Fabius reads from the apps you connect so it can tell you what changed and what needs you. That means holding the keys to your other accounts, so here is exactly how we look after them.
Read-only by design
- Fabius only reads. It never posts, sends, merges, deletes, or changes anything in your apps.
- When you sign in to an app, Fabius asks for the narrowest read-only permission that app offers. When an app needs a key instead, we ask for a read-only (or restricted) one and say which.
- Anything Fabius suggests, like a drafted reply or a task, only happens after you choose it, and in Fabius itself.
Your credentials
- App sign-ins, tokens, and keys are encrypted (AES-GCM) before they are stored, and are never sent back to your browser.
- Passwords for Fabius are stored only as a salted hash (PBKDF2-SHA256), never in readable form.
- Disconnecting an app deletes its credentials and the data synced from it right away.
- Teammates on a Fabius Max team never see your credentials, can't connect or change apps, and only see the clients you choose.
Your account
- Sessions end after a week without use, and you can sign out of every device at once from Settings.
- Repeated failed sign-ins are slowed down, and password reset links work once, for one hour.
- Every connection, credential change, sync failure, and deletion is recorded in an activity log you can read in Settings.
- You can export your workspace at any time, and deleting your account deletes everything in it immediately.
The website
- HTTPS everywhere, with HSTS, a strict Content Security Policy, and protection against being framed by other sites.
- Personal pages and data are never cached by browsers, proxies, or CDNs.
- Every request that changes something checks that it came from Fabius itself.
- Payments are handled by our payment provider; your card details never reach Fabius.
Your data
- We don't sell your data, show ads, or share it with other users.
- Data from Google APIs (YouTube, Calendar, Analytics) is never sent to an AI service.
- AI answers in Ask Fabius can be switched off in Settings; then nothing leaves Fabius to answer you. Usage counts can be switched off too.
- The full details of what we collect and how long we keep it are in the privacy policy.
What we don't claim
Fabius is a young product. We don't have SOC 2 or ISO 27001 certification, and we don't offer single sign-on yet. If your organisation needs those, tell us.
Reporting a problem
If you think you've found a security issue, please use the contact details on fabius.online before sharing it anywhere else. We'll reply, keep you updated, and credit you if you'd like.