Updated Oct 2026
Security at Prisma
Prisma asks for the minimum access needed to read and reply to your reviews, encrypts every token it stores, and lets you revoke access in one click. Prisma is operated by Sopa Lab SL, a company based in Madrid, Spain, in the European Union, and processes data under the GDPR.
Last updated: 26 October 2026
How we store your OAuth tokens
When you connect a location, the platform gives Prisma a token that lets us act on your behalf. That token is the most sensitive thing we hold, so:
- Encrypted at rest with AES-256-GCM and keys stored separately from the database .
- Encrypted in transit: all traffic to the Prisma API and to each platform uses TLS 1.2 or higher.
- Isolated per customer: every token is tied to one account. One customer’s API key can never reach another customer’s locations.
- Never exposed: tokens are not returned by any endpoint, not shown in the dashboard and not written to logs.
- Your Prisma account: passwords are stored only as a hash by our authentication system, email addresses are verified before the account gets its keys, and the dashboard session lives in a first-party HttpOnly cookie that lasts up to 7 days. API keys are stored hashed: the dashboard shows a key once when it is created or rolled, then only its prefix.
- Refreshed server-side: Google issues long-lived refresh tokens for offline access and recommends storing them securely. We store them encrypted and use them only to fetch short-lived access tokens.
Minimal scopes
We request only what reading and replying to reviews requires.
| Platform | What we request | Why |
|---|---|---|
| Google Business Profile | https://www.googleapis.com/auth/business.manage | The scope Google requires for the Business Profile APIs. Needed to list reviews and post replies. |
| Trustpilot | OAuth authorization by a user of your Trustpilot business account | Read service reviews and reply |
| App Store | App Store Connect API key with the Customer Support role | Read customer reviews and manage responses |
| Google Play | Prisma’s service account, invited in Play Console with two permissions: reply to reviews and view app information (API scope androidpublisher) | Read reviews and reply |
For the App Store, Apple recommends treating API private keys like passwords. If your setup allows it, use an individual key or the narrowest role available, and revoke it in App Store Connect if you ever suspect it’s compromised.
Revoke access in one click
- From Prisma: delete the connection with
DELETE /v1/connections/{id}(Connections). We revoke the token with the platform and delete it from our vault immediately. - From the platform: you can also remove Prisma from your Google Account’s third-party access page or revoke the key in App Store Connect. Prisma stops working for that location on its next call.
- Delete your account: email privacy@prismareviews.com from the address on your account. All tokens are deleted at once; review data and your account are deleted within 30 days.
What data we process
| Data | Why we keep it | Retention |
|---|---|---|
| OAuth tokens and API credentials | To call each platform for you | Until you disconnect |
| Reviews: rating, text, author display name, date, reply | To serve the API and keep history some platforms don’t | While the location is connected; deleted within 30 days after you disconnect it |
| Your account: name, email, password hash, sign-in provider ID, sessions | To run your account and keep you signed in | While your account is open; deleted within 30 days of closing it. Sessions last up to 7 days |
| Billing details | To invoice you | As required by Spanish tax law |
| API logs (no tokens, no review text) | Debugging and abuse prevention | 7 to 90 days, depending on your plan |
Prisma only works with businesses and apps you own or manage. We don’t scrape, and we don’t read reviews of businesses that haven’t connected to Prisma. More in Google reviews API vs scraper.
GDPR and your data
- Who we are: Sopa Lab SL, B23884570, registered in Spain, with registered office at Calle Reina Mercedes 1, 7º D, 28020 Madrid, Spain.
- Our role: for review data you pull through Prisma, you are the data controller and Sopa Lab SL is the data processor. For your account data, we are the controller.
- Data Processing Agreement: our Data Processing Agreement applies when you accept the Terms on creating your account. For a countersigned copy, email legal@prismareviews.com.
- Hosting region: European Union .
- Your rights: access, rectification, deletion and portability requests go to privacy@prismareviews.com. We answer within the deadlines set by the GDPR.
Full details in our Privacy Policy and Terms of Service.
Subprocessors
| Subprocessor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Cloud hosting provider | Website and API hosting | European Union | Within the EEA |
| Neon, Inc. (through Vercel’s Neon integration) | Postgres database: customer accounts, API data and their backups | European Union region | Data stored in the EEA; EU-US Data Privacy Framework or SCCs for any access from the US |
| Resend, Inc. | Transactional email (account verification, password reset, notifications) | United States | EU-US Data Privacy Framework or SCCs |
| PostHog Inc. (EU cloud) | Session recordings and heatmaps of prismareviews.com, only for visitors who accept analytics cookies; form fields masked | European Union (Frankfurt) | Not applicable (data stays in the EU) |
| ImprovMX | Forwarding of emails sent to our addresses (hello@, legal@, privacy@, security@) to our team mailbox | United States | Standard Contractual Clauses |
| Stripe Payments Europe, Ltd. | Payments and billing | Ireland, with processing in the US | Within the EEA; EU-US Data Privacy Framework |
| Holded Technologies S.L. | Invoicing | Spain | Within the EEA |
| DataForSEO, Apify | Public reviews of the Yelp, Tripadvisor and Booking.com listings you connect | European Union | Within the EEA |
We notify customers by email at least 30 days before adding or replacing a subprocessor.
Certifications
Prisma doesn’t hold SOC 2 or ISO 27001 certification yet. Our Data Processing Agreement lists the technical and organizational measures we apply, and we answer security questionnaires on request at security@prismareviews.com.
Report a vulnerability
Found a security issue? Email security@prismareviews.com with the details and steps to reproduce. We’ll acknowledge within 2 business days and keep you updated until it’s fixed. Please don’t access other customers’ data or run denial-of-service tests.
FAQ
Can Prisma employees see my tokens?
No. Tokens are encrypted and are never shown in any interface or log. Access to production systems is restricted to a small number of authorized engineers, with multi-factor authentication and logged access.
Can Prisma post replies without my action?
No. Prisma only publishes a reply when your application calls POST /v1/reviews/{id}/reply with your API key.
What happens to my data if I cancel?
Tokens are revoked and deleted immediately. Review data is deleted within 30 days unless you export it first.
Does Prisma work for US companies?
Yes. Prisma is built for companies in the United States as well as Europe. We act as your service provider under the CCPA and similar state laws, never sell or share personal data, and our DPA includes the terms those laws require.
Is Prisma GDPR compliant?
Prisma is run by Sopa Lab SL, an EU company that processes data under the GDPR and offers a Data Processing Agreement to every customer.
Questions before you connect?
Read our Data Processing Agreement or write to security@prismareviews.com.
Minimal scopes · Revoke anytime · EU company