Home
Fibly logo
FiblyContact

Legal and trust

Security at Fibly

A factual overview of current safeguards, user responsibilities and how to report a vulnerability. It is not a certification or a promise that incidents are impossible.

Effective: October 10, 2026

No system is risk-free

Fibly applies technical and organizational safeguards appropriate to an early-stage cloud service, but no internet service can guarantee absolute security. Do not use Fibly as the only copy of critical information.

1. Current safeguards

  • HTTPS encrypts traffic between supported browsers and the service.
  • Supabase authentication manages passwords and OAuth sessions; Fibly does not store plaintext passwords.
  • Database row-level security and server-side authorization are designed to restrict workspace records to their owner.
  • Private note images use private storage and time-limited signed access links.
  • Public APIs apply security headers, rate limits, authentication and input validation according to their route.
  • Production secrets are intended to remain server-side and outside public client bundles.
  • Agent actions are scoped to the authenticated user, reviewed before execution and recorded for audit/undo where supported.
  • Session replay is disabled in error monitoring, and default personally identifying telemetry is disabled.

2. What you should do

  • Use a unique password and secure your email and Google account.
  • Sign out of shared devices and use "sign out all devices" if you suspect unauthorized access.
  • Review connected Google Calendar, Spotify, notification and browser permissions.
  • Do not place passwords, authentication keys, full payment-card details or irreplaceable records in notes or prompts.
  • Contact support promptly if you notice unexpected account activity.

3. Responsible vulnerability reporting

Send reports to support@fibly.app with "Security" in the subject. Include the affected URL or feature, reproduction steps and impact. Do not access another user's data, use destructive tests, maintain persistence, disrupt availability, publicly disclose an unremediated issue or demand payment. Fibly does not currently operate a paid bug-bounty program.

4. Security incidents

Fibly will investigate suspected incidents, work with providers, preserve appropriate records and notify affected people or regulators when required by applicable law. Details may be limited while an investigation is active.

5. Certifications and assurance

Fibly does not currently claim SOC 2, ISO 27001, penetration-test certification, "bank-grade" security or immunity from breach. Provider certifications apply to those providers and do not automatically certify Fibly.