Security

Your assistant talks to your customers, so protecting their conversations and your account is part of the product, not an extra. Here's what's in place today, in plain words.

Your account

• Passwords are stored as secure one-way hashes (scrypt). Nobody, including us, can read them.
• Common passwords are refused, and you type a new password twice.
• Repeated wrong sign-in attempts are blocked for 15 minutes.
• Changing or resetting your password signs you out on every other device.
• Password reset links work once and expire after 24 hours.
• Optional two-factor sign-in with an authenticator app. Each code works once, and its secret is stored encrypted.
• New accounts confirm their email before their dashboard opens, or sign in with Google, which has already verified it.
• Your recent sign-ins, including failed ones, are listed in Settings, and we email you when a new device signs in.
• Teammates get their own logins with roles (admin, agent, viewer), checked on our server for every action. Each person only receives the data their role can see.

Your customers' conversations

• Every connection is encrypted (HTTPS), and browsers are told to always use it.
• Each business can only ever see its own conversations and leads.
• The assistant can only save a lead or note a question for your business. It can't read anything else or send messages on its own.
• The chat says clearly that it's an AI assistant.
• You can download your leads and conversations, delete single conversations, or delete your whole account.
• Our admin tools show only counts of your conversations and leads. We can open your dashboard to help only while you allow support access, and every visit is shown to you with its reason.
• Leads sent to your own tools by webhook are signed, so your app can check they came from Replyit.

The website itself

• Protected against common attacks such as SQL injection, cross-site scripting, clickjacking and request forgery.
• Rate limits on sign-in, sign-up, password resets and the chat, to stop abuse.
• We test these protections regularly against a copy of the site, and check our software dependencies for known vulnerabilities.

Where data lives

Replyit runs on Vercel and stores data in Supabase. Details are in our Privacy Policy and Data Processing Agreement.

Found a security issue?

Please tell us privately so we can fix it quickly: write to us through our contact page. We read every report and won't take action against good-faith research that avoids harming our clients or their customers.