# How Fabric Protects Your Data

Security measures that keep your data safe on the Fabric platform

## Data in Transit

**All communication is encrypted using TLS (HTTPS).**

- API calls: HTTPS only
- WebSocket connections: WSS (WebSocket Secure)
- File uploads/downloads: Encrypted channels

No unencrypted data transmission is allowed.

* * *

## Data at Rest

**Files are stored in encrypted cloud storage.**

- Workload packages: Encrypted
- Job inputs/outputs: Encrypted
- Result files: Encrypted

Storage uses industry-standard encryption (AES-256).

* * *

## Workload Isolation

Each job runs in an isolated sandbox:

- **Separate process:** Jobs cannot see other jobs
- **Temporary filesystem:** Deleted after completion
- **No network access:** Cannot exfiltrate data
- **Resource limits:** Cannot consume all system resources

See Workload Sandboxing for details.

* * *

## Authentication

**JWT-based authentication:**

- Tokens are signed and verified
- Tokens expire (limited lifetime)
- Secure token storage in agents
- OAuth integration for Google sign-in

**Browser-based OAuth:**

- No passwords stored in desktop app
- External browser for authentication
- Secure callback handling

* * *

## Node Privacy

**Device owners identities are protected:**

- Job submitters see only anonymized node IDs
- No personal information shared
- Hardware info used only for matching
- Location not tracked

* * *

## Job Submitter Privacy

**Your code and data are protected:**

- Only matched node sees your workload
- Workload deleted after execution
- Results returned only to you
- Node cannot retain your data

* * *

## Access Control

**Organization-level security:**

- Resources scoped to organizations
- Role-based access within organizations
- API keys scoped to specific permissions
- Audit logs for sensitive actions

* * *

## Infrastructure Security

**Platform security measures:**

- Cloud infrastructure with security compliance
- Regular security updates
- Network isolation between components
- Rate limiting to prevent abuse
- DDoS protection

* * *

## Stripe Payment Security

**Payment data handled by Stripe:**

- PCI-DSS compliant
- Card numbers never touch Fabric servers
- Secure tokenization
- 3D Secure support

* * *

## What We Do Not Do

- We do not sell your data
- We do not train models on your workloads
- We do not retain job data after completion
- We do not track device locations
- We do not access your personal files

* * *

## Reporting Security Issues

If you discover a security vulnerability:

Email security@fabric.carmel.so

Include detailed description

Steps to reproduce if applicable

We will acknowledge within 48 hours

Do not publicly disclose until we have addressed the issue.