Technical reference

What Forge actually implements, grouped by the three properties it is built for. For security reviewers, IT and anyone who has to sign off on a tool before it touches company material.

Each row is marked built, coming or not offered. The last of those is included on purpose. A list that only shows what exists tells a reviewer nothing about where the edges are, and they will find the edges anyway.

Confidential

What leaves, what is kept, and who can reach it.

PII redaction before egress	Email addresses, phone numbers, payment card numbers (Luhn-checked), Indian PAN and Aadhaar are replaced with placeholders before the request leaves for a model.	Built
Reversible masking	Real values are re-inserted into the answer the user reads, so the reply stays usable without the provider having seen them.	Built
Redaction across table cells and page wraps	Column-aware masking for tabular documents, and reconstruction of values split across a PDF line break.	Built
Organisation policy floor	An admin can require redaction across the organisation. A member may be stricter, never looser.	Built
Pre-upload PII report	A count of what was detected is shown before ingestion completes, with the option to cancel.	Built
Names, addresses, US identifiers	Not detected. The current tier is pattern-based; names and addresses need a model-based tier, and there is no SSN or EIN pattern.	Not offered
Original files discarded after extraction	Text is extracted on upload and the original file is deleted immediately. No provider ever receives a file.	Built
Ephemeral chat attachments	A file attached to a single conversation is not indexed and is deleted with the thread.	Built
Access granted per project	Membership is per project rather than per organisation. Being in the organisation grants nothing by itself.	Built
Private threads	Conversations are per member. No administrator query returns another person’s messages.	Built
Retention and deletion	A daily sweep enforces the retention window you set, with a server-side ceiling. Scope is conversation history; documents are removed when deleted.	Built
Encryption	Provider-managed encryption at rest; AES-256-GCM for stored secrets such as API keys.	Built
No training on your data	Commercial no-training terms with every provider in the path. Contractual rather than observable.	Built
Subject access and erasure	Export or erase everything held about one person, run by the operator on request.	Built
Data residency	One region for all customers. Choosing where data lives is not available, and program runs execute in a separate region again.	Not offered

PII redaction before egressBuilt: Email addresses, phone numbers, payment card numbers (Luhn-checked), Indian PAN and Aadhaar are replaced with placeholders before the request leaves for a model.
Reversible maskingBuilt: Real values are re-inserted into the answer the user reads, so the reply stays usable without the provider having seen them.
Redaction across table cells and page wrapsBuilt: Column-aware masking for tabular documents, and reconstruction of values split across a PDF line break.
Organisation policy floorBuilt: An admin can require redaction across the organisation. A member may be stricter, never looser.
Pre-upload PII reportBuilt: A count of what was detected is shown before ingestion completes, with the option to cancel.
Names, addresses, US identifiersNot offered: Not detected. The current tier is pattern-based; names and addresses need a model-based tier, and there is no SSN or EIN pattern.
Original files discarded after extractionBuilt: Text is extracted on upload and the original file is deleted immediately. No provider ever receives a file.
Ephemeral chat attachmentsBuilt: A file attached to a single conversation is not indexed and is deleted with the thread.
Access granted per projectBuilt: Membership is per project rather than per organisation. Being in the organisation grants nothing by itself.
Private threadsBuilt: Conversations are per member. No administrator query returns another person’s messages.
Retention and deletionBuilt: A daily sweep enforces the retention window you set, with a server-side ceiling. Scope is conversation history; documents are removed when deleted.
EncryptionBuilt: Provider-managed encryption at rest; AES-256-GCM for stored secrets such as API keys.
No training on your dataBuilt: Commercial no-training terms with every provider in the path. Contractual rather than observable.
Subject access and erasureBuilt: Export or erase everything held about one person, run by the operator on request.
Data residencyNot offered: One region for all customers. Choosing where data lives is not available, and program runs execute in a separate region again.

Reliable

Whether the answer can be depended on, and whether you would know if it could not.

Grounded retrieval	Answers in a project are drawn from your documents rather than the model’s own memory.	Built
Refusal when unsupported	The system declines rather than guessing when your material does not answer the question.	Built
Hybrid search with reranking	Vector and keyword retrieval combined, then reranked, rather than nearest-neighbour alone.	Built
Structure-aware chunking	Row-aware for tables, with lossless reassembly. Prose chunking is still character-based.	Built
Computation, not generation	Totals and arithmetic over tabular data are calculated in a sandbox in integer minor units, not produced by the model.	Built
Rules before the model	In classification workflows, deterministic rules run first and the model is asked only about what they could not decide. Each record stores which of the two decided it.	Built
Honest degradation	Unreadable or unparseable input is reported as such rather than silently skipped or guessed.	Built
Reliability reporting	Decline rate, retrieval depth as a share of your corpus, and routing mix, visible to organisation admins.	Built
Sealed program execution	A registered program runs in a sandbox with no network access. No model is in the path, and the same inputs produce the same outputs.	Built
Quality evaluation	A faithfulness and relevance harness with a dashboard. Runs are started by the operator rather than continuously.	Built
Your own document types	Describing the fields you want extracted, so a new document type does not require us to build it.	Coming
Reproducible prose	Retrieval and computation are reproducible. The wording of a generated answer is not, because generation samples.	Not offered
Evaluation gate on release	Evals are run by hand. Nothing blocks a deploy on a quality regression.	Not offered

Grounded retrievalBuilt: Answers in a project are drawn from your documents rather than the model’s own memory.
Refusal when unsupportedBuilt: The system declines rather than guessing when your material does not answer the question.
Hybrid search with rerankingBuilt: Vector and keyword retrieval combined, then reranked, rather than nearest-neighbour alone.
Structure-aware chunkingBuilt: Row-aware for tables, with lossless reassembly. Prose chunking is still character-based.
Computation, not generationBuilt: Totals and arithmetic over tabular data are calculated in a sandbox in integer minor units, not produced by the model.
Rules before the modelBuilt: In classification workflows, deterministic rules run first and the model is asked only about what they could not decide. Each record stores which of the two decided it.
Honest degradationBuilt: Unreadable or unparseable input is reported as such rather than silently skipped or guessed.
Reliability reportingBuilt: Decline rate, retrieval depth as a share of your corpus, and routing mix, visible to organisation admins.
Sealed program executionBuilt: A registered program runs in a sandbox with no network access. No model is in the path, and the same inputs produce the same outputs.
Quality evaluationBuilt: A faithfulness and relevance harness with a dashboard. Runs are started by the operator rather than continuously.
Your own document typesComing: Describing the fields you want extracted, so a new document type does not require us to build it.
Reproducible proseNot offered: Retrieval and computation are reproducible. The wording of a generated answer is not, because generation samples.
Evaluation gate on releaseNot offered: Evals are run by hand. Nothing blocks a deploy on a quality regression.

Accountable

Whether you can reconstruct what happened, six months later.

Append-only audit log	Who reached what, and when, per organisation, visible to admins in the product.	Built
Content-free auditing	The log records actions, not text. No message, prompt, reply or document content is stored in it.	Built
Usage and cost attribution	Who spent what, against which funding path and whose key.	Built
Governance events	Changes to privacy policy, keys and the model provider are recorded as events in the same log.	Built
Evidence of deletion	The retention sweep writes its result to the organisation’s own log, so deletion has an artifact rather than a promise.	Built
Versioned consent	Which version of the terms was accepted, by whom, and when.	Built
Stage history on a record	Every stage a record moves through is recorded against the member who moved it, with an append-only note.	Built
Answer provenance	Answers cite the documents they drew on, at file level. Passage, page and clause anchors are not implemented.	Built
Record of human reliance	Stage moves are recorded, but nothing records that a person reviewed or relied on a specific AI answer.	Not offered
Cryptographic tamper evidence	The log is append-only by access control and convention, not by hash chaining or signing.	Not offered

Append-only audit logBuilt: Who reached what, and when, per organisation, visible to admins in the product.
Content-free auditingBuilt: The log records actions, not text. No message, prompt, reply or document content is stored in it.
Usage and cost attributionBuilt: Who spent what, against which funding path and whose key.
Governance eventsBuilt: Changes to privacy policy, keys and the model provider are recorded as events in the same log.
Evidence of deletionBuilt: The retention sweep writes its result to the organisation’s own log, so deletion has an artifact rather than a promise.
Versioned consentBuilt: Which version of the terms was accepted, by whom, and when.
Stage history on a recordBuilt: Every stage a record moves through is recorded against the member who moved it, with an append-only note.
Answer provenanceBuilt: Answers cite the documents they drew on, at file level. Passage, page and clause anchors are not implemented.
Record of human relianceNot offered: Stage moves are recorded, but nothing records that a person reviewed or relied on a specific AI answer.
Cryptographic tamper evidenceNot offered: The log is append-only by access control and convention, not by hash chaining or signing.

Platform

What runs where, and on whose account.

Model providers	An organisation admin selects its provider. Governance is applied above the model call and does not vary with the choice.	Built
Bring your own key	An organisation key covers every member’s model calls, so spend sits on your own account under your own commercial terms. Individual keys are also supported.	Built
Retrieval subprocessor	Embedding and reranking run on a specialist provider under commercial terms with a published DPA, on our account rather than yours. Extracted text chunks are sent, never files.	Built
File types accepted	Plain text, Markdown, CSV, PDF, DOCX, plus audio and images. Spreadsheets reach Forge as inputs to a program rather than as corpus.	Built
Single sign-on	No SAML or OIDC integration. Access is by invitation with email authentication.	Not offered
Independent certification	No SOC 2, ISO 27001 or equivalent audit. Forge runs on certified infrastructure, which is not the same claim, and a DPA is available.	Not offered

Model providersBuilt: An organisation admin selects its provider. Governance is applied above the model call and does not vary with the choice.
Bring your own keyBuilt: An organisation key covers every member’s model calls, so spend sits on your own account under your own commercial terms. Individual keys are also supported.
Retrieval subprocessorBuilt: Embedding and reranking run on a specialist provider under commercial terms with a published DPA, on our account rather than yours. Extracted text chunks are sent, never files.
File types acceptedBuilt: Plain text, Markdown, CSV, PDF, DOCX, plus audio and images. Spreadsheets reach Forge as inputs to a program rather than as corpus.
Single sign-onNot offered: No SAML or OIDC integration. Access is by invitation with email authentication.
Independent certificationNot offered: No SOC 2, ISO 27001 or equivalent audit. Forge runs on certified infrastructure, which is not the same claim, and a DPA is available.

The security overview at /security covers the same ground for a procurement review, including the data processing agreement. Why Forge is built this way is argued on the thesis page.