Your data, handled with care.

This page explains exactly how Diploria hosts, stores, and protects your data. Plain language, no marketing gloss, and no claims about certifications we don't hold.

Infrastructure and hosting

Diploria runs on Replit's managed deployment infrastructure, which is built on Google Cloud Platform. All traffic between your browser and Diploria is encrypted in transit with TLS. Production services run in isolated environments, and application secrets (API keys, database credentials) are stored in a managed secrets system, never in source code.

Data storage and residency

Your account data, brand configurations, prompts, and poll results are stored in a managed PostgreSQL database (Neon), hosted in the United States, with encryption at rest. Uploaded files and generated reports are stored in cloud object storage on the same infrastructure.

If your organisation has specific data residency requirements, contact us and we'll tell you honestly whether we can meet them.

Subprocessors

We use a small number of third-party services to run the platform. Each processes only the data required for its function:

• Replit (Google Cloud) Application hosting and deployment infrastructure
• Neon Managed PostgreSQL database (primary data store)
• Clerk User authentication and session management
• Stripe Payment processing · card details never touch our servers
• OpenAI, Anthropic, Google, Perplexity, xAI (via API) AI engine polling · your tracked prompts are sent to these engines to measure visibility
• OpenRouter API routing for some AI engines
• DataForSEO / SerpAPI Search results and location data enrichment
• Transactional email provider (SMTP) Report delivery and account notifications

Data retention

• Poll history and visibility data are retained for the life of your account · the historical trend is the product, so we keep it.
• When you delete a brand, its prompts, poll results, and reports are deleted with it.
• When you delete your account, your data is removed from production systems, subject to a short window for operational backups.
• You can request deletion of your data at any time by emailing hello@diploria.ai.

Access control and roles

Diploria uses role-based access control with per-brand scoping, so agencies can give clients and team members exactly the access they need:

• Super Admin · full account control: billing, team management, brand creation and deletion, and all settings.
• Editor · can manage prompts, run polls, and change settings on the brands they've been granted access to.
• Viewer · read-only access to dashboards and reports for their assigned brands. Ideal for clients and stakeholders.

Access can be scoped per brand, so a team member or client only ever sees the brands assigned to them. Authentication is handled by Clerk, which supports secure sessions and social sign-in.

API and MCP access controls

• API keys are generated per account and can be revoked instantly from Settings → API Keys & MCP.
• Keys are shown once at creation and stored hashed · we can't read your key back, and neither can anyone else.
• MCP connections (Claude Desktop, Cursor, Windsurf, Zed) authenticate with the same revocable keys and are limited to your account's data.
• All API access is over HTTPS only.

How your data is used

• Your data is used to provide the service to you. We do not sell it, and we do not use your data to train AI models.
• Prompts you track are sent to AI engines (ChatGPT, Claude, Gemini, and others) to measure your visibility · that's the product working as described. Each engine's own data policy applies to those API calls.
• We don't currently hold formal certifications such as SOC 2 or ISO 27001, and we won't claim otherwise. If a certification matters for your procurement process, tell us · it helps us prioritise.

For full details, see our Privacy Policy and Terms of Service.

Security inquiries

Found a vulnerability, or have a security question for your procurement or IT team? Email hello@diploria.ai and we'll respond promptly. Responsible disclosure is appreciated and taken seriously.