Your data, handled with care.

Diploria runs on Replit's managed deployment infrastructure, which is built on Google Cloud Platform. All traffic between your browser and Diploria is encrypted in transit with TLS. Production services run in isolated environments, and application secrets (API keys, database credentials) are stored in a managed secrets system, never in source code.

Your account data, brand configurations, prompts, and poll results are stored in a managed PostgreSQL database (Neon), hosted in the United States, with encryption at rest. Uploaded files and generated reports are stored in cloud object storage on the same infrastructure.

If your organisation has specific data residency requirements, contact us and we'll tell you honestly whether we can meet them.

We use a small number of third-party services to run the platform. Each processes only the data required for its function:

• Poll history and visibility data are retained for the life of your account · the historical trend is the product, so we keep it.
• When you delete a brand, its prompts, poll results, and reports are deleted with it.
• When you delete your account, your data is removed from production systems, subject to a short window for operational backups.
• You can request deletion of your data at any time by emailing [email protected].

Diploria uses role-based access control with per-brand scoping, so agencies can give clients and team members exactly the access they need:

• Super Admin · full account control: billing, team management, brand creation and deletion, and all settings.
• Editor · can manage prompts, run polls, and change settings on the brands they've been granted access to.
• Viewer · read-only access to dashboards and reports for their assigned brands. Ideal for clients and stakeholders.

Access can be scoped per brand, so a team member or client only ever sees the brands assigned to them. Authentication is handled by Clerk, which supports secure sessions and social sign-in.

• API keys are generated per account and can be revoked instantly from Settings → API Keys & MCP.
• Keys are shown once at creation and stored hashed · we can't read your key back, and neither can anyone else.
• MCP connections (Claude Desktop, Cursor, Windsurf, Zed) authenticate with the same revocable keys and are limited to your account's data.
• All API access is over HTTPS only.

• Your data is used to provide the service to you. We do not sell it, and we do not use your data to train AI models.
• Prompts you track are sent to AI engines (ChatGPT, Claude, Gemini, and others) to measure your visibility · that's the product working as described. Each engine's own data policy applies to those API calls.
• We don't currently hold formal certifications such as SOC 2 or ISO 27001, and we won't claim otherwise. If a certification matters for your procurement process, tell us · it helps us prioritise.

For full details, see our Privacy Policy and Terms of Service.