Last updated 2026-10-10 (version 1)
Security
How HAVA Export B.V., trading as Vibel protects Instagram access tokens and campaign data in Vibel Reply.
Our role
Vibel Reply is a data processor. It uses official Meta APIs to send a private reply after a matched comment and, optionally, a public reply under it. It never scrapes Instagram, never uses browser automation, and never asks for an Instagram password.
Encryption
Instagram access tokens are encrypted at rest and are never exposed to the browser. All traffic between the browser, Vibel Reply, and Meta's APIs uses TLS.
Webhook security
Inbound Meta webhooks (comment and message events) are verified against their signature before Vibel Reply acts on them; unverified or malformed requests are rejected.
Access control
Workspace data is scoped to the signed-in account; staff access to production data is restricted to support, security, and legal compliance purposes.
Retention and deletion
Disconnecting Instagram removes the stored connection token and stops campaigns immediately. See the Data Deletion page for full account and workspace deletion.
Subprocessors
See the Sub-processors page for the vendors Vibel Reply engages and what each one processes.
Responsible disclosure
If you believe you have found a security vulnerability, report it to legal@getvibel.com before disclosing it publicly. We will acknowledge your report and work with you on a fix timeline before any public disclosure.
Contact
Security questions or reports: legal@getvibel.com.