Question 1

How are coding agents isolated?

Accepted Answer

Each workspace runs in its own Linux VM, built from the environment your admins configured. Workspaces don’t share a machine with each other, and warm-pool VMs belong to a single environment in a single organization. A workspace sleeps, with its compute paused, after 30 minutes without activity. After 7 days without activity it is archived, and its VM is deleted about an hour later. If you archive a workspace yourself, its VM is deleted 3 days later, or sooner once it reaches 7 days without activity. You can delete a workspace at any time.

Question 2

Where does our source code go?

Accepted Answer

Repositories are cloned into the workspace VM. While history saving is on, Replicas also saves chat transcripts, Canvas files, and the workspace’s git diff to object storage on AWS in Ohio, US, so you can read them after the workspace sleeps. Admins can turn history off, and then chat and Canvas history exist only while the workspace is awake.

Question 3

How are credentials and secrets stored?

Accepted Answer

Environment variables, files, MCP configs, API keys, and logins are encrypted in Supabase Vault and given to the workspace when it runs. GitHub access uses short-lived GitHub App installation tokens that the VM refreshes every 15 minutes. You can also sync secrets from Doppler or Infisical. Organization members are trusted users: agents and terminals in a workspace can read the credentials it was given.

Question 4

Can we use our own model keys, such as AWS Bedrock or Microsoft Foundry?

Accepted Answer

Yes, and you have to: Replicas doesn’t resell model usage. Claude Code runs on a Claude subscription, an Anthropic API key, AWS Bedrock, Microsoft Foundry, or Ollama. Codex runs on a ChatGPT subscription, an OpenAI API key, an OpenAI-compatible endpoint, Microsoft Foundry, or Ollama. Cursor uses your Cursor API key, and OpenCode uses OpenCode Go, OpenRouter, or your own endpoint. Inference stays on contracts you already hold.

Question 5

Do you train models on our code?

Accepted Answer

No. Our Data Processing Addendum says Replicas will not use customer personal data to train, develop, or improve machine learning models. Your model provider’s own terms apply to what agents send it.

Question 6

Can we control network egress?

Accepted Answer

On Team and Enterprise, a static egress IP sends traffic to the destinations you choose through a dedicated exit address, so you can add it to your firewall allowlists. Other traffic uses normal internet access. Workspaces don’t have an outbound firewall.

Question 7

Who can access workspaces, and can agents merge their own work?

Accepted Answer

Every organization member can open any workspace in the organization. Admins manage members, credentials, billing, and settings, and custom roles grant read or write access to environments and automations. Security policies can make commits and pull requests use the requesting person’s identity, and can block agents from merging pull requests or pushing to the default branch.

Question 8

Are you SOC 2 compliant, and do you sign a HIPAA BAA?

Accepted Answer

Replicas is SOC 2 Type I, with Type II in progress. You can request the report on our Trust Center. We sign a HIPAA Business Associate Agreement on Enterprise plans. GPU sandboxes and mobile testing are turned off under a BAA. Our Data Processing Addendum covers personal data for every customer.

Question 9

Can we self-host Replicas?

Accepted Answer

Yes, on Enterprise. You can run Replicas in our cloud, in a dedicated single-tenant deployment, or self-hosted in your own infrastructure. Contact sales to scope it.

Question 10

How do we report a vulnerability?

Accepted Answer

Email founders@replicas.dev. We acknowledge reports within 3 business days and triage them within 10. Our responsible disclosure policy covers scope, safe harbor, and rewards.

Area	Control	Plans
Isolation	Isolation · All plansOne Linux VM per workspace	All plans
Encryption	Encryption · All plansTLS in transit, encrypted at rest	All plans
Secrets	Secrets · All plansEncrypted in Supabase Vault	All plans
Secrets managers	Secrets managers · All plansDoppler and Infisical sync	All plans
Model credentials	Model credentials · All plansYour own keys, Bedrock, or Foundry	All plans
Code host access	Code host access · All plansGitHub App tokens, refreshed every 15 min	All plans
Merge control	Merge control · All plansBlock agents from merging PRs	All plans
Attribution	Attribution · All plansCommits and PRs use the requester’s identity	All plans
Roles	Roles · All plansAdmin, Member, and custom roles	All plans
Audit log	Audit log · All plansEvery configuration change, kept indefinitely	All plans
Data retention	Data retention · Trial, Team, EnterpriseTurn off saved chat and Canvas history	Trial, Team, Enterprise
Cloud access	Cloud access · Trial, Team, EnterpriseShort-lived workspace identity tokens	Trial, Team, Enterprise
Network	Network · Team, EnterpriseStatic egress IP for your allowlists	Team, Enterprise
Model training	Model training · All plansPersonal data never used for training	All plans
SOC 2	SOC 2 · Report on requestType I, Type II in progress	Report on request
DPA	DPA · All plansData Processing Addendum	All plans
HIPAA	HIPAA · EnterpriseBusiness Associate Agreement	Enterprise
Deployment	Deployment · EnterpriseDedicated or self-hosted	Enterprise

Data	Where	Kept
Source codeCloned into the workspace VMUntil the workspace is deleted	Cloned into the workspace VM	Until the workspace is deleted
Chat, Canvas files, git diffsObject storage on AWS, Ohio, USSaved unless history is turned off	Object storage on AWS, Ohio, US	Saved unless history is turned off
Secrets, API keys, loginsSupabase Vault, Ohio, USUntil removed	Supabase Vault, Ohio, US	Until removed
Paused VM diskSandbox provider snapshotUntil the workspace is deleted	Sandbox provider snapshot	Until the workspace is deleted
Audit logReplicas databaseIndefinitely, append-only	Replicas database	Indefinitely, append-only

Security at Replicas

Every workspace gets its own VM.

What happens to a VM after the work

The controls a security review asks for.

Where your code and secrets live.

Security
questions