Trust through clarity.
A recognition program should earn confidence. Here is what NyxThrive does, what your organization controls, and what is not promised.
Account access
Firebase Authentication handles sign-in. The server validates tokens and checks email verification, account status, organization membership and role. Administrator routes are separate from employee routes. Direct browser access to Firestore is denied by the repository's rules.
Platform oversight
The platform Owner requires a server-authorized, verified Firebase identity and can open a selected customer's real Admin portal without impersonation. Staff, points, rewards, engagement moderation, integrations, billing, exports and permanent deletion retain the actual Owner identity. A persistent context banner and return controls identify the selected customer and lead back to the platform dashboard. Entry requires a recent sign-in and management reason. Customer requests are recorded as attempted access in tenant audit and private platform history; completed mutations retain their normal outcome audit. Personal employee account actions are unavailable; Employee preview uses fictional sample data. Customer and white-label admins remain organization-scoped. Leadership changes preserve recent-sign-in, current-role, last-admin and employee-capacity safeguards. Suspension blocks customer access without deleting data or canceling charges. Suspended customers are read-only for Owner management except billing-portal entry and permanent deletion. Reactivation preserves customer subscription requirements. Private support history is kept separately from customer exports and deletion and requires an operator-managed retention process.
Earn and connect with clear boundaries
Employee activity submissions require admin review before the published points are awarded once, with the existing seven-day cap. Completion evidence stays private to its employee and tenant admins; it is included in authorized full-workspace exports, not the ledger or public feed. Workspace discussions show author identities and are not private messages. Authors and admins can remove text; post removal hides replies in the portal but retained replies remain in authorized exports until workspace deletion. Posts, replies and popularity do not award points. There is no automatic content moderation or automatic expiry schedule.
Employee choices
Personal goals, reward wishlists and in-app preferences are employee-scoped. Optional company leaderboards require employee opt-in. Pulse results are aggregate-only and suppressed below five active employee responses. Pulse responses are private, not anonymous.
Hosting and payments
Vercel hosts the application and API. Google Firebase provides authentication and Firestore storage. Stripe processes subscription payments when configured. Payment card entry happens in Stripe Checkout, not in NyxThrive. Optional Finch directory access is customer-authorized and read-only.
Human oversight
Employers review attendance imports, recognition rules and reward decisions. Points are program units, not a cash conversion. NyxThrive does not assess employee performance or establish that recognition caused a business outcome.
Data and operational responsibilities
Authorized administrators can export workspace records and request workspace deletion through the application. Private goals, wishlists and challenge-following identities are excluded from administrative exports. Backups and point-in-time recovery depend on the Firebase project's configuration; recovery data expires according to that configuration.
Backup schedules, restore exercises, retention periods, support commitments and customer agreements must be confirmed for commercial onboarding. This page does not claim an independently audited security certification, a completed restore test, or a service-level guarantee.
Do not enter payroll transactions, health information, passwords or unnecessary sensitive employee details. See the privacy notice for data handling and rights requests.
Honest integration boundaries
Administrator-reviewed CSV imports are available. A direct Paycom connector and real-time clock-punch connection have not been verified or implemented. Automated reward purchases and delivery are not included. Employers fulfill rewards themselves.
Request procurement information