Security

Repliva's architecture is built around one idea: your conversations stay yours. This page describes the concrete measures behind that.

• AI auto-replies run through Repliva's own managed AI providers, configured and rotated by Repliva admins only — there is no per-user API key to create, store, or leak. Repliva never retrains on your conversations and never inspects them beyond delivering the reply.
• Provider credentials are stored encrypted server-side and are never exposed to any user's browser. Each AI-generated reply is billed as one credit from your balance.

• Passwords are hashed with bcrypt — never stored or logged in plain text.
• Email verification is required at signup; password resets use time-limited codes.
• All traffic is encrypted in transit with TLS (HSTS enforced).

All payments run through Stripe Checkout. Card numbers never touch Repliva's servers — Stripe handles PCI-DSS compliance, 3-D Secure, and Apple/Google Pay. We store only your resulting credit balance.

Channels are connected with the platforms' own linking mechanisms (for example, WhatsApp links by QR code the same way WhatsApp Web does; Slack and Telegram use their official bot/app APIs). You can disconnect any channel instantly from the dashboard, which stops all message flow for that channel.

Found a security issue? Please email support@orbittechlab.com with the details. We take reports seriously, will acknowledge within 48 hours, and will credit researchers who report responsibly.