Security

1. Where Fabricate runs

• Fabricate and the apps you publish run on Cloudflare (Workers, Durable Objects, the D1 database and R2 storage). Cloudflare's platform is independently audited against SOC 2 Type II and ISO 27001.
• All traffic to fabricate.build and to published apps, including apps on your own domain, is served over HTTPS.
• Cloudflare encrypts the databases and stored files at rest.

2. Your account

• Sign-in is handled by Clerk. Your password, if you use one, goes to Clerk and never reaches Fabricate's servers.
• Every request made as you, to read or change your account or your apps, is checked against your signed-in session, and every change to an app checks that you own it or were invited to edit it. A few read-only requests are public on purpose and need no sign-in, such as viewing an app whose visibility is set to public.
• You can delete your account at any time from Settings, Account. The retention periods after deletion are in Section 6 of the Privacy Policy.

3. Payments

Plan payments are taken by Stripe Checkout. Your card details go directly to Stripe, a PCI DSS Level 1 certified payment processor, and never reach Fabricate's servers. Payments made inside an app you build go to your own Stripe account, as described in Section 1.6 of the Privacy Policy.

4. The apps you build

• Each published app runs as its own Cloudflare Worker, separate from Fabricate's own systems and from other people's apps.
• Secrets you add to an app, such as API keys, are encrypted with AES-256-GCM before they are stored. Only the app's owner can manage them.
• You can invite people to edit or view a single app. Editors can change and publish it; only the owner can delete it, change its visibility, connect domains, see its secrets, database, form responses and analytics, export its source, or invite and remove people.

5. AI and your data

To build your app, your prompts and your app's code are sent to the AI providers listed in Section 4 of the Privacy Policy. We do not use your prompts or generated content to train AI models, and we do not sell your data.

6. Monitoring and incidents

We monitor errors across the platform and run automated misuse checks on some prompts and AI replies. If we become aware of a security breach affecting your personal data, we will notify you and the relevant authorities as required by applicable law.

7. Certifications and single sign-on

Fabricate does not hold its own SOC 2 or ISO 27001 certification today, and single sign-on (SAML) is not available yet. If your organization needs a security questionnaire answered, email support@fabricate.build and we will answer what we can.

8. Reporting a vulnerability

If you find a security issue in Fabricate, email security@fabricate.build with the steps to reproduce it. Please give us a reasonable time to fix it before you disclose it, do not access or change other people's data, and do not run tests that degrade the service or target apps that other people have published. We do not run a paid bug bounty program. Our contact details are also published at /.well-known/security.txt.