Security at GetRating
GetRating is built and operated by Getia AS in Oslo, Norway. This page describes the security measures in place today, including what we do not have yet.
Hosting and infrastructure
- Application and PostgreSQL database hosted with Railway in the European Union.
- Traffic is served over HTTPS through Cloudflare, which also provides DNS and DDoS protection.
Accounts and access
- Sign in with Google, an email magic link or a password. Passwords are stored as bcrypt hashes, never in plain text.
- Optional two-factor authentication with an authenticator app and backup codes.
- Rate limiting on magic-link sign-in and signup endpoints.
- Team members get their own logins with roles; you can remove access at any time.
Encryption
- All traffic is encrypted in transit with TLS.
- Access tokens for connected Google, Trustpilot and Facebook accounts, and other stored integration secrets, are encrypted with AES-256-GCM before they are written to the database.
- API keys are shown once when created and can be revoked at any time.
- Outgoing webhooks can be signed with HMAC-SHA256 so you can verify they came from GetRating.
Your data and GDPR
- Account owners can export their data and delete their account from the dashboard settings.
- A data processing agreement and the list of subprocessors with their locations are public.
- Data is kept while your account is active and as needed to provide the service. See the privacy policy for details.
- Feedback text may be sent to Anthropic (United States) for AI-powered review analysis, as listed on the subprocessors page.
What we do not have yet
- No SOC 2, ISO 27001 or similar certification.
- No SAML single sign-on or SCIM provisioning.
- No option to choose a data region; data is hosted in the EU.
Reporting a vulnerability
Email security@getia.no. Our security.txt lists the same contact. Please give us reasonable time to fix an issue before disclosing it.
Frequently asked questions
Where is GetRating's data stored?
The application and database are hosted with Railway in the European Union. Some subprocessors, such as Stripe, Twilio, Cloudflare and Anthropic, are in the United States; the full list with locations is on the subprocessors page.
Is GetRating SOC 2 or ISO 27001 certified?
No. GetRating does not currently hold SOC 2, ISO 27001 or other security certifications.
Does GetRating support single sign-on?
You can sign in with Google, with a password or with an email magic link, and add two-factor authentication. SAML single sign-on is not available.
Can I delete my data?
Yes. Account owners can export their data and delete their account from the dashboard settings. Deleting the account removes it from the database; some records may be kept where the law requires it, as described in the privacy policy.