In short: Every connection is encrypted. We never see your card or your Google password. Each team member gets only the access their role needs. Found a problem? Email
support@mehrly.com.
1. Encryption and infrastructure
- All traffic to Mehrly uses HTTPS (TLS). Browsers are told to always use HTTPS (HSTS), and cookies are only sent over secure connections.
- The application runs on Render, and data is stored in a managed PostgreSQL database on Neon. Both encrypt data at rest.
- API keys and other secrets are kept in protected environment settings, never in our source code.
2. Accounts and sign-in
- Sign in with Google: Google handles your login, and we never see your Google password.
- Email sign-up: passwords are stored only as strong one-way hashes, never as readable text.
- You can see your active sessions in Account Settings.
- Forms are protected against cross-site request forgery (CSRF), and pages cannot be embedded in other sites (clickjacking protection).
3. Team access
- Four roles (Owner, Admin, Reviewer and Viewer) limit who can change settings, approve replies or only read. Checks run on the server, not just in the interface.
- Team invitations use single-use, unguessable links sent only to the invited email address.
- Only the account owner can change the plan or billing.
4. Payments
Checkout is handled by Polar, our Merchant of Record, and its payment processors. Mehrly never receives or stores your full card number. Billing updates reach us through signed webhooks, which are verified before we trust them.
5. AI safety
- Review text is treated as untrusted input. Instructions hidden inside a review cannot change how Mehrly behaves.
- Drafts are checked before they can be pre-approved, and you can require manual approval for every reply.
- What Mehrly learns from your edits stays inside your account and is never shared with other customers.
6. Abuse protection
- Rate limits on sign-in, access codes, public pages, webhooks and AI features block brute-force attempts and runaway costs.
- Incoming webhook data is strictly validated and size-limited.
- Exported CSV files are protected against spreadsheet formula injection.
- Public QR pages reveal no account information.
7. Your data, your control
You can export your reviews and reports at any time, and ask us to delete your account. If you connected Google, you can revoke Mehrly's access from your Google account at any time. See the Privacy Policy for details.
8. Reporting a vulnerability
If you believe you have found a security issue, please email support@mehrly.com with the subject "Security report" and the steps to reproduce it. Please give us reasonable time to fix it before sharing it publicly, and do not access other customers' data or disrupt the Service while testing. We will acknowledge your report within 3 business days, and we are grateful for responsible reports.
9. If something goes wrong
If a security incident affects your personal data, we will tell you without undue delay, explain what happened and what we are doing about it, and notify authorities where the law requires.