Q: What do the IT and security review, data privacy, and compliance requirements look like before implementation — especially for teammates using company-issued or company-managed devices?

Security and privacy are built into the platform from the ground up, so the review process is typically straightforward.

Anonymity is a design choice, not an afterthought.
The Challenges platform is built so participants can remain anonymous to whatever degree they prefer. Even administration is separated into distinct roles, so oversight of participants, client administrators, and internal representatives stays cleanly divided rather than concentrated in one view.

You control the access controls.
Every account can enable two-factor authentication (2FA) and domain-name locking when onboarding members or employees. How strict to be is entirely the client’s decision. Because the platform also lets friends and family join to encourage broader engagement, it’s worth knowing that each additional login barrier can reduce participation. We make a point of sharing that trade-off early, so you can set controls that match both your security posture and your engagement goals.

Company-issued and company-managed devices.
Participants access the platform through the standard iOS and Android apps or the web, so it fits within typical device-management setups. For teammates on company-issued or MDM-managed devices, your IT team applies its usual policies; domain-name locking and 2FA give you additional control over who can onboard under your organization.

Data privacy, compliance, and risk review.
We’re glad to support your IT and security review directly. If your team has specific data privacy, compliance, or risk-assessment requirements to work through before implementation, reach out to us and we’ll walk through them with you.

For more on how reporting is handled securely and privacy-first, see our Reporting Portal page.