Privacy Policy

ForgeStack provides a control plane that generates cloud infrastructure templates and applies them inside cloud accounts you control. In this policy, “ForgeStack”, “we”, “us” and “our” refer to the ForgeStack entity that operates the control plane and this website (the “Service”).

This policy covers the Service itself. It does not cover the model host, storage bucket, vector index, API gateway or other resources that ForgeStack creates inside your own cloud account. Those resources are yours and are governed by your agreements with your cloud provider.

• We collect account details, project configuration, deployment metadata and the cloud credentials you choose to connect.
• Cloud credentials are encrypted at rest. Secret values are never returned by an API response or rendered in the dashboard.
• Your model weights, documents, vector index and chat transcripts stay in your cloud account. ForgeStack stores metadata about them, not their contents.
• We do not sell personal information or use it for advertising.
• ForgeStack is a non-profit project. The control plane is free to use, and we do not pay for or hold the cloud storage that contains your content.
• We do not train models on your prompts, documents or outputs. Fine-tunes run on compute inside your own account.
• You can delete a stack at any time, and you can contact us to request access to or deletion of your account data.

Account and contact details. Your name, email address, optional company name, password hash (we never store the plaintext password), and whether your email address has been verified.

Authentication and security data. Session tokens, hashed one-time verification and password-reset codes, failed-attempt counters, the network address used for rate limiting, and timestamps. These records are used to keep accounts secure and to prevent abuse.

Cloud connection details. The connection method you choose, role ARN, external ID, profile name, SSO start URL, region, account ID and permission-set name, or GCP project ID. Where you choose a method that requires a long-lived secret, we also store the access key pair, SSO access token or service-account key in encrypted form.

Project and deployment data. Project name and slug, model identifier and parameter count, instance type, region, system prompt, temperature, retrieval setting, stack status, generated template, CloudFormation stack identifier, deployed endpoint, and deploy timestamps.

API key data. Key labels, scopes, the key value, creation time, last-used time and revocation time.

Knowledge-base metadata. Document names, byte sizes and chunk counts. If you connect an external source such as GitHub, Confluence or Jira, we also store the source type, endpoint, the connector credentials you provide (for example a token, API key or username), sync schedule, and sync status or error.

Chat metadata. For API and playground requests we record the source, latency and timestamp. Prompt and response text is not written to ForgeStack’s database; the router running in your account writes conversations to your own storage bucket.

Operational data. Deploy logs, resource status events, error messages, and standard request information that our hosting and database providers process to deliver and protect the Service, such as IP address, user agent, request path and time.

Browser storage. The dashboard keeps a small amount of UI state in your browser’s local storage, as described in the cookies section below.

• Model weights, your documents (including any legal or financial records you upload), your vector index, or the contents of your chat transcripts. These live in the cloud account you connected.
• Your cloud account root password. ForgeStack uses role assumption, SSO, access keys you provide, or a local profile; it never asks for a root password.
• Payment card details. ForgeStack is a non-profit project, the control plane is free to use, and your cloud provider bills you directly for the resources you deploy.
• Funds, securities or other financial assets. We do not process payments, hold money or act as a payment intermediary.
• Your cloud bills, invoices or billing statements. Your cloud provider bills you directly, and we do not receive what you are charged.
• Advertising identifiers or cross-site behavioural profiles. We do not run advertising or third-party analytics cookies.

• To create and secure your account, sign you in, and verify your email address.
• To store your configuration and generate the infrastructure template for a stack.
• To assume the cloud role or credentials you connected and apply, update or delete the stack.
• To proxy playground requests to the model node you deployed and show deploy progress.
• To issue, scope, validate and revoke API keys.
• To sync knowledge-base sources you configure and report sync results.
• To detect abuse, rate-limit authentication attempts, investigate errors and keep the Service reliable.
• To respond to support requests and send service, security or legal notices.
• To comply with applicable law and enforce our Terms of Service.
• To understand aggregate usage and improve the product, using data that does not identify you.

Where data-protection law requires a legal basis, we rely on: performance of our contract with you (providing the Service); our legitimate interests (securing the Service, preventing abuse, improving the product); compliance with legal obligations; and, where required, your consent (for example, for optional product emails). You can withdraw consent at any time, without affecting processing that already happened.

We use only the cookies needed to operate the Service. We do not use advertising cookies or third-party analytics cookies.

The dashboard also uses browser local storage for interface preferences: the last screen you opened for a project (forgestack:last-screen:<project>), a cached cloud-connection status (forgestack:cloud-status), and the SSO portal URL you last typed (forgestack:global-sso-portal-url). This information stays in your browser and is not sent to us except as part of a normal request. You can clear it through your browser settings.

ForgeStack needs a way to act in the cloud account you connect. The methods available are IAM role assumption with an external ID, IAM Identity Center (SSO), an access key pair, or a local AWS profile for local development. Role assumption and SSO are the preferred options because they avoid long-lived customer secrets.

Secret values are encrypted at rest with AES-256-GCM using envelope encryption: each credential row has its own data-encryption key, and that key is itself encrypted under the application root key. The root key is held separately from the database. Secrets are decrypted only in the server process that needs them to assume credentials or call a cloud API. They are not included in API responses, logs or rendered pages.

When you watch a deploy from the Apply screen, the browser receives a short-lived STS session scoped to reading that stack. It is kept in memory only and is discarded when the tab closes or the session expires. You can revoke a saved connection at any time in the dashboard, in IAM or in your SSO portal.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We share information only with service providers that help us run the Service, or where the law requires it.

We may also disclose information to professional advisers under confidentiality obligations, to authorities when legally required, or as part of a merger, acquisition or sale of assets, subject to this policy. If we use a new sub-processor that handles personal information, we will update this page.

Our hosting provider serves the control plane from its Sydney region in Australia at the time of writing. Our database and email providers may process information in Australia, the United States or other countries in which they operate. Where required, we rely on the safeguards offered by those providers for international transfers. The resources ForgeStack deploys run in the cloud region you choose, inside your own account.

We may retain limited information for longer where the law requires it, to resolve a dispute, or to protect the Service. Residual copies may remain in provider backups for a limited period after deletion. Deleting a stack does not delete your ForgeStack account.

We protect the Service with TLS in transit, scrypt password hashing, HTTP-only session cookies, AES-256-GCM envelope encryption for stored cloud credentials, least-privilege cloud permissions, short-lived STS sessions, and rate limiting on authentication endpoints. Access to production systems is limited to people who need it to operate the Service.

No system is completely secure. If you believe you have found a vulnerability, please contact us at contact@forgestack.au before disclosing it publicly.

If personal information is involved in a data breach, we will assess it and notify affected individuals and the Office of the Australian Information Commissioner where the Notifiable Data Breaches scheme requires it, and will meet equivalent obligations under other laws that apply.

Depending on where you live, you may have the right to access, correct, delete, export, restrict or object to the processing of your personal information, and to withdraw consent. You may also have the right to complain to your local data-protection authority.

To exercise a right, email legal@forgestack.au. We may ask you to verify your identity before acting on a request, and we may retain information where the law requires it. You can also update your account details and delete stacks from the dashboard.

We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is no opt-out to exercise for those activities. If you are a California resident, you may still request to know, delete or correct personal information, and you will not be discriminated against for making a request.

If you are in Australia, the Australian Privacy Principles apply to our handling of your personal information. You can ask us to access or correct it, or complain to us at legal@forgestack.au. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

The Service is intended for organizations and adults. It is not directed to children under 18, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, contact us and we will delete it.

We may update this policy as the Service changes. We will post the new version here and update the date above. If a change materially affects how we use personal information, we will notify you by email or in the dashboard before it takes effect.

For privacy questions or requests, contact legal@forgestack.au.

Effective October 27, 2026