Trust & Security

VibeMap turns product ideas into structured specifications. That means you trust us with your proprietary product plans, requirements, and — in the app builder — your code. This page explains, in plain terms, how we protect that data. If your security team needs more detail or a completed questionnaire, email security@vibemap.ai.

Your data is yours

• You own your inputs and generated outputs. We process them to deliver the service — nothing more.
• We do not sell your data. Ever.
• Export and deletion on demand. Export your projects as Markdown / JSON, or delete your account and associated content at any time (billing records are retained only as long as tax law requires).

AI data handling

This is the question most teams ask first, so we answer it directly. VibeMap sends your prompt content to large-language-model providers to generate artefacts. Here is exactly how that is governed:

• No training on your data. Your inputs and generated outputs are not used to train foundation models — not by us, and not by the providers we route to on paid plans.
• Enforced at the gateway, not just promised. Paid inference is routed through OpenRouter with a data_collection: "deny" policy, which restricts routing to upstream providers whose data policy is not to log or train on prompts. Optionally we can require zero-data-retention endpoints as well.
• Transient processing. Prompt content is transmitted to the provider, processed to produce an output, and returned. We persist your projects in our own database (so you can come back to them); the provider does not retain the request for training.
• Free tier is different — and labelled. If you explicitly choose a free model, that traffic may run on endpoints that collect prompt data (this is how “free” models are funded). Do not put confidential content through a free model. All paid plans carry the no-collection policy above.
• Safety monitoring. We apply automated abuse filters. Manual review is limited to content specifically flagged for safety.

Infrastructure & application security

• Encryption in transit: TLS 1.3 for all connections.
• Encryption at rest: AES-256 for database and object storage (Supabase, Vercel).
• Access controls: row-level security scopes every project to its members; privileged database keys are used only in server-side code, never shipped to the browser.
• Authentication: handled by Supabase Auth. Passwords are hashed, never stored in plaintext. OAuth sign-in supported.
• Payments: processed by Stripe. We never see or store your card details — they live in Stripe's PCI-DSS Level 1 environment.
• Monitoring: application errors and performance are monitored with Sentry; product analytics via PostHog. An organisation-wide spend kill-switch can halt all AI generation instantly during an incident.
• Hosting: Vercel's global edge network, with our database on Supabase's managed Postgres.

Subprocessors

We share data with the following subprocessors only as needed to run the service. The authoritative, versioned list lives in our Privacy Policy; the LLM-relevant entries are:

Compliance status

We are transparent about where we are on the compliance journey rather than implying more than is true:

• GDPR / UK GDPR: our practices are built around data-subject rights (access, deletion, portability, objection). See the Privacy Policy.
• Data Processing Agreement (DPA): available to business customers on request at legal@vibemap.ai.
• PCI-DSS: payment card data is handled entirely by Stripe; VibeMap never stores card numbers.
• SOC 2 Type II: on our roadmap. We are building toward the Trust Services Criteria and can share our current security posture and questionnaire responses under NDA today — contact security@vibemap.ai.

Reporting a vulnerability

We welcome reports from security researchers. Email security@vibemap.ai with steps to reproduce. Please give us a reasonable window to remediate before public disclosure. Acting in good faith under this policy — avoiding privacy violations, data destruction, and service disruption — we will not pursue or support legal action against you. Our machine-readable policy is published at /.well-known/security.txt.

See also: Privacy Policy · Terms of Service. Questions? security@vibemap.ai.