Hiring system boundary / 01

The employer owns the posting. Xaigh carries the work context.

Xaigh mirrors source job details without overwriting the employer system, attaches work steps to a stable record, and closes stale roles only when the source feed confirms they are gone.

01 · Client system owns

Job details, open state, pay range, and apply path.

02 · Xaigh work layer

Matches, site checks, documents, readiness, worker audience, and payroll handoff.

03 · Change trail

Provider, source, status, and close details for created, changed, closed, or missing roles.

Review integrations

Control tracks / 02

Built for audit evidence before certification claims.

This page shows the control tracks Xaigh operates and the evidence buyers can request during a security review. It does not imply certifications, contracts, or provider scopes that are not in place.

01

SOC 2 readiness

Control mapping

Security first, with availability, confidentiality, and privacy evidence mapped where Xaigh handles worker, employer, message, location, and pay-adjacent records.

Access reviewsChange-management evidenceIncident responseVendor registerAudit-log retention
02

ISO/IEC 27001 alignment

ISMS design

Risk register, asset ownership, policy review cadence, security roles, and corrective-action tracking for a formal information-security management system.

Risk treatment registerAsset inventoryPolicy ownersSupplier controlsManagement review
03

PCI DSS boundary

Provider-scoped

Card data is kept outside Xaigh application storage. Payment flows should stay tokenized through approved payment providers and reviewed before any direct card-data expansion.

Stripe/provider boundaryNo raw PAN storageWebhook verificationLeast-privilege keysPayment release guard
04

Privacy operations

Live controls + review

User data access, correction, deletion, account closure, age floor, telemetry minimization, and sensitive-media controls remain part of release review.

Privacy request lanesDeletion route18+ account ruleTelemetry allowlistPrivate asset access
05

HIPAA / PHI boundary

Not claimed

Xaigh should not claim HIPAA compliance unless a covered-entity or business-associate use case is contracted and a BAA, PHI data map, and Security Rule safeguards are approved.

No PHI default claimBAA gateMinimum-necessary reviewSecurity official ownerBreach workflow
06

Workforce compliance

Operational controls

Worker eligibility, screening, classification, payroll-adjacent records, insurance notes, dispute windows, and final-action review are tied to real operating records.

Identity gateBackground-check consentClassification reviewTax readinessAppeal/final-action evidence

Enterprise security review should request the current control register, data inventory, subprocessors, incident process, insurance evidence, and any signed customer agreements.

Security approach

Worker standards and breach review / 03

Clear rules before a shift is accepted.

Xaigh standards, point defaults, suspension thresholds, appeal flags, and regulatory review markers are one policy. Mobile apps and employer dashboards show the same rule set.

01 · Reliability

Confirm early, arrive on time, clock in from the right place, and use the cancellation policy before the cutoff.

02 · Excellence

Accept only work you can complete, read the requirements, and arrive with required gear and documents.

03 · Integrity

Follow site instructions, protect property, keep time records accurate, and complete the assigned work.

04 · Safety

Maintain a secure environment. Report hazards, follow site protocols, and prioritize the well-being of yourself and others.

05 · Respect

Treat coworkers, customers, employers, and support with dignity. Communicate early and help recover the shift instead of disappearing.

Point thresholds and authorized review

Warning

1+ rolling point

Low-level attendance, quality, or professionalism events become visible worker coaching signals.

Temporary suspension

3 rolling points or no-show

Work access pauses for the configured suspension window and payment holds stay in sync.

Permanent review

Critical conduct or 9 lifetime points

Safety, fraud, harassment, falsified records, or repeated breach patterns require trust review.

Final suspension

Authorized final action

Permanent suspension is recorded only after review, required notices, and appeal handling.

XaıGH operating code

The revolution of work begins here.

People know the work, know the pay, know the standard, and know what happens when the standard is missed.

ReliabilityExcellenceIntegritySafetyRespect
01

Time is the product

Workers arrive prepared and employers fund the role before launch. Every shift is built around clear timing, clear pay, and clean handoff.

02

Safety before scale

Unsafe conduct, falsified time, harassment, fraud, and site-risk reports go through review before access returns.

03

Respect both sides

Workers are not anonymous labor and employers are not blank checks. XaıGH keeps communication, expectations, and records visible.

04

Review before penalty

Warnings, holds, suspensions, and final account actions are tied to evidence, notices, appeal paths, and authorized review.

Worker classification / 04

Classification risk review.

Treating warehouse workers or servers as 1099 independent contractors can create serious classification risk. Xaigh keeps the classification path visible before covered work is accepted.

Covered shifts keep the intended W-2/EOR path, payroll requirements, insurance scope, and approval records attached for review.

Payroll tax handling requirements stay assigned to the covered-work path.

I-9 and E-Verify employment eligibility steps stay visible for review.

ACA tracking, wage garnishment, and payroll-adjacent flags stay attached when required.

Covered shifts keep payroll, insurance, and employment records assigned through the EOR path.

Durable audit records / 05

Compliance is a living practice.

Operating records help teams inspect what happened, which owner acted, and what still needs review.

01Insurance scope review

Active shifts can be tied to occupational accident coverage requirements and incident records before claims handling reaches the employer team.

02Security control review

Data transmission, PII storage, and account access controls are documented for enterprise procurement review.

03Background review workflow

Background-check decisions stay attached to notice, report-copy, dispute-window, and final-action steps instead of becoming automatic breach points.

Procurement review / 06

Ask for evidence that fits the work.

Move from broad badges to a review of the records, boundaries, and controls your team needs to assess.

Request enterprise review