Security

Repliva's architecture is built around one idea: your conversations and your AI relationship stay yours. This page describes the concrete measures behind that.

• When you add your own AI provider key, AI requests are made directly against your provider account. Repliva never routes your conversations through a shared AI account, never retrains on them, and never inspects them beyond delivering the reply.
• Keys are stored server-side, are never exposed to the browser of any other user, and can be rotated or deleted in Settings at any time. You can test a key before saving it so there are no surprise bills.

• Passwords are hashed with bcrypt — never stored or logged in plain text.
• Email verification is required at signup; password resets use time-limited codes.
• All traffic is encrypted in transit with TLS (HSTS enforced).

All payments run through Stripe Checkout. Card numbers never touch Repliva's servers — Stripe handles PCI-DSS compliance, 3-D Secure, and Apple/Google Pay. We store only your resulting credit balance.

Channels are connected with the platforms' own linking mechanisms (for example, WhatsApp links by QR code the same way WhatsApp Web does; Slack and Telegram use their official bot/app APIs). You can disconnect any channel instantly from the dashboard, which stops all message flow for that channel.

Found a security issue? Please email support@orbittechlab.com with the details. We take reports seriously, will acknowledge within 48 hours, and will credit researchers who report responsibly.