Security

Access Management

Admins manage active users by emailing changes to support@replicate.info

A simple admin portal to manage Billing + SCIM (via Auth0 SSO) will be an optional enhancement in 2026. GRC and security teams will have unlimited time to approve/deny the process change. It's opt-in.

Architecture

All infra is provisioned/managed by Heroku (in US-based AWS regions), and uses their HA failover. Data is encrypted at rest using AES-256, and TLS 1.2+ in transit. The tool is ephemeral, and wipes data older than 3 months. It's a cron job + webhook. DR just means your emails arrive a few minutes late.

Audit Logs

Administrative actions (e.g., user provisioning) are logged immutably and retained for 12 months in secure, append-only S3 buckets. Available upon request.

Automated Dependency Scanning

The codebase is continuously scanned using GitHub Dependabot to patch vulnerable libraries. Critical vulnernabilities are patched within 7 days of public disclosure.

Cookie Policy

This site does not use cookies. No logins, no Google Analytics, no policy for tech that isn't used. When SCIM is released, admins who opt-in will receive a single Ruby on Rails session ID cookie.

Database Backups

Heroku Postgres maintains rolling database backups, and prunes old snapshots automatically over time. Backups can be restored in minutes, and are captured at least once every 24 hours.

Incident Response

PagerDuty maintains a 24/7 oncall schedule. In the event of a confirmed incident, impacted customers will be notified without undue delay, and receive an RCA (from security@replicate.info) in 72 hours.

Data Lifecycle

Email Retention

Inactive conversations are automatically deleted after 3 months. That data is used to recreate email history when engineers reply a few weeks later. No AI training. Email support@replicate.info to request immediate deletion. It won't get stuck in a Postgres backup forever.

End-of-Service Planning

If the product is ever sunset, you will receive advance notice, full source code, all your data, and next steps. Current contracts will be fulfilled (including multi-year terms), and support will remain available.

Inactivity Handling

Engineers get automatically unsubscribed after 3 weeks without replies. The final email includes a link to resume coaching. The product simply fades away until they want it back.

Subprocessors

All vendors are GDPR compliant, offer Standard Contractual Clauses (SCCs), and underwent security review prior to onboarding. This is the complete list. No additional tools (e.g., Google Analytics) are used beyond those listed here.

Amazon S3

Stores immutable, append-only audits for admin actions (e.g., billing approvals) with AES-256 at rest.

Bouncer

Used to validate email addresses to improve deliverability and avoid bounces from invalid addresses. No message content is sent, just the email address itself (and only when needed).

Datadog

Used for infrastructure telemetry and monitoring (e.g., CPU, memory, service health).

Heroku

Used for application infra and encrypted storage. All workloads run in isolated containers with TLS 1.2+ enforced, and AES-256 encryption at rest. Includes managed Heroku Postgres + Redis instances.

OpenAI

OpenAI's API powers the real-time content generation for coaching emails. None of your data is persisted by OpenAI. None of it is used to train their models. The prompting is ephemeral.

PagerDuty

Used for incident alerting and on-call scheduling. May store system-level alerts with metadata (e.g., timestamps, service names). No customer-submitted content.

Papertrail

Used for infrastructure log aggregation and retention. Some logs may include metadata related to coaching email delivery (e.g. timestamps, team IDs).

Postmark

Used for transactional email delivery. No open/click tracking. No marketing newsletters.

Sentry

Used for internal error tracking and debugging. Some error logs may include technical metadata (e.g., error messages, timestamps, team IDs).

Stripe

Used for processing invoices. No auto-renewal. You manually approve every payment.