Trust & security
Security built for a multi-tenant platform
VibeBackend is designed to securely support many independent websites using a multi-tenant architecture. Tenant isolation, encryption and role-based access are active today; items marked “planned” are part of the roadmap and not yet live.
Tenant isolation
Every organization, website and user lives in its own isolated tenant. Data is scoped per tenant on every request so one customer can never read or write another customer’s content.
Encryption
Traffic is encrypted in transit with TLS, and secrets and credentials are encrypted at rest. Public read tokens are separated from server-side write credentials.
Secure credentials
Administrative write keys are never exposed in browser JavaScript or AI prompts, and prompts only ever reference environment variable names. Self-service key rotation is planned.
Role-based permissions
Granular roles from Platform Owner down to Viewer control exactly what each user can see and do. Authorization is enforced server-side, never only in the UI.
Backups & restore
The platform is designed for automated database and media backups with documented restore procedures so content can be recovered.
Audit logs (planned)
A full audit trail of sensitive actions — logins, publishes, deletes, invitations, permission and billing changes, key rotations — is planned and not yet recorded today.
Signed webhooks (beta)
Every outbound webhook is signed with a per-endpoint HMAC-SHA256 secret over a timestamped payload, so your deployment can verify a rebuild request genuinely came from VibeBackend and reject replays. Deliveries retry with backoff and are recorded in a per-site delivery log.
Allowed-domain controls
Each site defines which domains may use its public token, with input validation, CSRF and XSS protections and secure file-upload handling throughout.
VibeBackend does not claim security certifications it has not yet obtained. This page describes the security model and practices the platform is built around. For specific compliance requirements, contact our team.