Security
Last updated
In short
Reply2C isolates every workspace with Postgres row-level security, encrypts channel credentials with AES-256-GCM, verifies Meta webhook signatures on every request, and hosts its API in Frankfurt. It holds no audited certification today — no SOC 2, no ISO 27001, no HIPAA attestation — and this page says so rather than implying otherwise.
Which certifications does Reply2C hold?
None. Reply2C has not completed a SOC 2 audit, an ISO 27001 certification or a HIPAA attestation, and has not been through an independent GDPR audit. If your procurement process requires one of those reports today, Reply2C cannot satisfy it, and no amount of describing the controls below changes that.
The reason this page leads with the gap is that the alternative is worse. A trust page that implies an audit it has not had is the one claim a buyer can check in five minutes, and failing that check costs more than the missing certificate does.
What follows is a description of how the system is actually built, which is a different and weaker claim than an audited one — verified by reading the code and the database policies, not by an auditor.
How is one workspace isolated from another?
By Postgres row-level security on every tenant table, not by a filter in application code. Each query runs as the signed-in user, and the database refuses rows belonging to another workspace even if the API asks for them — so a bug in a route handler cannot leak another tenant's conversations.
The three roles — Admin, Team Leader and Agent — are enforced by the same policies. A permission that is hidden in the interface is also denied at the database, which is the only version of a permission that means anything.
How are channel credentials stored?
Encrypted at rest with AES-256-GCM, using a key held in the deployment environment and never in the database. Access tokens for WhatsApp, Instagram and Messenger are decrypted only at the moment an outbound request is signed, and are never returned to the browser.
Inbound Meta webhooks are verified against the app secret on every request, so a forged payload claiming to be a customer message is rejected before it reaches the inbox.
Where is data hosted?
The API and its realtime gateway run in Frankfurt, Germany. Postgres is hosted on Supabase. Message text is sent to the configured AI provider for triage and draft replies, and is not used to train models.
Conversation history belongs to the workspace and is exportable by an Admin. A plan change never deletes it.
What does Reply2C keep from conversations for its AI?
Each workspace has a memory of how its own team answers customers: short question-and-answer snippets taken from the replies its team sends. Email addresses, phone numbers, long digit runs, account numbers, link tokens and the customer's recorded name are removed before anything is saved, and only that workspace's own assistant can use it.
The assistant's own automatic replies are treated differently. When a workspace allows it, they are saved as "waiting for approval" and are never used until an Admin approves them, so the AI cannot teach itself from output nobody has read.
Removal is best effort: a name or an address written inside a sentence, which the system never recorded as a name or an address, may not be recognised. So an Admin can read every saved snippet under Settings → AI engine, switch the memory or either kind of learning off, and delete one snippet or all of them. Snippets learned from a conversation are deleted with it, when Shopify asks Reply2C to erase that customer, and when the workspace is deleted. They are not used to train models.
- Row-level security on every tenant table in Postgres
- Channel credentials encrypted at rest with AES-256-GCM
- Meta webhook signatures verified on every inbound request
- API and realtime gateway hosted in Frankfurt, Germany
- Roles enforced by database policy, not by the interface
- Audit log of workspace activity on the Scale plan
- AI memory snippets are stripped of customer details, and the assistant's own replies wait for an Admin's approval
Frequently asked questions
- Is Reply2C SOC 2 certified?
- No. Reply2C has not completed a SOC 2 audit. It also holds no ISO 27001 certification and no HIPAA attestation, and has not had an independent GDPR audit.
- Is Reply2C GDPR compliant?
- Reply2C is built for GDPR obligations — EU hosting, encryption at rest, per-workspace data isolation and Admin-initiated export and deletion — but it has not been independently audited, so it describes its controls rather than claiming certified compliance.
- Does Reply2C use my conversations to train AI models?
- No. Message text is sent to the configured model provider to classify a message or draft a reply, and is not used to train models.
- Does Reply2C keep my customers' messages so its AI can learn from them?
- It keeps short question-and-answer snippets from your team's replies, with phone numbers, emails and names removed, so your own assistant can answer the way your team does. The assistant's own replies are held for an Admin's approval before they are ever used. An Admin can read, switch off and delete all of it, and none of it is used to train models.
- Can I delete customer data on request?
- Yes. An Admin can delete a customer and their conversation history from the workspace, which removes it from the database rather than hiding it from the interface.
- How do I report a security issue?
- Email support@reply2c.com with the details. Reports are read directly by the person who builds the product.