Security

Authentication

ReviewPanel uses Firebase Authentication. You can sign in with:

• Google OAuth (recommended)
• Email and password

Session tokens auto-refresh. All API requests are validated server-side against Firebase Auth.

Encryption

• In transit: All connections use TLS (HTTPS). No unencrypted traffic.
• At rest: OAuth tokens and webhook signing secrets are encrypted with AES-256 before storage.

Data storage

Review data is stored securely in Firestore with access controlled by workspace membership. Your data is:

• Never shared with third parties
• Never sold
• Never used for training models or analytics outside your account

Access control

Access is controlled at two levels:

• Role-based: Owner, Admin, and Read-only roles with distinct permissions.
• Workspace isolation: Data in one workspace is invisible to members of another workspace.

See Team Roles & Workspaces for details.

Webhook security

• HMAC-SHA256 signatures on every webhook delivery.
• Secret rotation with a 24-hour grace period for both old and new secrets.
• Signing secrets encrypted at rest (AES-256).

See Webhooks for implementation details.

Account deletion

You can request full account deletion at any time. All data associated with your account — reviews, analytics, OAuth tokens, workspaces, and settings — is permanently removed. This action is irreversible.

OAuth credential options

You have two options for the Google Business Profile OAuth connection:

• Default credentials: Quick setup. ReviewPanel's pre-configured OAuth client handles the connection.
• Custom credentials: Bring your own Google Cloud OAuth client ID and secret. Full control over your API project and quotas.

Configure in Dashboard → Settings.