Is Replit safe for work?
Medium risk · 28Replit · Coding · facts (high-confidence)
Replit is medium-risk for default at-work use (28/100): it trains on your data unless you opt out, and holds SOC 2 Type II.
28
Medium risk
Watch out: On the paid Commercial Agreement, Replit will not train on your code and rides a SOC 2 Type II attestation with a DPA and public subprocessor list. Hosting is US-first with no EU residency and no BAA, so it is not positioned for PHI.
Data and compliance facts
- Trains on consumer-tier data
- Opt-out
- Trains on business-tier data
- No
- Training opt-out available
- Yes
- SOC 2 Type II
- Yes
- ISO 27001
- Unverified
- ISO 42001 (AI management)
- Unverified
- GDPR Data Processing Addendum
- Yes
- HIPAA BAA
- Unverified
- EU data residency
- No
- SSO / SAML
- Yes
- Data retention
- Account data deleted within 30 days of a deletion request; customers get 30 days post-termination to migrate content.
- Safer tier
- Enterprise (SSO and SCIM, private deployments) on top of the Commercial Agreement's no-training term
Why it scores 28 out of 100
- +18Trains on your data. Training is on by default on the consumer tier; you must find and set the opt-out.
- +10EU data residency. Whether data can be kept in the EU.