Effective 14 October 2026 · ForgeAI Studio Ltd (company no. 17175307), Oldbury, United Kingdom.
Architecture
The Service runs on managed, reputable cloud infrastructure. Data is encrypted in transit (TLS) and at rest. Access to production data is restricted and logged.
Tenant isolation
Every customer's data is isolated by row-level security tied to your organisation. Application code accesses data only within your permission scope.
Secrets & credentials
Integration tokens and API keys are stored in a restricted store that the application front-end cannot read; only server-side functions can use them. We never display a stored secret back to you, and we store inbound API keys only as a hash.
Authentication
You can sign in with an email address and password, with a one-time magic link, or with your Google account. Where you set a password it is never stored in readable form: our authentication provider keeps only a salted hash, which we cannot read or reverse, and password resets are performed by emailing a single-use link to your registered address. Sessions are short-lived and refreshable.
Safety gate
Outbound content passes automated checks before it goes out, such as a check that a claim about your business is supported. The checks lower the chance of a damaging post. They cannot remove it.
Reporting
Found a vulnerability? Please email support@novastacks.co.uk with details. We investigate all reports and won't pursue good-faith security research.