Replit
Provider: Replit, Inc. · Based in: Replit, Inc., 1001 E Hillsdale Blvd, Suite 400, Foster City, CA 94404, USA · Provider website
- Plans
- 4
- Sources
- 13
- As of
- 18 Oct
As of 18 Oct 2026. Based on our research on this date and the process described in the methodology. No guarantee of accuracy, not legal advice. The provider’s current documents take precedence. Found an error? Report a correction.
Incomplete. 6 points could not be verified in any provider source (see open points). This does not mean the matter is unproblematic; it means we have not checked it.
At a glance
- Hosting
- US only: Startermixed: Core, Pro, Enterprise
- Training on inputs
- not publicly documented: Starter, Coreopt-out available: Prono: Enterprise
- DPA
- not publicly documented: Starter, Coreyes: Pro, Enterprise
- Provider
- Replit, Inc.
- Based in
- Replit, Inc., 1001 E Hillsdale Blvd, Suite 400, Foster City, CA 94404, USA (Privacy Policy, q3). EU representative under Art. 27 GDPR: DataRep (q3)
Values from 4 plans, each listed with the plans it applies to. Details and evidence are in the plan table.
Compare Replit
Compare with another toolCompared plan by plan with other tools in the category Software development:
Details per plan
Short values per plan. Click a feature to open the evidence and notes for all plans; sources with retrieval dates are under “Evidence”.
| Feature | Starter (free of charge)Compare Replit Starter (free of charge) with another tool | CoreCompare Replit Core with another tool | ProCompare Replit Pro with another tool | EnterpriseCompare Replit Enterprise with another tool |
|---|---|---|---|---|
| differs by plan | 0 USD | 20 USD/mo… (further prices in the details) | 100 USD/mo… (further prices in the details) | custom |
| Details: Price | USD 0 (Starter Plan documentation; no longer listed as a separate plan on the pricing page) | 20 USD per month or 18 USD per month with annual payment (pricing page; prices plus taxes depending on location). Included: 20 USD credits per month; additional usage is billed under Effort-Based Pricing (pay-as-you-go) or covered by credit packs; budgets can be set as a hard cap (pricing page, FAQ). | 100 USD per month or 90 USD per month with annual payment (pricing page; plus taxes depending on location). The pricing page shows further Pro tiers at 225, 440, 850 and 2,050 USD per month (with annual payment 215, 425, 825 and 2,000 USD per month); monthly credits according to the FAQ 'starting at $100 for Pro'. Additional usage under Effort-Based Pricing (pay-as-you-go) or via credit packs; budgets can be set as a hard cap. | Individual (pricing page: 'Custom') |
| yes | yes | yes | yes | |
| Details: AI features included | yes (daily Agent credits up to a monthly limit, Lite Build, Design Canvas; no Full Build, no Plan Mode, no AI integrations) | yes (Replit Agent, AI integrations, Plan Mode; USD 20 credit for more powerful models) | yes (10 parallel Agents, USD 100 credit for the most powerful models, up to 15 collaborators, premium support) | yes (SSO/SAML, advanced privacy controls, single-tenant environments, static egress IPs) |
| differs by plan | not publicly documented | not publicly documented | yes | yes |
| Details: DPA | not publicly documented (the DPA forms part of the Replit Commercial Agreement; according to the Terms, this applies to Pro and Enterprise) | not publicly documented, whether included in the plan (the DPA forms part of the Replit Commercial Agreement; according to the Terms, this applies to Pro and Enterprise) | yes (DPA forms part of the Replit Commercial Agreement; EU SCCs Module Two/Three, UK Addendum; general authorisation for sub-processors) Provider’s DPA | yes (DPA forms part of the Replit Commercial Agreement) Provider’s DPA |
| differs by plan | not publicly documented | not publicly documented | opt-out available | no |
| Details: Training on inputs | Privacy Policy (as of 2026-08-03): legitimate interest in using personal data 'to improve the accuracy of our machine learning technologies such as code generation'. Terms: Replit may view the content of private apps, including to improve the service. Documentation 'Model improvement' (q7): opt-out from the use of content for model development only for Pro users (Settings > Personalization > Model Improvement); for Enterprise, Replit does not use customer content for training. Default setting not documented. No opt-out is documented for Starter. | Privacy Policy (as of 2026-08-03): legitimate interest in using personal data 'to improve the accuracy of our machine learning technologies such as code generation'. Terms: Replit may view the content of private apps, including to improve the service. Documentation 'Model improvement' (q7): opt-out from the use of content for model development only for Pro users (Settings > Personalization > Model Improvement); for Enterprise, Replit does not use customer content for training. Default setting not documented. No opt-out is documented for Core. | Privacy Policy (as of 2026-08-03): legitimate interest in using personal data 'to improve the accuracy of our machine learning technologies such as code generation'. Terms: Replit may view the content of private apps, including to improve the service. Documentation 'Model improvement' (q7): opt-out from the use of content for model development only for Pro users (Settings > Personalization > Model Improvement); for Enterprise, Replit does not use customer content for training. Default setting not documented. According to the documentation, the opt-out applies only to new content and does not delete any data; processing for operation, security and troubleshooting continues. | Documentation 'Model improvement' (q7): 'For Enterprise users, Replit does not use customer content to train its models.' Pricing page lists 'Advanced privacy controls' and 'Single-tenant environments' for Enterprise. Privacy Policy (as of 2026-08-03): legitimate interest in using personal data 'to improve the accuracy of our machine learning technologies such as code generation'. Terms: Replit may view the content of private apps, including to improve the service. |
| DPA: customer may request return or… | DPA: customer may request return or… | DPA: customer may request return or… | DPA: customer may request return or… | |
| Details: Data retention | DPA: customer may request return or deletion of customer data up to 90 days after the end of the contract. Docs 'Deleting your data': account deletion removes all content, personal information is 'purged from our systems'; no time limits. Privacy Policy: deletion or de-identification once no longer needed in identifiable form; no specific time limits. Retention periods for project content and prompts during operation: not publicly documented. Docs 'Account Inactivity': accounts not used within one year are considered inactive; Replit may terminate inactive accounts and delete data, for free accounts the apps are deleted. | DPA: customer may request return or deletion of customer data up to 90 days after the end of the contract. Docs 'Deleting your data': account deletion removes all content, personal information is 'purged from our systems'; no time limits. Privacy Policy: deletion or de-identification once no longer needed in identifiable form; no specific time limits. Retention periods for project content and prompts during operation: not publicly documented. Docs 'Account Inactivity': paid subscriptions are not terminated for inactivity. | DPA: customer may request return or deletion of customer data up to 90 days after the end of the contract. Docs 'Deleting your data': account deletion removes all content, personal information is 'purged from our systems'; no time limits. Privacy Policy: deletion or de-identification once no longer needed in identifiable form; no specific time limits. Retention periods for project content and prompts during operation: not publicly documented. Docs 'Account Inactivity': paid subscriptions are not terminated for inactivity. Pricing page: database rollback up to 28 days. | DPA: customer may request return or deletion of customer data up to 90 days after the end of the contract. Docs 'Deleting your data': account deletion removes all content, personal information is 'purged from our systems'; no time limits. Privacy Policy: deletion or de-identification once no longer needed in identifiable form; no specific time limits. Retention periods for project content and prompts during operation: not publicly documented. Docs 'Account Inactivity': paid subscriptions are not terminated for inactivity. |
| differs by plan | US only | mixed | mixed | mixed |
| Details: Hosting | Trust Center (FAQ): production infrastructure 'runs entirely on Google Cloud Platform (GCP), in the United States'; 'Data residency can be configured per customer needs'. Security page: a separate, isolated GCP project per customer. Privacy Policy: services hosted primarily in the USA. Docs 'Geography': workspace region (North America, EU, Asia) selectable only on Pro; publishing region (North America, EU, Asia, South America, Australia) on Core, Pro and Enterprise; free accounts publish to North America by default; region cannot be changed after publishing. The page does not state where AI requests are processed; according to the list, the AI sub-processors are located in the USA. Starter: no choice of region documented. | Trust Center (FAQ): production infrastructure 'runs entirely on Google Cloud Platform (GCP), in the United States'; 'Data residency can be configured per customer needs'. Security page: a separate, isolated GCP project per customer. Privacy Policy: services hosted primarily in the USA. Docs 'Geography': workspace region (North America, EU, Asia) selectable only on Pro; publishing region (North America, EU, Asia, South America, Australia) on Core, Pro and Enterprise; free accounts publish to North America by default; region cannot be changed after publishing. The page does not state where AI requests are processed; according to the list, the AI sub-processors are located in the USA. Core: publishing region (including EU) selectable, workspace region not. | Trust Center (FAQ): production infrastructure 'runs entirely on Google Cloud Platform (GCP), in the United States'; 'Data residency can be configured per customer needs'. Security page: a separate, isolated GCP project per customer. Privacy Policy: services hosted primarily in the USA. Docs 'Geography': workspace region (North America, EU, Asia) selectable only on Pro; publishing region (North America, EU, Asia, South America, Australia) on Core, Pro and Enterprise; free accounts publish to North America by default; region cannot be changed after publishing. The page does not state where AI requests are processed; according to the list, the AI sub-processors are located in the USA. Pro: workspace and publishing region selectable (including EU). | Trust Center (FAQ): production infrastructure 'runs entirely on Google Cloud Platform (GCP), in the United States'; 'Data residency can be configured per customer needs'. Security page: a separate, isolated GCP project per customer. Privacy Policy: services hosted primarily in the USA. Docs 'Geography': workspace region (North America, EU, Asia) selectable only on Pro; publishing region (North America, EU, Asia, South America, Australia) on Core, Pro and Enterprise; free accounts publish to North America by default; region cannot be changed after publishing. The page does not state where AI requests are processed; according to the list, the AI sub-processors are located in the USA. Enterprise: publishing region selectable and enforceable organisation-wide; the documentation names the workspace region choice only for Pro. |
| list available | list available | list available | list available | |
| Details: Sub-processors |
|
|
|
|
| differs by plan | 12 sources | 11 sources | 11 sources | 10 sources |
| Details: Sources with retrieval date |
|
|
|
|
Compare Replit Starter (free of charge) with another tool
Price and scope
- differs by plan
- 0 USD
USD 0 (Starter Plan documentation; no longer listed as a separate plan on the pricing page)
- yes
yes (daily Agent credits up to a monthly limit, Lite Build, Design Canvas; no Full Build, no Plan Mode, no AI integrations)
Contract and data use
- differs by plan
- not publicly documented
not publicly documented (the DPA forms part of the Replit Commercial Agreement; according to the Terms, this applies to Pro and Enterprise)
- differs by plan
- not publicly documented
Privacy Policy (as of 2026-08-03): legitimate interest in using personal data 'to improve the accuracy of our machine learning technologies such as code generation'. Terms: Replit may view the content of private apps, including to improve the service. Documentation 'Model improvement' (q7): opt-out from the use of content for model development only for Pro users (Settings > Personalization > Model Improvement); for Enterprise, Replit does not use customer content for training. Default setting not documented. No opt-out is documented for Starter.
- DPA: customer may request return or…
- DPA: customer may request return or deletion of customer data up to 90 days after the end of the contract. Docs 'Deleting your data': account deletion removes all content, personal information is 'purged from our systems'; no time limits. Privacy Policy: deletion or de-identification once no longer needed in identifiable form; no specific time limits. Retention periods for project content and prompts during operation: not publicly documented. Docs 'Account Inactivity': accounts not used within one year are considered inactive; Replit may terminate inactive accounts and delete data, for free accounts the apps are deleted.
Hosting and sharing
- differs by plan
- US only
Trust Center (FAQ): production infrastructure 'runs entirely on Google Cloud Platform (GCP), in the United States'; 'Data residency can be configured per customer needs'. Security page: a separate, isolated GCP project per customer. Privacy Policy: services hosted primarily in the USA. Docs 'Geography': workspace region (North America, EU, Asia) selectable only on Pro; publishing region (North America, EU, Asia, South America, Australia) on Core, Pro and Enterprise; free accounts publish to North America by default; region cannot be changed after publishing. The page does not state where AI requests are processed; according to the list, the AI sub-processors are located in the USA. Starter: no choice of region documented.
- list available
- Cloud/hosting: Google (cloud infrastructure and AI models), Microsoft Azure, Cloudflare, HashiCorp Cloud, Neon (database) – all USA
- AI models and infrastructure: Anthropic, OpenAI, OpenRouter, Baseten, Fireworks AI, Parallel Web Systems, Firecrawl, Anima App – all USA
- Others (extract): Stripe, Orb, Verifi, Clazar (payment/billing), Clerk, Stytch, WorkOS (identity/SSO), Datadog, Sentry, Grafana Labs (monitoring), Zendesk, Common Room, Civilized Discourse Construction Kit, IntouchCX (Canada), OWND ApS/Parahelp (support), analytics/marketing services (including Amplitude, Segment, HubSpot, ZoomInfo – USA)
- Full list (around 50 entries) see subprocessorUrl; all except IntouchCX (Canada) located in the USA
Evidence
- differs by plan
- 12 sources
- PricingPricing page, retrieved 18 Oct 2026
- SecurityTrust Center, retrieved 14 Oct 2026
- Privacy Policy (as of 2026-08-03)Privacy notice, retrieved 14 Oct 2026
- Data Processing Agreement (as of 2026-04-01)DPA, retrieved 18 Oct 2026
- Subprocessors (as of August 2026)Sub-processor list, retrieved 14 Oct 2026
- Terms of Service (as of 2026-08-03)Terms and conditions, retrieved 18 Oct 2026
- Docs: Model improvementDocumentation, retrieved 18 Oct 2026
- Docs: Starter PlanDocumentation, retrieved 14 Oct 2026
- Docs: GeographyDocumentation, retrieved 18 Oct 2026
- Replit's Trust CenterTrust Center, retrieved 18 Oct 2026
- Docs: Account InactivityDocumentation, retrieved 18 Oct 2026
- Docs: Deleting your dataDocumentation, retrieved 18 Oct 2026
not documentedmeans: not publicly documented, not verifiable in any provider source. It does not mean “no”.
Third-country transfers
Privacy Policy: services hosted primarily in the USA; anyone using the service consents to the transfer to the USA. DPA (as of 2026-04-01): EU standard contractual clauses (Decision 2021/914, Module Two and Module Three), UK Addendum. No mention of the EU-US Data Privacy Framework found on the retrieved pages. DPF List (retrieved 2026-10-18): no entry for Replit. Docs 'Geography': EU region selectable for workspaces (Pro) and publishing (Core, Pro, Enterprise); Trust Center: production 'entirely on Google Cloud Platform (GCP), in the United States'.
- Privacy Policy (as of 2026-08-03) (Privacy notice), retrieved 14 Oct 2026
- Data Processing Agreement (as of 2026-04-01) (DPA), retrieved 18 Oct 2026
- Docs: Geography (Documentation), retrieved 18 Oct 2026
- Replit's Trust Center (Trust Center), retrieved 18 Oct 2026
- Data Privacy Framework List (search for Replit) (Official register), retrieved 18 Oct 2026
Certifications (as stated by the provider)
Trust Center: 'Replit is SOC 2 Type II audited annually by an independent CPA firm'; listed are 'SOC 2 Type II - Letter of Attestation' and 'SOC 2 Type II - Full Report' (not reviewed); GCP is treated as a 'carved-out subservice organization' in the SOC 2 report. ISO 27001: the Trust Center lists only 'GCP ISO 27001 Cert (infra assurance)' for Google Cloud; Replit's own ISO 27001 certification is not shown (security page, retrieved 2026-10-14: 'working toward'). Compliance with the GDPR is claimed on the security page.
- Security (Trust Center), retrieved 14 Oct 2026
- Replit's Trust Center (Trust Center), retrieved 18 Oct 2026
AI Act
Functions: AI agent that generates apps, websites and slides from natural language, AI integrations, models from Anthropic, OpenAI and Google (pricing page, Subprocessors).
Provider’s statement: not publicly documented(no mention of the EU AI Act on the retrieved pages). Terms: AI-generated code may be erroneous or incomplete; pricing page: the Agent's behaviour is said to be probabilistic.
Classification (for review, not legal advice): For review: customer typically a deployer (Art. 3(4) AI Act). Which obligations apply depends on the specific intended use (review Annex III). Not legal advice.
- Pricing (Pricing page), retrieved 18 Oct 2026
- Terms of Service (as of 2026-08-03) (Terms and conditions), retrieved 18 Oct 2026
Current notes 2026
Privacy Policy and Terms 2026-08-03, DPA 2026-04-01, Subprocessors August 2026. The DPA applies only within the scope of the Commercial Agreement (Pro/Enterprise). Documentation "Model improvement": training opt-out only for Pro, Enterprise without training on customer content. The pricing page lists only Core, Pro and Enterprise; the free Starter plan is described in the documentation. Docs 'Geography' (retrieved 2026-10-18): choice of region for workspaces (Pro only) and publishing (Core, Pro, Enterprise), cannot be changed after publishing.
Provider structure
Replit, Inc. (USA); EU representative DataRep. An EU entity is not named on the retrieved pages.
Open points of the review
- Use for training on Starter and Core not expressly documented (docs 'Model improvement', retrieved 2026-10-18, name only Pro with opt-out and Enterprise without training; the Privacy Policy cites ML improvement as a legitimate interest); default setting of the opt-out not documented.
- Retention periods for project content, prompts and Agent histories during operation not quantified (the docs mention only account deletion and the inactivity rule, the DPA 90 days after the end of the contract).
- SOC 2 report listed in the Trust Center but not reviewed; Replit's own ISO 27001 certification not shown.
- Starter and Core: applicability of the DPA not documented (the DPA is part of the Commercial Agreement, which according to the Terms applies to Pro and Enterprise).
- Location information inconsistent (Trust Center: production only in the USA; docs 'Geography': EU regions selectable); location of AI processing and transfer basis per sub-processor not shown.
- Provider's AI Act statement not found.
Frequently asked questions
Where does Replit store data?
US only (plans: Starter (free of charge)); mixed (plans: Core, Pro, Enterprise). According to the provider, as of 18 Oct 2026.
Is there a DPA for Replit?
not publicly documented in: Starter (free of charge), Core; yes in: Pro, Enterprise. Based on our research, as of 18 Oct 2026.
Does Replit use inputs for AI training?
not publicly documented in: Starter (free of charge), Core; opt-out available in: Pro; no in: Enterprise. Based on our research, as of 18 Oct 2026.
Where is the provider based?
Replit, Inc., 1001 E Hillsdale Blvd, Suite 400, Foster City, CA 94404, USA. EU representative under Art. 27 GDPR: DataRep. According to the provider, as of 18 Oct 2026.
All sources
- 01PricingPricing page · retrieved 18 Oct 2026
- 02SecurityTrust Center · retrieved 14 Oct 2026
- 03Privacy Policy (as of 2026-08-03)Privacy notice · retrieved 14 Oct 2026
- 04Data Processing Agreement (as of 2026-04-01)DPA · retrieved 18 Oct 2026
- 05Subprocessors (as of August 2026)Sub-processor list · retrieved 14 Oct 2026
- 06Terms of Service (as of 2026-08-03)Terms and conditions · retrieved 18 Oct 2026
- 07Docs: Model improvementDocumentation · retrieved 18 Oct 2026
- 08Docs: Starter PlanDocumentation · retrieved 14 Oct 2026
- 09Docs: GeographyDocumentation · retrieved 18 Oct 2026
- 10Replit's Trust CenterTrust Center · retrieved 18 Oct 2026
- 11Data Privacy Framework List (search for Replit)Official register · retrieved 18 Oct 2026
- 12Docs: Account InactivityDocumentation · retrieved 18 Oct 2026
- 13Docs: Deleting your dataDocumentation · retrieved 18 Oct 2026
More tools in Software development with an EU hosting option (in at least one plan)
- Amazon Q Developer · Based in: Depending on the account country: Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg
- GitHub Copilot · Based in: According to the GitHub General Privacy Statement
- IONOS AI Model Hub · Based in: IONOS Cloud GmbH, Elgendorfer Straße 57, 56410 Montabaur, Germany
- Lovable · Based in: Lovable Labs Sweden AB, Regeringsgatan 25, 111 53 Stockholm, Sweden
All tools in Software development · Tools with an EU hosting option
Further reading
All tools in the category: Software development. Figures across all tools: Data report.