Review Engine

1. Proactive Review Collection

2. Centralized Review Management

3. AI-Powered Response Generation

End-to-End Flow

How the platform works for a business owner:

1. Step 1 — Connect Google Business ProfileOne-click OAuth connection syncs the business profile, existing reviews, rating, and star distribution in real time.
2. Step 2 — Import customer contactsUpload a CSV or add contacts manually. Each contact is tracked through a pipeline: pending → uploaded → synced to GHL CRM.
3. Step 3 — Configure messaging templatesCustomizable SMS and email templates with personalization variables. Logo, background image, and signature support for fully branded outreach.
4. Step 4 — Set scheduling rulesSend immediately or after a delay. Configure follow-up frequency, business hours restrictions, timezone support, and day exclusions.
5. Step 5 — Automated outreach runsThe platform sends personalized review requests and follow-ups automatically based on the configured rules — no manual action required.
6. Step 6 — Reviews are captured and analyzedIncoming reviews are pulled from Google, analyzed for sentiment (positive, negative, neutral), and surfaced in the dashboard with tags.
7. Step 7 — AI generates responsesThe AI engine drafts a contextually appropriate reply for each review. Content moderation catches profanity and escalation keywords before any response goes live.
8. Step 8 — Responses are publishedResponses post automatically or wait for human approval, depending on the configured mode. The cycle compounds more contacts, more reviews, stronger reputation.

GoHighLevel (GHL) Integration

Review Engine serves businesses across any industry where customer reviews directly impact revenue and brand trust.

Multi-tenant SaaS with full workspace isolation per business; designed to scale from a single-location owner to a marketing agency managing dozens of clients.

High-level architecture

Review Engine
├── review-engine-backend    (REST API Server — Node.js + Express)
│   ├── config/              AWS Secrets, Google OAuth, Database connection
│   ├── models/              MongoDB schemas (User, Business, Contact, etc.)
│   ├── services/            Core business logic (messaging, AI, GHL sync)
│   ├── controllers/         HTTP request / response handlers
│   ├── routes/              API endpoint definitions
│   ├── middleware/           Auth guards, error handling, rate limiting
│   └── utils/               Logger, helpers, seed scripts
│
└── review-engine-frontend   (React SPA — Vite + React 18)
    ├── components/           Reusable UI (atoms → organisms)
    ├── pages/                Full page views (dashboard, settings, admin)
    ├── hooks/                Custom React hooks for API calls
    ├── context/              Global state (auth, workspace, business)
    └── lib/                  API client, validators, utilities

• All API queries are scoped to the user's workspace cross-tenant data leakage is structurally impossible
• JWT tokens stored in HTTP-only Secure cookies inaccessible to JavaScript, preventing XSS-based theft
• Google Business Profile reviews fetched and cached per workspace on demand
• AI response generation runs server-side no LLM calls from the browser
• GHL contact sync runs asynchronously status tracked per contact record in MongoDB
• Messaging and scheduling logic runs on the backend the frontend only configures rules

The platform stores data across 8 core data models, all scoped by workspace for full tenant isolation.

• All sensitive credentials stored in AWS Secrets Manager — never hardcoded
• Passwords hashed using bcrypt with a cost factor of 12
• JWT tokens in HTTP-only, Secure cookies — inaccessible to JavaScript (XSS protection)
• Access tokens: 24-hour expiry; refresh tokens: 30-day expiry
• Every API query scoped to the user's workspace — no cross-tenant data leakage possible
• Password reset links expire after 10 minutes and are single-use only
• Cloudflare Turnstile CAPTCHA prevents automated bot signups
• API responses never expose raw error stack traces or internal data
• Content moderation: profanity filters and escalation keyword detection before AI responses post
• express-rate-limit protects all public endpoints from API abuse
• Google OAuth tokens stored securely server-side never exposed to the browser
• Admin console: user impersonation with full audit visibility

• 8 core data models covering the full reputation management lifecycle
• 3 AI response styles (Professional, Friendly, Casual) with per-sentiment tone control
• Dual-channel outreach: SMS and email with fully customizable templates
• Full multi-tenant workspace isolation each business operates independently
• GoHighLevel CRM sync with real-time contact status tracking
• Admin console with user impersonation for platform support
• Docker-ready deployment on any cloud infrastructure