--- title: "Trust & Security | Signed Reviews" description: "How Signed Reviews keeps reviews authentic: cryptographic signing, minimal Stripe permissions, prevention by design, data ownership." url: https://signedreviews.com/trust/ --- Trust # Trust & Security How we ensure every review is authentic, every transaction is verified, and your data stays yours. ## How we keep reviews authentic Signed Reviews is built on a simple premise: **a review should only exist if a real purchase backs it**. Every design decision flows from this principle. ### Cryptographic signing Every review collected through Signed Reviews is cryptographically signed at the moment of submission. The signature binds together the rating, the review text, the Stripe charge ID and a timestamp, creating a tamper-evident record. Anyone can check a review on its public verification page to confirm it has not been altered. ### Minimal Stripe permissions Our Stripe integration requests the least privilege needed to verify reviews. We **cannot** charge, refund, transfer funds, or change your customers, subscriptions, or prices. The only object we can ever create is a discount coupon for a reviewer, and only when you enable review incentives. We read your Stripe data only to: - Verify that a reviewer completed a purchase from your business - Match the reviewer to the correct transaction - Detect full refunds and disputes (checked every 6 hours) and automatically hide those reviews - Compute aggregate public-page metrics (when enabled) ### Purchase-gated by design Most review platforms fight fake reviews with detection algorithms, a reactive approach. Signed Reviews keeps non-customers out structurally: every review requires a verified purchase. A review link is issued either automatically when a new customer's charge comes in from Stripe or on request from the business's public page, and in both cases the email must match a real completed purchase. Links are single-use and expire after a set period. No matching purchase = no link = no review. ### Data ownership You own your review data. Signed Reviews is the processor; your business is the controller. Reviews collected through our platform belong to you: we do not sell, share, or use your review data for any purpose other than providing the service. See our [Privacy Policy](https://signedreviews.com/privacy/) and [Data Processing Agreement](https://signedreviews.com/dpa/) for the full legal framework. ### Infrastructure security Signed Reviews is hosted on Railway (AWS us-east-1) with PostgreSQL on Supabase. All data is encrypted in transit (TLS 1.3) and at rest (AES-256). API keys and Stripe access tokens are encrypted at the application layer using AES-256-GCM before storage. Our full list of sub-processors is published on our [Sub-processors page](https://signedreviews.com/subprocessors/). ### Compliance Signed Reviews is operated by Paid Rightly LLC, a New Mexico limited liability company. Our Data Processing Agreement incorporates Standard Contractual Clauses (SCCs) for GDPR compliance. We maintain a [DMCA policy](https://signedreviews.com/dmca/) for copyright matters and publish our [Terms of Service](https://signedreviews.com/terms/) transparently. ### Report a concern If you believe a review violates our Terms of Service (for example, contains illegal content, harassment, defamation, impersonation, or spam), you can report it through the abuse-report link on any review page. Every report is reviewed by our trust & safety team within 7 business days, per our Terms of Service.