Short answer: Your data is stored on servers in the EU, and the Data Processing Agreement (DPA) is included in every plan. You can download the DPA, the Technical and Organizational Measures (TOM) and the full sub-processor list from our legal documents page – no request needed.
Where is my data stored?
replient.ai is operated by replient.ai Software GmbH in Austria. The main hosting and the database run in the EU: Hetzner (Germany) provides cloud hosting and data storage, and Supabase (EU) provides the database and file storage.
For some functions we use providers outside the EU, for example for AI models, monitoring and email delivery. For these providers we have concluded EU Standard Contractual Clauses (SCCs) as required by the GDPR. These are the providers we currently use:
Provider | What it is used for | Location |
Hetzner Online GmbH | Cloud hosting and data storage | EU (Germany) |
Supabase, Inc. | Database, backend and cloud storage | EU |
Cloudflare, Inc. | CDN, DNS and DDoS protection | USA, SCCs |
OpenAI Ireland Ltd. | AI models | USA / EU, SCCs |
Anthropic PBC | AI models | USA, SCCs |
Google Ireland Limited | Cloud infrastructure and AI models | USA / EU (Ireland), SCCs |
Inngest Inc. | Control of background jobs | USA, SCCs |
Redis, Inc. | Database service for queues | USA / EU, SCCs |
Functional Software, Inc. (Sentry) | Error tracking | USA, SCCs |
Langfuse GmbH / Finto Technologies Inc. | AI prompt management and monitoring | EU / USA, SCCs |
Twilio Ireland Limited (SendGrid) | Email delivery, e.g. system notifications | USA, SCCs |
Intercom R&D Unlimited Company | Live chat support in the app | USA, SCCs |
PostHog, Inc. | Product analytics | EU / USA, SCCs |
The current list is always Annex 4 of the DPA. If we add or replace a provider, we inform you in advance by email newsletter. To receive it, send an email with the subject "Subscribe" to [email protected]. You can object to a change within 2 weeks if you have an important data protection reason.
Step 1: Get the Data Processing Agreement (DPA)
Open our legal documents page: replient.ai/en/legal-documents (German: replient.ai/rechtliche-dokumente).
Find Data Processing Agreement (DPA) and open the version marked Current. It is available in English and in German.
Download the PDF and fill in your company details in the controller section.
Keep it with your data protection records.
Direct links to the current version: DPA (English, PDF) · Auftragsverarbeitungsvertrag (Deutsch, PDF). Older versions stay available on the same page under Previous versions.
💡 Tip: Does your company need its own contract or a security review? Individual DPAs and security reviews are part of the Enterprise plan. Contact us in the chat and we will go through it with you.
Step 2: Read the security measures (TOM)
On the same page you find Technical and Organizational Measures (TOM) as a PDF: TOM (English, PDF). It describes the measures we take under Art. 32 GDPR, grouped by:
Confidentiality: access control, logging of access to applications, as few administrators as possible, separate production and test systems.
Integrity: logging of who entered, changed or deleted data.
Availability: regular backups and hosting with a professional hoster.
Regular review: data protection management, incident response process, employee training, careful selection and review of providers.
Our data protection officer is heyData GmbH ([email protected]).
Step 3: Check our Trust Center
Our Trust Center at security.replient.ai gives you an overview of our security controls, for example restricted access to production systems and databases, a password policy and data encryption.
How your account and connections are protected
Sign-in with the platform, not with your password: you connect Facebook, Instagram, TikTok, LinkedIn, YouTube and Google through the platform's own login window and grant permissions there. You never enter those passwords in replient.ai.
Encrypted connection tokens: the access tokens we store for your connected channels are encrypted.
Strong passwords: new passwords need at least 12 characters with uppercase and lowercase letters, a number and a symbol.
Two-factor authentication: go to Settings → Security and click Set up. Then you enter a code from your authenticator app at every sign-in.
Team access: only people you invite can see your brand, and you decide what each team member may do. See Teams & User Management.
Your rights and deleting data
GDPR requests (access, correction, deletion, export, objection): write to [email protected]. We may ask you to verify your identity first.
Delete a channel: in Learning, open the menu of the channel and click Delete. This also deletes the comments collected for this channel and cannot be undone.
Delete a brand: go to Settings → Manage brands and click Delete next to the brand. This cannot be undone.
When you end your contract: under the DPA we return your data or, on your request, delete it, including backups. On request we provide documented evidence of the deletion.
Need to know how long specific data is kept? Contact us in the chat.