Recognize Security Best Practices

Recognize recommends the following settings and administrative practices to help strengthen security, protect company information, and maintain appropriate control over your organization’s account.

Strengthen Authentication

Enable single sign-on and Force SSO

Enable single sign-on and the Force SSO setting for your organization.

Force SSO requires users to authenticate through your organization’s identity provider instead of using a separate Recognize username and password. This allows your organization to manage authentication requirements through its existing identity and access-management system.

Enable two-factor authentication

Enable a two-factor authentication method through your organization’s identity provider. Two-factor authentication uses a time-sensitive token, passcode, or another verification method to provide an additional layer of security beyond a password.

This helps protect users against account takeover, identity theft, and unauthorized access to sensitive information.

Disable unnecessary login methods

Review the authentication methods enabled for your account and keep only the options your organization expects employees to use.

For example, if employees should sign in exclusively through SSO, disable password-based and social sign-in options that are no longer needed.

Control User Access

Enable User Sync

Enable a User Sync to keep your Recognize user directory aligned with your corporate directory.

Once the initial settings are established, User Sync can automatically manage users and profile information in Recognize. Information supplied through the synchronization process, including email addresses and other synchronized fields, is locked so users cannot edit it manually from within their Recognize accounts.

Keeping directory information synchronized also helps organizations deactivate access when an employee is removed from the connected corporate directory.

Disable independent signups

Enable the Disable signups setting. This prevents users from creating accounts independently of your organization’s approved user-import or provisioning process.

Disabling independent signups gives administrators greater control over who can access the organization’s Recognize account.

Disable user invitations

Turn off the Allow users to invite others setting. When this option is disabled, users cannot independently invite additional people to the organization’s account.

This allows Company Admins to maintain control over which users are provisioned in Recognize.

Learn more about these options in Configuring Security & Privacy Settings.

Protect Recognition Privacy

Limit recognition recipients to your company

Enable the Limit sending to within company only setting. When enabled, recognitions can only be sent to existing users within your organization.

This prevents users from entering an outside recipient who has not been provisioned as part of your company’s Recognize account.

Restrict recognition visibility to your organization

Enable the Limit new recognition to be accessible only to your organization setting.

If this setting is disabled, new recognitions may be publicly accessible, including through search engines or social platforms. Enabling it helps ensure that new recognition content remains available only to authorized users within your organization.

For additional guidance, review Recognitions: Step-by-Step Instructions.

Limit Administrative Access

Users with the Company Admin role can view and potentially modify your organization’s platform data and settings. Restrict Company Admin access to a limited number of individuals who require it to perform their responsibilities.

Applying the principle of least privilege reduces the risk of accidental changes, unauthorized modifications, and administrative activity that may be difficult to identify or reverse.

Organizations should also periodically review their current Company Admins and remove elevated access when it is no longer required.

Learn how to add or remove Company Admin access.

Use Approvals for Additional Oversight

When configuring badges, Recognize allows organizations to establish an approval process in which Company Admins or Managers review recognitions before they are delivered to recipients.

For organizations using Rewards, Recognize recommends enabling approvals to help monitor rewards activity proactively.

Organizations that use a rewards approval process should also consider assigning a designated Rewards Manager to provide clear ownership and oversight.

• Learn about approval processes
• Review the Rewards Manager role

Security and Compliance Resources

The Recognize Trust Center provides the most current information about our security and compliance program, including certifications, controls, policies, penetration-testing documentation, privacy information, and subprocessors.

Some Trust Center documents are publicly available, while others may require an access request.

For security-related questions, email security@recognizeapp.com. For help configuring your Recognize account, contact support@recognizeapp.com.