Security & privacy

Tenant isolation, encrypted provider credentials, and the promises the product is built around.

Three promises

Nothing is posted without a person. ReviewHive has no auto-reply. Every reply that reaches a customer was read and sent by someone in your organization.

Your data never crosses into another workspace. Every request is checked against the organization it names, and every stored credential is bound to the one organization and connection that created it.

We ask for read access, not control. Connecting a source grants us permission to read your reviews, and, when you press Post reply, to publish the reply you wrote.

Tenant isolation

Organizations are separated at the storage layer, not by a filter in the interface. A review, a credential or a reply belongs to exactly one organization, and every read and write is authorized against your membership of that organization.

This matters most for agencies, whose one account routinely holds the data of businesses that compete with each other. It is why a reply can never be posted to the wrong client's listing, even in principle: the review itself decides where its reply goes, and the credentials it reaches for are the ones stored beneath it.

Provider credentials

The access tokens from Google and Facebook are the most sensitive thing we hold. They are:

encrypted with a managed key before they are stored;
bound to the organization and connection that created them, so a copied ciphertext simply fails to decrypt anywhere else;
never sent to your browser, since they are used only by our servers at the moment a sync or a reply needs them;
deleted when you disconnect the source.

Raw provider identifiers, such as a Google place ID or a Facebook page ID, are kept inside that encrypted payload rather than on records members can read.

Reviews are read-only from the browser

Nothing in the app writes reviews from your browser. Every change, whether a sync, a reply or a setting, goes through an authenticated, verified request to our servers, which check your role before doing anything. The database itself refuses writes from client applications, so a bug in the interface cannot become a data problem.

AI and your data

Your reviews are sent to our AI provider only to analyze them and to draft replies you request.
Analysis is stored on the review it came from, in your organization, and an Owner or Admin can erase it entirely.
Every AI claim about a review carries the quote it came from, verified against that review's own text before it is stored, so the analyst cannot attribute words to a customer who did not write them.
Tripadvisor reviews are analyzed in the language the customer wrote in. We never analyze a machine translation.

Sessions are held in a secure, httpOnly cookie your browser will not expose to scripts, and expire after two weeks. Mutating requests carry a token that prevents another site from acting on your behalf.