</Steps>

Feedback or Questions: Email [cs@xoxoday.com](mailto:cs@xoxoday.com)


# Customize Communication
Source: https://help-plum.xoxoday.com/send-rewards/reward-code/reward-code-customize-reward-communication

Learn how to customize the reward communication, including messaging and branding, sent to recipients along with reward codes in Plum.

*Learn how to customize Reward Communication to recipients.*

<Info>
  **Pro tip:** You can customize your Reward communication at the campaign level. These settings become the default communication template for the campaign. Further, you can customise to set a specific communication at the 'Send Reward' option, which will supersede the message in the default campaign template for that particular recipient(s).
</Info>

***

## Customizing Email in a Reward Code Campaign

<Frame />

<Frame>
  <img alt="" />
</Frame>

You have the option to customize the email either within the "Campaign" section or directly in the **"Reward Code"** section on the admin dashboard.

***

## Editing Email in Reward Code Section

To customize the email from the **"Reward Code"** section, follow these steps:

<Steps>
  <Step title="Navigate to Email Preview">
    Navigate to the **Reward Code** section in the dashboard.

    After configuring the campaign and uploading recipients, access the "**Email Preview**" section.

    From there, you can proceed to edit the email directly.
  </Step>

  <Step title="Customize email elements">
    You can customize the following elements before sending the Reward code.

    * The subject line of the email
    * Headline Message
    * Banner Image
    * Email footer

    <Frame>
      <img alt="" />
    </Frame>

    The banner can also be deleted by clicking on "**Remove Banner**".

    Edit the Message. Click on "**Edit Message**" and enter the message title and body. Once done, click on "**Save**". Refer to the image below:

    <Frame>
      <img alt="" />
    </Frame>

    <Frame>
      <img alt="" />
    </Frame>

    **Edit Background**: Click the pen icon to choose from the available colors, or enter your own using a hex code.

    <Frame>
      <img alt="" />
    </Frame>

    <Frame>
      <img alt="" />
    </Frame>

    Edit the background text by selecting one of the available options or entering your own. Then, "**Save**" your changes.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>
</Steps>

***

## Customizing SMS

***

## Editing Email in Reward Code Section

To customize the email from the **"Reward Code"** section, follow these steps:

<Steps>
  <Step title="Navigate to Email Preview">
    Navigate to the **Reward Code** section in the dashboard.

    After configuring the campaign and uploading recipients, access the "**Email Preview**" section.

    From there, you can proceed to edit the email directly.
  </Step>

  <Step title="Customize email elements">
    You can customize the following elements before sending the Reward code.

    * The subject line of the email
    * Headline Message
    * Banner Image
    * Email footer

    <Frame>
      <img alt="" />
    </Frame>

    The banner can also be deleted by clicking on "**Remove Banner**".

    Edit the Message. Click on "**Edit Message**" and enter the message title and body. Once done, click on "**Save**". Refer to the image below:

    <Frame>
      <img alt="" />
    </Frame>

    <Frame>
      <img alt="" />
    </Frame>

    **Edit Background**: Click the pen icon to choose from the available colors, or enter your own using a hex code.

    <Frame>
      <img alt="" />
    </Frame>

    <Frame>
      <img alt="" />
    </Frame>

    Edit the background text by selecting one of the available options or entering your own. Then, "**Save**" your changes.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>
</Steps>

***

## Customizing SMS

To customize the SMS, follow these steps:o customize the SMS, follow these steps:

<Steps>
  <Step title="Select Reward SMS">
    Select a "**Reward SMS**".

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Add your message">
    Add your message in the input field to customize the SMS.
  </Step>

  <Step title="Set Expiry (Optional)">
    Select a duration from the dropdown. Options include 1 month, 12 months, or a custom timeframSelect a duration from the dropdown. Options include 1 month, 12 months, or a custom timeframe.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>
</Steps>

Questions or Feedback: Email us at [cs@xoxoday.com](mailto:cs@xoxoday.com)Questions or Feedback: Email us at [cs@xoxoday.com](mailto:cs@xoxoday.com)


# Overview
Source: https://help-plum.xoxoday.com/send-rewards/reward-code/reward-code-overview

Get an overview of Plum reward codes, a flexible reward mode recipients can redeem themselves, and how they fit into your reward strategy.

*Learn all about Xoxoday Reward Code*

## Reward code

A reward code can used partially and in combination with other valid codes (up to 10).

Reward Code provides a fast and secure method to send unique reward codes to different participants in your ecosystem, regardless of their location.

### About

A Xoxo code is a 16 digit alpha numeric code that looks something like this: **S1H2-R3E4-D5I6-S7T8B**

Here are some of the features:

* Allows guest checkout (recipient doesn't need to log in).
* Allows partial redemption.
* Can be combined with up to 10 codes for a single checkout!

### Best fit if you want to:

* Allow easy redemption from our marketplace without account creation.
* Enable partial redemption or combining codes for larger rewards.
* Launch campaigns with unique landing pages and reward catalogs.
* Set expiry dates tailored to campaign duration and needs.

***

## Things to keep in mind

* Each Reward Code can hold up to 50,000 points, usable without campaign restrictions.
* Use up to 15 Reward Codes per transaction, applying them individually.
* Reward Codes are valid for 1 year by default.
* Send a maximum of 9,999 vouchers to one person at a time.
* Order multiple gift cards within your Reward Code Balance limit.

***

## Learn how to send Reward Code

* [Send Reward code: to Many](/send-rewards/reward-code/send-reward-code-bulk-upload)
* [Send Reward Code: to a Few](/send-rewards/reward-code/send-reward-code-individually)

Feedback or Questions: Email [cs@xoxoday.com](mailto:cs@xoxoday.com)


# Bulk Upload
Source: https://help-plum.xoxoday.com/send-rewards/reward-code/send-reward-code-bulk-upload

Learn how to send reward codes to many recipients at once using a bulk file upload in Plum, saving time on large distributions.

*Learn how to send reward codes to recipients one at a time and or many at a time.*

## Reward Code

Reward Code (reward code) provides a fast and secure method to send unique reward codes to different participants in your ecosystem, regardless of their location.

### About

A Reward code is a 16 digit alpha numeric code that looks something like this: **S1H2-R3E4-D5I6-S7T8B**

Here are some of the features:

* Allows guest checkout (recipient doesn't need to log in)
* Allows partial redemption
* Can be combined with up to 10 codes for a single checkout!

### Best fit if you want to:

* Allow easy redemption from our marketplace without account creation
* Enable partial redemption or combining codes for larger rewards
* Launch campaigns with unique landing pages and reward catalogs
* Set expiry dates tailored to campaign duration and needs

***

## Send Reward Code to many

<Info>
  **Pro tip:** Download the available template directly from the dashboard for your convenience.
</Info>

Here are the quick steps:

<Steps>
  <Step title="Select who can redeem the code">
    Click on the "**Reward code**" section in the admin dashboard (under settings) and select and input "**Choose who can redeem**" settings.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Select who can redeem">
    Here are the three options to choose from and what they mean:

    **Only the recipient of the code** — In this option, the recipient (and their email address) you mention at the time of sending the reward code, say [john.smith@acme.com](mailto:john.smith@acme.com) as the recipient email, only that person can use the Reward Code (to collect vouchers on that specified email address). It's best for direct sends to ensure the right person gets the reward.

    **Only users with same domain as yours** — In this option, if your email is [john.doe@xyz.com](mailto:john.doe@xyz.com), only those email address on the same domain (xyz.com) can use the Reward Code. This is recommended if you're sending the codes to people who might share them.

    **Any user with the code** — In this option, any user that has code can use/redeem it against your pre-funded wallet. This is the least secure of options, and to be used only when needed.
  </Step>

  <Step title="Upload recipients via CSV">
    Prepare a list of recipients in the CSV format and upload it in one shot. You can download the template directly from the Admin portal (as seen below).

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Set expiry and customize messages">
    Set an expiry (default is 12 months or can set custom) and customize email and SMS messages as needed.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>
</Steps>

<Info>
  Learn more about campaigns for Reward codes. [Click here](/campaigns/create-a-reward-code-campaign) >
</Info>

Feedback or Questions: Email [cs@xoxoday.com](mailto:cs@xoxoday.com)


# Send Individually
Source: https://help-plum.xoxoday.com/send-rewards/reward-code/send-reward-code-individually

See how to send a single reward code to one recipient individually in Plum, useful for one-off or personalized rewards.

*Learn how to send reward codes to recipients one at a time and or many at a time.*

## Reward code

Reward code provides a fast and secure method to send unique codes to different participants in your ecosystem, regardless of their location.

### About

A Xoxo code is a 16 digit alpha numeric code that looks something like this: **S1H2-R3E4-D5I6-S7T8B**

Here are some of the features:

* Allows guest checkout (recipient doesn't need to log in)
* Allows partial redemption
* Can be combined with up to 10 codes for a single checkout!

### Best fit if you want to:

* Allow easy redemption from our marketplace without account creation
* Enable partial redemption or combining codes for larger rewards
* Launch campaigns with unique landing pages and reward catalogs
* Set expiry dates tailored to campaign duration and needs

***

## Send Reward code to a few

Here are the quick steps to send one at a time:

<Steps>
  <Step title="Select who can redeem the code">
    Click on the "**Reward Codes**" in the admin dashboard and select input for "**Choose who can redeem**" option settings, based on your preference and requirement.

    <Frame>
      <img alt="" />
    </Frame>

    Here are the three options to choose from and what they mean:

    **Only the recipient of the code** — In this option, the recipient (and their email address) you mention when sending the reward code, say [john.smith@acme.com](mailto:john.smith@acme.com), as the recipient email; only that person can use the Reward Code (to collect vouchers on that specific email address). It's best for direct sends to ensure the right person gets rewarded.

    **Only users with same domain as yours** — In this option, if your email is [john.doe@xyz.com](mailto:john.doe@xyz.com), only those email address on the same domain (xyz.com) can use the Reward Code. This is recommended if you're sending the codes to people who might share them.

    **Any user with the code** — In this option, any user that has code can use/redeem it against your pre-funded wallet. This is the least secure of options, and to be used only when needed.
  </Step>

  <Step title="Select Send Individually and enter recipient details">
    Select the tab "**Send Individually**" and enter recipient details such as Name, Email address, and Reward Code value.

    <Frame>
      <img alt="" />
    </Frame>

    **Advanced Settings**

    <Frame>
      <img alt="" />
    </Frame>

    With advanced settings you can use following:

    * Schedule the reward sends to a future time date. It will be sent out at 12 AM in the UTC.
    * Add a personal message in the email body for the recipient. The message that you enter here will be sent to all the recipients in the batch. Except otherwise as indicated in the .CSV file in case of bulk.
    * You can also add an internal reference note — a note to self that you'll can recall at a later time.
  </Step>

  <Step title="Set expiry and customize messages">
    Set an expiry (default is 12 months or you can set custom time frame) and customize email and SMS messages as needed.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>
</Steps>

***

Feedback or Questions: Email [cs@xoxoday.com](mailto:cs@xoxoday.com)


# Customize Communication
Source: https://help-plum.xoxoday.com/send-rewards/reward-links/reward-link-customize-reward-communication



You can customize reward communication at two levels:

* **Campaign level** — Customizations apply to all sends within that campaign by default.
* **Send Reward level** — Customizations apply only to that specific send, overriding the campaign default for those recipients.

***

## Customizing Email in Reward Link Section

To customize the email from the "Reward Link" section, follow the steps:

<Steps>
  <Step title="Navigate to Email and SMS settings">
    Go to **Send Rewards > Reward Link > Additional Settings > Email and SMS**, then select the **Reward Email** tab.

    <Frame>
      <img alt="Screenshot 2026 09 07 At 12 21 06 PM" />
    </Frame>
  </Step>

  <Step title="Customize the email elements">
    Update any of the following elements:

    * **Subject line** — Edit the subject line recipients will see in their inbox.
      <Frame>
        <img alt="Screenshot 2026 09 07 At 12 23 15 PM" />
      </Frame>
    * **Banner image and logo** — Upload an image to appear at the top of the email or choose from the
      <Frame>
        <img alt="Screenshot 2026 09 07 At 12 24 16 PM" />
      </Frame>

    **Headline message** — Click **Edit Message**, enter the message title and body, then click **Save**.

    <Frame>
      <img alt="Screenshot 2026 09 07 At 12 25 23 PM" />
    </Frame>

    * **Background** — Click the pen icon to choose from available colours or enter a hex code. Update the background text by selecting an available option or entering your own, then click **Save**.
      <Frame>
        <img alt="Screenshot 2026 09 07 At 12 27 29 PM" />
      </Frame>

    * **Email footer** — Add or update footer content to match your brand or campaign needs. 
  </Step>
</Steps>

***

## Customize the Reward SMS

To customize the SMS, follow these steps:

<Steps>
  <Step title="Navigate to Reward SMS settings">
    Navigate to **Send Rewards > Reward Link > Additional Settings > Email and SMS**. Go to the tab "**Reward SMS**".

    <Frame>
      <img alt="Screenshot 2026 09 07 At 12 39 21 PM" />
    </Frame>
  </Step>

  <Step title="Customise the SMS message">
    Enter your message in the input field to replace the default SMS content, then click **Save**.
  </Step>
</Steps>

***

<Tip>
  **Before you send:** Preview both your email and SMS before sending Reward Links to recipients.
</Tip>

Feedback or Questions: Email [cs@xoxoday.com](mailto:cs@xoxoday.com)


# Overview
Source: https://help-plum.xoxoday.com/send-rewards/reward-links/reward-link-overview

Get an overview of Plum reward links, how recipients redeem them for a reward of their choice, and when to use this reward mode.

*Learn more about Reward Links — a unique link that can be sent to each recipient!*

Quickly create campaigns and distribute rewards with Xoxo Link. Share the link through any channel, allowing recipients to redeem rewards from a curated list of global brands easily.

## Reward Link is a good fit if you want to

* Provide recipients with one-click redemption without the hassle of account creation.
* Create campaigns with micro-landing pages with your hand-picked gift selections.
* Customize link expiry dates to match campaign needs.

***

## Learn how to send reward links

## Send Reward Links

* [Send Reward Links: to a Few](/send-rewards/reward-links/send-reward-links-send-individually)
* [Send Reward Links: to Many](/send-rewards/reward-links/send-reward-links-bulk-upload)
* [Send Reward Links: to Self](/send-rewards/reward-links/send-reward-links-to-self)


# Bulk Upload
Source: https://help-plum.xoxoday.com/send-rewards/reward-links/send-reward-links-bulk-upload

Learn how to send Reward Links to a large list of recipients at once using bulk CSV upload through the Plum Admin Portal.

## About Reward Link

Reward Link lets you create campaigns and deliver rewards through a single shareable link , via email, SMS, WhatsApp, or any channel you prefer. Recipients click the link and choose a gift card from a curated selection of leading global brands, with no account required.

**Reward Link works best when you want to:**

* **Keep redemption simple** — Recipients claim their reward instantly, without signing up.
* **Create a branded experience** — Build campaigns with a custom micro-landing page and hand-picked gift card options.
* **Control the timeline** — Set a custom expiry date to match your campaign window.

<Info>
  You'll need to create a campaign to be able to send Reward Link rewards to recipients. [Click here](https://revamptest.readme.io/docs/creating-xoxolink-campaigns) to learn how.
</Info>

***

### How to Send Reward Links in Bulk

<Info>
  **Pro tip:** Download the available template directly from the dashboard for your convenience.
</Info>

<Steps>
  <Step title="Select a campaign">
    Choose the campaign you want to use from the list of available campaigns.

    <Tip>
      Pro tip: You can also edit the campaign directly from this page before proceeding.
    </Tip>

    <Frame>
      <img alt="Screenshot 2026 09 06 At 1 05 31 AM" />
    </Frame>
  </Step>

  <Step title="Upload your CSV file">
    Choose send in bulk delivery.

    <Frame>
      <img alt="Screenshot 2026 09 06 At 1 05 43 AM" />
    </Frame>

    Review the field instructions on the page, then upload your completed CSV file using the provided template. Make sure all recipient details are filled in correctly before uploading.  

    <Frame>
      <img alt="Screenshot 2026 09 06 At 1 05 54 AM" />
    </Frame>
  </Step>

  <Step title="Set the expiry date and customize messaging">
    Set how long the Reward Link will remain active by choosing an expiry period (**1, 2, 3, 6, 9, or 12 months** ) or pick a **Custom date** to match your campaign timeline. The default is **12 months**. 

    <Frame>
      <img alt="Screenshot 2026 09 06 At 1 06 32 AM" />
    </Frame>

    Optionally, customise the email and SMS messages that will be delivered to each recipient.
  </Step>

  <Step title="Send the reward">
    Review your upload and settings, then click **Send Reward** at the bottom of the page. Reward Links will be delivered to all recipients on your list.

    <img alt="Screenshot 2026 09 06 At 1 52 50 AM" />
  </Step>
</Steps>

***

### Need to send to a single recipient?

You can also send Reward Links one at a time using manual entry.<br />[Learn how to send a Reward Link to an individual recipient](https://help-plum.xoxoday.com/send-rewards/reward-links/send-reward-link-individual)

Feedback or questions: Email [cs@xoxoday.com](mailto:cs@xoxoday.com)<br />


# Send Individually
Source: https://help-plum.xoxoday.com/send-rewards/reward-links/send-reward-links-send-individually

Learn how to send Reward Links to recipients one at a time through the Plum Admin Portal.

### What is Reward Link?

Reward Link lets you create campaigns and deliver rewards through a single shareable link — via email, SMS, WhatsApp, or any channel you prefer. Recipients click the link and choose a gift card from a curated selection of leading global brands, with no account required.

**Reward Link works best when you want to:**

* **Keep redemption simple** — Recipients claim their reward instantly, without signing up.
* **Create a branded experience** — Build campaigns with a custom micro-landing page and hand-picked gift card options.
* **Control the timeline** — Set a custom expiry date to match your campaign window.

<Info>
  You'll need to create a campaign to be able to send rewards to recipients. [Click here](/send-rewards/reward-links/reward-link-customize-reward-communication) to learn how.
</Info>

***

### How to Send a Reward Link to an Individual

<Steps>
  <Step title="Select a campaign">
    Log in to the **Plum Admin Portal**. Navigate to **Send Rewards > Reward Link**. Click **Campaigns** and use the drop-down to choose the campaign you want to use.

    <Tip>
      Pro tip: You can also edit the campaign directly from this page before proceeding.
    </Tip>

    <Frame>
      <img alt="Screenshot 2026 09 06 At 12 24 08 AM" />
    </Frame>
  </Step>

  <Step title="Choose individual delivery">
    On the **Add Recipients** page, select **Select Individually**.

    <Frame>
      <img alt="Screenshot 2026 09 06 At 12 56 42 AM" />
    </Frame>
  </Step>

  <Step title="Enter recipient details">
    Provide the recipient's **name** and **email address**.

    <img alt="Screenshot 2026 09 06 At 12 24 21 AM" />
  </Step>

  <Step title="Use **Advanced Settings** if required:">
    Customize the reward communication for this recipient. Add internal notes for reference.

    <img alt="Screenshot 2026 09 06 At 12 25 17 AM" />
  </Step>

  <Step title="Add more recipients (optional)">
    To send the same Reward Link to additional people, select the option to add a recipient and enter their details. Repeat as needed.

    <Frame>
      <img alt="Screenshot 2026 09 06 At 12 25 28 AM" />
    </Frame>
  </Step>

  <Step title="Set the expiry date and customize messaging">
    Set how long the Reward Link will remain active by choosing an expiry period  (**1, 2, 3, 6, 9, or 12 months)**  or pick a **Custom date** to match your campaign timeline. The default is **12 months**.

    <Frame>
      <img alt="Screenshot 2026 09 06 At 12 26 11 AM" />
    </Frame>
  </Step>

  <Step title="Send the reward">
    Review the recipient details and communication preview, then click **Send Reward**. The Reward Link will be delivered to each recipient immediately. 

    <Frame>
      <img alt="Screenshot 2026 09 06 At 12 26 11 AM 1" />
    </Frame>
  </Step>
</Steps>

***

### Need to send to multiple recipients?

Use the bulk upload option to send Reward Links to a large list at once.<br />[Learn how to send Reward Links in bulk](https://help-plum.xoxoday.com/send-rewards/reward-links/send-reward-links-bulk-upload)

Feedback or questions: Email [cs@xoxoday.com](mailto:cs@xoxoday.com)


# Send to Self
Source: https://help-plum.xoxoday.com/send-rewards/reward-links/send-reward-links-to-self

Learn how to generate Reward Links in bulk and distribute them through your own channels via the Plum Admin Portal.

## What is Reward Link?

Reward Link lets you create campaigns and deliver rewards through a single shareable link — via email, SMS, WhatsApp, or any channel you prefer. Recipients click the link and choose a gift card from a curated selection of leading global brands, with no account required.

**Reward Link works best when you want to:**

* **Keep redemption simple** — Recipients claim their reward instantly, without signing up.
* **Create a branded experience** — Build campaigns with a custom micro-landing page and hand-picked gift card options.
* **Control the timeline** — Set a custom expiry date to match your campaign window.

<Info>
  You'll need to create a campaign to be able to send Reward link rewards to recipients. [Click here](/send-rewards/reward-links/reward-link-customize-reward-communication) to learn how.
</Info>

***

## Send Reward Links to Self

Use this option when you want to manage recipient communication yourself, for example, through your own email, internal tools, or any channel outside the platform.

<Steps>
  <Step title="Select a campaign">
    Choose the campaign you want to use from the list of available campaigns.

    <Tip>
      Pro tip: You can also edit the campaign directly from this page before proceeding.<br />
    </Tip>

    <Frame>
      <img alt="Screenshot 2026 09 06 At 7 34 53 PM" />
    </Frame>
  </Step>

  <Step title="Specify the quantity">
    Enter email ID and the number of Reward Links you need. Each link can be distributed to a separate recipient.

    <Frame>
      <img alt="Screenshot 2026 09 06 At 7 35 04 PM" />
    </Frame>
  </Step>

  <Step title="Set the expiry date ">
    Set how long each Reward Link will remain active by choosing an expiry period ( **1, 2, 3, 6, 9, or 12 months)** or pick a **Custom date** to match your campaign timeline. The default is **12 months**. 

    <Frame>
      <img alt="Screenshot 2026 09 06 At 7 35 17 PM" />
    </Frame>
  </Step>

  <Step title="Send Reward">
    Once you're ready, click **Send Reward** at the bottom of the page.The Reward Links will be generated and delivered to you for distribution.
  </Step>
</Steps>

***

### Other ways to send Reward Links

You can also send Reward Links directly to recipients — one at a time or in bulk.

[Learn how to send a Reward Link to an individual recipient](https://help-plum.xoxoday.com/send-rewards/reward-links/send-reward-links-send-individually)<br />[Learn how to send Reward Links in bulk](https://help-plum.xoxoday.com/send-rewards/reward-links/send-reward-links-bulk-upload)<br /><br />Feedback or questions: Email at [cs@xoxoday.com](mailto:cs@xoxoday.com)


# Comparison Guide
Source: https://help-plum.xoxoday.com/send-rewards/reward-modes/comparison-of-when-to-use-what

Compare Plum's reward modes side by side to decide when to use gift cards, reward links, reward codes, or reward points for your use case.

*Learn about the best use-case fit for each of currency (aka Mode of rewarding). It's benefits and end-user experience.*

## Reward Code Vs Reward Points Vs Reward Link | Differences

| <br />**Feature Name**                 | **What it means**                                                                                                                                     | **Reward Points** | **Reward Code** | **Reward Link** | **Brand Gift Cards** |
| :------------------------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------- | :---------------- | :-------------- | :-------------- | :------------------- |
| Email Registration (DIY/Self Serve)    | Set up an account independently without any assistance from the team.                                                                                 | Yes               | Yes             | Yes             | Yes                  |
| Campaign Creation                      | The ability to customize catalog, add landing page, customize templates with brand logos, etc.                                                        | No                | Yes             | Yes             | No                   |
| Bulk Rewards                           | Option to send rewards to hundreds and thousands of recipients.                                                                                       | Yes               | Yes             | Yes             | Yes                  |
| Individual Rewards                     | Sending rewards manually to recipient                                                                                                                 | Yes               | Yes             | Yes             | Yes                  |
| Rewards API                            | It allow developers to implement seamless rewards and coupon systems into their applications giving the flexibility to execute any sort of campaigns. | Yes               | Yes             | Yes             | Yes                  |
| Omnichannel Delivery (email, SMS)      | Marketing communication across multiple channels like emails, SMS, WhatsApp, etc.                                                                     | Yes               | Yes             | Yes             | Yes                  |
| Integrations (CRM. HRMS, Survey tools) | Connects seamlessly with existing marketing automation tools, HR tools, and other productivity tools.                                                 | No                | No              | Yes             | Yes                  |
| Reward Accumulation                    | It allows you to accumulate and redeem rewards at your convenience based on the value in the designated currency.                                     | Yes               | No              | No              | No                   |
| Custom Expiry                          | The ability to change the expiry date for rewards<br />Offered expiry options are 3,6, and 9 months. It's 12 months by default.                       | No                | Yes             | Yes             | No                   |
| Landing Page (Campaign specific)       | A company branded web page that allows you to display a welcome screen, personalized message, and customize campaign as per brand requirements.       | No                | Yes             | Yes             | No                   |
| Distribution                           | The mechanism in which rewards are distributed for a reward program based to achieve desired outcomes.                                                | API, CSV, Email   | API, CSV        | API, CSV        | API, CSV             |

## **Benefit comparison**

| **Benefits**                     | **What it means**                                                                                                                                               | **Reward Points** | **Reward Code** | **Reward Link** | **Brand Gift Cards** |
| :------------------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------- | :---------------- | :-------------- | :-------------- | :------------------- |
| Ease of Choice                   | Ease to the end users in choosing rewards redemption as per their choice                                                                                        | Yes               | Yes             | Yes             | No                   |
| Ease of Distribution             | Flexibility in terms of distributing rewards which can be different based on the rewarding use-case.                                                            | Yes               | Yes             | Yes             | Yes                  |
| Personalization (Branding)       | The ability to add personalized messages and customize campaigns as per brand guidelines to keep it consistent.                                                 | No                | Yes             | Yes             | No                   |
| Flexible Denominations           | It allows for variations in the value or size of denominations in a particular currency and offers the flexibility to accommodate different transactional needs | Yes               | Yes             | Yes             | Limited              |
| Multi Currency                   | It offers uses to send rewards in multiple currencies.                                                                                                          | Yes               | Yes             | Yes             | No                   |
| Applicable in multiple countries | Rewards catalog across countries or geographies.                                                                                                                | Yes               | Yes             | Yes             | No                   |
| Multi-region deployment          | Ability to deploy the servers in specific regions                                                                                                               | Yes               | Yes             | Yes             | No                   |
| Multi-lingual                    | Ability to show marketplace, emails, notifications and platform in different languages                                                                          | Yes               | Yes             | Yes             | No                   |
| Reward Scheduling                | The ability to schedule rewards for the future date.                                                                                                            | Yes               | Yes             | Yes             | Yes                  |
| Redemption reports               | It refers to records or summary of rewards redeemed by the user.                                                                                                | Yes               | Yes             | Yes             | No                   |
| Catalog Customisation            | Offers the flexibility to choose catalog options like gift cards, merchandise, charity, experiences, travel and more for the campaign.                          | Yes               | Yes             | Yes             | Yes                  |
| Customer Support                 | Dedicated support team or CSM for resolving customer queries.                                                                                                   | Yes               | Yes             | Yes             | Limited              |
| Reward Cancellation\*            | The option to cancel the rewards sent within 180 days of reward sent date                                                                                       | Yes               | Yes             | Yes             | No                   |
| Transferable                     | The option to transfer the reward points associated with the account to another account or user                                                                 | No                | Yes             | Yes             | No                   |
| Linked to Email/Mobile number    | Reward associated to a particular account.                                                                                                                      | Yes               | No              | No              | No                   |
| Anonymous Redemption             | The ability to allow the redemption of rewards without revealing contact details such as email or phone number                                                  | No                | Yes             | Yes             | No                   |
| Generation to Self               | The ability to generate rewards for self which can be sent to others.                                                                                           | No                | Yes             | Yes             | Yes                  |

## **Rewards & Redemption Categories**

| **Reward Category**  | **What it means**                                                                                                                                 | **Reward Points** | **Reward Code** | **Reward Link** | **Brand Gift Cards** |
| :------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------ | :---------------- | :-------------- | :-------------- | :------------------- |
| Gift Cards           | Brand Vouchers or Cards that can be redeemed in online retail stores, restaurants, or any other service providers.                                | Yes               | Yes             | Yes             | Yes                  |
| Non Profit Donations | Monetary or in-kind contributions made to non-profit organizations or initiatives that operate for the benefit of the public or a specific cause. | Yes               | Yes             | Yes             | No                   |
| Prepaid Cards        | Payment cards from Visa/Mastercard loaded with funds which allow users to purchase or access any service.                                         | Yes               | Yes             | Yes             | No                   |
| Experiences          | Experiences that allows end-users to enjoy a wide range of activities like adventure, tours, hobbies, wellness, gourmet, arts, history etc.       | Yes               | Yes             | Yes             | No                   |
| Perks & Offers       | Offers & discounts from popular brands in the form of coupons or cashback to the end users.                                                       | Yes               | Yes             | Yes             | No                   |

Feedback or Questions: Email at [cs@xoxoday.com](mailto:cs@xoxoday.com)


# Reward Types
Source: https://help-plum.xoxoday.com/send-rewards/reward-modes/reward-modes-types-overview

Get an overview of the reward modes available in Plum, gift cards, reward links, reward codes, and reward points, and how each one works.

*Learn about different modes of rewards and explore the best fit for your use-case, its benefits, and user experience.*

Plum is made to handle all your rewarding needs effortlessly! Whether the intended recipient is an employee, a customer, or a partner — Plum lets you reward anyone, anywhere, in your own special way.

<img alt="" />

## 1. Reward Code(s)

Reward code provides a fast and secure method to send unique reward codes to different participants in your ecosystem, regardless of their location.

Learn how to send a reward code here [Reward Code](/send-rewards/reward-code/reward-code-overview).

### About

A Reward code is a 16 digit alpha numeric code that looks something like this: **S1H2-R3E4-D5I6-S7T8B**

Here are some of the features:

* Allows guest checkout (recipient doesn't need to log in)
* Allows partial redemption
* Can be combined with up to 10 codes for a single checkout!

### Best fit if you want to:

* Allow easy redemption from our marketplace without account creation.
* Enable partial redemption or combining codes for larger rewards.
* Launch campaigns with unique landing pages and reward catalogs.
* Set expiry dates tailored to campaign duration and needs.

## 2. Reward Point(s)

Give out reward points that can be accumulated, allowing users to stack up their Reward Points for redemption from our extensive rewards catalog.

Learn how to send reward points here [Reward points.](/send-rewards/reward-points/send-reward-points-send-individually)

### Best fit if you want to:

* Instantly transfer points to the recipient’s account, automatically adding to their existing balance.
* Recipients can choose to redeem all Reward Points at once or in parts for flexibility.
* Reward points are sent to the recipient’s email or phone, accessible anytime via login.

## 3. Reward Link(s)

Quickly create campaigns and distribute rewards with Reward Link. Share the link through any channel, allowing recipients to redeem rewards from a curated list of global brands easily.

Learn how to send a reward link here [Reward Links.](/send-rewards/reward-links/send-reward-links-send-individually)

### Best fit if you want to:

* Quickly distribute rewards within minutes.
* Provide recipients with one-click redemption, no account creation needed.
* Create campaigns with unique landing pages displaying curated brand lists.
* Customize link expiry dates to match campaign needs.

## 4. Brand Gift Card (Brand Vouchers)

Instantly send brand gift cards directly to recipients' inboxes. There are over 8,000 top global brands from Amazon to Walmart and everything in between!

Learn how to send a brand gift cards here [Brand Gift Cards.](/getting-started/for-end-users/gift-vouchers-faqs)

### Best fit if you want to:

* Rapidly distribute gift cards within minutes.
* Offer hassle-free redemption with specific brand gift cards, no login or registration required.
* Generate a gift card for yourself, shareable via any channel.

Feedback or Questions - Email to [cs@xoxoday.com](mailto:cs@xoxoday.com)


# Overview
Source: https://help-plum.xoxoday.com/send-rewards/reward-points/reward-points-overview

Get an overview of Plum reward points, how recipients accumulate a balance, and how they can redeem it in the reward marketplace.

*Learn about the concept of reward points and their use cases.*

## What are Xoxo Reward Points?

Xoxo Reward Points can be used by HR heads or CXO''s of a company to distribute rewards and incentivize their employees, stakeholders, or channel partners. Distributed points can be used by the recipients on the Plum Stores Platform.

***

## Instructions

* Xoxo Reward Points is the main unit of reward. It is at the core of all transactions. All Catalog Prices & Rewarding will be done based on these Points.
* The conversion value of points is equivalent to the base currency selected during sign-up. So if USD is selected as the base currency, 1 Point = 1 USD, and if EUR is selected as the base currency, 1 EUR = 1 Point.
* Xoxo Reward Points are instantly Transferred to a User account. The email Id of the recipient is the unique identifier.
* The reward points have an expiry of 1 year from the date of issue.
* Points are accumulated in the user account and they can redeem them in single or multiple transactions, irrespective of how the reward is received. The System takes care to consume the oldest points first to make sure points are used up optimally.
* Xoxo reward points can be created by Super Admin and Admins under the threshold set for each Admin.
* Xoxo reward points can be used by the employees, stakeholders, channel partners, etc.

Feedback or Questions: Email [cs@xoxoday.com](mailto:cs@xoxoday.com)


# Bulk Upload
Source: https://help-plum.xoxoday.com/send-rewards/reward-points/send-reward-points-bulk-upload

Learn how to send reward points to many recipients at once using a bulk file upload in Plum, saving time on large distributions.

*Learn how to send reward points to many recipients at once.*

<Info>
  Users must be registered on Plum to receive points; if not, they will receive a registration link to set up their account.
</Info>

***

## Send Reward Points to Recipients

<Steps>
  <Step title="Navigate to Send Rewards > Reward Points">
    Navigate to **Send Rewards > Reward Points** in the main menu.
  </Step>

  <Step title="Select Send in Bulk and upload CSV">
    Select the **Send in Bulk** option. To efficiently reward a large group of recipients, upload the CSV file by clicking the option provided.

    <Info>
      **Pro tip:** Download the available template directly from the dashboard for your convenience.
    </Info>

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Click Next">
    After uploading the file, click on **Next** to move ahead.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Customize the marketplace">
    Customize the marketplace.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Customize communication">
    Customize the communication for email and SMS.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Send Rewards">
    Once done, click on **Send Rewards.**

    <Frame>
      <img alt="" />
    </Frame>
  </Step>
</Steps>

***

## Resend Reward Points in Bulk

<Steps>
  <Step title="Navigate to Reports > Reward Points">
    Navigate to **Reports > Reward Points.**
  </Step>

  <Step title="Select contacts">
    **Select Contacts:** Choose the contacts you want to resend the rewards.
  </Step>

  <Step title="Click Resend">
    **Resend Option:** Click the three dots next to the selected contacts, then click **'Resend'.**
  </Step>

  <Step title="Confirm action">
    **Confirm Action:** A confirmation pop-up will appear. Click **'Yes, Proceed'** to resend the rewards.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>
</Steps>

Feedback or Questions: Email [cs@xoxoday.com](mailto:cs@xoxoday.com)


# Send Individually
Source: https://help-plum.xoxoday.com/send-rewards/reward-points/send-reward-points-send-individually

See how to send reward points to a single recipient individually in Plum, useful for one-off or performance-based rewards.

*Learn how to send reward points to a few recipients at a time.*

<Info>
  Users must be registered on Plum to receive points; if not, they will receive a registration link to set up their account.
</Info>

***

<Steps>
  <Step title="Navigate to Send Rewards > Reward Points" />

  <Step title="Enter recipient details">
    Enter the user's "**Name**," "**Email ID**," "**Number of Points**," and "**Mobile Number**."

    Optionally, provide a citation explaining the purpose of the points, such as Long-time employee, Birthday, Work Anniversary, etc.

    <Frame>
      <img alt="" />
    </Frame>
  </Step>

  <Step title="Review and send">
    Once all user details are entered, proceed to distribute the points.

    * Users must be registered on Plum to receive points; if not, they will receive a registration link.
    * Points will be deducted from the existing "Company Balance"; if insufficient, you'll receive a warning to recharge or remove entries.

    Click **"Send Reward"** to instantly deliver the reward to the user's account via email.
  </Step>
</Steps>

***

## Advanced Settings

Here are some advanced settings that you can use to customize your reward points.

<Frame>
  <img alt="" />
</Frame>

With advanced settings you can use following:

* Schedule the reward sends to a future time date. It will be sent out at 12 AM in the UTC.
* Add a personal message in the email body for the recipient. The message that you enter here will be sent to all the recipients in the batch. Except otherwise as indicated in the .CSV file in case of bulk.
* You can also add an internal reference note — a note to self that you'll can recall at a later time.

For feedback or questions: Email to [cs@xoxoday.com](mailto:cs@xoxoday.com)


# Rewards Hub
Source: https://help-plum.xoxoday.com/walkthrough-videos/plum-product-videos

Watch a collection of Plum product walkthrough videos covering key features and common workflows in the platform.

*Learn how to get started with Xoxoday Plum with these Product Walkthrough Videos.*

## Onboarding

### Getting Started with Plum - Create Account and Verify KYB

<video />

In this step-by-step guide, learn how to create your Plum account and complete the KYB (Know Your Business) verification process. We'll walk you through the sign-up, document upload, and approval steps so you can get started with sending rewards quickly and compliantly.

***

## Settings

### How to Apply for Amazon Global Verification

Learn how to apply for Amazon Global Verification within Plum to enable seamless reward delivery using Amazon Global vouchers. This video guides you through the verification process, including document submission and brand compliance, so you can start offering Amazon rewards across supported countries.

<video />

### How to Apply for Amazon India Verification

Learn how to apply for Amazon India Verification within Plum to enable seamless reward delivery using Amazon India vouchers. This video guides you through the verification process, including document submission and brand compliance, so you can start offering Amazon rewards in India.

<video />

### How to Manage Storefront Catalog, Customise Branding and More

Learn how to manage your Plum storefront by customising the reward catalog, updating branding elements like logos and colours, and configuring settings to create a seamless, on-brand reward experience.

<video />

### How to Add and Authenticate Your Domain to Send Emails

Learn how to add and authenticate your domain in Plum to enable secure, branded email sending. This video walks you through domain setup, DNS configuration, and verification steps to ensure your emails land in inboxes with your company's name.

<video />

### How to Manage Team and Access Levels in Plum

Learn how to manage your team on Plum by adding members, assigning roles, and sharing access securely. This video covers everything you need to collaborate efficiently while maintaining control over who can view and manage different parts of your account.

<video />

### How to Set up Low Balance Alerts

Learn how to set up low balance alerts in Plum to stay informed when your account balance drops below a set threshold. This ensures uninterrupted reward distribution by helping you top up on time and avoid delays.

<video />

***

## Payments

### How to Add Funds to Wallet

Learn the simple steps to add funds to your Xoxoday Plum wallet. This video covers multiple payment options, wallet management tips, and how to ensure your account is always ready for seamless reward distribution.

### How to View & Download Transaction History

This video shows you how to easily download your transaction history in Xoxoday Plum. Learn to access detailed reports of all your wallet activities and export them for record-keeping and analysis.

<video />

***

## Campaigns

### How to Create Reward Code Campaigns

Learn how to easily create and manage Reward Code Campaigns in Xoxoday Plum. This video guides you step-by-step through setting up reward codes, customising campaign details, and distributing codes to your audience to drive engagement and incentivise actions effectively.

<video />

### How to Create Reward Link Campaigns

Discover how to create and launch Reward Link Campaigns in Xoxoday Plum. This tutorial walks you through generating personalised reward links, configuring campaign settings, and sharing links effortlessly to engage your users and boost participation.

***

## Send Rewards

### How to Send Reward Codes

Learn how to quickly and securely send reward codes to your recipients using Xoxoday Plum. This video guides you through selecting the right campaign, choosing delivery methods, and tracking the status of your sent rewards.

### How to Send Reward Points

[Open](https://app.supademo.com/demo/cm8mqb9g9000djryxm4pca47i/edit#ai) Learn how to easily send reward points to your recipients using Xoxoday Plum. This video guides you through selecting users, specifying point amounts, and completing the transfer quickly and securel

<video />

### How to Send Reward Links

Learn how to send reward links to your recipients effortlessly with Xoxoday Plum. This video shows you how to generate reward links and share them quickly via multiple channels for seamless reward distribution.

### How to Send Gift Cards

Learn how to send gift cards easily using Xoxoday Plum. This video guides you through selecting gift card options, adding recipient details, and delivering digital gift cards quickly and securely.

<video />

***

## Reports

### How to View and Download Reports

Learn how to access, view, and download detailed reports in Xoxoday Plum. This video guides you through navigating the reports dashboard, filtering data, and exporting reports for your records and analysis.

<video />

***

## Integrations

### Xoxoday Plum X Hubspot Integration

Discover how to integrate Xoxoday Plum with HubSpot to automate and personalize reward campaigns. This video walks you through connecting both platforms, mapping contact data, and triggering rewards directly from your HubSpot workflows.

### Xoxoday Plum X Typeform Integration

Learn how to integrate Xoxoday Plum with Typeform to automate reward distribution based on form responses. This video covers how to connect both platforms, set up triggers, and send rewards instantly when users complete a Typeform.

### Xoxoday Plum Salesforce Loyalty Account Walkthrough

Get a complete walkthrough of the Salesforce Loyalty Account integration with Xoxoday Plum. This video shows you how to manage loyalty points, track member activity, and deliver personalized rewards—all within your Salesforce environment.

<video />

### Xoxoday Plum X Qualtrics Integration

Learn how to integrate Xoxoday with Qualtrics to automate reward distribution based on survey responses. This video guides you through connecting both platforms, setting up response-based triggers, and sending personalized rewards to boost survey participation.

<video />

### Xoxoday Plum X Zapier Integration

Discover how to connect Xoxoday with thousands of apps using Zapier. This video walks you through setting up Zaps to automate reward workflows—triggering rewards from actions in tools like Google Forms, Slack, HubSpot, and more without writing any code.

<video />

### Xoxoday Plum X SurveyMonkey Integration

Learn how to integrate Xoxoday with SurveyMonkey to automatically send rewards based on survey responses. This video walks you through connecting both platforms, setting up triggers, and ensuring timely, personalized reward delivery to boost response rates.

<video />

### Xoxoday Plum X Zoho People Integration

Learn how to integrate Xoxoday Plum with Zoho People to seamlessly automate employee recognition and reward workflows. This video walks you through connecting both platforms, configuring eligibility and applicability settings, awarding points directly within Zoho People, and enabling employees to redeem their rewards — all without leaving their HRMS.

### Redeem Rewards inside SAP SF

Learn how to redeem your earned rewards and purchase gift cards directly within SAP to easily access your favorite perks. This video guides you through the complete redemption process, including browsing the integrated catalog and checking out with your points, so you can instantly start enjoying your benefits without ever leaving your SAP workspace.

***

## How to Redeem

### How to Redeem Reward Code

This video guides you through the quick and easy process of redeeming a reward code on Xoxoday Plum. Learn how to enter your code, browse available options, and complete your redemption in just a few clicks.

<video />

### How to Redeem Reward Points

Learn how to redeem your reward points seamlessly on Xoxoday Plum. This video walks you through checking your points balance, exploring the catalog, and using your points to claim exciting rewards.

<video />

### How to Redeem Reward Link

This video shows you how to redeem a reward received via a Xoxoday Plum reward link. Learn how to open the link, browse available reward options, and complete your redemption in a few easy steps.

<video />

***

## Plum Marketplaces

### Plum Offers Marketplace - Mobile View

Explore the Plum Offers Marketplace in this video walkthrough. Discover exclusive deals, discounts, and cashback offers from top brands—all available to you through Xoxoday Plum. Learn how to browse, access, and redeem these exciting offers in just a few clicks.

<video />

### Plum Embedded Marketplace Journey

Take a tour of the Plum Embedded Marketplace experience. This video shows how to seamlessly integrate and navigate the marketplace within your platform, offering users easy access to curated rewards and offers without leaving your app.

<video />