Where your code goes, and what gets checked
VibeManager builds software in a folder on your computer. This page explains what leaves your machine, how long we keep it, and what VibeManager is and isn't allowed to do on your computer.
Your computer
Projects, files and version history stay here.
VibeManager servers
Your requests and VibeManager's steps pass through. Records are kept 30 days, in the EU.
AI model provider
Answers each request. Some providers are in the United States.
Your project stays on your computer
Your projects, files and version history stay on your machine. To answer, the AI model has to see your request, so the app sends our servers:
- your messages
- the code and files VibeManager reads
- the AI model's replies and each step VibeManager takes
We pass these to the AI model provider that answers each request. Some of these providers are in the United States.
How long we keep it
- 30 days
- Our records of each request and step, kept on our own servers in the EU to run the service and fix problems. Then we delete them. We keep a count of usage (cost and timing, never your messages or code) for accounting.
- Your choice
- “Help improve VibeManager” in Settings, under Privacy, decides whether we may also use them to improve the product. It starts off in the EU and EEA, the UK and Switzerland.
- Never sold
- We don't sell your data and we don't show ads.
VibeManager works inside your project, within limits
- Unfinished work is built in its own copy of the project, inside your project folder. Nothing is written outside the project before a change is approved and added.
- VibeManager is kept from reading your secrets, such as passwords and keys.
- VibeManager can't start a server that is open to your whole network.
- When you save a version of your work, VibeManager never offers your .env file, the file that holds your passwords and keys.
- Each project has a budget. When it runs out, the work under way stops.
Check any folder for security problems
Choose a folder and VibeManager checks the code for security problems. On a Mac, the audit can run the code it checks in an offline sandbox that blocks outside network access, and each finding is double-checked before it reaches you. If your Mac is missing a tool the sandbox needs, the audit reads the code without running it. Nothing in the folder is changed, and the audit reads only that folder. Like any request, the code it reads goes through our servers to the AI model, under the same 30-day record.
- See findings in a table or a board, each with how it was checked and a suggested fix.
- Export a report as PDF, Markdown, CSV, JSON or SARIF (the format code-scanning tools read).
- Send findings back to VibeManager with Fix with VibeManager, then re-check to mark them fixed.
- Reports stay on your Mac unless you choose to keep finished reports in your VibeManager account.
- The audit's working files stay on your Mac for 7 days by default (Settings, Storage).
On Windows the audit reads the code but doesn't run it. Running it in the sandbox needs a Mac.
Certifications we're working toward
VibeManager is young, and it isn't certified yet. SOC 2 Type II and ISO 27001 are planned. If your security team has questions before then, we'll answer them directly.
- SOC 2 Type IIPlanned
- ISO 27001Planned