Data Privacy & Security Policy
Last updated: December 28, 2025
Encryption at Rest
All sensitive data is encrypted using AES-256-GCM encryption before storage.
Encryption in Transit
All data transmissions use TLS 1.3 to prevent interception.
Secure Infrastructure
Hosted on enterprise-grade cloud infrastructure with SOC 2 compliance.
Access Controls
Role-based access control with principle of least privilege.
Threat Monitoring
24/7 security monitoring and automated threat detection.
Regular Audits
Quarterly security audits and annual penetration testing.
1. Our Commitment to Security
At AppReviewSuite, we understand that you are entrusting us with your app review data and sensitive integrations. Security is not an afterthought—it's foundational to how we build and operate our platform. This document outlines our comprehensive approach to protecting your data.
2. Data Classification
We classify data into the following categories:
🔴 Critical Data
- OAuth tokens and API credentials
- Payment information
- User passwords (hashed with Argon2)
🟡 Sensitive Data
- Personal identifiable information (email, name)
- App review content
- AI-generated responses
🟢 Standard Data
- Aggregated analytics
- Feature usage metrics
- Public app metadata
3. Encryption Standards
3.1 Data at Rest
- AES-256-GCM encryption for all sensitive data
- Unique encryption keys per workspace
- Keys stored in secure key management system (AWS KMS)
- Database-level encryption enabled
3.2 Data in Transit
- TLS 1.3 for all API communications
- HTTPS enforced across all endpoints
- Certificate pinning for mobile applications
- Perfect Forward Secrecy (PFS) enabled
4. Authentication & Access Control
- Passwords hashed using Argon2id algorithm
- Optional two-factor authentication (2FA)
- JWT tokens with short expiration (15 minutes access, 7 days refresh)
- Rate limiting on authentication endpoints
- Account lockout after failed login attempts
- Session management and forced logout capabilities
5. Infrastructure Security
- Cloud infrastructure with SOC 2 Type II certification
- Virtual private cloud (VPC) with network isolation
- Web Application Firewall (WAF) protection
- DDoS protection and mitigation
- Regular security patches and updates
- Immutable infrastructure deployment
6. Third-Party Security
We carefully vet all third-party services and require:
- SOC 2 or equivalent security certification
- Data Processing Agreements (DPAs)
- Regular security assessment reviews
- Minimal data sharing principles
Key Third-Party Partners:
- • OpenAI: AI processing (SOC 2 certified)
- • Google Cloud / AWS: Infrastructure (SOC 2, ISO 27001)
- • Razorpay: Payment processing (PCI DSS compliant)
- • Resend: Email delivery (SOC 2 certified)
7. Incident Response
Our incident response plan includes:
- 24/7 security monitoring and alerting
- Documented incident response procedures
- Breach notification within 72 hours as required by GDPR
- Post-incident analysis and remediation
- Regular tabletop exercises and drills
8. Employee Security
- Background checks for all employees
- Mandatory security awareness training
- Principle of least privilege for system access
- Secure development practices (OWASP guidelines)
- Code review requirements for all changes
9. Compliance
We are committed to meeting or exceeding the following standards:
10. Security Contact
To report security vulnerabilities or concerns, please contact our security team at: security@appreviewsuite.com
We operate a responsible disclosure program and appreciate security researchers who help us keep our platform secure.