Security

Built with practical security controls to protect customer feedback data and workspace access.

Last updated: June 6, 2026

Security is part of how we build whatsrating. This page summarizes the practical controls currently in place for workspace access, survey integrity, monitoring, and data protection.

Security at a glance

  • HTTPS everywhere
  • Workspace-level access controls
  • Audit logging
  • Unique survey tokens
  • Error monitoring
  • Responsible disclosure process

Access and workspace controls

  • Email verification is required before workspace access.
  • Sessions are HTTP-only cookies managed server-side.
  • Workspace roles separate admin, editor, and viewer permissions.
  • Team invites and join requests are reviewed through workspace access controls.
  • Administrative access is restricted to authorized personnel.

Data protection

  • Traffic is served over HTTPS.
  • Customer data is stored using managed cloud infrastructure with access controls and encrypted transport.
  • Passwords are not stored in plain text and are handled through industry-standard authentication workflows.
  • Secrets are stored in environment configuration and are not shown in customer-facing settings.
  • API keys are scoped to the workspace and shown only once when created.
  • Sensitive operational actions are recorded in audit logs where appropriate.

Survey integrity

  • Email survey links use unique tokens and reject duplicate submissions.
  • Submission origin checks help prevent invalid response posts.
  • Unsubscribe and suppression controls are built into the email workflow.

Monitoring, backups, and operations

  • Error monitoring helps us identify and investigate reliability issues.
  • Operational workflows support controlled deploys, data exports, deletion requests, suppressions, and billing events.
  • Backups and managed infrastructure help maintain service reliability.

Security incidents

If we become aware of a security issue affecting customer data, we will investigate, contain the issue, and notify affected customers when appropriate.

Responsible disclosure

If you believe you found a security issue, please do not test against customer data or attempt to access another workspace. Send a concise report, affected URL, and reproduction details to hello@whatsrating.com.

Security questions

Customers with security questions may contact hello@whatsrating.com.