ReplokitRead-only by design. Your code stays yours.
Replokit needs to read a handful of configuration files to map your stack — nothing more. Here's exactly what we access, what we keep, and how it's protected.
Access to your code
- Repository access uses a GitHub App with read-only Contents and Metadata permissions. Replokit never writes to repositories, opens pull requests, or changes settings.
- Each scan uses short-lived GitHub installation tokens, minted as needed and never stored.
- When the app is installed, GitHub confirms that the person installing it can access that installation, so nobody can attach another organisation's repositories.
- You choose which repositories to include, and uninstalling the GitHub App revokes access immediately.
What we store — and what we don't
- Replokit reads dependency manifests, environment-example files, infrastructure-as-code, and CI configuration to detect services. Source code is not stored.
- We keep derived findings only: service names, dependency names and versions, licence identifiers, file-path evidence, and aggregate commit counts (never contributor identities).
- Environment files are parsed for key names, not values. If a real credential is committed to a repository, it is flagged as a risk and stored masked to its last 4 characters.
Encryption & isolation
- All traffic uses TLS, with HTTP Strict Transport Security enforced on our domains.
- Data is encrypted at rest by our database provider, and any access tokens or provider credentials are additionally encrypted at the application layer with AES-256-GCM. The key is held outside the database.
- Every workspace's data is scoped to that workspace on every request, with row-level security enabled on all tables.
- Incoming webhooks from GitHub and Razorpay are verified with HMAC signatures and rejected if the signature doesn't match.
AI and analytics
- Code analysis is deterministic. Your source code is never sent to an AI model and is never used to train one.
- Optional AI summaries and the inventory assistant receive derived findings only — service names, repository names, and counts.
- Product analytics run only after you accept analytics cookies, never record your screen, and identify signed-in users by an opaque ID rather than email.
Payments, sharing & deletion
- Payments are processed by Razorpay. Card and bank details are entered with Razorpay directly; we never see or store them.
- Shared reports use long random links that expire on a date you choose, can be revoked at any time, and are excluded from search engines.
- You can permanently delete your account and workspace data yourself from Settings; active subscriptions are cancelled first.
Replokit is operated by Prahalada Sumiran Techlabs. Read our privacy policy, or email support@replokit.com for a security review.
Questions
Who are your sub-processors?
Supabase (database and authentication), Vercel (hosting), Sentry (error monitoring), Resend (email), Razorpay (payments), PostHog (product analytics, opt-in), Anthropic (optional AI summaries of derived findings), and GitHub (read-only repository access). The full list is in our privacy policy.
Do you have SOC 2?
Not yet. We're happy to complete your security questionnaire and walk your team through how Replokit handles data — email us.
How do I report a vulnerability?
Email support@replokit.com with the subject "Security report" and as much detail as you can. Please give us a reasonable chance to fix the issue before disclosing it publicly.