Security

You are handing us your customers’ email addresses and, if you choose to connect Google or Facebook, permission to post in your name. This page says exactly how that is protected, and where the gaps are.

Nothing has to be granted before you start

Most review tools need management access to your Google Business Profile before they can do anything. That is the same permission that can change your opening hours, your photographs and your description, and it is asked for on day one.

RespondWay starts from notification emails you forward from your own inbox, so you can use it without granting anything. Publishing is then a paste: the draft is ready, you put it live yourself.

Connecting Google to publish in one click is not available yet. Our own API approval with Google is still pending, and until it lands there is no connect option to click. When it does, the scope is business.manage, used only to read reviews on the locations you pick and post the replies you approve. The token is encrypted with AES-256-GCM, and disconnecting deletes it immediately. It will be optional, per business, and a decision you make after the product has proved itself.

What forwarding actually exposes, stated plainly

Forwarding is not automatically the safer option, and we are not going to pretend otherwise. A mail forwarding rule is only as narrow as you make it. Our setup guide has you create a filter so that only mail from the review platforms is copied to us, and that is the version you should use.

If you instead forward your whole inbox, we receive your whole inbox, and there is nothing at our end that can prevent that or filter it for you. We delete anything we cannot recognise as a review, but it reaches our server first. A scoped OAuth token is, on this one measure, tighter than an unfiltered forwarding rule: it is limited to one permission and you can revoke it from your Google account in a single click.

Use the filter. If you think you may have set up a blanket forward, change it to a filtered rule and email security@respondway.com and we will delete everything we hold for that address.

Your data is separated at the database, not in our code

Every table uses PostgreSQL row level security. Access is decided by the database on each query, so one account cannot read another’s reviews, customers or settings even if our application code contained a bug. This is enforced for reviews, replies, locations, customer invitations, usage and billing records alike.

Connected accounts

When you connect Google or Facebook, the access token is encrypted with AES-256-GCM before it is written down. The key lives in the deployment environment, not in the database, so a copy of the database on its own does not let anybody post as you. Disconnecting a platform deletes the stored token immediately.

Mail we receive on your behalf

Forwarded review notifications reach us through a signed webhook: each message carries an HMAC-SHA256 signature checked with a constant-time comparison before we read a single byte of it. An unsigned or wrongly signed request is refused. Without this, anyone who guessed the address could inject fake reviews into your dashboard.

In transit and in the browser

• HTTPS everywhere, with HSTS preloading, so the site cannot be loaded unencrypted.
• A Content Security Policy that names every origin the page may talk to. Anything else is blocked by the browser.
• Framing is denied outright, which rules out clickjacking.
• Rate limits on every endpoint that costs money or sends mail.

Your reviews are not used to train anything

We use OpenAI’s API to draft replies, with Anthropic as a fallback during outages. Both providers state that data submitted through their APIs is not used to train their models. We do not train models of our own, and we do not sell or share your data with anyone else.

Leaving

Settings has a data export that gives you everything we hold as a JSON file, and an account deletion that removes your profile, businesses, reviews, replies and activity log. Deletion is real deletion, not a flag, and it cascades. Backups age out within 30 days.

What we have not done

RespondWay is a new product run by a small team, and it would be easy to put a row of compliance badges here. We have not done these things, so we will not claim them:

• No SOC 2 or ISO 27001 audit. Those cost more than the company currently earns.
• No HIPAA Business Associate Agreement. Do not put patient information into replies.
• No third-party penetration test yet.

If your procurement process requires any of the above, we are not the right supplier today. Tell us what you need at security@respondway.com and we will tell you honestly whether and when we can meet it.

Reporting something

If you find a vulnerability, email security@respondway.com. We will confirm within two working days. We will not take legal action against anyone who reports a flaw in good faith, gives us reasonable time to fix it, and does not access other people’s data.