Security

This page describes how we protect your product and your customers’ data. It lists only practices we apply today. We do not hold certifications such as SOC 2 or ISO 27001; if that changes, it will be stated here.

Access

• Every person has their own user, with the least privilege they need and mandatory MFA. No shared credentials.
• The root user of each account is locked away and not used for day-to-day work.
• Access is reviewed at the end of every project and whenever someone leaves the team.
• Deployments authenticate through OIDC, with no long-lived access keys.

Secrets

Passwords and keys never live in the code. They are kept in a vault, such as AWS Secrets Manager, AWS Systems Manager Parameter Store or HashiCorp Vault, depending on the project’s infrastructure, and are read only by the service that needs them.

Data

• Data is encrypted in transit (TLS) and at rest, in databases and storage.
• The region where your data lives is agreed with you at the start of each project, based on where your users are and on the legal requirements that apply to your business.
• Each project has separate staging and production environments. Staging starts with fictitious seed data, so there is something realistic to work with from day one. Before a release, it is also tested by a group of real people involved in the project, who use their own data and are encouraged to use the product the wrong way on purpose, so we can see how it holds up.

Infrastructure

All infrastructure is described as code (Terraform) and reviewed before it is applied. Databases sit on private networks, and only what needs to be reachable from the internet is exposed.

Backups

Databases are backed up automatically. The default retention is 7 days and can be extended per project. When your business requires a defined maximum data loss (RPO), such as 24 hours, the backup policy is designed to meet it.

Development

• Every change is reviewed by a person before it reaches production.
• Before major releases, we run a security review of the code and check dependencies for known vulnerabilities.

Incidents

If a security incident affects personal data, we notify you within 48 hours of identifying it, with what happened, what was affected and what has already been done. We also support you in meeting your legal obligations, including notifying the relevant data protection authority.

Privacy

Under Brazil’s data protection law (LGPD), you are the data controller and Forge Labs is the processor. We use your data only to operate your product. We never sell it, share it for marketing or use it to train models. When our work together ends, your data is returned to you and deleted from our environments once the handover is complete, and we confirm the deletion in writing.