Where is my data stored and how is it protected?
Last updated
Plans: Free: included · Pro: included · Scale: included
Replavia’s data is stored with named providers that operate mainly in the United States. Data is encrypted in transit, Instagram login tokens are encrypted, and passwords are stored only as hashes.
The short answer
Your data is stored with a small number of named providers. Our Privacy Policy lists each one. Data is encrypted while it travels, and the most sensitive items are encrypted where they are stored.
Where your data is stored
Neon
- What it hosts
- The database with your account, automations and leads
Vercel
- What it hosts
- The website and your dashboard
Railway
- What it hosts
- The engine that receives comments and sends your DMs
| Provider | What it hosts |
|---|---|
| Neon | The database with your account, automations and leads |
| Vercel | The website and your dashboard |
| Railway | The engine that receives comments and sends your DMs |
The policy says these providers “operate principally in the United States”. Some may also use other regions. If you use Replavia from outside the United States, your data is processed in the United States.
How it is protected
The policy names four safeguards: “encryption in transit, hashed credentials, access controls and regular review”. Here is what that means in practice.
- Encrypted in transit. Data moving between your browser and Replavia is encrypted.
- Passwords are hashed. We store a one-way hash of your password, never the password itself.
- Login tokens are encrypted. Your Instagram and HubSpot tokens are encrypted with AES-256-GCM before they are stored.
- Sensitive comment text is encrypted. This covers comments waiting for an AI reply and comments that Comment Shield flags.
- API keys are never stored. Replavia keeps only a fingerprint of each key. That is why a key is shown to you once.
Who can reach it
- Each Replavia account sees only its own data.
- Staff access is limited to need-to-know. Viewing a lead’s contact details needs a special permission, a written reason and an audit log entry. See Who can see my leads?
Payments
Card details go straight to Stripe. The policy says they “are never stored on our systems”. See Is it safe to pay for Replavia?
Error reports and analytics
- Sentry receives error reports. It is set up not to attach personal data by default, and we strip credentials first. It does not receive your leads or message content.
- PostHog records which dashboard pages you open. Session recording and automatic click capture are switched off in our own code. So the text on your screen is never sent.
What no one can promise
Our policy is honest about this: “no method of transmission or storage is 100% secure”. We take the steps above to lower the risk. If you ever notice something wrong, tell us straight away.
Related questions
- Does Replavia sell my data?
- What can Replavia see on my Instagram account?
- Does Replavia read or store my DMs?
- Can I download or delete all my data?
- What happens to my data when I leave?
- Which other companies handle my data?
- Who is behind Replavia?
- Is Replavia approved by Meta?
- How Replavia follows Meta platform rules
- Is my data used to train AI?
Good to know
- Use a strong password that you do not use anywhere else. Our Terms make you responsible for keeping it safe.
- If you think someone else used your account, email info@replavia.com at once.