How we protect your feedback data
Feedback often holds what your customers would only tell you. Here is how Reflet keeps it safe.
Infrastructure
- Convex Cloud
- Your data lives on Convex’s SOC 2 Type II compliant infrastructure, with automatic backups and zero-downtime deployments.
- Vercel Edge Network
- The web app runs on Vercel’s edge network with automatic TLS and DDoS protection.
- Encryption
- Data is encrypted in transit (TLS 1.3) and at rest. API keys are hashed before storage. Session tokens live in HTTP-only secure cookies.
Authentication and access
- Role-based access control
- Three roles: Owner, Admin, and Member. Decide who can change settings, moderate feedback, and invite teammates.
- Secure authentication
- Built on Better-Auth, with bcrypt password hashing, CSRF protection, and automatic session rotation.
- OAuth providers
- Sign in with GitHub or Google. No password is stored when you use social login.
Data and privacy
- GDPR
- We process data in line with GDPR. Anyone can request an export or deletion of their data at any time.Read the privacy policy
- Open source
- The whole codebase is public. Audit it, run your own security analysis, or self-host for full control.View the code on GitHub
- Data portability
- Export your feedback, votes, and changelog entries as CSV or JSON. Your data stays yours.
API security
- API key authentication
- Public keys for reads, secret keys for writes. Every key is scoped to one organization.
- Rate limiting
- Every API endpoint is rate limited to protect against abuse and keep usage fair.
- Input validation
- Inputs are validated with Zod schemas. XSS protection, no SQL injection surface (Convex uses a document model), and Content Security Policy headers.
Questions?
- Talk to the team
- Found a vulnerability or need details for a security review? Write to us and a person will answer.security@reflet.app