Security at ReplyMint

Last updated: September 29, 2026

We never see your password

• You connect Instagram, Facebook, and Threads through Meta's official login (OAuth). You sign in on Meta's own screen; ReplyMint never sees or stores your password.
• ReplyMint is a Verified Meta Tech Provider and uses only Meta's official Graph API. No scraping, no browser automation, no unofficial access.
• We request only the permissions needed to read and manage comments and messages on the accounts you connect.
• You can disconnect any channel anytime in Settings → Channels, and you can also remove ReplyMint's access from your Facebook or Instagram settings.

Where your data lives

• The ReplyMint app is hosted on Vercel.
• Your data is stored in a Supabase Postgres database hosted in the United States (AWS US East).
• All connections to ReplyMint use HTTPS, and data is encrypted in transit and at rest by our infrastructure providers.

Your workspace is isolated

• Every request is checked against your workspace before any data is read or written, and database row-level security adds a second layer of protection.
• Team access has two roles: owners manage billing, AI settings, and channels; members work the inbox.
• Incoming Meta webhooks are verified with Meta's signature before we process them, so forged events are rejected.

How AI is used

• To classify comments and suggest replies, message text is sent to Google's Gemini API.
• We use Google's paid Gemini API. Under Google's terms for paid use, Google doesn't use these prompts or responses to improve its products; it keeps them for a limited time only to detect abuse and meet legal requirements.
• ReplyMint doesn't train its own AI models on your comments or messages.
• Brand knowledge you add (your products, FAQs, tone) is stored only for your workspace and used only to answer your customers.

Payments

Payments are handled by Dodo Payments, our merchant of record. ReplyMint never sees or stores your full card number.

Keeping and deleting data

• Disconnecting a channel stops new comments and messages from syncing.
• You can ask us to delete your message data or your whole account at any time; we complete verified requests within 30 days. How deletion works.
• Retention periods for messages and media are listed in our Privacy Policy.

Service providers we use

Vercel (hosting, plus aggregate performance and usage metrics), Supabase (database, authentication, storage), Google Gemini API (AI classification and replies), Resend (email), Dodo Payments (billing), Upstash (caching and rate limiting), Sentry (error monitoring, with message text redacted), Google Analytics and Microsoft Clarity (usage analytics on our website and app, with customer content masked), Meta (Instagram, Facebook, and Threads APIs).

Who can access your data

ReplyMint is run by its founder, who is the only person with administrative access to production systems. That access is used for support and troubleshooting.

What we don't claim

We're a young company, so we'd rather be clear: ReplyMint is not SOC 2 certified today. If your company requires specific security documentation, email us and we'll tell you honestly what we can provide.

Reporting a security issue

If you find a vulnerability or suspect a problem with your account, email support@replymint.app with "Security" in the subject line. We read every report and respond as quickly as we can. If we learn of an incident affecting your data, we'll notify affected customers by email without undue delay.