Once a tool is "useful enough" inside an organization, it stops being a developer choice and starts being a CTO choice. The questions get sharper. Here are the eight we hear most often, and how we answer them.
1. Where does the code live?
In your repo, your sandbox, your deploy target. Vibely never holds your code hostage — every project exports cleanly to GitHub and runs on stock Node and Expo.
2. Who can see it?
Only members of your workspace. Sandboxes are isolated per project. Previews are served from a Cloudflare worker that strips iframe-blocking headers but enforces auth on private projects.
3. What about secrets?
Secrets are stored encrypted at rest and are never round-tripped through the model. The agent sees the names, not the values.
4. What model is running, and where?
You can pin the model from the composer's picker; the default is Auto, which today resolves to DeepSeek V4 Pro for builds. Claude Opus 5 and Sonnet 5, Gemini 3 Flash and GPT-5.6 are all selectable. Inference runs on those providers' own infrastructure, and every model vendor we route to is named in our public subprocessor list — worth reading if the vendor's jurisdiction matters to your review.
5. How do you handle vulnerabilities?
Every project ships with a security view backed by five automated scanners — RLS policies, database schema, application code, dependencies, and exposed PII — surfacing findings by severity. All five run on a deep scan you start yourself, or schedule on Business; a publish kicks off a background code and PII scan and does not wait on it. To be clear about what that is and is not: it is an automated scan of the code we generated for you, not a penetration test and not an audit.
6. Observability?
Console logs, agent traces, and tool-call timelines for every turn, readable in the project. Business workspaces additionally get a workspace audit log. We do not yet ship a SIEM export or a log-streaming webhook — if that is a hard requirement for you, tell us, because it moves up the roadmap on demand.
7. What if Vibely disappears tomorrow?
You keep your code. You keep your data. You keep your domain. That is the whole bet.
8. Where is our data hosted, and is there a DPA?
Vibely runs on managed cloud infrastructure. We do not offer a data-residency choice today — there is no region selector in the product, and we would rather say that plainly than imply one. The authoritative, current list of every provider that touches your data is public in Annex 3 of our DPA. Our GDPR Article 28 Data Processing Agreement is published at /dpa and applies without signature. We hold no SOC 2 report and no ISO 27001 certificate, and no audit against either framework is under way; see our security page, which we update on the day that changes.