Alaio Vibecode works with your Bitrix24 data, including deals, customers, documents, and messages. It uses several security layers to protect that data.

• Servers are not exposed to the public internet
• Authentication works only through Bitrix24
• Different access keys are used for different tasks
• You can revoke access at any time

How Alaio Vibecode protects data

Servers are hidden from external access. Applications run on Black Hole servers. These servers have no public IP address, and their ports do not respond to incoming requests from the internet. Scanners cannot find the server directly, and attackers cannot access it through open ports.
Black Hole servers

Black Hole protects servers from direct external connections, but it does not protect a key that has been published or shared with others. Do not add keys to public pages, general chats, or documents.

Access settings. For each application, choose who can open it: only the owner, selected employees or a department, all Bitrix24 employees, authenticated users, or anyone with a public link.

If an application requires authentication, Alaio Vibecode first checks the user’s permissions and then opens the application.

Separate access keys for different tasks. Apps need access keys to work with Bitrix24 data. Vibecode uses different key types for different tasks. If one key is compromised, the others keep working. Each key has only the permissions it needs.

Main key types:

• An API key allows an application, bot, or server-side integration to work with Bitrix24. This is the main key type. Create it when you need to connect an application to Bitrix24.
• An authorization key is required for an application that employees sign in to. After signing in, the application uses the specific employee's permissions rather than the application owner’s general permissions.
• A management key is required for a service script to manage API keys: create, view, replace, and deactivate them. It does not give the application access to deals, tasks, messages, or other account data.
  What are access keys in Alaio Vibecode

Revoke keys and remove access at any time. You can revoke a key, remove an employee's access, or delete an app at any time. This is useful if:

• A key was exposed in a public place or message
• An employee left the company or changed roles
• You no longer need an app and want to free up resources.

When you regularly reissue a key, the previous key value continues to work for up to 24 hours. Update your external integrations during this time. If a key is blocked, there is no transition period — update the key value in the application and restart it immediately.
Restrict access to a server in Alaio Vibeсode

Receiving data. An app running on Black Hole sends a request to the Alaio Vibecode API. The platform checks the access key and its permissions, forwards the request to Bitrix24, and returns the response back to the app. The app can only access data and perform actions allowed by the key.

How the app uses and stores the data depends on its code and the services connected to it.

What to do if a key is compromised

If you think someone has gained unauthorized access to a key, deactivate it. Any requests using that key will be denied. You can reactivate the key later if needed.

1. Go to Access > API Keys. Find the key by its name, username, or prefix.
2. Click Three dots (...) next to the key.
3. Select Deactivate.

If you no longer need the key, delete it.

1. Go to Access > API Keys.
2. Click the Three dots (...) next to the key you want to revoke.
3. Select Delete. You cannot restore a deleted key.

If any active servers, agents, or bots use this key, assign them another key before deleting it.