{
  "product": "The Forge",
  "registryReviewedAt": "2026-07-17",
  "statusVocabulary": {
    "verified": "Independently Checked",
    "implemented": "Active",
    "configurable": "Configurable",
    "limited_availability": "Limited Availability",
    "under_validation": "In Review",
    "planned": "Coming to the platform",
    "not_supported": "Not Currently Supported",
    "not_applicable": "Not Applicable"
  },
  "source": "https://www.theforge.systems/security",
  "controls": [
    {
      "id": "sc-wa-01",
      "name": "Encrypted browser connection",
      "category": "web_access",
      "status": "verified",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "defaultEnabled": true,
      "customerConfigurationRequired": false,
      "verificationMethod": "Automated configuration review",
      "lastVerifiedAt": "2026-07",
      "limitations": [],
      "scope": [
        "Customer web sessions",
        "API requests"
      ]
    },
    {
      "id": "sc-wa-02",
      "name": "Content Security Policy",
      "category": "web_access",
      "status": "verified",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "defaultEnabled": true,
      "customerConfigurationRequired": false,
      "verificationMethod": "Automated header test",
      "lastVerifiedAt": "2026-07",
      "limitations": [
        "The marketing site currently permits inline scripts for theme bootstrapping, so its script policy is same-origin plus inline rather than nonce-based",
        "The platform application (app.theforge.systems) enforces a stricter policy with no inline scripts and automatic violation reporting"
      ],
      "scope": [
        "All web pages"
      ]
    },
    {
      "id": "sc-wa-03",
      "name": "Security response headers",
      "category": "web_access",
      "status": "verified",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "defaultEnabled": true,
      "customerConfigurationRequired": false,
      "verificationMethod": "Automated header test",
      "lastVerifiedAt": "2026-07",
      "limitations": [],
      "scope": [
        "All HTTP responses"
      ]
    },
    {
      "id": "sc-wa-04",
      "name": "Secure session management",
      "category": "web_access",
      "status": "implemented",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "defaultEnabled": true,
      "customerConfigurationRequired": false,
      "verificationMethod": null,
      "lastVerifiedAt": null,
      "limitations": [
        "Session lifetime is a fixed absolute limit — inactivity-based timeout is not yet available",
        "Session lifetime is not customer-configurable"
      ],
      "scope": [
        "Authenticated user sessions"
      ]
    },
    {
      "id": "sc-wa-05",
      "name": "Mobile browser access",
      "category": "web_access",
      "status": "implemented",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "defaultEnabled": true,
      "customerConfigurationRequired": false,
      "verificationMethod": null,
      "lastVerifiedAt": null,
      "limitations": [
        "Progressive web application not currently supported"
      ],
      "scope": [
        "Mobile web sessions"
      ]
    },
    {
      "id": "sc-wa-06",
      "name": "Bot protection on public forms",
      "category": "web_access",
      "status": "implemented",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "defaultEnabled": true,
      "customerConfigurationRequired": false,
      "verificationMethod": null,
      "lastVerifiedAt": null,
      "limitations": [],
      "scope": [
        "Public-facing forms"
      ]
    },
    {
      "id": "sc-id-01",
      "name": "Individual user accounts",
      "category": "identity",
      "status": "implemented",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "defaultEnabled": true,
      "customerConfigurationRequired": true,
      "verificationMethod": null,
      "lastVerifiedAt": null,
      "limitations": [
        "An explicit email-verification step for self-service signup is not yet implemented (accounts are invitation-provisioned during beta)"
      ],
      "scope": [
        "All platform users"
      ]
    },
    {
      "id": "sc-id-02",
      "name": "Password requirements",
      "category": "identity",
      "status": "implemented",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "lastVerifiedAt": null
    },
    {
      "id": "sc-id-03",
      "name": "Account lockout and throttling",
      "category": "identity",
      "status": "verified",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "lastVerifiedAt": "2026-07"
    },
    {
      "id": "sc-id-04",
      "name": "Multi-factor authentication",
      "category": "identity",
      "status": "configurable",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "defaultEnabled": false,
      "customerConfigurationRequired": true,
      "verificationMethod": "Platform code and test-suite review (2026-07)",
      "lastVerifiedAt": "2026-07",
      "limitations": [
        "Opt-in per user unless the organization mandates it",
        "SMS codes are not offered — authenticator app and passkey only"
      ],
      "scope": [
        "User sign-in"
      ]
    },
    {
      "id": "sc-id-05",
      "name": "Single sign-on",
      "category": "identity",
      "status": "planned",
      "plans": [
        "operations"
      ],
      "defaultEnabled": false,
      "customerConfigurationRequired": true,
      "verificationMethod": null,
      "lastVerifiedAt": null,
      "limitations": [
        "Not yet available"
      ],
      "scope": [
        "Enterprise sign-in"
      ]
    },
    {
      "id": "sc-rp-01",
      "name": "Role-based access control",
      "category": "roles_permissions",
      "status": "verified",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "defaultEnabled": true,
      "customerConfigurationRequired": true,
      "verificationMethod": "Automated test suite (fail-closed authorization)",
      "lastVerifiedAt": "2026-07",
      "limitations": [
        "Custom role definitions available on Pro and Operations tiers"
      ],
      "scope": [
        "All platform features"
      ]
    },
    {
      "id": "sc-rp-02",
      "name": "Permission scoping by location and business",
      "category": "roles_permissions",
      "status": "configurable",
      "plans": [
        "pro",
        "operations"
      ],
      "defaultEnabled": false,
      "customerConfigurationRequired": true,
      "verificationMethod": null,
      "lastVerifiedAt": null,
      "limitations": [
        "Requires Pro or Operations tier",
        "Granular per-record permissions are not yet available"
      ],
      "scope": [
        "Multi-location, multi-business accounts"
      ]
    },
    {
      "id": "sc-rp-03",
      "name": "Administrative separation",
      "category": "roles_permissions",
      "status": "implemented",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "defaultEnabled": true,
      "customerConfigurationRequired": false,
      "verificationMethod": null,
      "lastVerifiedAt": null,
      "limitations": [],
      "scope": [
        "Administrative functions"
      ]
    },
    {
      "id": "sc-bs-01",
      "name": "Access separated by business",
      "category": "business_separation",
      "status": "configurable",
      "plans": [
        "operations"
      ],
      "defaultEnabled": false,
      "customerConfigurationRequired": true,
      "verificationMethod": null,
      "lastVerifiedAt": null,
      "limitations": [
        "Available on Operations tier",
        "Separation is enforced at the application layer, not at the database layer"
      ],
      "scope": [
        "Multi-business accounts"
      ]
    },
    {
      "id": "sc-bs-02",
      "name": "Location-level access boundaries",
      "category": "business_separation",
      "status": "configurable",
      "plans": [
        "pro",
        "operations"
      ],
      "defaultEnabled": false,
      "customerConfigurationRequired": true,
      "verificationMethod": null,
      "lastVerifiedAt": null,
      "limitations": [
        "Requires Pro or Operations tier"
      ],
      "scope": [
        "Multi-location accounts"
      ]
    },
    {
      "id": "sc-bs-03",
      "name": "Executive consolidated view",
      "category": "business_separation",
      "status": "configurable",
      "plans": [
        "operations"
      ],
      "defaultEnabled": false,
      "customerConfigurationRequired": true,
      "verificationMethod": null,
      "lastVerifiedAt": null,
      "limitations": [
        "Available on Operations tier"
      ],
      "scope": [
        "Executive reporting"
      ]
    },
    {
      "id": "sc-bs-04",
      "name": "Customer data isolation",
      "category": "business_separation",
      "status": "verified",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "defaultEnabled": true,
      "customerConfigurationRequired": false,
      "verificationMethod": "Automated test suite (17 tenant-isolation suites)",
      "lastVerifiedAt": "2026-07",
      "limitations": [],
      "scope": [
        "All customer organizations"
      ]
    },
    {
      "id": "sc-dp-01",
      "name": "Transport encryption",
      "category": "data_protection",
      "status": "verified",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "defaultEnabled": true,
      "customerConfigurationRequired": false,
      "verificationMethod": "Automated configuration review",
      "lastVerifiedAt": "2026-07",
      "limitations": [],
      "scope": [
        "All network communication"
      ]
    },
    {
      "id": "sc-dp-02",
      "name": "Encryption at rest",
      "category": "data_protection",
      "status": "implemented",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "lastVerifiedAt": null
    },
    {
      "id": "sc-dp-03",
      "name": "Integration credential storage",
      "category": "data_protection",
      "status": "verified",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "lastVerifiedAt": "2026-07"
    },
    {
      "id": "sc-dp-04",
      "name": "Input sanitization",
      "category": "data_protection",
      "status": "implemented",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "lastVerifiedAt": null
    },
    {
      "id": "sc-is-01",
      "name": "Integration authorization",
      "category": "integration_security",
      "status": "verified",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "defaultEnabled": true,
      "customerConfigurationRequired": true,
      "verificationMethod": "Automated test suite (integration lifecycle)",
      "lastVerifiedAt": "2026-07",
      "limitations": [],
      "scope": [
        "All integrations"
      ]
    },
    {
      "id": "sc-is-02",
      "name": "Scoped integration permissions",
      "category": "integration_security",
      "status": "verified",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "defaultEnabled": true,
      "customerConfigurationRequired": true,
      "verificationMethod": "Automated test suite (integration lifecycle)",
      "lastVerifiedAt": "2026-07",
      "limitations": [
        "Permission granularity varies by integration type"
      ],
      "scope": [
        "Configured integrations"
      ]
    },
    {
      "id": "sc-is-03",
      "name": "Integration revocation",
      "category": "integration_security",
      "status": "verified",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "defaultEnabled": true,
      "customerConfigurationRequired": false,
      "verificationMethod": "Automated test suite (integration lifecycle)",
      "lastVerifiedAt": "2026-07",
      "limitations": [],
      "scope": [
        "Active integrations"
      ]
    },
    {
      "id": "sc-aa-01",
      "name": "Approval thresholds",
      "category": "automation_approvals",
      "status": "configurable",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "defaultEnabled": false,
      "customerConfigurationRequired": true,
      "verificationMethod": null,
      "lastVerifiedAt": null,
      "limitations": [
        "Threshold types and granularity are expanding during beta"
      ],
      "scope": [
        "Optional spend, lead purchases, campaign changes"
      ]
    },
    {
      "id": "sc-aa-02",
      "name": "Emergency spending stop",
      "category": "automation_approvals",
      "status": "verified",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "defaultEnabled": true,
      "customerConfigurationRequired": false,
      "verificationMethod": "Platform code and test-suite review (2026-07)",
      "lastVerifiedAt": "2026-07",
      "limitations": [],
      "scope": [
        "Marketplace and optional spend"
      ]
    },
    {
      "id": "sc-aa-03",
      "name": "Customer-controlled optional spend",
      "category": "automation_approvals",
      "status": "implemented",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "defaultEnabled": true,
      "customerConfigurationRequired": true,
      "verificationMethod": null,
      "lastVerifiedAt": null,
      "limitations": [
        "During beta no payment method is attached to the platform — optional spend is metered and informational until a customer explicitly arranges it"
      ],
      "scope": [
        "Marketplace, lead programs, campaigns"
      ]
    },
    {
      "id": "sc-ah-01",
      "name": "Administrative activity history",
      "category": "audit_history",
      "status": "verified",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "defaultEnabled": true,
      "customerConfigurationRequired": false,
      "verificationMethod": "Automated test suite (audit events)",
      "lastVerifiedAt": "2026-07",
      "limitations": [
        "Retention period is defined by the platform, not yet customer-configurable",
        "Activity history is recorded append-only, not cryptographically immutable"
      ],
      "scope": [
        "Administrative actions"
      ]
    },
    {
      "id": "sc-ah-02",
      "name": "Sign-in activity",
      "category": "audit_history",
      "status": "limited_availability",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "defaultEnabled": true,
      "customerConfigurationRequired": false,
      "verificationMethod": null,
      "lastVerifiedAt": null,
      "limitations": [
        "A per-event history of successful sign-ins is not yet recorded"
      ],
      "scope": [
        "Authentication events"
      ]
    },
    {
      "id": "sc-ah-03",
      "name": "Record change history",
      "category": "audit_history",
      "status": "limited_availability",
      "plans": [
        "pro",
        "operations"
      ],
      "defaultEnabled": true,
      "customerConfigurationRequired": false,
      "verificationMethod": null,
      "lastVerifiedAt": null,
      "limitations": [
        "Security-sensitive actions (authentication, MFA, integrations, exports) are audit-logged today; individual edits to general business records are not yet versioned"
      ],
      "scope": [
        "Key record types"
      ]
    },
    {
      "id": "sc-pm-01",
      "name": "Application availability monitoring",
      "category": "platform_monitoring",
      "status": "implemented",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "defaultEnabled": true,
      "customerConfigurationRequired": false,
      "verificationMethod": null,
      "lastVerifiedAt": null,
      "limitations": [
        "Customer-facing status page is live at /status, reporting live-probed reachability rather than historical uptime percentages or an incident timeline"
      ],
      "scope": [
        "Platform application"
      ]
    },
    {
      "id": "sc-pm-02",
      "name": "Error detection",
      "category": "platform_monitoring",
      "status": "implemented",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "defaultEnabled": true,
      "customerConfigurationRequired": false,
      "verificationMethod": null,
      "lastVerifiedAt": null,
      "limitations": [],
      "scope": [
        "Application runtime"
      ]
    },
    {
      "id": "sc-pm-03",
      "name": "Integration health monitoring",
      "category": "platform_monitoring",
      "status": "verified",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "defaultEnabled": true,
      "customerConfigurationRequired": false,
      "verificationMethod": "Automated test suite (integration lifecycle)",
      "lastVerifiedAt": "2026-07",
      "limitations": [
        "Monitoring depth varies by integration type"
      ],
      "scope": [
        "Configured integrations"
      ]
    },
    {
      "id": "sc-pm-04",
      "name": "Content-Security-Policy violation reporting",
      "category": "platform_monitoring",
      "status": "verified",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "defaultEnabled": true,
      "customerConfigurationRequired": false,
      "verificationMethod": "Live configuration probe (2026-07)",
      "lastVerifiedAt": "2026-07",
      "limitations": [],
      "scope": [
        "Platform application (app.theforge.systems)"
      ]
    },
    {
      "id": "sc-ar-01",
      "name": "Database backups",
      "category": "availability_recovery",
      "status": "implemented",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "lastVerifiedAt": null
    },
    {
      "id": "sc-ar-02",
      "name": "Deployment rollback",
      "category": "availability_recovery",
      "status": "implemented",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "lastVerifiedAt": null
    },
    {
      "id": "sc-ar-03",
      "name": "Recovery testing",
      "category": "availability_recovery",
      "status": "planned",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "defaultEnabled": true,
      "customerConfigurationRequired": false,
      "verificationMethod": null,
      "lastVerifiedAt": null,
      "limitations": [
        "Formal recovery testing program not yet established"
      ],
      "scope": [
        "Disaster recovery"
      ]
    },
    {
      "id": "sc-ar-04",
      "name": "Duplicate-submission protection and reliable delivery",
      "category": "availability_recovery",
      "status": "verified",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "defaultEnabled": true,
      "customerConfigurationRequired": false,
      "verificationMethod": "Automated test suite (idempotency + outbox)",
      "lastVerifiedAt": "2026-07",
      "limitations": [],
      "scope": [
        "Critical write operations"
      ]
    },
    {
      "id": "sc-sd-01",
      "name": "Source control and code review",
      "category": "secure_development",
      "status": "verified",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "lastVerifiedAt": "2026-07"
    },
    {
      "id": "sc-sd-02",
      "name": "Dependency management",
      "category": "secure_development",
      "status": "implemented",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "lastVerifiedAt": null
    },
    {
      "id": "sc-sd-03",
      "name": "Environment separation",
      "category": "secure_development",
      "status": "implemented",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "lastVerifiedAt": null
    },
    {
      "id": "sc-sd-04",
      "name": "External security assessment",
      "category": "secure_development",
      "status": "planned",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "defaultEnabled": true,
      "customerConfigurationRequired": false,
      "verificationMethod": null,
      "lastVerifiedAt": null,
      "limitations": [
        "External assessment not yet completed"
      ],
      "scope": [
        "Platform application"
      ]
    },
    {
      "id": "sc-su-01",
      "name": "Centralized platform updates",
      "category": "secure_updates",
      "status": "verified",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "defaultEnabled": true,
      "customerConfigurationRequired": false,
      "verificationMethod": "Operational review",
      "lastVerifiedAt": "2026-07",
      "limitations": [],
      "scope": [
        "Platform application"
      ]
    },
    {
      "id": "sc-su-02",
      "name": "Staged deployment process",
      "category": "secure_updates",
      "status": "implemented",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "lastVerifiedAt": null
    },
    {
      "id": "sc-ir-01",
      "name": "Incident response process",
      "category": "incident_response",
      "status": "implemented",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "defaultEnabled": true,
      "customerConfigurationRequired": false,
      "verificationMethod": null,
      "lastVerifiedAt": null,
      "limitations": [
        "Notification timelines are determined by the nature of the incident and applicable requirements, not by a fixed SLA"
      ],
      "scope": [
        "Security events"
      ]
    },
    {
      "id": "sc-ir-02",
      "name": "Vulnerability reporting",
      "category": "incident_response",
      "status": "verified",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "defaultEnabled": true,
      "customerConfigurationRequired": false,
      "verificationMethod": "Live endpoint probe (security.txt)",
      "lastVerifiedAt": "2026-07",
      "limitations": [
        "Formal bug bounty program not currently offered"
      ],
      "scope": [
        "Platform security"
      ]
    },
    {
      "id": "sc-sr-01",
      "name": "User lifecycle management",
      "category": "shared_responsibility",
      "status": "implemented",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "defaultEnabled": true,
      "customerConfigurationRequired": true,
      "verificationMethod": null,
      "lastVerifiedAt": null,
      "limitations": [],
      "scope": [
        "User accounts"
      ]
    },
    {
      "id": "sc-sr-02",
      "name": "Endpoint and browser security",
      "category": "shared_responsibility",
      "status": "implemented",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "defaultEnabled": true,
      "customerConfigurationRequired": false,
      "verificationMethod": null,
      "lastVerifiedAt": null,
      "limitations": [],
      "scope": [
        "Customer devices"
      ]
    },
    {
      "id": "sc-cd-01",
      "name": "Data export",
      "category": "customer_data_rights",
      "status": "verified",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "defaultEnabled": true,
      "customerConfigurationRequired": false,
      "verificationMethod": "Automated test suite (portability)",
      "lastVerifiedAt": "2026-07",
      "limitations": [
        "Export formats and scope may vary by data type",
        "Platform-generated analytics and derived data may not be exportable"
      ],
      "scope": [
        "Customer-supplied records"
      ]
    },
    {
      "id": "sc-cd-02",
      "name": "Data retention and deletion",
      "category": "customer_data_rights",
      "status": "verified",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "defaultEnabled": true,
      "customerConfigurationRequired": false,
      "verificationMethod": "Automated test suite (offboarding)",
      "lastVerifiedAt": "2026-07",
      "limitations": [
        "Backup copies may be retained for a limited period after deletion",
        "Legal retention requirements may override deletion requests"
      ],
      "scope": [
        "Customer data lifecycle"
      ]
    },
    {
      "id": "sc-cd-03",
      "name": "Customer data ownership",
      "category": "customer_data_rights",
      "status": "implemented",
      "plans": [
        "start",
        "core",
        "pro",
        "operations"
      ],
      "defaultEnabled": true,
      "customerConfigurationRequired": false,
      "verificationMethod": null,
      "lastVerifiedAt": null,
      "limitations": [
        "Aggregated, anonymized usage data may be used to improve the platform"
      ],
      "scope": [
        "All customer-supplied data"
      ]
    }
  ]
}