Security
Security at ReviewJet
ReviewJet handles your customer contacts and review data. This page describes exactly how that data is encrypted, where it lives, who can access it, and which guarantees Enterprise plans add. If your procurement team needs more, email [email protected].
Encryption
Encrypted in transit and at rest
In transit with TLS 1.2+
All traffic between your browser, our widget script, our API and our servers is encrypted with TLS 1.2 or higher. Plain HTTP is refused and HSTS is enforced on all ReviewJet domains. Internal service-to-service traffic inside our VPC is encrypted as well.
At rest with AES-256
Databases, file storage and backups are encrypted at rest with AES-256 using provider-managed keys. Backups are taken daily, stored encrypted in a separate availability zone, and tested for restorability every quarter.
Compliance
GDPR, DPA and data residency
GDPR and DPA
For the customer data you bring into ReviewJet, we act as a processor and you remain the controller. A Data Processing Agreement incorporating the EU Standard Contractual Clauses is available on request from [email protected]. Data subject requests, including export and deletion, are completed within 30 days.
EU or US data residency
Choose where your workspace data is stored when you create it: the United States or the European Union. Review content, contact lists, backups and logs stay in the selected region. Residency can be changed later through a supported migration.
Subprocessors
Who touches your data, and why
Every category of provider that processes customer workspace data. We notify DPA holders 30 days before adding a subprocessor.
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Hosting provider | Hosting, databases, backups | All workspace data, encrypted | United States or European Union, per workspace |
| Email delivery provider | Transactional email delivery (review requests, confirmation codes) | Recipient email addresses, message content | United States |
| Network and security provider | CDN for the widget script, DNS, DDoS protection | Visitor IP addresses in transit; no stored personal data | Global edge network |
| Payment processor | Card payments and subscription billing | Billing name, email address and payment details; we never see or store full card numbers | United States and European Union |
Availability
The widget is served from a global edge network and degrades gracefully: if our API is ever unreachable, your page renders normally without the widget, never with a broken block. We do not publish an uptime percentage and we do not sign an availability SLA, because we do not yet measure our own availability over a period long enough to stand behind a number.
Responsible disclosure
Found a vulnerability? Email [email protected] with reproduction steps. We acknowledge reports within 2 business days, keep you informed through the fix, and credit researchers who wish to be named. Please do not test against other customers' data.
Need a security questionnaire completed, a penetration test summary, or a custom review? Enterprise plans include a full security review with our team.
See Enterprise pricing