Reference
Security and data handling
How credentials are stored, how access is revoked, and what deactivating an organization does
Store credentials
- Encrypted at rest, and never displayed back to you once saved
- Redacted from error messages, so a failed connection cannot leak key material into a log
- Replaceable at any time — leave the fields blank when editing to keep the existing values
- Revocable from your own store console, which stops ReviewDesk syncing immediately
Passwords and sessions
Passwords are stored as bcrypt hashes and are never recoverable in plain text. New accounts verify their email with a one-time code before a password can be set, so an account cannot be created against an address you do not control.
Changing your password signs out every other device. An owner can also reset a team member’s password, which issues a new temporary one by email.
Access control
Team members see only the accounts and apps assigned to them, and the reply permission is separate from visibility. Enforcement is server-side — an unassigned app is not merely hidden in the interface. See Roles and permissions.
Programmatic access
MCP connections use OAuth: each host receives its own scoped token, listed on the MCP & CLI screen and revocable individually without changing your password. API tokens are scoped to read, write, or moderate. See MCP setup and API tokens.
Deactivating an organization
Settings → Account has a danger zone with Deactivate organization. It does all of the following at once:
- Signs out every member
- Stops syncing all connected apps
- Revokes every API token and MCP grant
- Retains your reviews and replies
What ReviewDesk does not do
- It does not change your app listing, pricing, or availability — it reads reviews and posts replies
- It does not post anything until you send it or an automation rule you created permits it
- It does not offer SSO or multi-factor authentication today — sign-in is email and password, with one-time code verification at signup