Security

Credential encryption

Your store keys are encrypted before they are saved in ReviewTower.

How keys are protected

ReviewTower uses AES-256-GCM encryption for stored credentials. The encryption key is held separately from the database.

The server decrypts credentials when it needs to authenticate with a store, such as when syncing reviews or posting a reply. Saved private keys are not returned to the browser.

Use dedicated credentials

Create a key or service account specifically for ReviewTower.
Grant access only to the apps and store actions your team needs.
Replace or revoke the credentials in your store account when you no longer need them.

Update a connection

Owners and admins can replace saved keys in Settings → General. Verify the replacement to check that it can still access your apps.