Built for trust at every layer.
Reviews are reputation infrastructure. We protect the data behind them with hardened defaults, isolated environments and controls you can audit.
Everything you need, animated into one workflow.
Encryption everywhere
TLS 1.3 in transit, AES-256 at rest, per-tenant key isolation on enterprise plans.
SOC 2 aligned
Access reviews, change management, vendor risk and incident response mapped to SOC 2 TSC.
SSO & SCIM
SAML 2.0 and SCIM 2.0 for Okta, Entra ID, JumpCloud and Google Workspace.
Tamper-evident audit log
Every moderation, reply, invite and admin action signed and queryable.
Network isolation
Tenant-scoped storage, private VPC peering and IP allow-listing on request.
Resilient infra
Multi-AZ Postgres, point-in-time recovery and tested failover runbooks.
Verification ladder you can prove.
Every review carries a signed verification tier. Buyers see the difference between an open submission and a client-confirmed engagement — and you can audit every step.
Six layers from request to storage.
Edge
WAF, rate limits, bot heuristics and TLS 1.3 termination.
Identity
SSO, SCIM, hardware-key MFA and role-scoped sessions.
Service
Signed RPC, per-tenant secrets, ephemeral credentials.
Data
AES-256, KMS-rotated keys, PITR and immutable audit log.
How ScoreReview compares on security posture.
Independent reviews demand independent infrastructure.
| Capability | ScoreReview | Trustpilot | Google Reviews |
|---|---|---|---|
| SOC 2 Type II report | |||
| Per-tenant key isolation | |||
| SCIM 2.0 provisioning | |||
| Tamper-evident audit log | |||
| EU + UK data residency | |||
| Signed webhooks |
Security isn't an upsell.
- Role-based access control with custom roles
- Scoped API keys per environment
- Webhook signature verification
- Backups with point-in-time recovery
- Rate limiting and abuse detection
- Quarterly penetration testing summary
The questions our security team gets most.
Primary regions are London (eu-west-2) and Dublin (eu-west-1). US tenants can opt into us-east-1. We do not replicate review data outside the chosen region.
Run reviews on infrastructure you can audit.
Request our trust report, SOC 2 letter and architecture overview.