top of page

Trust & Security 

Effective Date: October 21, 2025 

1. Definition of Terms 

For clarity, the following terms are used throughout this document: 
 

1. RTO (Recovery Time Objective): The maximum acceptable duration of time for the platform to be restored after an incident. 
 

2. RPO (Recovery Point Objective): The maximum acceptable data loss, measured in time, that can occur after an incident. 
 

3. RBAC (Role-Based Access Control): A method of restricting system access to authorized users based on their defined roles. 
 

4. MFA (Multi-Factor Authentication): An authentication method requiring two or more verification factors to grant access. 
 

5. IRP (Incident Response Plan): A documented procedure for identifying, managing, and resolving security incidents. 
 

6. SDLC (Secure Development Lifecycle): A process that embeds security activities and testing throughout the software development process. 
 

7. PII ( Personally Identifiable Information): Information that can be used to distinguish or trace an individual's identity. 

2. Introduction and Commitment 

This document details the security, privacy, and compliance framework governing the Forge aHedge SaaS platform. At Forge aHedge, we are fundamentally committed to protecting our customers' data and maintaining a secure, resilient, and trustworthy service that meets or exceeds relevant industry standards and legal requirements. 
 

Security Objectives 
 

  • Confidentiality, Integrity, and Availability (CIA): Protect customer data against unauthorized access, modification, or destruction. 
     

  • Trust and Resilience: Ensure continuous platform security and operational stability. 
     

  • Regulatory Adherence: Maintain strict compliance with global data protection regulations and established frameworks. 
     

  • Transparency: Provide clear, open communication regarding our security practices. 

3. Data Security Management 

3.1 Data Classification 

All data handled by the platform is formally classified to ensure appropriate protection controls are applied. This includes:
 

  • Public Information: any information approved for general disclosure. Common examples are marketing materials and public documentation.
     

  • Internal Information: This refers to business information that is not intended for public release, such as internal policies and operational data.
     

  • Confidential Information: This covers proprietary information that carries a moderate risk if exposed. Examples include financial forecasts and strategic plans.
     

  • Restricted Information: This is highly sensitive data that requires the strictest security controls. It typically includes personally identifiable information (PII), financial records, and health data.

​

3.2 Data Encryption 

​Data Encryption protocol/standards include:

  • Data in Transit: All data transmission between clients and our platform, as well as between internal services, is protected using TLS 1.2+ and strong ciphers.

  • Data at Rest: All customer data including databases, file storage and backups is securely encrypted using industry-standard AES-256 encryption.

​

3.3 Data Retention and Deletion 

Data retention periods are strictly governed by customer contracts and applicable regulations. Upon customer request or service termination, all associated data is securely and irrevocably deleted within 60 days. 

4. Access Control and Authentication 

We enforce the principle of least privilege to limit access to production systems and customer data only to authorized personnel who require it to perform their job functions. 

4.1 User Authentication 

We implement robust access controls and authentication mechanisms to ensure that only authorized users can access your data:
 

  • Multi-Factor Authentication (MFA): We fully support and strongly encourage Multi-Factor Authentication for all users, providing an essential layer of protection against credential theft.

  • Role-Based Access Control (RBAC): To ensure granular control over functionality and data, access permissions are strictly granted based on a user's specifically defined role.

  • Enterprise SSO/SAML: Single Sign-On integration is available for enterprise clients, which streamlines authentication and centralizes user management via their chosen Identity Provider (IdP).

​

4.2 Internal Access Controls 

  • Access to production environments is logged, audited, and requires explicit approval. 
     

  • All internal user access to critical systems is protected by MFA. 
     

  • Quarterly access reviews are conducted to revoke unnecessary privileges. 

4.3 Single Sign-On (SSO) 

We support the use of enterprise-grade SSO to enhance security and simplify user onboarding/offboarding for enterprise clients. 
 

  • Supported Protocols: OAuth 2.0. 
     

  • Identity Provider (IdP) Integrations: Seamless integration with Azure Active Directory.  
     

  • Advanced Features: Support for SCIM provisioning/deprovisioning and granular role mapping based on IdP groups. 

5. Infrastructure and Application Security 

5.1 Hosting Environment 

The Forge aHedge platform is hosted on Microsoft Azure, leveraging their robust, global security infrastructure, which includes advanced network firewalls, distributed denial of service (DDoS) protection, and physical data center security. 

5.2 Application Security 

We embed security throughout our development process (SDLC). 
 

  • Code Review: Mandatory peer code reviews for all production changes. 
     

  • Testing: Routine static and dynamic application security testing (SAST/DAST). 
     

  • Vulnerability Management: Continuous dependency management and vulnerability scanning. 

6. Monitoring, Incident Response, and AI 

6.1 Logging and Monitoring 

We employ centralized, continuous logging across all infrastructure, application, and security components. This system provides real-time alerting for any suspicious or unauthorized activity. 

6.2 Incident Response Plan (IRP) 

We maintain a documented and regularly tested IRP. 

  • Incidents are categorized by severity, with clear escalation paths. 

  • In the event of a confirmed data breach, affected customers will be notified within 48 hours, in accordance with our legal and contractual obligations. 

6.3 Artificial Intelligence (AI) and Machine Learning (ML) 

For features that utilize AI/ML, we adhere to a Responsible AI framework.
 

  • Data Usage: We do not use customer data to train AI/ML models unless explicit, opt-in consent is obtained. Customer data used for AI features is isolated and never exposed to third-party models without contractual data protection agreements. 
     

  • Transparency and Control: Users are informed when AI features are in use and can generally enable or disable AI functionality at the account level. 
     

  • Security: AI models and pipelines are secured with the same encryption, access control, and monitoring standards as traditional systems. We perform regular assessments for adversarial risks and potential model abuse. 

7. GDPR and Subprocessors 

7.1 GDPR 

We are compliant with the European Union's General Data Protection Regulation (GDPR), and this provides additional protection to individuals located in Europe. This may provide you with additional rights and remedies if your personal information is handled in a manner inconsistent with that law. 

7.2 Subprocessors 

We use the following subprocessors: 

  • Microsoft Azure SQL 

  • Microsoft Azure OpenAI  

  • Microsoft Azure Communication Services 
     

All subprocessors undergo thorough due diligence and are bound by contractual data protection obligations to maintain our compliance standards. 

8. Business Continuity and Disaster Recovery (BC/DR) 

We maintain robust BC/DR processes to ensure service availability and data durability. 

8.1 Data Backups 

  • Automated and Daily: Automated backups are performed daily.
     

  • Geographic Redundancy: Backups are stored in geographically separated, secure locations. 
     

  • Tested: Backup restoration is tested regularly to validate data integrity and process efficacy. 

8.2 Disaster Recovery 

Our comprehensive Disaster Recovery (DR) plan ensures the platform remains resilient, with clearly defined recovery targets and protocols that are formally reviewed and tested on an annual basis:
 

  • Recovery Time Objective (RTO): We target a maximum recovery time of 8 hours, which is the greatest acceptable duration to fully restore the platform following an incident.
     

  • Recovery Point Objective (RPO): We target a maximum recovery point of 24 hours, which represents the greatest acceptable limit of potential data loss, measured in time, in the event of a disruption.

​

9. Customer Responsibilities 

While Forge aHedge maintains the security of the underlying infrastructure and application, customers are responsible for security within their own tenant environment:
 

  • Credentials: Maintaining secure user credentials and enabling MFA. 
     

  • Access Management: Setting and managing appropriate RBAC for their organization's users. 
     

  • Internal Policy: Ensuring the use of the platform aligns with their organization's internal compliance and security policies. 

10. Contact and Reporting 

For all security-related inquiries or to report potential concerns, please utilize our dedicated communication channels:
 

  • Security Contact: For general security matters, you can reach our team directly at security@forgeahedge.com.
     

  • Vulnerability Reporting: To report a potential security vulnerability, please email the security address listed above. We value the security community and are deeply committed to following coordinated disclosure best practices to resolve issues swiftly.​

​

bottom of page