Security & Trust

Last reviewed: 6 October, 2026

Enterprise-grade security, independently certified. Forge aHedge is certified to ISO/IEC 27001:2022, the internationally recognized standard for information security management systems. Our ISMS has been independently audited to verify that appropriate controls and processes are in place to manage security risk

ISO Certification

ISO/IEC 27001:2022 Certified. Independent certification of our Information Security Management System

SOC 2 Assurance

SOC 2 Type II (In Progress)

Currently in independent audit phase

Data Protection

AES-256 encryption at rest and TLS encryption in transit.

Access Controls

Enterprise Access Controls — MFA, role-based access control, and enterprise SSO.

Cloud Infrastructure

Resilient Cloud Infrastructure — Hosted on Microsoft Azure with monitoring, backup, and disaster recovery controls.

AI Security

Enterprise AI Security — Customer data is not used to train Forge aHedge or third-party foundation models.

1. Compliance & Independent Assurance

ISO/IEC 27001:2022 Certification: Forge aHedge maintains an information security management system independently certified to ISO/IEC 27001:2022.

Certificate Access: Need a copy of our certificate for your vendor due diligence? [Request Certificate]

GDPR Alignment: Forge aHedge maintains technical and organizational measures designed to support customers' GDPR requirements.

SOC 2 Type II (In Progress): Currently undergoing an independent, third-party audit evaluation to assess and validate the operational effectiveness of our security control environment over an extended monitoring period.

2. Data Security & Encryption

Encryption in Transit: All data transmitted between clients and Forge aHedge is protected using strong Transport Layer Security (TLS 1.2+).

Encryption at Rest: Customer data, database stores, and backups are encrypted at rest using industry-standard AES-256 encryption.

Data Isolation: Multi-tenant architecture with strict logical tenant separation ensuring customer data is isolated at all times.

Data Retention & Deletion: Data retention periods are strictly governed by customer contracts and applicable regulations. Upon customer request or service termination, all associated data is securely and irrevocably deleted within 60 days.

3. Identity & Access Management

Forge aHedge implements robust access controls designed to ensure that only authorized personnel can access sensitive corporate finance and risk workflows. These access controls include:

Enterprise Single Sign-On (SSO): Integration with corporate identity providers using OpenID Connect (OIDC) over OAuth 2.0, including Microsoft Entra ID (formerly Azure Active Directory).
Multi-Factor Authentication (MFA): Enforced MFA across administrative and user access paths.
Role-Based Access Control (RBAC): Granular permissions ensuring users only access the treasury and risk data relevant to their role.

4. Infrastructure Security

Forge aHedge's cloud infrastructure platform is engineered for high performance, continuous oversight and resilience against external threats across the entire software development lifecycle.

Hosted on Microsoft Azure: Built on enterprise-grade Microsoft Azure infrastructure leveraging advanced cloud security protections.
Continuous Monitoring: Real-time logging, security event monitoring, and automated vulnerability scanning.
Vulnerability Management: Regular third-party penetration testing and automated software dependency scanning across the SDLC.

5. AI Security & Data Privacy

As an AI-native treasury and commodity-risk platform, we ensure that advanced intelligence capabilities are strictly governed and completely isolated from model training.

Your data remains your data: Customer data is not used to train Forge aHedge or third-party foundation models.
Tenant Isolation: AI access follows the exact same strict tenant isolation and role-based access controls as the rest of the platform.
Protected Framework: AI requests and responses are protected under Forge aHedge's comprehensive information-security framework.
Subprocessor Integration: Microsoft Azure OpenAI is utilized securely as an enterprise subprocessor.
Governance: AI capabilities can be configured and governed according to your enterprise security requirements.

For features that utilize AI/ML, we adhere to a Responsible AI framework.

Data Usage: Customer data is not used to train Forge aHedge or third-party foundation models. Where AI functionality requires model inference, customer data may be securely processed by approved enterprise subprocessors, including Microsoft Azure OpenAI, subject to contractual data-protection obligations and Forge aHedge's existing encryption, access-control, tenant-isolation and monitoring requirements.
Transparency and Control: Users are informed when AI functionality is used, and AI capabilities can be governed according to enterprise security requirements.
Security: AI services are subject to the same encryption, tenant-isolation, access-control and monitoring requirements as the rest of the Forge aHedge platform.

6. Business Continuity & Disaster Recovery

We maintain robust operational safeguards and redundancy measures designed to support service availability and rapid recovery in the event of disruption.

High Availability: Redundant cloud architecture designed to minimize downtime.
Backups: Automated, encrypted daily backups with isolated off-site storage.
Recovery Targets: Documented Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) tested regularly through disaster recovery simulations.

Our comprehensive Disaster Recovery (DR) plan ensures the platform remains resilient, with clearly defined recovery targets and protocols that are formally reviewed and tested on an annual basis:

Recovery Time Objective (RTO): We target a maximum recovery time of 8 hours, which is the greatest acceptable duration to fully restore the platform following an incident.
Recovery Point Objective (RPO): We target a maximum recovery point of 24 hours, which represents the greatest acceptable limit of potential data loss, measured in time, in the event of a disruption.

7. Monitoring and Incident Response

Logging and Monitoring: We employ centralized, continuous logging across infrastructure, application and security components, providing real-time alerting for suspicious or unauthorized activity.

Incident Response Plan (IRP): We maintain a documented and regularly tested IRP. Incidents are categorized by severity with clear escalation paths.

In the event of a confirmed data breach, affected customers will be notified within 72 hours, in accordance with our legal and contractual obligations.

8. GDPR and Subprocessors

Technical and organisational measures designed to support compliance with applicable requirements of the European Union General Data Protection Regulation (GDPR) are established and maintained.

We use the following subprocessors:

Microsoft Azure SQL

Microsoft Azure OpenAI

Microsoft Azure Communication Services

All subprocessors undergo thorough due diligence and are bound by contractual data protection obligations to maintain our compliance standards.

9. Customer Responsibilities

While Forge aHedge maintains the security of the underlying infrastructure and application, customers are responsible for security within their own tenant environment:

Credentials and Identity: Maintaining secure user credentials and appropriately managing their organization's identity-provider and user-access settings.
Access Management: Setting and managing appropriate RBAC for their organization's users.
Internal Policy: Ensuring the use of the platform aligns with their organization's internal compliance and security policies.

10. Contact and Reporting

For all security-related inquiries or to report potential concerns, please utilize our dedicated communication channels:

Security Contact: For general security matters, you can reach our team directly at security@forgeahedge.com.
Vulnerability Reporting: To report a potential security vulnerability, please email the security address listed above. We value the security community and are deeply committed to following coordinated disclosure best practices to resolve issues swiftly.