Security documentation

How your information is protected

• Customer-controlled data
• Exportable records
• No mandatory removal of working systems
• Itemized third-party spend
• Guided Launch included on Start, Core, and Pro
• Optional Marketplace expansion
• No automatic plan upgrades
• Customer approval required for optional purchases
• Provider cost and Forge fee shown separately

Security categories

Security on The Forge is organized into these categories.

• Secure Web Access: The Forge is accessed through a supported web browser. Customers do not install a Forge desktop application or maintain a Forge server inside their organization. This delivery model allows platform updates and security corrections to be applied centrally without requiring every customer to manually patch a separate installation.
• Identity and Sign-In: Each user should access The Forge through an individual identity so permissions, assignments, approvals, changes, and administrative actions can be attributed to the correct person.
• Roles and Permissions: Access to one part of The Forge should not automatically provide access to every part of the business. Permissions can be scoped by business, location, role, department, and assigned responsibility.
• Business and Location Separation: The Forge supports organizations managing multiple legal entities, operating companies, and locations. An owner may be authorized to view consolidated reporting across three businesses while a location manager sees only the company and location they manage.
• Data Protection: Customer information is protected during transmission and at rest using industry-standard methods appropriate to the platform's architecture and hosting environment.
• Integration Security: Integrations should be authorized for a defined purpose and limited to the permissions required for the approved workflow. An accounting integration should not automatically receive employee records, customer communications, or marketing data unless explicitly required and approved.
• Automation and Approval Controls: The Forge can automate follow-ups, assignments, reminders, escalations, and workflow transitions. Sensitive actions support authorization boundaries, approval thresholds, spending limits, and human review so automation assists operations without taking ownership away from the customer.
• Audit History: Administrative changes, permission updates, approval decisions, and security events are recorded with the actor, timestamp, organization, and action details so changes can be reviewed and attributed.
• Platform Monitoring: The platform monitors application availability, authentication failures, integration errors, and unexpected conditions to detect and respond to issues that could affect customer operations.
• Availability and Recovery: Security also includes operational resilience — backups, recovery procedures, and continuity planning so customer operations can be restored when incidents occur.
• Secure Development Practices: The Forge security program uses recognized web-application security guidance as an internal reference for control design and verification. Development practices include source control, code review, dependency management, and environment separation.
• Secure Platform Updates: Because The Forge is delivered as a managed web platform, customers do not need to manually install Forge updates across employee devices or maintain separate versions of the application. Updates are applied centrally, tested against the managed platform, and monitored after release.
• Incident Response: Security events are assessed for scope and customer impact. Corrective action is applied, affected customers are notified where required, and follow-up controls are reviewed.
• Shared Responsibility: A secure web application does not eliminate the need for secure customer account management. Security responsibilities are shared between HustleForge, the customer, and third-party providers.
• Customer Data Rights: The Forge is designed to help your organization operate on its information, not to trap that information inside the platform. Customer records should remain exportable according to the account's permissions, contractual terms, and applicable retention requirements.