Recognize recommends the following settings and administrative practices to help strengthen security, protect company information, and maintain appropriate control over your organization’s account.
Looking for security and compliance documentation?
Visit the Recognize Trust Center for current certifications, security controls, policies, subprocessors, and other available security resources.
Learn how Recognize protects your data
For an overview of the platform, infrastructure, authentication, privacy, and data-protection measures maintained by Recognize, review the Recognize Security Overview.
Jump to a section
Strengthen Authentication
Enable single sign-on and Force SSO
Enable single sign-on and the Force SSO setting for your organization.
Force SSO requires users to authenticate through your organization’s identity provider instead of using a separate Recognize username and password. This allows your organization to manage authentication requirements through its existing identity and access-management system.
Before enabling Force SSO: Confirm that your SSO connection has been configured and successfully tested. Your organization may also want to retain a controlled backup login method for designated administrators.
Enable two-factor authentication
Enable a two-factor authentication method through your organization’s identity provider. Two-factor authentication uses a time-sensitive token, passcode, or another verification method to provide an additional layer of security beyond a password.
This helps protect users against account takeover, identity theft, and unauthorized access to sensitive information.
Disable unnecessary login methods
Review the authentication methods enabled for your account and keep only the options your organization expects employees to use.
For example, if employees should sign in exclusively through SSO, disable password-based and social sign-in options that are no longer needed.
Control User Access
Enable User Sync
Enable a User Sync to keep your Recognize user directory aligned with your corporate directory.
Once the initial settings are established, User Sync can automatically manage users and profile information in Recognize. Information supplied through the synchronization process, including email addresses and other synchronized fields, is locked so users cannot edit it manually from within their Recognize accounts.
Keeping directory information synchronized also helps organizations deactivate access when an employee is removed from the connected corporate directory.
Disable independent signups
Enable the Disable signups setting. This prevents users from creating accounts independently of your organization’s approved user-import or provisioning process.
Disabling independent signups gives administrators greater control over who can access the organization’s Recognize account.
Disable user invitations
Turn off the Allow users to invite others setting. When this option is disabled, users cannot independently invite additional people to the organization’s account.
This allows Company Admins to maintain control over which users are provisioned in Recognize.
Learn more about these options in Configuring Security & Privacy Settings.
Protect Recognition Privacy
Limit recognition recipients to your company
Enable the Limit sending to within company only setting. When enabled, recognitions can only be sent to existing users within your organization.
This prevents users from entering an outside recipient who has not been provisioned as part of your company’s Recognize account.
Restrict recognition visibility to your organization
Enable the Limit new recognition to be accessible only to your organization setting.
If this setting is disabled, new recognitions may be publicly accessible, including through search engines or social platforms. Enabling it helps ensure that new recognition content remains available only to authorized users within your organization.
Recommended: Review both settings before launching your program and periodically confirm that they still align with your organization’s privacy requirements.
For additional guidance, review Recognitions: Step-by-Step Instructions.
Limit Administrative Access
Users with the Company Admin role can view and potentially modify your organization’s platform data and settings. Restrict Company Admin access to a limited number of individuals who require it to perform their responsibilities.
Applying the principle of least privilege reduces the risk of accidental changes, unauthorized modifications, and administrative activity that may be difficult to identify or reverse.
Organizations should also periodically review their current Company Admins and remove elevated access when it is no longer required.
Learn how to add or remove Company Admin access.
Use Approvals for Additional Oversight
When configuring badges, Recognize allows organizations to establish an approval process in which Company Admins or Managers review recognitions before they are delivered to recipients.
For organizations using Rewards, Recognize recommends enabling approvals to help monitor rewards activity proactively.
Organizations that use a rewards approval process should also consider assigning a designated Rewards Manager to provide clear ownership and oversight.
Recommended Account Security Checklist
- Enable SSO and Force SSO.
- Enable two-factor authentication through your identity provider.
- Disable authentication methods your organization does not use.
- Enable User Sync.
- Disable independent user signups.
- Prevent users from inviting others.
- Limit recognition recipients to existing company users.
- Restrict new recognition visibility to your organization.
- Limit Company Admin access.
- Enable approvals and assign a Rewards Manager when appropriate.
Security and Compliance Resources
The Recognize Trust Center provides the most current information about our security and compliance program, including certifications, controls, policies, penetration-testing documentation, privacy information, and subprocessors.
Some Trust Center documents are publicly available, while others may require an access request.
For security-related questions, email security@recognizeapp.com. For help configuring your Recognize account, contact support@recognizeapp.com.
Available settings and configuration options may vary by package or evolve over time. Review your organization’s security requirements and consult the Recognize Trust Center for the most current information.