Security

You connect a site with a Framer Server API key that you create in your project’s settings. FrameVault uses it to read your CMS collections when it takes a backup, and to write CMS items only when you press Restore. It does not touch pages, components or the design canvas.

You can revoke the key in Framer at any time, and FrameVault loses access immediately.

The key is encrypted with AES-256-GCM before it is saved. The encryption key lives only in the server environment, not in the database, so a copy of the database alone cannot decrypt it. The key is never sent back to your browser, including on your own dashboard.

Backups are JSON files in Supabase Storage, which encrypts stored data, and are only read by our server on your behalf. Database row-level security means each account can only read its own sites, backups and restore history. All traffic is over HTTPS.

History is kept for 7 days on Free, 90 days on Pro and 180 days on Studio and Agency; your latest complete backup is always kept. Removing a site from your dashboard deletes its backups and stored files.

• Supabase: database, sign-in and backup storage.
• Vercel: hosting.
• Stripe: payments. Card details go to Stripe; FrameVault stores only a customer ID and your plan.

After every release, an automated test signs in as a test customer, connects a real Framer project, backs it up and downloads the backup. It then edits and deletes articles in Framer, restores one item and then the whole collection, and checks every field, item ID and the item order against the original before removing the test site. A failed run is flagged to us straight away.

If you find a security issue, email support@useframevault.com with “Security” in the subject. Please don’t test against other people’s accounts. Full details of what we collect are in the privacy policy.