Question 1

Where is customer data stored?

Accepted Answer

Application servers and project sandboxes run in the United States (AWS us-east-1). The primary database, authentication and file storage run on Supabase in Singapore (ap-southeast-1), and our team accesses both from India. We do not operate an EU or India hosting region today and we are not naming a date for one. Every subprocessor and its location is listed at /subprocessors.

Question 2

Is customer data used to train AI models?

Accepted Answer

Vibely does not use your prompts, code, or project data to train models. OpenAI, Anthropic, Google and Fireworks exclude API traffic from model training under their standard API terms. DeepSeek and Moonshot AI are used under their standard terms, which permit using inputs to improve their models, and process data in China. Product-improvement data collection is off by default on every plan and carries usage metrics only — model, provider, token counts and cost — never prompts or code; the control is at Settings → Privacy & security → Data protection.

Question 3

Is Vibely multi-tenant, and how is data isolated?

Accepted Answer

Vibely is multi-tenant with logical isolation between workspaces and projects: authorization is evaluated server-side on every request, shared database tables carry row-level security, and each project builds and runs in its own cloud sandbox with its own filesystem. It is logical isolation, not physical, and no third party has audited it.

Question 4

Which subprocessors does Vibely use?

Accepted Answer

A small, deliberate set of subprocessors (cloud hosting, sandboxes, AI inference, payments, email, observability, analytics, the connector OAuth gateway and the mobile build pipeline). Each is engaged under that vendor's own published data processing terms where it offers them; we do not hold a negotiated agreement with every vendor and we do not claim every vendor's terms match our DPA at /dpa. The current list is public at /subprocessors, and the position vendor by vendor is available from privacy@vibely.sh.

Question 5

Does Vibely access or clone source code?

Accepted Answer

Vibely generates and runs your project inside its own isolated sandbox — it does not enter your environments or require CI/CD access. If you connect a GitHub repository, Vibely reads and writes files in exactly the repositories you select, through the GitHub App you install, which can only reach the repositories you selected when you installed it. That access can be revoked from GitHub at any time. The scope of what we can see is the scope you granted GitHub.

Question 6

Does Vibely require CI/CD or production access?

Accepted Answer

No. Vibely does not deploy agents into your production environments and does not require any inbound connections from your network.

Question 7

How are publishing controls enforced?

Accepted Answer

Publishing is enforced server-side with separate role-based permissions: Owners, Admins and Editors can publish, while only Owners and Admins can make a project publicly accessible. A workspace can also block publishing when a scan reports critical findings or exposed PII.

Question 8

How does Vibely enforce RBAC?

Accepted Answer

Roles are Owner, Admin, Editor and Viewer, and every request is authorized server-side against an explicit permission. Business workspaces can drive membership from a SAML or OIDC identity provider, with optional SCIM provisioning.

Question 9

Does Vibely support least-privilege access?

Accepted Answer

Yes. Viewing, editing, deleting, publishing and publishing publicly are separate permissions, and member groups let you scope a single project to part of the workspace — so every member only has the access they need.

Question 10

How are secrets and API credentials managed?

Accepted Answer

Secrets are encrypted at rest, scoped to your workspace, and role-controlled — the API never returns a value in plaintext. Rotating or revoking one takes effect in running sandboxes immediately, without a redeploy.

Question 11

Does Vibely perform automated security scanning?

Accepted Answer

Yes. Scans run on demand and on every publish, covering RLS policies, database schema, application code, dependencies and exposed PII; Business workspaces can schedule recurring deep scans. Findings are ranked by severity and surfaced before you ship.

Question 12

Is Vibely SOC 2 or GDPR compliant?

Accepted Answer

GDPR: our Article 28 Data Processing Agreement is published at /dpa and applies without signature. SOC 2 and ISO 27001: we hold neither, and no audit or certification process against either is under way. We would rather say that than describe a programme we have not started. If one begins, this page says so on the day it does.

Question 13

Is Vibely ready for the EU AI Act?

Accepted Answer

Vibely is a general-purpose AI development tool, not a high-risk AI system under the EU AI Act — the apps you build with it are your own products and your own compliance responsibility. Vibely follows GDPR data protection practices for the platform itself; see our Data Processing Agreement at /dpa.

Aman sejak desain

Kontrol yang diharapkan oleh tim keamanan Anda

Access and control

Guardrails for building & publishing

Secrets handled securely

Where your data runs

No training on your data

Isolation by design

Continuous monitoring

Automatic security scanning

Protected infrastructure

Alat keamanan yang dibangun untuk para pengirim

Evidence you can hand over

Security answers for founders

Find vulnerabilities before they find you

Framework yang kami dukung

SOC 2

GDPR

ISO 27001

Pertanyaan yang sering diajukan

Siap membangun dengan percaya diri?

✻Aman sejak desain