Security overview

Every Vibewax project starts with secure foundations built in. Encryption, EU hosting, authentication, isolated databases, and edge protection come ready out of the box. This page explains what runs in the background so you don’t have to set it up, and what stays with you as the person publishing the project.

How security works on Vibewax

Security in any web application involves both the platform underneath it and the person building on top. Vibewax takes care of the infrastructure layer: hosting, encryption, the authentication library, edge protection, isolated databases, and ongoing security updates. You stay in charge of the application layer: what data your project stores, who can access it, and how your end users are informed.

This split means you don’t need to set up servers, certificates, or auth libraries from scratch. It also means decisions about your data and your users stay with you, where they belong.

What’s built in

Hosting and data residency

Published projects are hosted in the EU region (Frankfurt). Databases run in EU West (Ireland). Both sit behind an edge network, which serves content from servers closer to your visitors and mitigates attack traffic before it reaches your project.

Each Vibewax project gets its own isolated database, so data from one project is never mixed with another.

You can also choose the region where the AI models the agent uses to build your projects run. If you need your data to stay in the EU, you can select models hosted only in the EU. For the list of available models and the countries where they are hosted, see AI models.

Encryption

Data is encrypted in transit and at rest:

HTTPS is enforced on every published project
Data at rest is encrypted at our hosting and database providers
Sensitive credentials used internally by Vibewax are encrypted before storage

Authentication

Vibewax’s built-in authentication uses an industry-standard library that handles password hashing, session management, and one-time codes. Two methods are available:

OTP login for passwordless email-code authentication
Email and password login with signup, verification, and reset flows

You don’t need to set up a separate auth service. Describe what you need in your prompt and the agent connects it to your project’s database.

Secure-by-default agent

The Vibewax agent is guided by built-in practices that apply across every project. Authentication, database access patterns, secrets handling, and integration setup follow established defaults rather than being assembled from scratch each time.

The agent works in a secure sandbox with real development tools, so it can build, run, and test your project in an isolated environment.

You can also ask the agent at any time to walk you through how a specific part of your project is protected, or to adjust something based on your needs. See Building secure apps for practical guidance.

AI transparency

Vibewax tells people when AI is involved. A notice above the prompt explains that you are working with an AI agent, and published projects carry a machine-readable ai-generated tag in their head.

These cover the platform. Disclosures about your own project, such as a chatbot you build for your end users, stay with you. See Using AI responsibly for where the line sits.

Edge protection and updates

The edge network and the platform’s protections handle common abuse patterns automatically, including DDoS mitigation and basic bot filtering. Security-relevant fixes to our infrastructure and underlying dependencies roll out across all projects continuously, so you don’t need to track or apply patches yourself.

Vulnerability scanning and security reviews

Vibewax scans published Next.js apps for known framework vulnerabilities. If a critical issue is found, publishing stays blocked until you resolve it by clicking Fix Now, which sends the fix straight to the agent.

You can also run a full security check on your project at any time. The Security tab in your chat reads through your code, reports what it finds in plain language across eight areas from access permissions to payments, and can apply the fixes for you. The first check in each chat is free.

What’s in your hands

When you publish a project on Vibewax, the application itself is yours. A few things naturally stay with you, since they depend on your project and your users.

Data and compliance

You decide what data your project collects and stores. Compliance with GDPR, the CCPA, and other laws applicable to your end users is something to plan for as part of building. In practice, this usually means:

Letting your users know how their data is handled
Adding a privacy policy if your project collects personal data
Including a cookie banner if your project serves EU visitors
Being able to handle user requests for access, correction, and deletion

The agent can help with most of these. Adding a privacy policy, a cookie banner, or a data deletion flow is a normal part of working on a project.

Your application’s access controls

The agent can build authentication, role-based access, and ensure each user only sees their own data. How these are set up for your project, and who sees what, is part of describing what you want. The next page, Building secure apps, covers how to do this well.

Backups

Vibewax provides several safeguards for your project and your data:

Project versions are saved as the agent works. You can restore an earlier version from any message in the chat.
Source code of git-backed projects is durably backed up on Vibewax’s side.
Database snapshots can be exported as a ZIP file from the Database tab whenever you want your own copy of your data.

For git-backed projects, source code is backed up in a managed Git service and immutable snapshots in private storage. Restoring a project version changes its code, not database records or files uploaded by app users. Export your database from the Database tab for your own copy of its tables and rows; the ZIP excludes uploaded files. Importing a database export replaces the target data. See Downloading and restoring.

Your data is still yours, so keeping your own copies is a good habit, especially before significant changes:

GitHub integration backs up your project’s source code to a private repository
Duplicating chats creates an independent copy of your project as a safety point before larger changes

AI features in your app

If your project includes AI features for end users, such as chatbots, content generation, or summarization, the configuration and the outputs they produce are part of your project. Your end users need to know when they are interacting with AI, and Vibewax’s own in-app notice does not carry over to what you publish. Using AI responsibly covers what to add and where.

Payments

Vibewax is not a payment processor and does not store or transmit card data. If your project accepts payments, use a hosted payment provider that handles cards on its own infrastructure. Avoid storing card numbers, CVCs, or other raw payment data in your project’s database.

When Vibewax is the right fit

Vibewax is built for marketing websites, landing pages, internal tools, dashboards, MVPs, and small to medium web applications. It works well for projects where you want to move quickly and iterate based on real feedback.

For projects involving highly regulated data, additional compliance work may be needed beyond what Vibewax handles by default. This includes:

Healthcare data covered by HIPAA or similar regulations
Raw payment card data subject to PCI DSS
Apps directed at children under 13 (COPPA) or under 18

If your project falls into one of these areas, talking to a legal or compliance advisor early on is a good idea. Vibewax can still be useful for parts of the work, while the compliance side benefits from human expertise.

Reporting a security issue

If you spot something that looks like a security issue, we’d like to hear about it. Contact support with a description and steps to reproduce, and we’ll review it as quickly as we can.

If you think your published app has been compromised, contact support right away instead of relying on a code restore. Include the project and published URLs, when you noticed the problem, and what changed. Do not send passwords or API keys.

Compliance and legal documents

For full details on data processing, subprocessors, and contractual terms: