Current security scope
ForgeQM security overview
This page describes controls that are currently implemented. It is intended to support a practical customer security review without implying a certification or assurance report that ForgeQM does not hold.
Identity and access
ForgeQM stores password hashes using bcrypt. Signed login tokens expire. Organisation membership and roles are used to control access, with owner, administrator, QA manager, inspector, buyer and viewer roles available for different responsibilities.
Organisation data separation
Business records carry an organisation identifier and authenticated API operations use that context when retrieving or changing records. Permission and organisation-isolation checks are included in the automated test suite and release review.
Hosting and transport
The production web application, API and database run on managed Google Cloud services. Public production traffic uses HTTPS. Production credentials and integration secrets are kept outside the browser application and are supplied to the service through managed configuration and secret storage.
Audit records
ForgeQM records security events for invitations and membership changes. It also maintains document change records for supported revision and content changes so the responsible user and time can be reviewed.
Operational providers
Google Cloud provides application hosting and managed data services. ForgeQM also uses a configured transactional email provider, Stripe for billing and Expo for mobile push delivery where enabled. Each provider receives only the information needed for its part of the service. The current provider scope is reviewed during customer onboarding.
Scope and assurance
ForgeQM is not currently represented as ISO 27001 or SOC 2 certified. Product checks support quality record preparation; they do not replace customer approvals, competent engineering judgement, governing standards or project requirements. Customer-specific security requirements are reviewed during onboarding and recorded in the agreed scope.
Security contact
Report a security concern or request a customer security review at security@forgeqm.com.
