Replika's security claims live in its privacy policy, not a trust page

The design

Replika does not operate a dedicated security or trust-center page of the kind some technology companies publish separately from their legal documents; no security or trust subdomain resolves for the company, and the current sitemap for replika.com lists only the privacy policy, terms and cookie policy as legal pages. The company's specific security claims instead sit inside the Privacy Policy, retrieved 16 September 2026, under a section on protecting user information. It states that 'all transmitted data are encrypted during transmission' using 'standard Secure Socket Layer (SSL) encryption,' that 'all stored data are maintained on secure servers,' and that access is 'protected by multi-layered security controls, including firewalls, role-based access controls, and passwords.'

What the evidence says

These are Replika's own descriptions of its own infrastructure; the Privacy Policy does not reference an independent audit, a SOC 2 report, or a named security certification, and a help-center search for those terms on 16 September 2026 returned no matching articles. The policy itself adds a qualifier that a typical trust page tends to omit: 'no technology, data transmission, or system can be guaranteed to be 100% secure,' and the company commits only to notifying users 'if and as required by applicable law' in the event of a breach. A companion help-center article, 'How can I protect my personal information?', adds user-side measures, a PIN lock available only on iOS and a unique password, as supplementary steps.

What it asks of people

Because there is no separate assurance document, a user weighing Replika's security has to read the same policy that governs data use generally, and is asked to supply part of the protection themselves by choosing a strong password and, on iOS, opting into an app-level PIN lock not offered on Android or web. A second article, 'Do you sell my personal information?', offers a one-line reassurance, that Replika does not sell personal information, that functions as the closest thing to a trust statement in the company's public documentation.

Privacy and safeguards

The safeguards described are limited to transport encryption, access controls, and password hygiene; the documents do not describe encryption of stored conversation content specifically, retention limits tied to security rather than legal requirements, or third-party verification of the claims made.

• Would a named certification or audit change how much weight these claims should carry?
• Why is the PIN-lock protection limited to iOS according to the help center?
• What would 'secure servers' and 'multi-layered security controls' need to specify to be checkable rather than asserted?

What exists is a set of unverified, self-reported claims spread across a legal policy and two consumer help articles, not a consolidated security disclosure, and the policy's own hedge, that no system is guaranteed secure, is the most concrete limit the record supplies.