Security
How we protect your app and its data
The short version of what we run, what we do not store and how to report a problem.
Data separated per account
Every project's data is isolated per tenant, and access to each record is decided by the app's own rules — public, signed-in, by role or by ownership.
Card data never touches your app
Payments go through Stripe, Pagar.me and Mercado Pago. The card fields are rendered by a hosted vault component; the card number does not pass through the code the AI wrote.
Builds run isolated
An app's build runs in an ephemeral container with no host environment, dropped capabilities and CPU, memory and time limits. Secrets stay outside it — the sandbox never sees one.
Files served safely
Active document types are forced private and delivered through short-lived signed URLs; videos are never public links.
Secrets are held, not copied
Integration credentials live in encrypted rows on our side and are injected at call time. Snapshotting an app into a template never carries a secret with it.
Edge protection
The published apps and the platform sit behind Cloudflare, with HTTPS, rate limiting and bot protection in front of them.
Reporting a vulnerability
Email security@fabapp.com. Our disclosure channel is published at /.well-known/security.txt, following RFC 9116. Please give us a chance to fix it before publishing.
Documents: The terms of use, the privacy policy, the data-processing addendum and the responsible-use policy are published in full and versioned.