How Vibgrate handles security questions
Security reviews stall when the answer is a badge, or when it is a folder of policies nobody can see. This Trust Center is the short version: what the program is aligned to, how your code is handled, who else processes data, and how to reach a person.
Aligned to ISO/IEC 27001 and SOC 2. Independent audit planned.
That sentence is the whole of the framework claim. Top management approved the security policies on 7 October 2026. An independent audit has not been commissioned. This site is not a certificate and not an auditor's report.
What you can read here
- Security overview — what the program covers, and the status sentence.
- Frameworks and status — the standards the program is written against, and what we do not claim.
- Data handling — scans send metadata. Source stays on your machine, with one exception you choose.
- Subprocessors — who processes data, what they receive, and where.
- Policies — what each approved policy covers. The full text is not posted.
- Data processing agreement — the template, on request.
- Vulnerability disclosure — how to report a problem, and how fast we answer.
- Contact — security and privacy mailboxes.
Signed releases, SBOMs, and the commands to check a signature live on Signed releases. The longer account of ingestion lives on Security.
The policy set, the Statement of Applicability, the data processing agreement, and CAIQ Lite are available on request under NDA. There is no portal. Write to [email protected]. The list is on Policies.
Last reviewed
12 October 2026.
Trust changelog
- 12 October 2026. Trust Center text reviewed. Documents available on request are listed on Policies. To hear when the subprocessor list changes, use the note on Subprocessors.
What we leave out on purpose
Audit reports, when a company has them, are almost always behind a request. We do not have one to send. We also do not publish internal review notes, scan totals, or the names of individuals. Role mailboxes are on the contact page.