Is it safe to send payouts through the Tremendous rewards platform?
By Mindy Woodall●4 min. read●Oct 1, 2025
Tremendous protects your information and money behind layers and layers of security barriers. When you're sending hundreds or thousands of rewards and incentives around the world, trustworthy security is essential.
We designed every facet of our platform, including features, infrastructure, and internal processes, with the express purpose of keeping sensitive information safe.
Below is a breakdown of how we protect your account.
Product security at Tremendous
It's your data. You decide who sees it. Tremendous gives you the tools to control data access, order approvals, and account takeover prevention.
Zero-trust architecture for sensitive data
Tremendous one-way encrypts sensitive data, like reward links and API keys. Our team has no access to them once they're created.
Access controls
You can set role-based permissions (RBP) to control who can do what with your account. Role-based permissions give specific individuals access to certain features, workspaces, or actions while blocking them from others. RBP also allows companies to create multiple roles, and doesn't require them to manage permissions when new users are hired, or when they leave.
Login protections
If our system observes unfamiliar login attempts from an unrecognized device or location, it prompts an extra email verification step to confirm user identity.
Multi-factor authentication
We offer multi-factor authentication (MFA) for every member of your organization who uses our platform. MFA requires users to provide at least two verification factors to gain access. All verified users can access this feature, and you can adjust your settings to require MFA for everyone on your team.
Single sign-on (SSO) support
Tremendous supports Google SSO and custom SAML SSO to authenticate users via external identity providers, like Google and Okta. This integration simplifies the login process and reduces the number of passwords you and your team need to remember.
Audit logs
Audit logs record every action taken within your account. These logs create extensive documentation for account admins that tracks who did what and when.
Order approvals
You can set custom rules that require admin approval for certain orders, based on various parameters like channel, order amount, or daily and weekly limits. This step gives you a second look before confirming and sending with confidence.
Process security at Tremendous
Maintaining high security standards requires regular assessments. We routinely conduct testing with third parties to identify and address any potential vulnerabilities.
Internal multi-factor authentication
We require Tremendous employees to use MFA to access our systems.
SOC 2 Type II compliant
SOC 2 is a voluntary compliance standard for service organizations. The standard is based on the following five Trust Services Criteria:
Security
Availability
Processing integrity
Confidentiality
Privacy
We can share our SOC 2 Type II reports and attestations with customers if needed.
Vulnerability scans
As part of SOC 2 compliance, we invite a third-party security solution to identify any potential weaknesses across our platform. This approach helps us stop any potential harm before it happens.
Penetration tests
These tests are run by independent third parties that flag any vulnerabilities or security gaps they may find. Penetration tests are available upon request.
Infrastructure security at Tremendous
Robust infrastructure and bank-level encryption systems fortify our security strategy and protect personally identifiable information (PII).
Data encryption at all times
We safeguard sensitive information with encryption at rest and encryption in transit, employing industry best practices to maintain confidentiality and integrity.
Continuous data backups
We perform frequent, encrypted backups stored in separate locations and regularly test restores, so your data can be recovered promptly when needed.
Environment segregation
We segregate our environments — sandbox for development, staging for pre-release testing, and production for live use. Sandbox and staging are isolated from production infrastructure, so changes are validated and reviewed before promotion.
Data never crosses environments. Sandbox and staging use separate data stores and credentials, so test activity can’t access or alter production records.
DDoS protection
A managed edge protection layer absorbs DDoS floods and throttles suspicious request spikes before they hit production, helping ensure continuous availability.Our system shields against denial-of-service (DDoS) attacks. These attacks flood servers with traffic, exhaust resources, and prevent legitimate users from accessing the platform. Our security configurations keep operations running smoothly.
Fraud prevention at Tremendous
Customize your fraud controls
You can create and toggle specific fraud control rules to detect suspicious activity based on IP address, country, redemption amount, and more.
Catch fraudsters who cycle through identities
We detect and flag fraudsters who attempt to disguise themselves using VPNs or multiple email addresses.
Flag and review rewards
Our system holds suspicious rewards for your review, so you can be confident before blocking them from going through.
Together we fight fraud
There's safety in numbers. Our AI detects suspicious activity using payouts data across the more than 20,000 companies in the Tremendous network.
Key takeaways
We use multi-layered security protocols across our product features, internal processes, and infrastructure to protect your sensitive data and financial transactions.
We protect your information and money with a comprehensive security approach that covers every aspect of our platform, from product features to infrastructure.
Sensitive data like reward links and API keys are one-way encrypted, meaning our team has no access to them once they're created.
You have full control over who accesses what through role-based permissions, multi-factor authentication, SSO support, and custom approval workflows.
We maintain SOC 2 Type II compliance and regularly conduct third-party vulnerability scans and penetration testing to identify and address potential security weaknesses.
Your data is protected with bank-level encryption standards, whether it's stored on our systems or traveling across networks.
Our AI-powered fraud detection tools use data from over 20,000 companies in the Tremendous network to help catch suspicious activity while letting your team customize rules to support your business needs.
Your account benefits from robust operational protections including DDoS shields, continuous data backups, separate testing environments, and comprehensive audit logs.
Ready to get started? Book a demo with Tremendous.
