Hotels trust us with their public voice and their Google account. Here is how we protect both.
Passwords are hashed with bcrypt. Optional two-factor authentication (TOTP) for every client account and mandatory-by-default for our staff extranet. Login attempts are rate-limited and logged.
We use the official Google Business Profile API with OAuth — we never ask for your Google password. Tokens are encrypted at rest (AES-256-GCM) and you can revoke access any time from Connections or from your Google account.
All traffic is TLS 1.2+ with HSTS. Sessions use HttpOnly, Secure, SameSite cookies. Administrative sessions are fully isolated from client sessions and expire after 30 minutes of inactivity.
Review text is sent to our AI provider (Anthropic) solely to generate your reply. It is not used to train models. No guest booking data is required — only what is already public on the review platform.
Each account's data is scoped by account and property at the query level. Encrypted backups run daily with 30-day retention; restore drills are performed quarterly.
Transactional mail is sent with SPF, DKIM and DMARC. Marketing e-mails always carry a one-click unsubscribe (RFC 8058).
You can export everything (JSON) and delete your account yourself from My account. Deletion is immediate and irreversible; backups age out within 30 days. For EU/UK customers we act as processor under our Data Processing Addendum.
Found a vulnerability? E-mail hello@replyinn.com with “Security” in the subject. We acknowledge within 48 hours, fix critical issues as a priority and are happy to credit you.
Live platform status: /status.