Security Best Practices
Peakon provides different security options to make sure that the access to your account is safe and protected. We recommend the following best practices to reduce the risk of a security breach.
Consider Single Sign-On (SSO)
If you're an administrator, consider configuring SSO for your organization and mandating it as the only sign in option. This enables users to authenticate against an external directory first, and gain access to Peakon through the directory's listed apps. See Set Up Single Sign-On for instructions.
Keep Survey Links Private
Each survey email contains a personal survey link that connects to the employee's survey token and employee record. Anyone who has the link can open that employee's survey, so keep the link private.
To keep your personal survey link private:
- Don't forward your survey email or share your survey link with colleagues. They could complete the survey on your behalf.
- Don't post your survey link anywhere public. Example: Chat channels, shared documents, or websites.
- Don't submit your survey link to online tools that check, scan, or archive web pages. Some of these tools make the links they process publicly searchable.
If you're an administrator, you can also:
- Check how your organization's email security or link-checking software handles links in incoming emails. Some tools open every link in an email and can share those links with external services.
- Share the SSO survey link with employees, if your organization uses SSO. The SSO survey link is the same for all employees. Peakon validates each employee's identity through your organization's identity provider (IdP) before opening their survey, so the link alone doesn't give access to anyone's survey. See Single Sign-On Survey Link.
Enforce Secure Passwords
Peakon uses the
zxcvbn
library to ensure your password complexity meets the security standards. It uses a set of algorithms to estimate the number of guesses required to successfully find a password. Peakon's password validation ensures that passwords aren't guessable in less than 10,000,000,000 attempts. When entering a new password in Peakon, a message will inform you of your password strength.
Your password must not contain:
- Your user ID, first name, last name or email address in the password.
- The words "peakon" or "workday".
- Characters in sequence, either in the alphabet or on the keyboard, e.g. "abcde", "12345" or "qwerty".
- Very common password phrases, e.g. "P@ssword1".
Set Up Two-Factor Authentication (2FA)
Setting up 2FA helps secure your account against attacks, because you'll require both your password and an authentication code sent to your phone through Authy.
See Set Up Two-Factor Authentication (2FA) for instructions.
Monitor Active Sessions & Activity History
The standard session timeout is 4 weeks on all devices. Customers can open a case with Workday to change to a different session timeout for their organization.
Your active sessions and activity history are available in the
Security
tab in your profile area.You can click
Log out of session
to end an active session.The account activity history section displays different account events. Example: survey or schedule updates, integration changes, and dashboard access. Each event displays the time, browser/OS, location and IP address.
If your organization uses a VPN for web browsing or link-checking software for emails, this page can display additional account activity.
Monitor Dashboard Sharing Settings
If you've shared your dashboard with your team, you can revoke access at any time and regenerate the link by going into the
Sharing options
.Administrators can access all shared dashboards (and revoke them if needed) by going to .