Replicant

The integrations page names out-of-the-box connectors in six categories: CCaaS with Genesys, Five9, NICE inContact, Talkdesk, Amazon Connect, Ujet and 8x8; CRM with Salesforce, Zendesk, ServiceNow, Kustomer and Gladly; ERP with SAP and PeopleSoft; iPaaS with MuleSoft and Twilio; point of sale with Stripe and Shopify; and telephony with Cisco, Avaya, Telnyx and Spectrum, with the list stated as non-exhaustive and custom integrations available.

The agent acts rather than reads: published use cases cover authentication, billing and payments, and account and order management, which require writing to and transacting against those systems. Prismatic is named in the sub-processor list as the integration platform used to manage and scale customer integrations.

Sourcereplicant.com/platform/integrationsread 2026-09-05

Multi-step execution to resolution rather than deflection: agents are built with the customer's business logic, knowledge, workflows and guardrails and resolve up to 80 percent of conversations end to end, across published use cases that each require several dependent steps, including authentication, billing and payments, account and order management, appointment scheduling and reservations, and call routing. Authentication before a transactional step is the ordering that distinguishes a workflow from an answer, and it is published as its own use case.

Sourcereplicant.com/platformread 2026-09-05

Grounding is documented and it is concrete about its source: agents are built on the customer's own conversation data so they emulate that customer's best live agents rather than starting from scratch or relying on trial and error, and the build stage loads the customer's business logic, knowledge, workflows and guardrails.

Answers are further constrained at runtime by proprietary guardrails against hallucination, unsafe responses and prompt injection, with pre-approved responses used in high-risk workflows.

No index, embeddings layer, retrieval architecture, refresh behavior or source-level citation is documented anywhere, so a maintained retrieval structure is asserted rather than shown, and there is no published account of how the knowledge behind a live answer is kept current.

Sourcereplicant.com/platform/conversation-automationread 2026-09-05

The control sits ahead of the action and belongs to the vendor.

Business rules and security policies are codified outside LLM prompts so adherence is deterministic rather than persuaded, a multi-agent supervisory architecture audits every conversation turn in real time for brand compliance, hallucinations and policy violations, and pre-approved responses are used in high-risk workflows so the model does not compose an answer where the cost of a wrong one is highest.

Proprietary guardrails cover hallucination, unsafe responses and prompt injection, with exhaustive testing for prompt injection, jailbreaks and adversarial misuse, and escalation to a person is published as a first-class path with seamless handoff.

Sourcereplicant.com/platformread 2026-09-05

Compliance posture and access surface are both documented on the vendor's own safety and security page and corroborated in the privacy policy.

SOC 2 Type 2, PCI DSS and HIPAA are stated as independently validated, with GDPR and CCPA alignment, certification marks carried on the page, TLS 1.2+ and AES-256 encryption in transit and at rest, intrusion detection and prevention with continuous threat monitoring, and the OWASP Top 10 embedded in the development lifecycle.

The platform is also stated to adhere to the NIST Cybersecurity Framework and the NIST AI Risk Management Framework, and a vulnerability disclosure program is published in the footer. Access controls include granular role-based access control with full audit trails, multi-factor authentication built in, and automatic redaction of PII, payment data and regulated content across transcripts, logs and QA analytics.

The privacy policy independently confirms the access model, stating that client administrators create users who reach the application through their own identity provider and grant them roles carrying different permissions, with Auth0 named as the authentication subprocessor. ISO 27001 is not claimed anywhere on the site.

Sourcereplicant.com/safety-ai-securityread 2026-09-05

Reconstruction rather than reporting: the security page publishes audit visibility into all conversational behavior covering what the AI said, why, and what triggered it, which is a decision trace rather than an outcome summary.

Around it, the platform captures and analyzes 100 percent of conversations across channels and agents for full traceability, granular role-based access control carries full audit trails so every interaction with customer data is logged and traceable, real-time analytics report dispositions, CSAT and escalation drivers, dashboards are customizable, and any call or subset of calls can be interrogated conversationally inside the platform. Splunk appears in the sub-processor list for application log monitoring, which is Replicant's own infrastructure telemetry rather than a customer-facing surface.

Sourcereplicant.com/safety-ai-securityread 2026-09-05

A memory layer with a stated scope or lifetime is not documented. What Replicant publishes is design-time rather than runtime: agents are built from the customer's own conversation data so they emulate the best live agents rather than starting from scratch, which is how the agent is authored.

The privacy policy documents that all calls interacting with the product are recorded and stored and that information is retained as long as necessary to provide the service, which is a data retention position rather than state an agent carries between conversations, and a store is not a memory layer whoever writes it. No persistence a buyer could name, scope or delete appears on any page.

Sourcereplicant.com/platform/conversation-automationread 2026-09-05

Data is processed in the continental United States, and no residency choice is offered. The privacy policy states at section 9 that Replicant processes data in the continental United States and relies on legally provided cross-border mechanisms, and its published sub-processor table locates all thirteen sub-processors in the United States and Canada, with two in the United States only.

Cross-border protection is legal rather than locational: Standard Contractual Clauses and European Commission adequacy decisions, which are not residency. No region menu, VPC, single-tenant or self-hosted option appears anywhere on the site.

The security page carries a heading on data residency and sovereignty protections, but the text beneath it describes secure API based transfers that maintain residency boundaries under GDPR, which is transfer compliance rather than a location a buyer selects, and a recent blog post claiming the ability to define residency and sovereignty boundaries has nothing enumerated behind it and is contradicted by the privacy policy.

The multi-region, multi-vendor infrastructure published on the platform page distributes workloads for automated failover and 99.95% uptime, which is a reliability property rather than a residency choice. The privacy policy carries a September 2023 effective date, older than the marketing pages.

Sourcereplicant.com/legal/privacy-policyread 2026-09-05

Assets the customer assembles or receives built, rather than adopts as units. Seven use cases are published with their own pages, covering appointments and scheduling, frequently asked questions, outbound calling reminders, call routing, account and order management, authentication, and billing and payments, alongside seven industry configurations, and a no-code builder lets teams create and edit agents with natural-language instructions.

No packaged agent, template or pack a customer selects and puts into service is documented on any first-party page. The use-case pages describe what the platform is used for rather than an asset adopted, and the vendor's own delivery model runs the other way, with the Replicare page stating that Replicant builds agents for the initial and any subsequent use case as a full service.

Sourcereplicant.com/replicareread 2026-09-05

Work reaches the agent across voice, chat and SMS as three separately described channels rather than one with two labels, with SMS documented as sending links and documents to resolve an issue in text and chat framed as handling complex issues beyond a basic chatbot, and agents speaking more than 30 languages and dialects.

The agent also initiates rather than only receiving: outbound calling reminders is published as its own use case. Voice arrives through the customer's existing estate over a proprietary telephony stack with third-party backups, with Cisco, Avaya, Telnyx, Twilio and Bandwidth named across the integrations page and the sub-processor list.

Sourcereplicant.com/platform/conversation-automationread 2026-09-05

Vendor-internal orchestration across multiple models is documented, and the customer neither selects nor supplies one. Replicant publishes model orchestration as a platform property, coordinating multiple fine-tuned models across speech recognition, text to speech and reasoning for a best-of-breed result, with AI model redundancy described as a vendor-agnostic architecture protecting against downtime and latency.

The sub-processor list names the providers and shows where the multiplicity actually sits: Azure, Google Cloud and Deepgram for speech recognition, Google Cloud, ElevenLabs and Amazon Web Services for text to speech, and OpenAI for large language models.

No model selection, routing control or bring-your-own-model option is exposed to the customer on any surface, and the Replicare page states that when new models are released Replicant tests and deploys them, which places the choice with the vendor's delivery team rather than the buyer.

The two first-party sources disagree on LLM multiplicity: the platform page claims multi-vendor failover across telephony, text to speech and LLM, while the sub-processor list names a single LLM provider.

Sourcereplicant.com/legal/privacy-policyread 2026-09-05

No developer surface for Replicant's own platform is documented: the site navigation and footer carry no developer portal, API reference, SDK, documentation subdomain or Model Context Protocol server. The Replicare page does list robust APIs for smooth integration, but as a capability of Replicant's own telephony and integration engineers under a heading describing the delivery team, with nothing published for a customer to read, authenticate against or call.

The prebuilt connectors run outward into the customer's CCaaS, CRM, ticketing and systems of record, and the no code natural language agent builder is a console rather than a way in from outside. Prismatic appears in the sub-processor list as the integration platform Replicant uses to manage and scale customer integrations, a build dependency of Replicant's own rather than a customer capability.

Sourcereplicant.com/replicareread 2026-09-05

A gate on the release path and a scored loop after it, both on customer-facing surfaces. Before launch, the published lifecycle runs a Test stage that simulates conversations and stress tests an agent for quality and compliance, and the platform page describes no-code self-service development where teams build and edit agents with natural-language instructions and test them against synthetic customer data to optimize performance. At deployment, launches run through A/B tests.

After launch, generative AI scoring assesses every conversation for policy adherence, customer satisfaction and customer effort, with real-time dashboards on dispositions, CSAT and escalation drivers and point-and-click script editing to push a better conversation to every customer. The result is readable and comparable at both ends, and the artifact under test is the customer's own agent. The Replicare page also states that Replicant's own team runs experiments to refine flows and tests new models on the customer's behalf; that is the engagement rather than the platform.

Sourcereplicant.com/platformread 2026-09-05

Nothing on the site shows browser control, a hosted session, a virtual desktop or remote computer control. The route out is stated positively and it is programmatic: agents reach the customer's CCaaS, CRM, ERP, point-of-sale and telephony systems through named out-of-the-box connectors and a managed integration layer, and reach customers over voice, chat and SMS.

Sourcereplicant.com/platform/integrationsread 2026-09-05