Security at AskReplay

Data protection

• Encryption of data in transit using TLS, and at rest by our infrastructure providers.
• Tenant isolation: data is scoped per workspace, with database row-level security policies that restrict access to a user’s own tenant.
• Authentication via signed, httpOnly session tokens, with server-side verification.
• Optional two-factor authentication (authenticator app). When enabled, it is enforced on every request, not just at the sign-in screen.
• Role-based access: admins control what leaves the workspace, what becomes publicly visible, and what is permanently deleted.
• Admin audit log recording who did what, from which IP, with export.
• Offboarding: admins can end a person’s sessions immediately or remove them entirely, and SCIM directory sync can do both automatically from your identity provider.
• Optional content approval, so new knowledge needs a reviewer before it can answer buyers.
• Least-privilege access: privileged operations run server-side with scoped service credentials.
• Rate limiting and abuse controls on public and AI endpoints.

AI and content handling

• AI answers are grounded in the content you approve and include citations.
• We do not use Customer Content, viewer questions, or AI answers to train general-purpose AI models, and our AI providers are engaged on terms intended to prevent such training on data submitted through their APIs.
• Uploaded documents are read for their text and then discarded; the original files are not stored.

Infrastructure and providers

We host on reputable cloud infrastructure and rely on a small set of vetted subprocessors for hosting, database, AI, and payments. See our Subprocessors list and Privacy Policy.

Certifications, backups and availability

We would rather tell you exactly where we are than imply more than we can evidence.

• SOC 2: not certified today. The controls a Type II audit examines — access control, audit logging, deprovisioning, encryption — are implemented and evidenced in the product, but the audit itself has not been performed.
• Backups: our database provider takes automated daily backups with point-in-time recovery on their managed infrastructure. We have not yet run a documented restore exercise, so we do not publish a recovery-time commitment.
• Availability: no contractual uptime SLA today. A health endpoint is available at /api/health if you want to monitor us from your own tooling.
• Penetration test: no third-party test has been commissioned yet.
• On-premises or private cloud: not offered.

Reporting a vulnerability

If you believe you have found a security vulnerability, please report it to contact@ask-replay.com. We welcome good-faith research and ask that you:

• give us a reasonable time to investigate and remediate before public disclosure;
• avoid privacy violations, data destruction, and service degradation;
• do not access or modify data that is not yours; and
• provide enough detail to reproduce the issue.

We will not pursue legal action against researchers who act in good faith and in accordance with this policy.

Your part

Security is shared. Keep your credentials confidential, use strong passwords, manage team access carefully, and only publish content you have the right to share. No system is perfectly secure, and we cannot guarantee absolute security.