# Where is my data stored and how is it protected?

> Replavia’s data is stored with named providers that operate mainly in the United States. Data is encrypted in transit, Instagram login tokens are encrypted, and passwords are stored only as hashes.

- Topic: Privacy and trust
- Plans: Free: included · Pro: included · Scale: included
- Last checked: 2026-10-29
- Web page: https://replavia.com/help/how-is-my-data-protected

## The short answer

Your data is stored with a small number of named providers. Our [Privacy Policy](https://replavia.com/privacy) lists each one. Data is encrypted while it travels, and the most sensitive items are encrypted where they are stored.

## Where your data is stored

| Provider | What it hosts |
|---|---|
| Neon | The database with your account, automations and leads |
| Vercel | The website and your dashboard |
| Railway | The engine that receives comments and sends your DMs |

The policy says these providers “operate principally in the United States”. Some may also use other regions. If you use Replavia from outside the United States, your data is processed in the United States.

## How it is protected

The policy names four safeguards: “encryption in transit, hashed credentials, access controls and regular review”. Here is what that means in practice.

- **Encrypted in transit.** Data moving between your browser and Replavia is encrypted.
- **Passwords are hashed.** We store a one-way hash of your password, never the password itself.
- **Login tokens are encrypted.** Your Instagram and HubSpot tokens are encrypted with AES-256-GCM before they are stored.
- **Sensitive comment text is encrypted.** This covers comments waiting for an AI reply and comments that Comment Shield flags.
- **API keys are never stored.** Replavia keeps only a fingerprint of each key. That is why a key is shown to you once.

## Who can reach it

- Each Replavia account sees only its own data.
- Staff access is limited to need-to-know. Viewing a lead’s contact details needs a special permission, a written reason and an audit log entry. See [Who can see my leads?](https://replavia.com/help/who-can-see-my-leads)

## Payments

Card details go straight to Stripe. The policy says they “are never stored on our systems”. See [Is it safe to pay for Replavia?](https://replavia.com/help/is-my-money-safe)

## Error reports and analytics

- **Sentry** receives error reports. It is set up not to attach personal data by default, and we strip credentials first. It does not receive your leads or message content.
- **PostHog** records which dashboard pages you open. Session recording and automatic click capture are switched off in our own code. So the text on your screen is never sent.

## What no one can promise

Our policy is honest about this: “no method of transmission or storage is 100% secure”. We take the steps above to lower the risk. If you ever notice something wrong, tell us straight away.

## Related questions

- [Does Replavia sell my data?](https://replavia.com/help/does-replavia-sell-my-data)
- [What can Replavia see on my Instagram account?](https://replavia.com/help/what-replavia-can-see-on-instagram)
- [Does Replavia read or store my DMs?](https://replavia.com/help/do-you-read-my-dms)
- [Can I download or delete all my data?](https://replavia.com/help/get-or-delete-all-my-data)
- [What happens to my data when I leave?](https://replavia.com/help/what-happens-to-my-data-when-i-leave)
- [Which other companies handle my data?](https://replavia.com/help/who-processes-my-data)
- [Who is behind Replavia?](https://replavia.com/help/is-replavia-a-real-company)
- [Is Replavia approved by Meta?](https://replavia.com/help/is-replavia-approved-by-meta)
- [How Replavia follows Meta platform rules](https://replavia.com/help/how-replavia-follows-meta-rules)
- [Is my data used to train AI?](https://replavia.com/help/ai-privacy-and-your-data)

## Good to know

- Use a strong password that you do not use anywhere else. Our [Terms](https://replavia.com/terms) make you responsible for keeping it safe.
- If you think someone else used your account, email info@replavia.com at once.