Program data deserves clear boundaries.

Accounts have permissions for participant, partner, or administrative tasks. The platform checks the user’s organization, current role, and account status before granting access. Disabling an account or revoking its sessions blocks subsequent authenticated requests.

Within those controls, your program defines who qualifies to join and which permissions your staff need. Email verification, partner-domain rules, audience eligibility, and administrative approval support those decisions.

Access to program records is checked against the user’s organization. Sales-claim invoices and receipts are held in private storage. The application controls access to those files, using protected requests or links that expire.

Uploads are checked for permitted file type and size. Credentials used for privileged operations are kept out of participants’ browsers.

Program data is encrypted in transit and at rest through the managed infrastructure supporting the service. Production access is restricted to authorized people and services with an operational or support responsibility.

Managed providers support hosting, sign-in, database, storage, and enabled communication or payment services. The DPA provides for a current list of providers that process customer data, available on written request.

Managed database backups support recovery of program records. Backup frequency and the available recovery window depend on the deployment’s configuration.

Uploaded files are stored separately. Database backups include references to those files, not their contents, so database restoration and file recovery are distinct.

Claim decisions and partner onboarding actions are recorded with the relevant program and the person or process responsible. Those records support investigation and operational review.

Security checks cover application behavior, access permissions, database access rules, and restricted pages and services. Relevant check results and their scope can be shared during review.

Under the DPA, we notify the customer without undue delay after becoming aware of a personal data breach. We provide available details about the affected information, likely consequences, and response, and cooperate as described in the agreement.

We use the customer’s designated contact. Report a suspected issue through your Incenify contact or our contact page so we can coordinate the next steps.