Replit
- Rank
- Score
- 43/149
- 48 out of 100
Replit is an American technology company, founded in 2016, that operates a cloud-based platform for writing and running software. It first built a browser-based online development environment supporting many programming languages, later added AI tools that generate code, and has released its own open code models.
Is Replit Agent safe?
Replit Agent scores 48 out of 100 and ranks 43 of 149. Its strongest category is Security, and its weakest category is Transparency.
How is Replit Agent scored?
Replit Agent is scored out of 100 on Safety (25%), Transparency (25%), Security (25%), and Privacy (25%). See how we score.
Safety framework
Average used24.4This outside rating doesn't cover this company, so the average of the companies it covers is used.
Pre-release testing
0Points for each confirmed yes.
- No
Was the model tested for dangerous capabilities, such as biological, chemical or cyber risks?
Company claim0/50huggingface.co (opens in a new tab) · 20 Oct 2026 - No
Did an outside organisation test the model before release?
Company claim0/50huggingface.co (opens in a new tab) · 20 Oct 2026
Safety test results
Average used74.1This outside rating doesn't cover this company, so the average of the companies it covers is used.
Incident record
67.1This check counts only when a source covers the company. With no events it holds the pillar, which is not proof of a clean record. Each recorded event takes points off the pillar, and serious or recent ones count most. Allegation checks, regulator actions and open investigations use half the severity load. AI Incident Database and AIAAIC Repository, last 24 months.
1 event
AllegationAI Incident Database (opens in a new tab) · 12 Nov 2026These are reports, not proven findings.
Date Event Severity 18 Jul 2025 AIID #1152 · LLM-Driven Replit Agent Reportedly Executed Unauthorized Destructive Commands During Code Freeze, Leading to Loss of Production Data18 Jul 2025 · Medium (reported) Medium (reported)
Protecting children
50Points for each confirmed yes.
- No
Does the model card report child-safety tests or safeguards?
Company claim0/50huggingface.co (opens in a new tab) · 20 Oct 2026 - Yes
Does the privacy policy set a minimum age, or say the service is not directed at children?
Company claim50/50“Our Services are directed to a general audience and are not directed to children under the age of 13.”
replit.com privacy policy (opens in a new tab) · 20 Oct 2026
Model documentation
50Points for each confirmed yes.
- Yes
Does the model card describe what the model can do?
Company claim25/25“Replit Code v1.5 is a 3.3B parameter Causal Language Model focused on Code Completion.”
huggingface.co (opens in a new tab) · 20 Oct 2026 - No
Does the model card report test results?
Company claim0/25huggingface.co (opens in a new tab) · 20 Oct 2026 - Yes
Does the model card state the model's limitations?
Company claim25/25“The pre-training dataset may have contained offensive or inappropriate content even after applying data cleansing and toxicity and profanity…” MoreLess
“The pre-training dataset may have contained offensive or inappropriate content even after applying data cleansing and toxicity and profanity filters, and such content may be reflected in model generated text.”
huggingface.co (opens in a new tab) · 20 Oct 2026 - No
Does the model card describe safety safeguards?
Company claim0/25huggingface.co (opens in a new tab) · 20 Oct 2026
Training-data disclosure
Average used29.9This outside rating doesn't cover this company, so the average of the companies it covers is used.
Independent transparency index
Average used40.7This outside rating doesn't cover this company, so the average of the companies it covers is used.
Transparency reports
Average used25This outside rating doesn't cover this company, so the average of the companies it covers is used.
Public safety commitments
0Average of the commitments signed.
- No
Has it signed the EU code of practice for general-purpose AI?
Company claim0/100European Commission (opens in a new tab) · 14 Oct 2026 - No
Did it sign only the safety and security chapter?
Company claim0/50European Commission (opens in a new tab) · 14 Oct 2026 - No
Has it signed the Frontier AI Safety Commitments (Seoul 2024)?
Company claim0/100Frontier AI Safety Commitments (opens in a new tab) · 14 Oct 2026
No problems found in 1 public record. That is not proof.
Security programme and certifications
67Points for each confirmed yes.
- Yes
Is there a way to report security flaws, such as a bug bounty?
Company claim34/34“Please use the following dedicated channel for all security-related concerns: Email: security@replit.com Subject: “Security Vulnerability Re…” MoreLess
“Please use the following dedicated channel for all security-related concerns: Email: security@replit.com Subject: “Security Vulnerability Report”.”
docs.replit.com security page (opens in a new tab) · 20 Oct 2026 - Yes
Does it state it holds a SOC 2 Type II report?
Company claim33/33“Replit is SOC 2 Type II audited annually by an independent CPA firm and holds an Advanced Bitsight rating.”
trust.replit.com security page (opens in a new tab) · 20 Oct 2026 - No
Does it state it holds ISO 27001 certification?
Company claim0/33replit.com security page (opens in a new tab) · 20 Oct 2026
Software vulnerabilities
70This check counts only when a source covers the company. With no events it holds the pillar, which is not proof of a clean record. Each recorded event takes points off the pillar, and serious or recent ones count most. Allegation checks, regulator actions and open investigations use half the severity load. Known-exploited flaws (CISA list) in the company's official software, last 24 months. A disclosed and fixed flaw does not lower the score.
No events
Independent sourceGitHub Advisory Database (opens in a new tab) · 12 Nov 2026
Data breaches
Not enough dataClear privacy policy
80Points for each confirmed yes.
- Yes
Does the privacy policy say what personal data is collected?
Company claim20/20“We collect data associated with your account registration, including name, username, email address and phone number.”
replit.com privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Does the privacy policy say whether your data is used to train AI?
Company claim20/20“For example, we have a legitimate interest in using Personal Data for product development and internal analytics purposes, to improve the ac…” MoreLess
“For example, we have a legitimate interest in using Personal Data for product development and internal analytics purposes, to improve the accuracy of our machine learning technologies such as code generation, and otherwise to improve the safety, security, and performance of our Services.”
replit.com privacy policy (opens in a new tab) · 20 Oct 2026 - No
Does the privacy policy say how long data is kept?
Company claim0/20replit.com privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Does the privacy policy say who your data is shared with?
Company claim20/20“We may share Personal Data with vendors and service providers that process data on our behalf in connection with the provision of our Servic…” MoreLess
“We may share Personal Data with vendors and service providers that process data on our behalf in connection with the provision of our Services.”
replit.com privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Does the privacy policy explain your privacy rights?
Company claim20/20“Access and Portability: The right to access the Personal Data that we have collected about you.”
replit.com privacy policy (opens in a new tab) · 20 Oct 2026
Training-data defaults
0100 if training is opt-in only, 50 if you can opt out, 0 if neither.
- No
Is your data used for training only if you opt in?
Company claim0/100replit.com privacy policy (opens in a new tab) · 20 Oct 2026 - No
Can you stop your data being used for training?
Company claim0/50replit.com privacy policy (opens in a new tab) · 20 Oct 2026
Export and delete your data
100Points for each confirmed yes.
- Yes
Can you get a copy of your data?
Company claim50/50“Access and Portability: The right to access the Personal Data that we have collected about you.”
replit.com privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Can you delete your data?
Company claim50/50“You can also submit a request to delete your Personal Data through your account settings.”
replit.com privacy policy (opens in a new tab) · 20 Oct 2026
Privacy fines
Not enough dataIndependent privacy ratings
Average used52.9This outside rating doesn't cover this company, so the average of the companies it covers is used.
Risk governance
Average used26.6This outside rating doesn't cover this company, so the average of the companies it covers is used.
Regulator actions
Not enough dataCourt judgments
Not enough dataPrivacy contact and complaints
100Points for each confirmed yes.
- Yes
Is there a privacy contact, such as an email or a data protection officer?
Company claim50/50“As an alternative to contacting Replit directly, you may contact DataRep to exercise your rights through the following webform: https://www.…” MoreLess
“As an alternative to contacting Replit directly, you may contact DataRep to exercise your rights through the following webform: https://www.datarep.com/replit.”
replit.com privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Does it tell you that you can complain to a regulator?
Company claim50/50“If you are located in the EEA or the UK, you are also able to raise any concerns with your local supervisory authority.”
replit.com privacy policy (opens in a new tab) · 20 Oct 2026
Score history
Newest first. Only days when the score changed are listed.
2 Nov 2026
Score 48
Method 2 Nov 2026
-2
28 Oct 2026
Score 50
Method 28 Oct 2026, update 2
-5 · combines both 28 Oct updates (28 Oct 2026 - Update 1 and 28 Oct 2026 - Update 2)
23 Oct 2026
Score 55
Method 21 Oct 2026
+6 · Data fix
21 Oct 2026
Score 49
Method 21 Oct 2026
-2
20 Oct 2026
Score 51
Method Not recorded
+2
14 Oct 2026
Score 49
Method Not recorded
-