Trust · Last updated 28 September 2026

Security

Fabric connects to your production databases, so this page says plainly where it runs, what it keeps, what it never keeps, and how one workspace is kept apart from another.

This document is a working draft and has not yet been reviewed by counsel. If you need a signed copy or have questions, write to legal@fournibbles.com.

Where it runs

The hosted service runs on DigitalOcean, LLC. The platform, its database and every workspace's pipeline runners run there; nothing is replicated to another provider.

If your data must never leave your own network, run Fabric self-hosted instead: the same product, installed with one Helm chart in your own VPC. Write to sales@fournibbles.com.

What we store

Your account: your email address and your workspace's name. There are no passwords; see Signing in.
Connection settings for your sources and destinations. Every secret among them — database passwords, access keys, tokens, connection strings — is encrypted at rest with Fernet (AES-128 in CBC mode with an HMAC-SHA256 integrity check) before it is written, under a key held as a Kubernetes secret, not in the database. Secrets are write-only in the interface: once saved they are never shown again.
Pipeline state: the tables you chose, their column definitions, the replication position (for example a Postgres log sequence number or a MySQL binlog position), run history, and operational logs.

What we don't store

Your rows. You bring your own destination — your bucket, your warehouse, your database — and every change is written there. A runner holds changes in memory only until they are committed to your destination, then discards them. We do not keep a copy of your data, and we provide no storage for it.

How workspaces are isolated

Its own Kubernetes namespace. Each workspace's worker and pipeline runners run in a namespace of their own, under CPU and memory quotas, so one workspace cannot starve another.
Network policy, deny by default. Nothing can connect into a workspace. A runner may reach DNS, the platform database, and the public internet (to reach your source and destination) — never another workspace and never any private address inside the platform. Runners have no access to the Kubernetes API.
Its own database role. Each workspace connects to the platform database as its own role, and row-level security in the database — not only the application — restricts that role to its own rows. The credential that could lift that restriction is never given to a workspace.

Connecting to your database

Runners connect out to your database; you never open an inbound path to us. Allowlist our outbound address in your firewall or security group: [to be completed].
Give Fabric a dedicated login with only the privileges change capture needs. The least-privilege setup guide has the exact grants for every source.
A database without a public endpoint can be reached through an SSH bastion you control; Fabric checks the bastion's host key against a fingerprint you supply (or, if you supply none, the key seen on first connection), and everything between the runner and the bastion is encrypted. The hosted service requires TLS to your database by default: a new source starts at require, and the two stronger modes also check the server's certificate — and its name — against a CA you supply. Self-hosted, you choose the TLS mode per source, so each connection is encrypted the way that database can be; the source setup guide lists the modes each engine offers and where to download the CA.

Sign-in is passwordless: we email a single-use link that expires after 15 minutes. The sign-in form is protected against automated abuse.
Moving from your account into your workspace uses a signed token that is valid for 60 seconds, can be used once, and only for your own workspace.
All traffic to the site, the API and workspaces is HTTPS.

Backups

[to be completed]

Who has access

Four Nibbles is a small team. Production access is limited to the people who operate the platform, and we look at a workspace's configuration or logs only to operate the service or when you ask us to for support. The third parties that process data for the service are listed in the privacy policy.

Reporting a vulnerability

Write to security@fournibbles.com with what you found and how to reproduce it. We will acknowledge within two business days, keep you informed while we fix it, and credit you if you wish. Please don't access other customers' data, degrade the service, or disclose the issue publicly before it is fixed; good-faith research that follows these rules is welcome.