Vybe Security

Your data security is our top priority.
Learn how we protect your information.

Overview

Vybe is built with security as a foundational principle
We provide enterprise-grade security for your internal applications and data
We protect your integrations, credentials, and business data
All Vybe apps are protected by default behind a login and only accessible to organization members
We have a security layer (middleware) that every single request goes through, and which checks authentication and access control, this layer is not controlled by the AI and never vibe coded

Infrastructure Security

Vybe Apps Internal Databases

Hosted on Neon
Data is encrypted at rest
Backups are kept for 7 days by default (changeable upon requests), with restore capabilities up to the millisecond
Each organization has its own isolated Neon project
Complete data separation between organizations

Vybe Apps Preview Environment

Hosted on Blaxel
Secure sandbox environment for testing and development
Protected by token-based authentication

Published Vybe Apps

Hosted on Vercel, powered by AWS infrastructure
Enterprise-grade hosting with global CDN
See Vercel Security Center for detailed security information

External Database Connections

Support for PostgreSQL, MySQL, and Redshift
SSH tunnel available for secure external database access
Parameterized queries to prevent SQL injection
All queries routed through our secure middleware

Architecture diagram

Data Encryption

Data Storage Encryption

All inactive data is encrypted at rest by Neon
All sensitive data (secrets, API keys, SSH keys, credentials, etc.) is additionally encrypted before being stored in DB using AES-256-GCM (authenticated encryption)

Encryption in Transit

All connections secured with TLS/HTTPS
Secure cookie attributes enforced (HttpOnly, Secure, SameSite)
Cross-subdomain communication protected with secure headers

Authentication & Access Control

User Authentication

Secure OAuth authentication via Google (Okta coming soon)
Session management with secure cookies
Cross-subdomain session sharing with strict security controls

Access Control

Only members of an organization have access to the organization apps by default
Granular organization roles: Owner, Admin, Editor, Member
App-level access controls: Organization-wide, Restricted to specific users, or Creator-only
Path-level access control restrictions for sensitive application routes
Every Vybe API endpoint is wrapped with an access control check (enforced in CI)

Security Middleware

Every single request goes through our dedicated security middleware
Each request is checked for both authentication and access level
All requests to access data (to Third-Party Integrations, Vybe App Databases, or External Databases) also go through this layer
This middleware is not controlled by the AI and never vibe coded
As an example, our customers were protected from the recent React2Shell vulnerability thanks to this security layer

Integration Security

Third-Party Integrations

OAuth-based connections to 3,000+ services (Slack, Salesforce, HubSpot, etc.)
Integration credentials managed through a secure provider (Pipedream)
All auth tokens are stored encrypted by Pipedream
Tokens refreshed automatically; never exposed to client-side code

Database Queries

All database queries go through our secure middleware
Request validation and sanitization on all endpoints
Parameterized queries to prevent SQL injection
Ability to enforce read-only for all requests to external databases
SSH Tunnel feature available to connect to an external database securely

Compliance & Certifications

SOC 2 Type II Certified

Independently audited and certified for security, availability, and confidentiality
Annual third-party assessments of security controls
Comprehensive policies and procedures validated by auditors
SOC 2 Type II Report available upon request

Penetration Testing

Regular penetration tests conducted by third-party security firms
Proactive identification and remediation of vulnerabilities
Latest Penetration Testing Report available upon request

Security Standards

OWASP security guidelines followed
Regular security review of dependencies
Secure coding practices enforced

Security Reporting

Responsible Disclosure

Report security vulnerabilities to security@vybe.build
We take all security reports seriously and respond promptly
Work with security researchers to address issues responsibly

Incident Response

Dedicated security monitoring and alerting
Rapid response to security incidents
Transparent communication with affected customers

Subprocessors

View Vybe Subprocessors list

Become an AI native company

AI coworkers and custom apps that run your operations

Product

Company

Social

Legal