Security & data

Last updated: August 4, 2026

WPVibe is a hosted relay between the AI client you already use and the WordPress sites you authorize. This page explains how that path works, what we store, how credentials are protected, and the safety defaults built into the product. For legal privacy terms, see the Privacy Policy. For product brakes in plain language, see Safe by default on the homepage.

How data flows

When you connect WPVibe and run a tool, the path is:

Your AI client (Claude, ChatGPT, Cursor, or another MCP-compatible client) calls WPVibe.
The WPVibe service runs on Cloudflare Workers at mcp.wpvibe.ai. That Worker is the product: a hosted relay so web AI clients can reach your site without a local install.
The Worker authenticates your WPVibe account, applies plan limits and safety gates, then sends an HTTPS request to your WordPress site.
The free WPVibe plugin (WordPress.org slug vibe-ai) executes the request under the WordPress user you authorized, then returns results to the Worker.
The Worker returns tool results to your AI client. The AI client displays, stores, or processes those results under its own privacy policy and settings.

The Worker sits in the path on purpose. That is how WPVibe works from Claude or ChatGPT in the browser. We do not claim that site content never leaves your host. We do claim that access is authorized by you, credentials are encrypted, risky actions can require your approval, and we do not use your site content to train WPVibe-owned AI models.

What we hold vs what we do not

We store to run the service

Account: email, plan, sign-in session, Stripe customer/subscription identifiers if you pay.
Connected sites: site URL, site name, connection status, WordPress username used for the Application Password, timestamps.
Site credentials: WordPress Application Passwords generated for WPVibe, encrypted at rest with AES-GCM. We never store your normal WordPress login password.
Approvals: parameters and dry-run previews for gated operations, approve/decline status, and related timestamps for security and support.
Usage and reliability logs: tool name, site URL, action detail (for example a REST route or CLI family), status, error type, duration, plan, MCP client name/version, session id. These power daily allowances, debugging, and abuse prevention. They are not a full archive of every page you edited.

What passes through but is not our content store

Tool inputs and outputs may include WordPress content, media, settings, or admin data when you ask for that work. That data is processed to complete the request and returned to your AI client. Content you create or change lives on your WordPress site and host, under your policies. Draft themes, uploads, and published changes remain on your site until you remove them.

What we do not hold

Your WordPress admin password (use Application Passwords only).
Your Claude, ChatGPT, or other AI provider API keys. You bring your own AI subscription; those vendors are not WPVibe API keys we store.
Payment card numbers (Stripe handles checkout).

Key custody

Connect flow uses WordPress Application Passwords on WordPress's own authorization screen. WPVibe never asks for your normal WP password.
Stored Application Passwords are encrypted at rest (AES-GCM).
Credentials are decrypted only as needed to call your site for a tool you (or your AI client on your behalf) requested.
You can disconnect a site in WPVibe at any time, or revoke the Application Password under Users → Profile → Application Passwords in WordPress. Either path stops further access with that credential.

Safety defaults (product brakes)

Security is not only encryption. WPVibe is built so the AI cannot silently wreck a live site:

Draft-first themes: theme work happens in an isolated draft. Preview uses a private URL. Publish is explicit, with an automatic backup of the previous theme on publish.
Approval gates: destructive or high-risk operations (bulk deletes, search-replace, role changes, and similar) can require a dry-run preview and your browser approval before they run.
Approval log: gated operations leave an audit trail of what was proposed and whether you approved.
Trash, not hard-delete for content deletes where WordPress supports trash.
WordPress capabilities: the plugin runs as the WordPress user you authorized. It cannot do more than that user can do in wp-admin.
WP-CLI allowlist: commands are emulated in PHP against an allowlist. There is no open shell, no arbitrary eval, and lockout protections on role and capability edits.
HTTPS end to end between the AI client, WPVibe, and your site.

No online service is risk-free. You control which sites you connect, which AI client you use, and which prompts and tools you run.

Training and models

We do not use your WordPress site content to train WPVibe-owned AI models. WPVibe does not run the large language model itself. Your AI client (Claude, ChatGPT, Cursor, and so on) processes prompts and tool results under that vendor's terms. Check that vendor's settings for conversation retention and whether data may be used to improve their models.

Sub-processors and infrastructure

These providers help us run WPVibe. We disclose data to them only as needed for the roles below.

Provider	Role
Cloudflare	Hosted relay (Workers), databases and key-value storage (D1, KV), object storage where used, edge network, security, Analytics Engine, Browser Rendering when a tool needs it
DigitalOcean	Off-Cloudflare egress forwarder for WordPress hosts that challenge or block Cloudflare-origin traffic
Stripe	Checkout, subscriptions, billing records
SendLayer / Lindris	Magic links, service email, lifecycle messaging
Google Analytics	Marketing site usage on wpvibe.ai only
Unsplash (and similar)	Image search when you use media search tools

Your AI provider is not our sub-processor for model generation. You already have an account with Claude, ChatGPT, or another client. Tool outputs are returned to that client; their privacy policy applies to what they store.

Infrastructure certifications

WPVibe is built on infrastructure from providers that publish SOC 2 Type II and similar attestations (including Cloudflare). That means the platforms under the product are independently audited.

WPVibe itself is not SOC 2 certified. We do not claim "WPVibe is SOC 2" or "ISO 27001 certified." When enterprise procurement requires a company-level report on SeedProd, LLC / WPVibe specifically, talk to us. Until then, this page and the Privacy Policy are the accurate public story.

Breach notification

If we confirm a personal data breach that affects your WPVibe account or connected-site credentials under our control, we will notify affected customers without undue delay, and where feasible within 72 hours of confirmation, describe what we know and what we are doing. Notice goes to the email on your WPVibe account unless law requires a different channel.

Your controls

Disconnect any site from WPVibe.
Revoke the Application Password in WordPress.
Decline or ignore approval prompts for risky operations.
Disconnect the WPVibe connector inside your AI client (ChatGPT apps, Claude connectors, and similar).
Request access, correction, export, or deletion of WPVibe account data at [email protected].

Data Processing Agreement (DPA)

If you need a GDPR Article 28 Data Processing Agreement for WPVibe as a processor of data that passes through the relay, email [email protected] with your company legal name and signatory details. We provide a standard DPA template for execution.

Roles in short: you are the controller of your WordPress site content and of the personal data on that site. WPVibe processes that data only to provide the relay service you requested. Your AI model provider processes prompts and tool results under your agreement with them.

Questions about this page: [email protected].