Security
What we store, where it lives, who can reach it, and how you get it back or get rid of it.
What is stored
Contact records a practice uploads or connects (name and email address), the send and delivery state of each request, reviews and replies retrieved from Google Business Profile, drafted reply text and its clearance record, and the practice’s own account and billing details.
We do not store payment card numbers. Card handling is performed by our payment processor and card data never reaches StarRep infrastructure.
Where it lives
United States regions only, on managed infrastructure. Data is encrypted in transit with TLS 1.2 or better and at rest with AES-256. Backups are encrypted with the same keys and held in the same regions.
Who can see it
Practice users see only their own practice. Multi-location accounts see the locations assigned to them. StarRep staff access to customer data is role-restricted, requires a business reason, is logged, and is reviewed quarterly.
Authentication
Email and password with a minimum length requirement and a breached-password check, or Google sign-in. Two-factor authentication by authenticator app is available on every plan and can be required account-wide by an owner. Sessions expire after 30 days of inactivity.
Retention
Contact records and send history are retained for the life of the account plus 90 days. Clearance records are retained for seven years, because they are the evidence a practice may need to produce to a regulator. Deleted contacts are purged from primary storage within 30 days and from backups within 90.
Export and deletion
An owner can export contacts, send history, reviews, replies and clearance records as CSV at any time from the account settings, without contacting us. Account deletion is self-serve, takes effect immediately, and completes purge within the windows above. A deletion request by email to privacy@starrep.io is honoured within 30 days.
Incidents
We notify affected practices without undue delay and within 72 hours of confirming an incident that affects their data, by email to account owners, with what we know and what we are doing about it. We do not hold notification for the completion of an investigation.