# Security at Replicas

How agents are isolated, where your code and credentials live, and the controls your security review will ask about.

Updated 2026-10-25. Canonical URL: https://replicas.dev/security

## Isolation

Every workspace runs in its own Linux VM with your cloned repositories, the coding agent, its environment variables and secrets, and a short-lived code host token. Model calls go to your provider on your account, and work comes back as a pull request for your review.

- **Awake:** The agent works in its own VM
- **Sleeping:** Compute paused after 30 minutes idle
- **Archived:** After 7 days without activity
- **Deleted:** About an hour after auto-archiving, or 3 days after you archive it

## Controls

| Area | Control | Plans |
| --- | --- | --- |
| Isolation | [One Linux VM per workspace](https://docs.replicas.dev/features/workspaces/overview) | All plans |
| Encryption | [TLS in transit, encrypted at rest](https://replicas.dev/dpa) | All plans |
| Secrets | [Encrypted in Supabase Vault](https://docs.replicas.dev/admin/credentials) | All plans |
| Secrets managers | [Doppler and Infisical sync](https://docs.replicas.dev/features/doppler) | All plans |
| Model credentials | [Your own keys, Bedrock, or Foundry](https://docs.replicas.dev/admin/credentials) | All plans |
| Code host access | [GitHub App tokens, refreshed every 15 min](https://docs.replicas.dev/features/github) | All plans |
| Merge control | [Block agents from merging PRs](https://docs.replicas.dev/admin/security) | All plans |
| Attribution | [Commits and PRs use the requester’s identity](https://docs.replicas.dev/admin/security) | All plans |
| Roles | [Admin, Member, and custom roles](https://docs.replicas.dev/admin/team) | All plans |
| Audit log | [Every configuration change, kept indefinitely](https://docs.replicas.dev/admin/audit-log) | All plans |
| Data retention | [Turn off saved chat and Canvas history](https://docs.replicas.dev/admin/data-retention) | Trial, Team, Enterprise |
| Cloud access | [Short-lived workspace identity tokens](https://docs.replicas.dev/features/workspaces/workspace-identity) | Trial, Team, Enterprise |
| Network | [Static egress IP for your allowlists](https://docs.replicas.dev/features/static-egress-ip) | Team, Enterprise |
| Model training | [Personal data never used for training](https://replicas.dev/dpa) | All plans |
| SOC 2 | [Type I, Type II in progress](https://trust.replicas.dev) | Report on request |
| DPA | [Data Processing Addendum](https://replicas.dev/dpa) | All plans |
| HIPAA | [Business Associate Agreement](https://replicas.dev/enterprise) | Enterprise |
| Deployment | [Dedicated or self-hosted](https://replicas.dev/enterprise) | Enterprise |

## Where your data lives

| Data | Where | Kept |
| --- | --- | --- |
| Source code | Cloned into the workspace VM | Until the workspace is deleted |
| Chat, Canvas files, git diffs | Object storage on AWS, Ohio, US | Saved unless history is turned off |
| Secrets, API keys, logins | Supabase Vault, Ohio, US | Until removed |
| Paused VM disk | Sandbox provider snapshot | Until the workspace is deleted |
| Audit log | Replicas database | Indefinitely, append-only |

## FAQ

### How are coding agents isolated?
Each workspace runs in its own Linux VM, built from the environment your admins configured. Workspaces don’t share a machine with each other, and warm-pool VMs belong to a single environment in a single organization. A workspace sleeps, with its compute paused, after 30 minutes without activity. After 7 days without activity it is archived, and its VM is deleted about an hour later. If you archive a workspace yourself, its VM is deleted 3 days later, or sooner once it reaches 7 days without activity. You can delete a workspace at any time.

### Where does our source code go?
Repositories are cloned into the workspace VM. While history saving is on, Replicas also saves chat transcripts, Canvas files, and the workspace’s git diff to object storage on AWS in Ohio, US, so you can read them after the workspace sleeps. Admins can turn history off, and then chat and Canvas history exist only while the workspace is awake.

### How are credentials and secrets stored?
Environment variables, files, MCP configs, API keys, and logins are encrypted in Supabase Vault and given to the workspace when it runs. GitHub access uses short-lived GitHub App installation tokens that the VM refreshes every 15 minutes. You can also sync secrets from Doppler or Infisical. Organization members are trusted users: agents and terminals in a workspace can read the credentials it was given.

### Can we use our own model keys, such as AWS Bedrock or Microsoft Foundry?
Yes, and you have to: Replicas doesn’t resell model usage. Claude Code runs on a Claude subscription, an Anthropic API key, AWS Bedrock, Microsoft Foundry, or Ollama. Codex runs on a ChatGPT subscription, an OpenAI API key, an OpenAI-compatible endpoint, Microsoft Foundry, or Ollama. Cursor uses your Cursor API key, and OpenCode uses OpenCode Go, OpenRouter, or your own endpoint. Inference stays on contracts you already hold.

### Do you train models on our code?
No. Our Data Processing Addendum says Replicas will not use customer personal data to train, develop, or improve machine learning models. Your model provider’s own terms apply to what agents send it.

### Can we control network egress?
On Team and Enterprise, a static egress IP sends traffic to the destinations you choose through a dedicated exit address, so you can add it to your firewall allowlists. Other traffic uses normal internet access. Workspaces don’t have an outbound firewall.

### Who can access workspaces, and can agents merge their own work?
Every organization member can open any workspace in the organization. Admins manage members, credentials, billing, and settings, and custom roles grant read or write access to environments and automations. Security policies can make commits and pull requests use the requesting person’s identity, and can block agents from merging pull requests or pushing to the default branch.

### Are you SOC 2 compliant, and do you sign a HIPAA BAA?
Replicas is SOC 2 Type I, with Type II in progress. You can request the report on our Trust Center. We sign a HIPAA Business Associate Agreement on Enterprise plans. GPU sandboxes and mobile testing are turned off under a BAA. Our Data Processing Addendum covers personal data for every customer.

### Can we self-host Replicas?
Yes, on Enterprise. You can run Replicas in our cloud, in a dedicated single-tenant deployment, or self-hosted in your own infrastructure. Contact sales to scope it.

### How do we report a vulnerability?
Email founders@replicas.dev. We acknowledge reports within 3 business days and triage them within 10. Our responsible disclosure policy covers scope, safe harbor, and rewards.

## Links

- Enterprise: https://replicas.dev/enterprise
- Trust Center: https://trust.replicas.dev
- Data Processing Addendum: https://replicas.dev/dpa
- Responsible disclosure: https://replicas.dev/responsible-disclosure
- AI coding agents and HIPAA: https://replicas.dev/resources/ai-coding-agents-hipaa