Security
Forge works inside production systems, so security is part of the product rather than a feature of it. This page summarizes how we protect customer environments. Customers can request our full security documentation and audit reports through their account team.
Compliance
Forge Systems holds a SOC 2 Type II report covering security, availability and confidentiality, renewed every year by an independent auditor. We support GDPR obligations with a data processing addendum and EU data residency, and we sign HIPAA business associate agreements on the Enterprise plan.
- SOC 2 Type II
- GDPR with EU data residency
- HIPAA business associate agreements
Least privilege by default
Every connection Forge makes starts read-only. Write access is granted per repository and per environment, can be withdrawn at any time and is never required to get value from Forge.
Every change is reviewed
Forge proposes code and configuration changes as pull requests that a person approves. Each one carries test results, replayed incident traffic and a rollback plan, and ships behind a canary that rolls back automatically if its numbers slip.
Data protection
Telemetry and code are encrypted in transit with TLS 1.3 and at rest with AES-256. Dedicated deployments can use customer managed keys, and deployments inside your own VPC keep telemetry and code in your account entirely.
Customer data is never used to train models shared with other customers.
Audit trail
Every query, finding, suggestion and change is logged with its evidence and the person who approved it. Logs can be exported to your own security tools on the Scale and Enterprise plans.
Reporting a vulnerability
If you believe you have found a security issue in Forge or this website, please tell us. Customers can use their shared support channel, and anyone else can reach our security team through the form on our Book a demo page. We acknowledge reports within two business days and do not pursue researchers who act in good faith.