Security

There is no customer login. Your teaser and full report are reached through a tokenised URL emailed to you. Treat that link like a document: anyone who has it can open the report.

Scan tables use deny-all row-level security. The public site does not use an anonymous database key. Our servers read and write with a service-role key that never ships to the browser.

Card details are collected on Stripe Checkout. ReplyScore stores the Stripe session reference and payment status, not the card number. The merchant account is held by Reply Intelligence Group Ltd.

We store a salted hash of the caller IP, not the raw address, to cap scans per hour and per day and to stop one visitor receiving another visitor's report token. External AI spend is capped per scan and per day.

We do not scrape consumer ChatGPT or Gemini sessions. Engine checks use official APIs (Anthropic, Perplexity, DataForSEO). The crawler identifies as ReplyScoreBot and obeys robots.txt. Details: bot identity and how we test.

Security issues: hello@replyintelligencegroup.co.uk. Data rights: privacy@replyscore.co.uk.