Security & Data Protection

1. Data Encryption

Data is protected in transit and at rest.

• In transit: Production web traffic is protected with TLS. Web security headers are applied where configured.Implemented
• At rest: Stored data is encrypted at rest by the underlying infrastructure and storage providers.Provider-managed
• Passwords: Plain-text passwords are never stored. Password handling uses secure hashing/authentication controls.Implemented

2. Access Control

Access is scoped at every level.

• Scoped access: Access is scoped by account, organization, project, and role.Implemented
• Session management: Token-based authentication with automatic expiration.Implemented
• Project data: Project data is tenant-scoped and access-controlled. Higher-isolation deployment models may be available for enterprise plans.In progress
• API security: Protected API endpoints require authentication. Public routes and approved webhooks are handled separately with scoped controls. Rate limiting is applied.Implemented

3. Code Privacy

Your code privacy is a foundational principle.

• No model training: Private project code is not used to train or fine-tune AI models.Implemented
• Private by default: All generated projects are private to your account.Implemented
• Ownership: Generated app code belongs to you, subject to ForGrit terms and third-party licenses.Implemented

4. Repository Security

Generated code is stored in private GitLab repositories linked to the project. Repository access is scoped to the project owner or approved organization members. Marketplace transfer workflows update access only after the approved transfer step.

5. Infrastructure & Monitoring

ForGrit is designed for reliable cloud hosting, backups, monitoring, and dependency security checks. We will update this page as controls are completed and reviewed.

6. Marketplace & Ownership Protection

Marketplace listings are reviewed before they become visible. Ownership-transfer workflows are designed to record seller, buyer, app, repository, and transfer status before access changes. We do not list, sell, or transfer private apps unless the owner starts and approves the relevant marketplace workflow.

• Private by default: Apps stay private until you choose otherwise.
• Reviewed listings: Listings require ForGrit review.
• Tracked transfer: Ownership transfer is recorded at each step.
• Separated workflows: Buyer and seller workflows are kept separate.
• Protected release: Disputes and reviews are handled before final release where applicable.

7. Compliance Status

ForGrit is not currently claiming SOC 2 certification. SOC 2 readiness, formal security reviews, and third-party testing are part of the roadmap. We will update this page when formal compliance milestones are completed.

8. Report a Security Issue

If you believe you found a security issue, report it as described under Vulnerability Disclosure below. Please avoid sharing sensitive data in public channels.

For account, billing, or build problems that are not security issues, email support@forgrit.com. No automated receipt is provided.

9. Vulnerability Disclosure

We welcome good-faith security research on forgrit.com.

• How to report: Email security@forgrit.com with steps to reproduce. We acknowledge reports within 3 business days.
• Safe harbor: Good-faith research conducted within these rules will not result in legal action. Do not access other users’ data, degrade the service, or exfiltrate more data than needed to demonstrate the issue.
• No bounty program: ForGrit does not currently offer a monetary bug bounty program.
• Machine-readable contact: A machine-readable copy of this policy is published at /.well-known/security.txt.

Read the machine-readable policy at /.well-known/security.txt.