Bizy
- Proactive recognition suggestions based on real collaboration signals, delivered when they matter.
- Ready-to-send recognition drafts that reference specific contributions, so appreciation feels personal.
- A conversational assistant you can ask about recent work, contributions, and who to recognize.
- Insight into collaboration patterns that helps managers and peers give fairer, more consistent recognition.
- Deep integration with Bonusly, so recognition, points, awards, and nominations flow through your existing program.
- A quiet-by-default design that prioritizes signal over noise and keeps you in control of every message.How Bizy uses your Slack dataWhen a member connects Slack, Bizy reads public channel activity on that person's behalf to understand recent work and find recognition opportunities. Using Slack's Real-Time Search, Bizy looks across the public channels the connecting user already has access to, and reads message history, reactions, and user profiles to add context to recognition. Bizy reads public channels only. It does not read direct messages, group messages, or private channels. Bizy uses this information to answer questions you ask, to draft recognition that reflects what actually happened, and to power its proactive suggestions.Bizy searches Slack as the signed-in user, so it can only ever see what that user is already permitted to see in Slack. Bizy does not post, edit, or delete anything in your Slack workspace, and it does not require a bot presence in your channels. Slack access is read-only for the purpose of understanding work and generating recognition.Privacy, permissions, and controlEvery member connects Slack individually through Slack's standard OAuth flow, and each connection is scoped to that member's own access. Workspace admins approve Bizy through Slack's normal app-approval process and can review and revoke access at any time. Members can disconnect Slack from Bizy whenever they choose. Bizy is designed around your organization's existing Slack governance, so access always respects Slack's permission model.Getting startedBizy is part of Bonusly and works best for teams already using Bonusly for recognition. After a Bonusly admin enables Bizy, each member can connect Slack in a few clicks to unlock richer, more specific recognition. From there, Bizy starts surfacing opportunities and is ready to answer your questions and draft recognition on demand.Make recognition a habit instead of an afterthought. Bizy helps your team see the good work happening every day and celebrate it while it still matters.AI-generated contentBizy's conversational assistant, recognition drafts, and proactive suggestions are powered by large language models. AI-generated responses, drafts, and suggestions may sometimes be inaccurate, incomplete, or missing important context. Please review anything Bizy produces before sending or relying on it, and treat its answers as a helpful starting point rather than a definitive record of what happened.
- Ready-to-send recognition drafts that reference specific contributions, so appreciation feels personal.
- A conversational assistant you can ask about recent work, contributions, and who to recognize.
- Insight into collaboration patterns that helps managers and peers give fairer, more consistent recognition.
- Deep integration with Bonusly, so recognition, points, awards, and nominations flow through your existing program.
- A quiet-by-default design that prioritizes signal over noise and keeps you in control of every message.How Bizy uses your Slack dataWhen a member connects Slack, Bizy reads public channel activity on that person's behalf to understand recent work and find recognition opportunities. Using Slack's Real-Time Search, Bizy looks across the public channels the connecting user already has access to, and reads message history, reactions, and user profiles to add context to recognition. Bizy reads public channels only. It does not read direct messages, group messages, or private channels. Bizy uses this information to answer questions you ask, to draft recognition that reflects what actually happened, and to power its proactive suggestions.Bizy searches Slack as the signed-in user, so it can only ever see what that user is already permitted to see in Slack. Bizy does not post, edit, or delete anything in your Slack workspace, and it does not require a bot presence in your channels. Slack access is read-only for the purpose of understanding work and generating recognition.Privacy, permissions, and controlEvery member connects Slack individually through Slack's standard OAuth flow, and each connection is scoped to that member's own access. Workspace admins approve Bizy through Slack's normal app-approval process and can review and revoke access at any time. Members can disconnect Slack from Bizy whenever they choose. Bizy is designed around your organization's existing Slack governance, so access always respects Slack's permission model.Getting startedBizy is part of Bonusly and works best for teams already using Bonusly for recognition. After a Bonusly admin enables Bizy, each member can connect Slack in a few clicks to unlock richer, more specific recognition. From there, Bizy starts surfacing opportunities and is ready to answer your questions and draft recognition on demand.Make recognition a habit instead of an afterthought. Bizy helps your team see the good work happening every day and celebrate it while it still matters.AI-generated contentBizy's conversational assistant, recognition drafts, and proactive suggestions are powered by large language models. AI-generated responses, drafts, and suggestions may sometimes be inaccurate, incomplete, or missing important context. Please review anything Bizy produces before sending or relying on it, and treat its answers as a helpful starting point rather than a definitive record of what happened.
Bizy will be able to view:
Review the details to better understand this app’s security practices. To learn more about assessing apps for your workspace visit our Help Center.
General
Privacy & data governance
Data retention policy
Customer data is retained for as long as the account is active. When a customer voluntarily closes their account, data enters an "expired" state and is retained for at least 1 year before removal. If an account is involuntarily suspended, there's a 60-day grace period (account inaccessible but data intact) before it closes and enters the same 1-year expired/removal cycle — except where data must be retained longer to comply with law.
Data archiving and removal policy
Backups run daily and are encrypted the same as production data — daily backups kept 7 days, weekly backups kept 4 weeks, monthly backups kept 1 year. Security documentation and audit trails are kept a minimum of 7 years by default. Removal of expired customer data follows the retention policy above (permanently removable after the 1-year expired period, subject to legal holds).
Data storage policy
All customer data at rest is stored on encrypted volumes using encryption keys managed by Bonusly. Customer data is logically separated at the database/datastore level via a unique customer identifier, enforced at the API layer (every query is scoped to that identifier). Employees don't have standing admin access to production data — access is approval-gated and reviewed case by case, with all access logged.
Data center location(s)
United States
Data hosting details
Application servers run on Heroku (on AWS), fronted by Cloudflare for CDN/DNS/WAF. Primary data store is MongoDB Atlas (three-node cluster: one primary, two secondary). AWS RDS hosts the rewards catalog, in-product analytics, and imported-user data. Elasticache provides ephemeral storage for the job system. Static assets and app JS are served from AWS S3.
Data hosting company
AWS, MongoDB Atlas
App/service has sub-processors
yes
Guidelines for sub-processors
App/service uses large language models (LLM)
yes
LLM model(s) used
GPT 5.4
LLM retention settings
Zero data retention is enabled on Bonusly's OpenAI account: prompts and completions are not stored by OpenAI and never used for training. Slack context is held in memory only for the request; generated output is kept in the customer's Bonusly tenant.
LLM data tenancy policy
Single-tenant: requests run through Bonusly's own OpenAI enterprise account, scoped to one customer and one authenticated user per call. No shared prompt pool; data is isolated by customer ID at the API layer. Customer data never trains or tunes models.
LLM data residency policy
All LLM processing occurs in the United States. Bizy calls OpenAI's US API endpoints from Bonusly infrastructure hosted in US regions (AWS, MongoDB Atlas). No prompts are routed or processed outside the US, and no customer data is stored at the provider.
Certifications & compliance
SOC attestation
Data deletion request procedure
Individual/end-user requests: A user emails support@bonus.ly to request access, correction, or deletion of their personal information. Bonusly notes it can't delete all of a person's data without deleting the entire user account (since account data is core to providing the service). Copies that live in cached/archived pages or that other users have already seen (e.g., recognition posts) get "reasonable steps" toward deletion but immediate removal in every case isn't guaranteed.
Company/customer account closure: Per the Data Retention Policy — when a customer voluntarily closes their account, data enters an "expired" state and is retained for at least 1 year, then may be removed. Customers are told to export their data before closing. Involuntarily suspended accounts get a 60-day grace period before the same expired/1-year/removal cycle kicks in — except where data must be kept longer for legal reasons.
Contractual (GDPR/DPA) data subject requests: Under the Bonusly Customer DPA, Bonusly acts as the data processor and the customer is the controller of their employees' data, so formal "Data Subject Requests" (access, rectification, erasure, portability) are contractually routed through the customer first — Bonusly assists the customer in responding rather than acting directly on an individual's request, consistent with the standard controller/processor structure.
HIPAA compliant
no
While this app may offer HIPAA compliance, Slack does not have a business associate agreement with any third-party application providers, including those in the Slack Marketplace, so you are responsible for validating the provider's compliance and executing an appropriate agreement before enabling.
Security
Date of latest pen test
2026-03-11
Executive summary is available to potential customers upon request
yes
Supports Single Sign On (SSO) with the following providers
Okta, Google, Microsoft
Supports Security Assertion Markup Language (SAML)
yes
Has a dedicated security team
yes
Contact for security issues
security@bonus.ly
Has a vulnerability disclosure program
no
Has a bug bounty program
no
Requires third party authorization/connections
no
Uses token rotation
no