R-301Security
Your pricing and pipeline stay yours.
Rep firms compete with each other for the same jobs. RepLine is built so that no firm can see another firm's data, and so you control who on your own team sees what.
- Read-only session, 1 hourReason: quote PDF logo looks blurryEnded
- Read-only session, 1 hourReason: help importing CRM contactsEnded
Every firm is its own tenant
Each rep firm in RepLine is a separate tenant. Every table that holds firm data carries a tenant id, and Postgres row-level security filters every request to the signed-in user's own firm.
That rule lives in the database, not just in the screens, so a bug in the app cannot show one firm's quotes to another. Uploaded files follow the same rule: plans, submittals and logos are stored in a folder per firm, and storage policies only open your own folder.
Role-based access inside your firm
Owners, admins and sales reps see what their job needs. Rep pay settings are private to the rep and to the firm's owners and admins. Roles can only be changed by an owner or admin, and never on their own account.
| Task | Owner and admin | Sales rep |
|---|---|---|
| Quote, scope and work their projects | Yes | Yes |
| Edit POs and invoices on a project | Any project | Own projects |
| See commissions | Whole team | Their own |
| See rep pay settings | Whole team | Their own |
| Analytics dashboard | Yes | No |
| Edit the line card | Yes | No |
| Change someone's role | Others only | No |
| Read the support access log | Yes | No |
How the rest is handled
- AI keys stay on the server
Scoper and the other AI features call the model through RepLine’s own server. The API key never reaches the browser.
Each AI request must carry a valid signed-in session, only approved models can be used, and the size of each response is capped.
- Support access is read-only and logged
When RepLine support needs to look at your workspace to help with a problem, they open a support session with a written reason. Sessions are read-only at the database level and end after one hour.
Every session is listed in your Settings under the support access log, visible to your firm’s owners and admins.
- Bid Inbox only accepts mail from your people
Each incoming email is checked for a valid provider signature. Mail is accepted only from active users of your firm or senders your firm has approved, and attachments are stored in private storage.
- Your name on the documents, not ours
Quotes, submittals, purchase orders and takeoffs go out with your firm’s logo, colors and document naming. Customers see your firm, not RepLine.
- Where it runs
RepLine runs on Vercel, with data, sign-in and file storage on Supabase (Postgres). Sign-in and password resets are handled by Supabase Auth.
Have a security question or a questionnaire from your IT team? Email dylan@replineai.com.
Ask the hard questions in a demo.
Bring your IT person if you have one. We will show exactly how separation, roles and support access work.