Security documentation

Trust posture summary

• Customer-controlled data
• Exportable records
• No mandatory removal of working systems
• Itemized third-party spend
• Managed implementation
• Optional Marketplace expansion
• No automatic plan upgrades
• Customer approval required for optional purchases

Security categories

Every claim on the Security page is organized under one of these categories, each backed by the same control registry.

• Secure Web Access: The Forge is accessed through a supported web browser. Customers do not install a Forge desktop application or maintain a Forge server inside their organization. This delivery model allows platform updates and security corrections to be applied centrally without requiring every customer to manually patch a separate installation.
• Identity and Sign-In: Each user should access The Forge through an individual identity so permissions, assignments, approvals, changes, and administrative actions can be attributed to the correct person.
• Roles and Permissions: Access to one part of The Forge should not automatically provide access to every part of the business. Permissions can be scoped by business entity, location, role, department, and assigned responsibility.
• Business and Location Separation: The Forge supports organizations managing multiple legal entities, operating companies, and locations. An owner may be authorized to view consolidated reporting across three businesses while a location manager sees only the company and location they manage.
• Data Protection: Customer information is protected during transmission and at rest using industry-standard methods appropriate to the platform's architecture and hosting environment.
• Integration Security: Integrations should be authorized for a defined purpose and limited to the permissions required for the approved workflow. An accounting integration should not automatically receive employee records, customer communications, or marketing data unless explicitly required and approved.
• Automation and Approval Controls: The Forge can automate follow-ups, assignments, reminders, escalations, and workflow transitions. Sensitive actions support authorization boundaries, approval thresholds, spending limits, and human review so automation assists operations without taking ownership away from the customer.
• Audit History: Administrative changes, permission updates, approval decisions, and security events are recorded with the actor, timestamp, organization, and action details so changes can be reviewed and attributed.
• Platform Monitoring: The platform monitors application availability, authentication failures, integration errors, and unexpected conditions to detect and respond to issues that could affect customer operations.
• Availability and Recovery: Security also includes operational resilience — backups, recovery procedures, and continuity planning so customer operations can be restored when incidents occur.
• Secure Development Practices: The Forge security program uses recognized web-application security guidance as an internal reference for control design and verification. Development practices include source control, code review, dependency management, and environment separation.
• Secure Platform Updates: Because The Forge is delivered as a managed web platform, customers do not need to manually install Forge updates across employee devices or maintain separate versions of the application. Updates are applied centrally, tested against the managed platform, and monitored after release.
• Incident Response: Security events are assessed for scope and customer impact. Corrective action is applied, affected customers are notified where required, and follow-up controls are reviewed.
• Shared Responsibility: A secure web application does not eliminate the need for secure customer account management. Security responsibilities are shared between HustleForge, the customer, and third-party providers.
• Customer Data Rights: The Forge is designed to help your organization operate on its information, not to trap that information inside the platform. Customer records should remain exportable according to the account's permissions, contractual terms, and applicable retention requirements.