Replit
replit.com
Automated, point-in-time. Not independently reviewed or approved by TRUSTYCYBER unless expressly stated.
- User content is used for model improvement by default outside Enterprise; opt-out documented only for Pro
- No formal subprocessor register disclosed
- No clear commitment that your data will not train their models
+1 more
See Before you sign, with what to ask for ↓
Scanned Oct 25, 2026 · Public evidence · Point-in-time
Higher scores indicate stronger, independently supported AI assurance, governance, AI systems, models, data, supply chain and third-party assurance evidence. The score and the decision are related but different: a well-scored vendor can still carry conditions.
Before you sign
Why it matters: Replit's Model improvement page states that prompts, instructions, context and generated responses are used to develop and improve its models and AI features. An opt-out is described for Pro users only and applies to new content going forward. No opt-out is described for Free or Core plans.
What to ask for: Confirm whether Free and Core plan content is used for model improvement and whether an opt-out exists for those plans; confirm what 'develop and improve our models' covers (fine-tuning, evaluation, human review) and whether third-party model providers also receive content for their own training.
“We use content you provide, including your prompts, instructions, context, and responses generated for you, to help develop and improve our models and AI features. This allows us to make our services more powerful.”
“If you opt out of model improvement, new content associated with your account will not be used to develop or improve our models. Opting out of model improvement does not delete your content, remove it from your projects, or affect your ability to use the services.”
“This control is available to Pro users. For Enterprise users, Replit does not use customer content to train its models.”
Why it matters: The vendor names AI-related providers or partially addresses its supply chain, but the public sources scanned do not include a formal, dated subprocessor register.
What to ask for: Request a dated subprocessor register with change-notification terms for the DPA/order form.
Why it matters: The public sources scanned do not clearly state that customer prompts, files, and outputs are excluded from training or fine-tuning of first- or third-party models.
What to ask for: Get a no-training clause covering first- and third-party models into the DPA/order form.
“We use content you provide, including your prompts, instructions, context, and responses generated for you, to help develop and improve our models and AI features. This allows us to make our services more powerful.”
“If you opt out of model improvement, new content associated with your account will not be used to develop or improve our models. Opting out of model improvement does not delete your content, remove it from your projects, or affect your ability to use the services.”
“This control is available to Pro users. For Enterprise users, Replit does not use customer content to train its models.”
Why it matters: The public sources scanned do not give a retention period for customer data or prompts/outputs.
What to ask for: Get retention windows, in days, in writing.
“Retrieve retained customer prompt content to enrich Replit Enterprise audit logs for security and compliance workflows.”
Buyer questionsanswered only from the public evidence scanned, click a row for the answer
!Will they train on your data?Ask the vendor
By default Replit uses the content users provide, including prompts, instructions, context and generated responses, to develop and improve its models and AI features.
Requires written confirmation, see Before you sign ↓
“We use content you provide, including your prompts, instructions, context, and responses generated for you, to help develop and improve our models and AI features. This allows us to make our services more powerful.”
“If you opt out of model improvement, new content associated with your account will not be used to develop or improve our models. Opting out of model improvement does not delete your content, remove it from your projects, or affect your ability to use the services.”
“This control is available to Pro users. For Enterprise users, Replit does not use customer content to train its models.”
!How long do they keep your data?Ask the vendor
Replit retains customer prompt content for Enterprise customers and exposes it through a Compliance API for audit-log enrichment; no retention period is stated in the collected documents.
Requires written confirmation, see Before you sign ↓
“Retrieve retained customer prompt content to enrich Replit Enterprise audit logs for security and compliance workflows.”
!Who else can access your data?Ask the vendor
Enterprise account admins can enable or restrict models from OpenAI, Anthropic, Google, DeepSeek, Kimi and Z.ai; at least one model from each of OpenAI, Anthropic and Google must remain enabled, and the catalog can change.
Requires written confirmation, see Before you sign ↓
“Open a provider to configure its policy. The settings shown include OpenAI , Anthropic , Google , DeepSeek , Kimi , and Z.ai . The available model catalog can change; use the models listed in your settings as the source of truth.”
“Builders on Core and Pro can now choose Claude Haiku 5.5 from the model selector in Power Mode.”
“Once published, Replit applications run on Google Cloud Platform infrastructure. We take a deliberately contrarian approach to tenant isolation compared to other providers: every single customer gets their own GCP Project , even free-tier users.”
“We conduct thorough due diligence on all subprocessors to ensure they meet our strict security standards and compliance requirements.”
!Where is your data processed?Ask the vendor
Replit hosts data primarily in Google Cloud Platform data centres in the United States, with an optional opt-in hosting region in India.
Confirm in writing: Ask the vendor to state this in writing before signing.
“Replit hosts data primarily in Google Cloud Platform (GCP) data centers in the United States, with an optional hosting region in India for users who opt in.”
“This setting governs deployment geography. It is not a promise that every service used by an app, such as an external database or API, stores or processes data in the same geography.”
!What happens in a security incident?Ask the vendor
Replit states every security incident is handled with urgency and feeds root-cause hardening, but the collected documents contain no customer-notification commitment or timeline.
Requires written confirmation, see Before you sign ↓
“At Replit, every single security incident is handled with urgency because users’ data is at stake. Trust is something that has to be earned over time, and can be easily lost by not going above and beyond.”
Email to send the vendor7 items to confirm in writing
Hello Replit team, We are assessing Replit as part of our supplier review. Before we proceed, please confirm the following in writing: 1. What is your commitment to notify customers of a security incident affecting our data, including the timeframe? 2. Please provide your current, dated subprocessor list and explain how you notify customers of changes. 3. Do you use our data (inputs, outputs or uploaded files) to train or improve your models? Please confirm in writing, including any opt-out and whether it applies to every plan. 4. How long do you retain our data, in days, for each type (inputs, outputs, logs and backups), and how is it deleted? 5. In which countries and regions is our data processed and stored, and can processing be limited to a region we choose? 6. Describe how Agent model changes are evaluated before release, including any benchmark, red-team or regression suite for generated code security. 7. Microsoft appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data. A written reply to each point, or a link to where it is documented, is enough. Where a point is covered by a certification or independent report, please include the certificate number or the report and its date. Thank you,
Key findingsclick a row for the evidence
✓Enterprise plan excludes customer content from training and gives admins model-provider controlsStrong
Replit states that Enterprise customer content is not used to train its models, and Enterprise admins can restrict which third-party model providers (OpenAI, Anthropic, Google, DeepSeek, Kimi, Z.ai) and models builders may use, alongside deployment-geography and private-deployment policies.
These are the controls a procurement team needs to confine data flows and model choice to an approved set; they are contractual and configurable rather than best-effort.
“This control is available to Pro users. For Enterprise users, Replit does not use customer content to train its models.”
“Open a provider to configure its policy. The settings shown include OpenAI , Anthropic , Google , DeepSeek , Kimi , and Z.ai . The available model catalog can change; use the models listed in your settings as the source of truth.”
“If your company has an approved set of AI models, configure which providers and models your builders can use in Replit. These controls help align model access with your organization’s requirements and spending priorities.”
“This setting governs deployment geography. It is not a promise that every service used by an app, such as an external database or API, stores or processes data in the same geography.”
✗User content is used for model improvement by default outside Enterprise; opt-out documented only for ProGap
Replit's Model improvement page states that prompts, instructions, context and generated responses are used to develop and improve its models and AI features. An opt-out is described for Pro users only and applies to new content going forward. No opt-out is described for Free or Core plans.
Any organisation using Replit on a non-Enterprise plan should assume source code, prompts and connected-data context may be used for model development unless an opt-out is exercised and is available for its plan.
Question for vendor: Confirm whether Free and Core plan content is used for model improvement and whether an opt-out exists for those plans; confirm what 'develop and improve our models' covers (fine-tuning, evaluation, human review) and whether third-party model providers also receive content for their own training.
“We use content you provide, including your prompts, instructions, context, and responses generated for you, to help develop and improve our models and AI features. This allows us to make our services more powerful.”
“If you opt out of model improvement, new content associated with your account will not be used to develop or improve our models. Opting out of model improvement does not delete your content, remove it from your projects, or affect your ability to use the services.”
“This control is available to Pro users. For Enterprise users, Replit does not use customer content to train its models.”
!Multiple third-party model providers are in the request path; their data terms are not describedGap
Agent routes paid work to models from at least six providers, selected automatically in Auto mode. The collected documents name the providers but do not describe what data is sent to them, whether zero-data-retention terms apply, or where those providers process it.
The buyer's data flows to whichever provider Auto selects; without provider-level terms the organisation cannot assess retention, location or training use by those providers.
Question for vendor: Provide the data-processing terms (retention, training exclusion, processing region) in place with each model provider, and confirm whether provider selection can be fixed to a single approved provider.
“Open a provider to configure its policy. The settings shown include OpenAI , Anthropic , Google , DeepSeek , Kimi , and Z.ai . The available model catalog can change; use the models listed in your settings as the source of truth.”
“Builders on Core and Pro can now choose Claude Haiku 5.5 from the model selector in Power Mode.”
“Free Mode is no-cost everyday Agent work within your plan’s allowance. In Power or Max, Auto selects a model for each paid task. Power is a paid, mid-tier mode with powerful models at an affordable price. Max is the paid, top-tier mode for the most demanding work. Paid actions require confirmation before they start.”
!No subprocessor list, retention period, privacy policy or SOC 2 scope in the collected public documentationGap
Replit asserts subprocessor due diligence and a SOC 2 Type 2 attestation, and refers to a Trust Center, Terms of Service, Commercial Agreement and Privacy Policy, but none of these artefacts were in the collected set. Retained prompt content is referenced for Enterprise without a retention period.
Subprocessor identity, retention windows and audit scope are the core inputs to a vendor risk assessment; they must be obtained from the Trust Center or contract rather than the public documentation.
Question for vendor: Provide the current subprocessor list, the retention period for prompts, chat history and project content on each plan, and the SOC 2 Type 2 report with its period and system scope.
“We conduct thorough due diligence on all subprocessors to ensure they meet our strict security standards and compliance requirements.”
“Retrieve retained customer prompt content to enrich Replit Enterprise audit logs for security and compliance workflows.”
“Additionally, Replit has achieved SOC 2 Type 2 Attestation of Compliance , demonstrating our ongoing commitment to security best practices and controls.”
“Our security and data handling practices are governed by these key documents:”
“Replit hosts data primarily in Google Cloud Platform (GCP) data centers in the United States, with an optional hosting region in India for users who opt in.”
✓Documented security testing programme, but no published safety evaluation of Agent outputsStrong
Replit documents third-party penetration testing, a HackerOne bug bounty, a Trail of Bits assessment, an internal AI-driven code-scanning harness, prompt-injection scanning of MCP traffic, and pre-publish SAST/SCA plus LLM scanning of built applications. The collected documents do not describe evaluation of the Agent's own model outputs (for example, red-teaming of generated code quality or harmful-output testing).
The security engineering evidence is unusually detailed for a vendor of this type and supports platform-level trust; the remaining question is how the AI component itself is evaluated before and after model changes.
Question for vendor: Describe how Agent model changes are evaluated before release, including any benchmark, red-team or regression suite for generated code security.
“We have partnered with several companies over the years that provide penetration testing for both the Replit platform as well as the serving infrastructure that we use. HackerOne has managed our bug bounty program in addition to helping us do spot checks of new services just prior to releasing them. We also recently engaged with Trail of Bits to do a much more in-depth assessment of several Replit services.”
“We have also recently investing in AI red-teaming for our internal testing. Even though Replit doesn’t have access to Project Glasswing , we have seen great success with building an internal security-focused harness that continuously scans our source code, prioritizes potential findings, and validates them before involving engineers to address them.”
“Before any application is published to production, Replit runs a full suite of security and privacy scans. We've deliberately built a scanning pipeline that goes beyond AI-powered analysis alone, since purely LLM-based safety programs have been shown to be insufficient for adequately protecting AI-built applications.”
“All traffic flows through a transparent proxy that adds OAuth headers without exposing them to the application context. In addition to protecting secrets, we scan MCP tool definitions and tool responses to detect and prevent several families of prompt injection attacks.”
?Technical dependency observed: MicrosoftObservation
Technical evidence (DNS, certificate, or HTTP) shows a dependency on Microsoft as a service provider. This dependency is not identified in the vendor's published materials.
An undisclosed provider dependency is exactly the gap independent verification exists to surface.
Question for vendor: Verification required — Microsoft appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data.
“Open a provider to configure its policy. The settings shown include OpenAI , Anthropic , Google , DeepSeek , Kimi , and Z.ai . The available model catalog can change; use the models listed in your settings as the source of truth.”
“Builders on Core and Pro can now choose Claude Haiku 5.5 from the model selector in Power Mode.”
“Once published, Replit applications run on Google Cloud Platform infrastructure. We take a deliberately contrarian approach to tenant isolation compared to other providers: every single customer gets their own GCP Project , even free-tier users.”
“We conduct thorough due diligence on all subprocessors to ensure they meet our strict security standards and compliance requirements.”
Assurance dimensionsweighted components of one score, not eight separate ratings
Organisation & AI governance15% of the score40
Who owns AI risk: policies, responsible-AI principles, human oversight and administrative controls.
Assessed against ISO 42001 · NIST AI RMF · AIUC-1
“Security is a fundamental priority at the executive level, with direct oversight and engagement from company leadership.”
“If your company has an approved set of AI models, configure which providers and models your builders can use in Replit. These controls help align model access with your organization’s requirements and spending priorities.”
AI system15% of the score53
What AI the vendor actually runs and where it sits in the product, the map everything else is judged against.
Assessed against ISO 42001 · NIST AI RMF
“Agent is your creative partner. Agent takes your ideas, helps you refine them, and then makes them real. Unlike a chatbot that only answers questions, Agent takes action: it sets up your project, creates applications, checks its work, and fixes problems along the way.”
“Free Mode is no-cost everyday Agent work within your plan’s allowance. In Power or Max, Auto selects a model for each paid task. Power is a paid, mid-tier mode with powerful models at an affordable price. Max is the paid, top-tier mode for the most demanding work. Paid actions require confirmation before they start.”
“All traffic flows through a transparent proxy that adds OAuth headers without exposing them to the application context. In addition to protecting secrets, we scan MCP tool definitions and tool responses to detect and prevent several families of prompt injection attacks.”
“Every user's development environment runs in its own isolated sandbox: anything that happens inside it only affects that sandbox, and it is protected from outside influence.”
How AI features are evaluated before and after release, evals, red-teaming, monitoring.
Assessed against NIST GenAI · NIST AI RMF · ISO 42001
“We have partnered with several companies over the years that provide penetration testing for both the Replit platform as well as the serving infrastructure that we use. HackerOne has managed our bug bounty program in addition to helping us do spot checks of new services just prior to releasing them. We also recently engaged with Trail of Bits to do a much more in-depth assessment of several Replit services.”
“We have also recently investing in AI red-teaming for our internal testing. Even though Replit doesn’t have access to Project Glasswing , we have seen great success with building an internal security-focused harness that continuously scans our source code, prioritizes potential findings, and validates them before involving engineers to address them.”
“Before any application is published to production, Replit runs a full suite of security and privacy scans. We've deliberately built a scanning pipeline that goes beyond AI-powered analysis alone, since purely LLM-based safety programs have been shown to be insufficient for adequately protecting AI-built applications.”
How changes to models and AI features are controlled and communicated: versioning, notice, rollback.
Assessed against ISO 27001 · ISO 42001
“Meet your autonomous on-call engineer. Agent can investigate production issues using your app’s logs and metrics, then attempt and validate fixes.”
“Full BYOC (private preview): Run the full Replit platform in your cloud tenant.”
“Builders on Core and Pro can now choose Claude Haiku 5.5 from the model selector in Power Mode.”
AI system description: vendor-evidenced, not yet independently corroborated.
Change management: vendor-evidenced, not yet independently corroborated.
Model10% of the score60
Which model providers and versions process customer data, and how changes to them are disclosed.
Assessed against NIST GenAI · ISO 42001
“Open a provider to configure its policy. The settings shown include OpenAI , Anthropic , Google , DeepSeek , Kimi , and Z.ai . The available model catalog can change; use the models listed in your settings as the source of truth.”
“Builders on Core and Pro can now choose Claude Haiku 5.5 from the model selector in Power Mode.”
Model provider transparency: vendor-evidenced, not yet independently corroborated.
Customer data15% of the score40
Whether customer data trains models, how long it is retained, where it is processed, and how it is protected.
Assessed against ISO 27018 · OAIC APPs · EU AI Act
“We use content you provide, including your prompts, instructions, context, and responses generated for you, to help develop and improve our models and AI features. This allows us to make our services more powerful.”
“If you opt out of model improvement, new content associated with your account will not be used to develop or improve our models. Opting out of model improvement does not delete your content, remove it from your projects, or affect your ability to use the services.”
“This control is available to Pro users. For Enterprise users, Replit does not use customer content to train its models.”
“Replit hosts data primarily in Google Cloud Platform (GCP) data centers in the United States, with an optional hosting region in India for users who opt in.”
“This setting governs deployment geography. It is not a promise that every service used by an app, such as an external database or API, stores or processes data in the same geography.”
“By default, applications on Replit cannot access data in other applications. Cross-application data access requires explicitly opting in through Connectors or Data Connectors .”
“Retrieve retained customer prompt content to enrich Replit Enterprise audit logs for security and compliance workflows.”
AI supply chain10% of the score40
The named chain of AI and infrastructure providers behind the product, and how it is disclosed.
Assessed against ISO 27001 · ISO 27017
“Once published, Replit applications run on Google Cloud Platform infrastructure. We take a deliberately contrarian approach to tenant isolation compared to other providers: every single customer gets their own GCP Project , even free-tier users.”
“We conduct thorough due diligence on all subprocessors to ensure they meet our strict security standards and compliance requirements.”
“Open a provider to configure its policy. The settings shown include OpenAI , Anthropic , Google , DeepSeek , Kimi , and Z.ai . The available model catalog can change; use the models listed in your settings as the source of truth.”
Security foundation15% of the score65
How security problems are found, reported and handled: disclosure channels, bug bounty, incident response.
Assessed against ISO 27001 · NIST AI RMF
“Email [email protected] with a description of the issue and we’ll respond as soon as possible.”
“At Replit, every single security incident is handled with urgency because users’ data is at stake. Trust is something that has to be earned over time, and can be easily lost by not going above and beyond.”
“We have partnered with several companies over the years that provide penetration testing for both the Replit platform as well as the serving infrastructure that we use. HackerOne has managed our bug bounty program in addition to helping us do spot checks of new services just prior to releasing them. We also recently engaged with Trail of Bits to do a much more in-depth assessment of several Replit services.”
Vulnerability & incident handling: vendor-evidenced, not yet independently corroborated.
Independent assurance evidence10% of the score35
Whether claimed certifications and attestations are independently corroborated, checked against official registries and issuing bodies. Which certifications, and what each one does and does not establish, is stated per certificate.
Assessed against ISO 17021-1 · ISO 42006 · ISO 27006-1 · ISO 27008
“Additionally, Replit has achieved SOC 2 Type 2 Attestation of Compliance , demonstrating our ongoing commitment to security best practices and controls.”
None of the corroborated certifications is AI-specific (ISO/IEC 42001 or AIUC-class) — this assurance is security and data-transfer attestation, not AI-management-system assurance.
Legal & contractual10% of the score40
The contractual backbone a buyer can rely on, terms, DPAs, privacy commitments and regulatory posture.
Assessed against EU AI Act · OAIC APPs
“Replit may still process content as needed to provide, maintain, secure, and troubleshoot the service, enforce its terms, and comply with law. For more information, see the Replit Pro Agreement .”
“Our security and data handling practices are governed by these key documents:”
Not graded: Agent, not applicable to this scan.
What would strengthen assuranceeach figure is from today's score, resolving one changes the others
Resolving an evidence gap strengthens the dimension it belongs to, and with it the score: 47 → up to 69 with every identified gap resolved.
AI supply chainclick a node to focus it · drag to pan · zoom with the controls
View as list
What you inheritTrustyCyber's AI Shared Responsibility Matrix v1.0
This scan names the vendor’s AI supply chain without assessing the responsibility split, that depends on how you consume the product. Under the common managed models, a deployer inherits 16 of the matrix’s 41 responsibilities from providers, each with named evidence owed.
Map your inherited responsibilitiesAssurance evidence: certifications 2, registry checks and verification ladders, click to view
Stated on Replit's Information Security documentation page as an 'Attestation of Compliance'. No audit period, auditor or system scope is given in the collected documents; the page refers to a Trust Center that was not collected. The ISO 27001 and SOC 2 Type 2 certifications mentioned on the same page belong to Google Cloud Platform, not Replit.
Not yet checked against a registry. Treat it as the vendor’s own claim and ask the vendor for the current certificate.
Not claimed in any public source scanned. This is the AI-management-system certification — in its absence, the vendor’s AI governance rests on its general security and privacy certifications.
Sources 27, click to view
Appendix: standards landscape 8, click to view
Where each standard behind this assessment stands today, from TrustyCyber’s continuously maintained standards radar.
Want to go further?
This scan assesses Replit at an organisational level. Assurance can vary significantly between products, models and agents, enter the product you’re evaluating to run a deeper AI System Assurance Scan.
Scan a specific product →This automated result is based on publicly available information at the time of scanning. It is not an audit, certification, legal opinion or assurance engagement. Publicly unavailable evidence may materially change the conclusion.
Monitor for changes
Get an email if its TRUSTYCYBER Score, grade or certifications change. One credit per refresh; reading the report always stays free.