Security & privacy
Your customer conversations. Written down like an obligation.
This page is what we would want to read if we were the ones handing over an inbox. Claims we can defend, and the gaps stated in the same type size.
Security questions, DPAs and questionnaires go straight to a founder.
- Hosting region
- Singapore
- Jakarta on Scale
- Encryption
- TLS 1.3 / AES-256
- in transit and at rest
- Model training
- Never shared
- your data, your model
- Certification
- Not yet
- SOC 2 Type I scheduled
01 Section
Data protection
-
Encrypted in transit and at rest
TLS 1.3 on every connection. AES-256 for stored data, media and backups, with keys managed by our cloud provider's KMS and rotated on a schedule.
-
Regional hosting
Singapore by default; Jakarta available on Scale. Backups stay in the same region as primary data — they never cross a border you did not agree to.
-
Isolation per workspace
Every query is scoped to a workspace at the data layer, not just in application code. Cross-workspace reads are structurally impossible.
-
Deletion that finishes
Deleting a contact or workspace clears messages, media, notes and scores within 30 days, backups included, with written confirmation on request.
02 Section
Access control
-
Roles you define
Owner, manager, agent and read-only out of the box; custom roles on Growth and above, scoped per pipeline.
-
Two-factor authentication
TOTP for every account, enforceable workspace-wide. SSO via SAML or OIDC, with SCIM provisioning, on Scale.
-
Audit log
Sign-ins, permission changes, exports, workflow edits and AI kill-switch events, each with actor, timestamp and IP.
-
Our own access is narrow
A small on-call group, two-factor required, every access logged. We look at your data when you ask us to, and we tell you when we did.
03 Section
AI handling
-
No shared-model training
Your conversations are never used to train models that serve anyone else. Your lead-scoring model is yours and runs only in your workspace.
-
Grounded answers only
The AI agent answers from documents you uploaded and cites them. Out-of-scope questions escalate to a human instead of being guessed at.
-
Retention you control
Set how long transcripts and call recordings are kept — from 7 days to your full plan retention — per workspace.
-
Kill switch
Disable the AI agent globally or per pipeline, instantly. No deploy, no support ticket, no waiting period.
04 Section
Operations
-
Backups and recovery
Continuous backup with point-in-time recovery to any moment in the last 14 days. Restores are rehearsed, not theoretical.
-
Dependency and secret hygiene
Automated dependency scanning on every build. Secrets live in a managed secret store, never in source control or images.
-
Uptime
Published status page. A 99.9% SLA with service credits comes with Scale; the same infrastructure serves every plan.
-
Independent testing
Annual third-party penetration test. Summary letter available under NDA on request.
05 Full disclosure
What we do not claim yet
We are a pre-seed company and will not pretend otherwise. Replai is not SOC 2 or ISO 27001 certified today — an SOC 2 Type I readiness assessment is scheduled, and we will publish the report when we have it rather than before. If your procurement process requires a certificate we do not hold, tell us early and we will tell you honestly whether we can meet the deadline.
Security questions, DPAs and questionnaires go straight to a founder.
privacy@usereplai.site06 For procurement
What we can send you, and how fast.
No sales gate on any of it. Ask and it arrives — some items need an NDA, which we will say up front.
-
Data processing agreement
Our standard DPA with sub-processor list, transfer terms and deletion timelines. Signed within two business days.
-
Penetration test summary
The letter from our most recent independent test, with severity counts and remediation status.
-
Security questionnaire
Send yours in whatever format your team uses. A founder fills it in — no outsourced compliance desk.
-
Export & exit plan
Full CSV and JSON export of contacts, conversations, media and scores, plus written confirmation once we have deleted our copy.
Next step
Bring your security review to the first call.
We would rather answer the hard questions before you sign than after. Send the questionnaire ahead of time and we will work through it live.
Replai is invite-only and quoted per team, so there is no signup form and no public price list. Both start with the same call.
- sales@usereplai.site
- Mon–Fri, 09:00–18:00 WIB