Awardco Security & Compliance

Data retention and deletion are governed by the applicable agreement, privacy documentation, product configuration, legal requirements, backups, and any transition or support obligations.

Before signing or terminating an agreement, customers should confirm the retention period, deletion process, export options, backup treatment, subprocessors, employee access after termination, and the parties’ responsibilities for completing deletion requests. Do not promise immediate or universal deletion without confirming the applicable contractual and technical process.

A typical review may include the customer’s security questionnaire, Awardco’s Trust Center materials, applicable SOC or ISO documentation, privacy and data-processing terms, subprocessor information, technical architecture, integration details, access controls, business-continuity information, and contract language.

Awardco can coordinate with the customer’s procurement, legal, IT, information-security, privacy, and business stakeholders to answer questions and identify the correct documentation. Starting the review early is important when the customer requires a questionnaire, NDA, detailed report, data-residency assessment, or contract changes.

The review outcome depends on the customer’s own risk framework and approval process. Awardco documentation can support the review but does not replace the customer’s required approval.

Awardco may use third-party providers to support hosting, communications, imagery, payments, integrations, rewards, or other platform services. Customers may ask for the current subprocessor list, provider roles, security documentation, data flows, and applicable contractual protections.

Awardco has described a process for reviewing subprocessor security and compliance materials and assessing exceptions or nonconformities through its risk-management process. The current subprocessor list, review cadence, notification process, and customer rights should be confirmed in the applicable Trust Center and agreement.

Where a payment or marketplace provider handles payment-card or redemption information, the parties should confirm which provider receives the information, what Awardco stores or does not store, and which provider’s compliance documentation applies to that portion of the transaction.

Awardco provides privacy and data-protection information to help customers evaluate requirements such as GDPR, CCPA, and other applicable privacy obligations. Depending on the relationship and data flow, customer documentation may address data-processing terms, subprocessors, international transfers, data-subject requests, retention, security measures, and breach or incident responsibilities.

Global customers should confirm the processing locations, transfer mechanism, data-residency options, regional configuration, employee notice requirements, and customer-versus-vendor responsibilities for each use case. Awardco should not be presented as making a customer compliant simply because the platform supports privacy controls or has relevant documentation.

The customer remains responsible for determining which laws apply, selecting an appropriate configuration, providing required notices, documenting its legal basis, and obtaining internal or external legal advice where needed.

Awardco integrations may use supported APIs, secure web connections, managed file transfer or SFTP, identity-provider connections, or other configured methods. The appropriate method depends on the system, data flow, fields, frequency, and customer requirements.

Implementation teams may coordinate user-file formatting, allowlisting, credentials, encryption, certificates, service accounts, permissions, and testing. Where a customer uses encrypted file transfer, the parties should confirm the file format, encryption method, key exchange, delivery location, monitoring, error handling, and troubleshooting process.

Customers should not assume that every integration uses the same protocol or security controls. Confirm the exact connection architecture and responsibilities for each data flow before production use.

Awardco can support configured identity and access workflows that may include SAML-based single sign-on, standard login, multifactor authentication or other verification methods, and role-based administrative permissions.

Organizations can coordinate with their IT or identity teams to configure the appropriate login method, user identifiers, domains, certificates or metadata, access policies, and administrator roles. The customer’s configuration determines whether standard login is available, whether SSO is required, which users can access the platform, and what each administrator can view or change.

Access should follow least-privilege principles. Customers should define who can administer programs, manage budgets, view employee data, access reports, configure integrations, approve rewards, and respond to security or privacy requests.

The data required depends on the programs, integrations, and workflows the customer enables. Organizations can generally work with Awardco to identify the fields needed for eligibility, user provisioning, organizational relationships, authentication, rewards, reporting, communications, or other configured purposes.

Organizations should apply data minimization: provide the fields required for the intended workflow, avoid sending unnecessary sensitive information, and confirm how fields are mapped, stored, used, and removed. An integration does not automatically require every field available in the source system.

Customers remain responsible for confirming that their selected data, purposes, notices, permissions, and employee communications satisfy their own legal, privacy, and internal-policy requirements.

Awardco describes safeguards for protecting data during transmission and while stored. Security discussions have referenced encryption in transit and at rest, including TLS and AES-256 controls, but the exact protocols, algorithms, key-management practices, systems, and exceptions should be confirmed in current technical documentation.

Encryption is one part of a broader security program. Customers should also evaluate identity controls, least-privilege access, environment separation, monitoring, vulnerability management, incident response, backups, and recovery practices as relevant to their review.

Awardco should not be described as providing end-to-end encryption for every workflow unless the applicable technical documentation expressly supports that claim.

Yes. Awardco’s security materials have historically included SOC 2 Type II and ISO 27001-related documentation, along with privacy and regulatory materials relevant to global customers. The exact certification, attestation, report period, scope, issuing body, and covered services should be confirmed in the current Trust Center rather than inferred from a general security statement.

A certification or attestation describes a defined control environment or scope. It does not automatically mean that every customer configuration, integration, marketplace provider, employee process, or legal obligation is covered in the same way. Customers should review the applicable report and evaluate it against their own requirements.

Awardco provides security and compliance information through its Trust Center and related customer documentation. Depending on the request and the document, this may include attestations or certifications, security policies, privacy materials, subprocessor information, technical safeguards, business-continuity details, and answers to security questionnaires.

Some materials may be available directly, while more detailed reports or sensitive security documentation may require a request, approval, or nondisclosure agreement. Customers should use the current Trust Center and contract materials as the source of truth for the applicable report, certification, date, scope, and control environment.