Security & Compliance | ISO 27001 Certified

Keeping your data secure

Managing workforce data comes with a responsibility we take seriously. Xemplo is built with security at its core to protect the personal, financial, and operational information entrusted to us by our customers. From rigorous compliance standards to best-practice infrastructure, we’re committed to maintaining the highest standards of data protection, privacy, and cybersecurity.

Certified to global standards

Xemplo is proudly ISO/IEC 27001:2022 certified, the internationally recognised standard for Information Security Management Systems (ISMS).This confirms our commitment to best-in-class security practices, including ongoing internal risk management, independent audits, and continuous improvement of our systems and processes.

Key safeguards include:

ISO/IEC 27001:2022 certification (Certificate No. 703412)
Regular third-party audits and assessments
Proactive risk mitigation and improvement processes

Regional data hosting

To meet local data residency requirements and deliver fast, reliable service, we operate secure data centres in Australia, Singapore, and Europe. All sites meet stringent physical and digital security standards and are hosted with globally trusted providers.

What you can expect:

Regional hosting ot meet local data requirements
High-availability, fault-tolerant infrastructure
Physical and network security protections

Local privacy compliance

Xemplo aligns with data protection laws in every region we serve.

In Australia, we comply with the Australian Privacy Act and Australian Privacy Principles (APPS)
For EU customers, we maintain policies that meet GDPR requirements

Our published security policies define our standards for data usage, retention, and deletion – and are regularly reviewed to stay aligned with evolving legal obligations.

Key safeguards include:

Complies with the Australian Privacy Act and APPs
GDPR-aligned policies and practices for EU customers
Transparent data handling and retention practices

Authentification and access controls

User access is protected by multi-factor authentication (MFA), and system permissions are managed through robust role-based access controls. This ensures that only authorised individuals can access sensitive data and functions.

Multi-factor authentification (MFA) available for all users
Role-based access controls (RBAC) configurable by your admins
Activity logging and session controls for complete oversight

Frequently asked questions

Answers to the burning questions in your mind about Xemplo security and compliance.

Is Xemplo ISO 27001 certified?

Yes. Xemplo is ISO/IEC 27001:2022 certified for its Information Security Management System (ISMS).

Where is customer data stored?

We host data in secure, regional data centers located in Australia, Singapore, and Europe, depending on your location and legal requirements.

Does Xemplo comply with data privacy laws like GDPR and the Australian Privacy Act?

Yes. Xemplo aligns with applicable privacy legislation including the Australian Privacy Principles (APPs) and the General Data Protection Regulation (GDPR).

How does Xemplo control access to sensitive information?

Access is protected using multi-factor authentication (MFA) and role-based access controls (RBAC) that can be configured by your administrators. All activity is logged for auditing.

How often are your systems and controls audited?

Our security controls undergo regular third-party audits and are continuously improved as part of our ISO 27001 risk management framework.