Security

Last updated 11 October 2026

Fibonna is based in Singapore. In this page, "we" means the people who run Fibonna.

Fibonna holds what your coding agents remember: decisions, lessons, tasks and handoffs. This page says how we protect it and how it is handled. For exactly what leaves your stack, see Privacy.

One stack per pilot

Every pilot gets their own isolated stack: one backend and one database, used by nobody else. No data is shared between pilots.

Where it runs

• Railway hosts each stack's backend and Postgres database.
• Cloudflare runs the API gateway, file storage (R2), sign-in and this website.

Protecting access

• Secrets are held as platform secrets on the services above. They are never written into code.
• Machines are paired with their own key. You can revoke a machine's key without affecting your others.
• Sign-in is with Google, and asks for openid, email and profile only. We can't see your Gmail, your Calendar or anything else in your Google account.
• Your AI key. Your API key is stored once, in your own stack's database, encrypted with a key derived from your stack's server secret. Responses and logs show only its last four characters. It is sent only to the provider you chose, and never shared with another stack.
• Transport: all traffic uses TLS.

Backups

Each stack is backed up on its own, and we run restore drills to check that a backup can be brought back. When you leave, we delete your whole stack. Backups of a deleted stack are purged within 30 days.

Who can see your data

Only the people who run Fibonna can reach a pilot's stack, and only to support you. We ask for your consent first. The one exception is responding to a security incident.

What leaves your stack

Embeddings, which make your memories searchable, are computed on your stack and never sent out. Your stack calls the AI provider you chose, with your own key, for five jobs: compiling memories into pages, checking and distilling lessons, the Ask chat, extracting lessons from a handoff and summarising a session for a handoff. Each job sends only the text it needs. Fibonna holds no AI key of its own for pilot stacks. The Privacy page lists every recipient and what each one receives.

Your data, your call

You can ask to see, export or delete everything on your stack. Email [email protected] and we will do it within 7 days. When you leave, we delete the whole stack.

This website

fibonna.com sets no cookies and uses no analytics. The only thing it stores is an application you choose to send, with a hashed IP address used to limit abuse.

Where we are today

Fibonna is early, and we don't hold any third-party security certifications yet. We would rather say so than imply otherwise.

Report a problem

If you think you've found a security problem, or something looks wrong on your stack, email [email protected].