Security controls

Security for your infrastructure and customers

We separate Forte's security responsibilities into two categories: (1) isolating the account, source, network, and code that run your product; and (2) protecting the end customers who authenticate to it.

Forte undergoes regular third-party penetration testing. The assessor and report are confidential. Security questions can be submitted through Support.

Compliance & attestations

HIPAA
Compliant, BAA available
ISO 27001In progress
Compliance review in progress
SOC 2 Type IIn progress
Compliance review in progress

Security responsibility at a glance

Forte manages your infrastructure security and helps keep your users safe

Forte protects two different surfaces: the infrastructure that runs your product, and the authentication system your customers use. The controls and responsibilities for each are different, and we separate them to make it clear what Forte manages and what you manage.

Your account and infrastructure (managed in Forte)

Goal: protect source code, compute, and infrastructure

Forte limits where source code exists, isolates running workloads within VM boundaries, and manages all network ingress to your private infrastructure network.

Your source stays isolated
GitHub source is processed in a customer-isolated build workspace on encrypted disk. The workspace cannot access another customer’s source and is discarded after the build.
Your code gets its own VM boundary
Customer workloads run in MicroVM-isolated environments. Your code never executes on the same virtual machine as another customer’s code.
The public internet stops at managed ingress
TLS, routing, and DDoS protection sit in front of every Service. Traffic reaches the workload over private networking instead of exposing its compute environment directly.

Your end customers (authenticated by Forte)

Goal: protect user credentials, detect abuse, and manage sessions

Forte provides the authentication controls for your users. Your application still owns authorization for what each authenticated user is allowed to see and do.

User passwords are hashed and never retained
Forte uses Argon2 password hashing, configurable strength rules, and enumeration-resistant verification paths. Plaintext passwords are never stored or logged.
Suspicious sign-ins are challenged
Bot-risk checks validate the attempted action and score before authentication continues. Session IP and approximate location provide context for reviewing unfamiliar access.
Accounts can require a second factor
Authenticator apps, passkeys and security keys, email or SMS codes, and backup codes are supported. Sessions can be inspected, expired, and revoked.

ABoundary

Your Forte account + infrastructure

Protect the control plane, source, and running code

Account access, builds, network boundaries, workload isolation, storage, and the systems Forte operates for your team.

A.01

Workload isolation

Customer code does not share a virtual machine with another customer’s code.

MicroVM boundary

Forte runs customer code in MicroVM-isolated environments. A customer workload never executes on the same virtual machine as another customer’s workload.

Scope: Forte Services and server-side application workloads
Forte responsibility: Maintain workload placement and isolation controls so customer workloads never share a VM boundary.
Your responsibility: Choose application dependencies and rebuild promptly when those dependencies need patches.

Provider-specific isolation

Forte delegates physical, network, and hypervisor boundaries to AWS or Cloudflare when feasible. OVH-hosted workloads use Firecracker and Kata isolation to preserve the MicroVM boundary.

Scope: Depends on the selected region and workload placement
Forte responsibility: Select, configure, and monitor the provider isolation appropriate to each region while preserving the documented MicroVM boundary.
Your responsibility: Confirm regional, contractual, or provider-specific requirements with Forte before deployment.

Private service routing

After a request crosses Forte-managed ingress, Forte routes it to the customer Service over private networking rather than exposing the workload directly to the public internet.

Scope: Traffic from Forte ingress and internal product services to Forte Services
Forte responsibility: Operate managed ingress and keep Service workloads reachable through private routing rather than direct public exposure.
Your responsibility: Validate presence and correctness of Forte gateway headers for trust and identity checking.

A.02

Source and builds

Repository contents exist only where the build needs them, for as long as the build needs them.

Ephemeral source workspace

Source read from GitHub is processed in an ephemeral build workspace on encrypted disk. The workspace is discarded after the build and cannot access another customer’s source workspace.

Scope: Repository source used by Forte builds
Forte responsibility: Create an isolated encrypted workspace for each build, prevent cross-customer access, and discard the workspace afterward.
Your responsibility: Limit repository installation scope, review committed secrets, and remove credentials from source history.

Immutable deployment artifact

A successful build produces a versioned container or website artifact. Build and deployment steps retain state transitions and timestamps; the temporary source workspace does not become the runtime filesystem.

Scope: Service and website deployments
Forte responsibility: Produce versioned deployment artifacts and retain the build, release, and state history customers use to inspect a rollout.
Your responsibility: Review source changes, lockfiles, build scripts, and the environment values supplied at build or runtime.

Separated configuration

Environment variables and secrets are supplied through Forte configuration rather than written into the deployment record or application source.

Scope: Configured Service and Website values
Forte responsibility: Protect configured secrets, avoid returning stored values, and inject them only into the applicable build or runtime environment.
Your responsibility: Scope, rotate, and revoke application credentials and avoid printing them to logs.

A.03

Account and operations

Controls for the people and credentials that can operate Forte resources.

Forte account sessions

Forte account sign-in uses OAuth, server-side sessions, CSRF validation, and protected cookie settings.

Scope: Forte console accounts
Forte responsibility: Operate OAuth sign-in, server-side sessions, CSRF validation, and protected session-cookie behavior for Forte accounts.
Your responsibility: Protect the upstream identity account and remove organization access when roles change.

Programmatic credentials

API keys are project-scoped, expire, and are stored as non-reversible hashes rather than retrievable plaintext.

Scope: CLI and API access
Forte responsibility: Hash project API keys, enforce their expiration and scope, and provide supported creation and revocation controls.
Your responsibility: Store sensitive values in Forte Secrets, rotate them, and revoke leaked credentials.

Operational response

Forte maintains procedures for change review, vulnerability remediation, incident triage, containment, recovery, and customer communication.

Scope: Forte-operated systems
Forte responsibility: Maintain incident-response and vulnerability-remediation procedures, publish applicable service updates, and commission recurring independent testing.
Your responsibility: Maintain an application incident plan and a current contact path for Forte notifications.

BBoundary

Your end customers

Protect the people who sign in to your product

Passwords, contact verification, sessions, MFA, bot-risk checks, recovery, and the user state your application can inspect.

B.01

Passwords and verification

Passwords are one authentication method, not a plaintext identity record.

Argon2 password hashing

Forte hashes end-user passwords with Argon2. Verification compares against the stored hash; plaintext passwords are not retained.

Scope: Users with password sign-in enabled
Forte responsibility: Hash passwords with Argon2 and ensure authentication paths never persist or return plaintext passwords.
Your responsibility: Enable password sign-in only when the product needs it and provide a safe account-recovery experience.

Enumeration-resistant verification

Unknown-user and missing-password paths still perform a dummy Argon2 comparison so response timing more closely matches a known password account.

Scope: Password verification
Forte responsibility: Apply the dummy Argon2 comparison on unknown-user and missing-password paths to reduce timing differences.
Your responsibility: Keep application error messages neutral and do not reveal whether an identifier belongs to an account.

Configurable strength rules

Projects configure minimum length plus uppercase, lowercase, digit, and symbol requirements. Forte enforces an absolute 6–128 character boundary and defaults to an 8-character minimum.

Scope: Password creation, change, reset, and administrative set flows
Forte responsibility: Apply the configured password policy consistently to creation, change, reset, and administrative password flows.
Your responsibility: Choose rules appropriate to the audience and pair passwords with MFA where the risk requires it.

B.02

Sessions, MFA, and risk

Authentication produces inspectable state that can be challenged, expired, or revoked.

Invisible bot-risk checks

Projects can require reCAPTCHA v3 on sign-up, login, OTP, and reset paths. Forte validates success, action, and risk score, rejects scores below the configured threshold, retries provider errors, and fails closed when validation cannot complete.

Scope: Configured end-user authentication paths
Forte responsibility: Validate bot-check success, action, and score; reject attempts below the threshold and fail closed when validation cannot complete.
Your responsibility: Configure the project keys, use the documented action names, and decide how the application explains a rejected attempt.

Session and location context

Forte records the session source IP and derives an approximate location when sessions are listed. This gives the user or administrator context for reviewing unfamiliar sign-ins without persisting a second location record.

Scope: End-user sessions and successful login history
Forte responsibility: Record session source IP, derive approximate location for review, and expose that context through supported session surfaces.
Your responsibility: Provide a session-review and revocation experience appropriate to the product’s risk.

MFA and recovery state

Projects can require authenticator apps, passkeys or security keys, email or SMS codes, and backup codes. Pending MFA uses a restricted token until the challenge succeeds.

Scope: Projects with MFA configured
Forte responsibility: Operate enrollment, challenge, backup-code, and recovery flows while restricting pending sessions until MFA succeeds.
Your responsibility: Choose allowed factors, recovery policy, enrollment prompts, and support procedures.

B.03

User lifecycle

Verification, recovery, and administration remain visible state transitions.

Verified contact ownership

Email and phone contact methods carry verification state. Forte applies documented reclaim and session invalidation behavior when ownership changes.

Scope: Email and phone contact methods
Forte responsibility: Maintain contact verification state and apply the documented reclaim and session-invalidation behavior when ownership changes.
Your responsibility: Configure notification content and avoid treating an unverified contact as an established identity.

Revocable sessions

Projects configure session lifetime. Users and administrators can list sessions, renew eligible sessions, log out, and revoke access through documented flows.

Scope: End-user session tokens
Forte responsibility: Enforce configured session lifetimes and provide supported renewal, logout, listing, and revocation flows.
Your responsibility: Store tokens safely in the client and revoke them after suspected account compromise.

User audit trail

User creation, verification, login, credential, MFA, session, and administrative events retain relevant state and timestamps for review.

Scope: Supported Forte Users lifecycle events
Forte responsibility: Record supported identity, credential, MFA, session, and administrative events with state and timestamps.
Your responsibility: Review suspicious activity and preserve records required beyond Forte retention.

Evidence routes

Continue the review

Live operations

Ship production-ready products faster with Forte.

Connect your repo and launch, operate, debug, scale, and monetize from one platform.