Security Policy

Overview

VibeWorks takes the security of our platform and your data seriously. This policy describes how we approach security across our infrastructure, data handling, and product. And how you can report vulnerabilities to us.

Data We Collect

We collect only the data necessary to operate the platform. This includes:

• Account information (email address, display name, username)
• OAuth tokens for any connected platform
• Project metadata imported from connected integrations
• Portfolio content you create or edit on VibeWorks
• Basic usage analytics (page views, portfolio visits)

We do not collect or store payment card information. Payments are processed by Stripe and subject to their security policies.

Data Storage and Encryption

All data is stored in encrypted databases hosted on infrastructure with SOC 2 Type II compliance. Sensitive credentials such as OAuth tokens are encrypted at rest using AES-256. All data transmitted between your browser and our servers is encrypted in transit using TLS 1.2 or higher.

Passwords are stored as bcrypt hashes; nothing is kept in plaintext. You can also sign in with secure, time-limited magic links.

Cohort Anonymity (Pulse / Org View)

Pulse, the org-level view available to admins, only ever renders aggregated, anonymized cohort signal. We enforce a minimum cohort size before any score is shown, suppress cells whose membership falls below the floor, and never expose individual fluency scores, prompts, or conversations to other members of an org. Per-user evidence stays in the individual surface and is never joined back to a cohort row.

Authentication and Access Control

All authenticated routes require a valid signed session, established at login and invalidated on logout. We apply strict server-side authorization checks on every request. Users can only access and modify their own data.

Public portfolio pages are intentionally unauthenticated and contain only information the account holder has explicitly chosen to make public.

Third-Party Integrations

When you connect a third-party platform, VibeWorks requests only the minimum OAuth scopes needed to read your project data. We never request write permissions unless explicitly required and documented. You can revoke access to any connected integration at any time by emailing us.

OAuth access tokens for connected platforms are stored encrypted and are never exposed in API responses or client-side code.

Infrastructure Security

• Our services run in isolated containers with least-privilege IAM policies
• Database access is restricted to application servers via private networking
• We use automated dependency scanning to detect known vulnerabilities in our dependencies
• Production deployments go through automated testing pipelines before release
• We maintain audit logs of privileged operations

Data Retention and Deletion

You can delete your VibeWorks account at any time by emailing hello@fluencity.ai. Upon deletion, your personal data, portfolio content, and connected integration tokens are permanently removed from our production systems within 30 days. Anonymized analytics data may be retained for longer periods.

AI Fluency conversation uploads follow a stricter retention window: raw conversation text is automatically deleted 90 days after the conversation started. Extracted per-dimension signals and your aggregated fluency scores persist past that window. Only the raw bodies are dropped. You can ask us to delete the raw text at any time, or to wipe every uploaded conversation, every signal, and every aggregated score.

We do not sell your data to third parties. We do not use your portfolio content to train AI models without explicit consent.

Vulnerability Disclosure

We welcome responsible disclosure of security vulnerabilities. If you believe you have found a security issue in VibeWorks, please report it to us privately before disclosing it publicly.

To report a vulnerability, email us at security@fluencity.ai. Please include:

• A description of the vulnerability and its potential impact
• Steps to reproduce the issue
• Any relevant screenshots, request/response examples, or proof-of-concept code

We will acknowledge your report within 2 business days and aim to provide a resolution timeline within 5 business days. We ask that you give us a reasonable amount of time to address the issue before any public disclosure.

Contact

For general security questions or concerns, reach out to security@fluencity.ai. For other inquiries, contact us at hello@fluencity.ai.