Legal

Security

Last updated and effective:

Protecting your work and your information is central to how we build our Services. This page summarizes our main safeguards for your VektorForgeAI account and each of our Platforms. Words such as Services, Platform, Your Content, staff, Security Incident, vulnerability report and service incident have the meanings in our Terms of Service. This page forms part of our Privacy Policy. For how we handle personal information, see the rest of that policy; for the companies we rely on, see our Subprocessors page. Safeguards marked “(Product Architect)” are in place on Product Architect today and will be added to our other Platforms; we remove the mark when they are.

Infrastructure

  • The Services run on Vercel and Supabase. Your VektorForgeAI account is kept in its own accounts database, and each Platform keeps Your Content in its own separate database. All of them are stored in the United States (AWS, Oregon region).
  • All connections use HTTPS (TLS). Our providers encrypt stored data at rest.
  • Our database provider takes daily backups, which expire within 30 days.

Your VektorForgeAI account

  • Your VektorForgeAI account signs you in to every Platform that uses it; today, that is Program Forgemaster. Product Architect still has its own sign-in and its own account until it moves to your VektorForgeAI account. We require multi-factor authentication with an authenticator app for both.
  • Sign-ins end 30 days after you sign in, or after 7 days without use, whichever comes first; then you sign in again.
  • Passwords are stored only as salted hashes and must be at least 8 characters. New accounts confirm their email address.
  • Sign-in, sign-up and password-reset forms are protected against automated abuse by Cloudflare Turnstile.
  • Password resets and sign-in emails come from our own domain, not a third-party address.

Access to Your Content

  • Per-person access rules in the database. Row-level security means each person can read and change only their own work and work shared with them, with the role (owner, editor or viewer) the owner chose. The rules are enforced by the database itself, not just the app.
  • Server-side checks. Actions that need extra privileges, such as AI requests, billing, deleting an item or sending invitations, run in server functions that check who you are and what you are allowed to do before acting.
  • Sharing you choose. Invitations must be accepted before shared work appears in someone’s account, and invitation emails are rate-limited to prevent abuse. (Product Architect) Owners decide whether viewers may download, viewer access expires after 90 days unused, and exports and downloads are recorded and watermarked, as described in its Service Terms.
  • Staff access. Only VektorForgeAI’s staff can use our internal admin tools, which are separate from the Platforms. Staff sign in with company Microsoft accounts protected by multi-factor authentication; staff sessions expire after 4 hours, and sensitive actions require a fresh sign-in. Staff can’t see or set passwords; a customer who is locked out gets a reset link instead. Staff can change a customer’s plan, send a password-reset link or sign a customer out of all sessions, but can’t edit Your Content. Viewing Your Content requires a recorded reason and closes after 30 minutes. If we view Your Content for security or legal reasons without the customer’s request, we tell the customer afterwards unless the law prevents it. A consultant working with you on a Guided plan or a consulting engagement reaches your work only through access you give them, like anyone else you share with.
  • Audit log. Every staff action is recorded before it runs: who did it, when, to which account or item, and why. The log is append-only: the database refuses changes and deletions.

Payments

Card details are entered only on Stripe’s hosted checkout and billing pages. They never pass through or are stored on our systems; Stripe is certified to the PCI DSS payment security standard.

AI features

Requests to our AI provider go from our servers, never from your browser, so our keys are never exposed. The model, the AI’s core instructions and its safeguards are set on the server and can’t be changed by the browser. Our servers check AI requests and AI answers (and, in Product Architect, content written through an API) for signs of manipulation. When a check matches, we record which check, the account, the item and when, never Your Content. AI features are subject to plan limits, including daily AI usage caps, and monitoring. Our AI provider does not train on data sent through its commercial API. See How VektorForgeAI uses AI.

Third-party services, API keys and secrets

(Product Architect) Credentials for third-party services you connect, such as a Jira API token or a Slack or Teams webhook address, are kept in an encrypted secrets vault, not in regular database tables, and are never sent back to your browser. Our own service keys are stored as encrypted environment settings, never in the code.

(Product Architect) API keys you create are shown once and then stored only as a one-way fingerprint, so we can’t show them again. Each key is read-only unless you choose to let it make changes, expires after the period you choose (at most one year), can reach only the work its owner can edit, is limited to 120 requests a minute, can be revoked at any time in your settings, and every change made with it is recorded in the document’s history. Each request made with a key is logged without its content (the key, what was requested and the result) and kept for 90 days.

Web app protections

Each Platform is served with browser security headers that protect against clickjacking and content-type sniffing. (Product Architect) A Content Security Policy also limits where scripts and data can be loaded from, and error reports from your browser have emails, tokens, keys and web addresses’ query strings removed before they are sent, and they stay in our own database.

Development practices

Every change goes through automated checks before release: code linting, a production build, dependency vulnerability scanning, type checks on server functions, and checks that every new database table has the right access rules.

Vulnerability reports

Testing the security of the Services, including security research, requires our written permission given in advance. To ask, email security@vektorforgeai.com describing what you want to test and how. If you come across a security weakness while using the Services normally, don’t test it further; report it to security@vektorforgeai.com with enough detail to reproduce it. Our security.txt file lists the same contact. Please don’t access other people’s data, disrupt the Services, or publicly disclose the issue before we’ve had a chance to fix it. We will acknowledge your report and keep you updated, and we won’t take legal action against security research done with our written permission that follows these guidelines.

To report a suspected Security Incident affecting your account or your work, use the “Report an incident” form (Product Architect) and tick “Possible security issue”, or email security@vektorforgeai.com. Our Terms of Service list every way to report a problem.

If a Security Incident happens

If we learn of a Security Incident affecting your personal information, we will notify affected account holders without undue delay, and in any event within 72 hours after becoming aware of it, and as otherwise required by law, and tell you what happened and what we are doing about it. Business customers are notified as described in our Data Processing Addendum.