Secure by default.Yours by design.
The safest place for your data is a server you control. Forge is built so we see as little of it as possible, and everything we do touch is encrypted, signed and logged.
What Forge sees, and what never leaves your server.
Forge is the control plane. Your apps, databases and traffic run on your VPS, not ours.
Forge control plane
Coordinates your deployments. Stores only what it needs to do that.
- Account and workspace detailsyou + your team
- Project and service settingsnames, repos, ports
- Environment variablesAES-256-GCM encrypted
- Deploy and audit logsbounded + redacted
Your VPS
Runs your code. The Agent opens the connection outward, so no inbound management port is needed.
- Your application code and containerson your disk
- Your databases and their dataon your disk
- Your users' trafficserved by Caddy on your IP
- Your backupsyour own R2 bucket
Built in, not bolted on.
Every control below is live in Forge today.
Variables, provider keys, SMTP and DKIM secrets are encrypted at rest with AES-256-GCM. Production won't start with a weak key.
✓ LiveNormal API responses show that a secret exists, never its value. Revealing one needs a fresh sign-in and leaves an audit record.
✓ LiveAuthenticator codes with recovery codes, session management, and a workspace policy to require MFA for everyone.
✓ LivePasswords are hashed with scrypt and random salts, and checked in constant time.
✓ LiveEvery Agent build is signed with Ed25519. Your server checks the signature, source revision and SHA-256 before it upgrades.
✓ LiveDatabase backups are encrypted before they leave your server, checksummed on upload, and verified again before a restore.
✓ LiveThe Agent dials out over HTTPS. Docker, the Docker socket and database ports stay closed to the internet.
✓ LiveSensitive actions are recorded with who, what and when. History is kept from 90 days to 2 years depending on plan.
✓ LiveDatabase-level ownership checks keep each workspace's data separate, and Forge refuses to start if they're broken.
✓ LiveWhat we can say today.
Done
- Encryption, MFA and audit controls listed above
- Signed, reproducible Agent releases
- Recovery drills before every Agent release
- A private channel for security reports
On the way
- Passkeys
- Single sign-on and SCIM for larger teams
- A public subprocessor list and data processing agreement
- Independent audits
We don't claim SOC 2, ISO 27001 or any certification yet. When an independent auditor has checked us, we'll say so here.
Found something? Tell us first.
Send the details privately. We'll confirm we got it, keep you updated, and credit you when it's fixed if you'd like.
security@forgecloud.cc- Don't access other people's data
- Give us time to fix it before going public
- Include steps to reproduce